@skrr-ai/cli 0.1.58 → 0.1.60

package/dist/lib/api-fetch.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ApiFetchError = void 0;
 exports.apiFetch = apiFetch;
+exports.__resetDaemonHandoffFallbackForTest = __resetDaemonHandoffFallbackForTest;
 exports.hasHumanSession = hasHumanSession;
 /**
  * api-fetch.ts — authenticated fetch helper for endpoints not yet in
@@ -61,6 +62,14 @@ class ApiFetchError extends Error {
      * attributed by guesswork — see `node-adapter.ts`.
      */
     requestId;
+    /**
+     * Set on a 401 when this CLI's own refresh was refused AND the local
+     * daemon, asked for a hand-off, refused too (OSK-12474). The daemon's reason
+     * decides the repair, so the 401 message carries it rather than a bare
+     * "Run `skrr login`" (OSK-12149, OSK-12151); `describeBrokerRefusal` turns
+     * it into words. Absent when the daemon was never asked.
+     */
+    brokerFailure;
     constructor(message, status, body, code, method, requestId) {
         super(message);
         this.name = 'ApiFetchError';
@@ -181,6 +190,7 @@ async function apiFetch(pathOrUrl, opts = {}) {
         });
     };
     let res = await fetchWithCredential(cred);
+    let brokerFailure = null;
     if (res.status === 401 && delegatedCli) {
         // Deliberately terminal on broker failure: an Agent whose daemon cannot
         // rotate its family must surface the 401, never fall through to
@@ -217,6 +227,25 @@ async function apiFetch(pathOrUrl, opts = {}) {
             (0, node_adapter_1.setAdapterCredentialOverride)(cred);
             res = await fetchWithCredential(cred);
         }
+        else if (fresh.skippedReason === 'refresh_failed' ||
+            fresh.skippedReason === 'no_refresh_token') {
+            // OSK-12474 — this CLI's STORED sign-in could not be renewed (e.g.
+            // DEVICE_KEY_MISMATCH after a key split). The node-adapter asks the local
+            // daemon for a hand-off at this point; this transport did not, so a
+            // healthy daemon was ignored and every apiFetch command demanded
+            // `skrr login`. Gated on the stored-credential skip reasons only: a
+            // `--token`, OVERSKY_TOKEN, CI token or bare-mode credential is the
+            // operator's, and must never be swapped for the daemon's principal.
+            const brokered = await daemonHandoffAfterRefusedRefresh();
+            if (brokered.credential) {
+                cred = brokered.credential;
+                (0, node_adapter_1.setAdapterCredentialOverride)(cred);
+                res = await fetchWithCredential(cred);
+            }
+            else {
+                brokerFailure = brokered.failure;
+            }
+        }
     }
     if (!res.ok) {
         let text = '';
@@ -235,7 +264,10 @@ async function apiFetch(pathOrUrl, opts = {}) {
         catch {
             /* ignore body read failures */
         }
-        throw new ApiFetchError(`HTTP ${res.status} ${res.statusText} — ${method} ${pathOrUrl}`, res.status, text, code, method, res.headers.get('x-request-id') || undefined);
+        const error = new ApiFetchError(`HTTP ${res.status} ${res.statusText} — ${method} ${pathOrUrl}`, res.status, text, code, method, res.headers.get('x-request-id') || undefined);
+        if (brokerFailure)
+            error.brokerFailure = brokerFailure;
+        throw error;
     }
     // 204/205 carry no body by definition; an empty body has no content-type
     // worth judging. Neither is an error.
@@ -255,6 +287,71 @@ async function apiFetch(pathOrUrl, opts = {}) {
     }
     return (await res.json());
 }
+/**
+ * One daemon hand-off attempt per process (OSK-12474). Memoized, including a
+ * failure: a command that makes many requests must not ask the daemon again
+ * on every 401, and a hand-off token that is itself refused is renewed by the
+ * brokered re-redeem branch above, never by coming back here — so this cannot
+ * loop.
+ */
+let daemonHandoffFallback = null;
+function daemonHandoffAfterRefusedRefresh() {
+    daemonHandoffFallback ??= attemptDaemonHandoffFallback();
+    return daemonHandoffFallback;
+}
+async function attemptDaemonHandoffFallback() {
+    const cliConfig = (0, config_1.loadConfig)();
+    let result;
+    try {
+        // `maybeAutoBroker` applies the same opt-outs as the node-adapter's
+        // recovery: OVERSKY_TOKEN/OVERSKY_REFRESH_TOKEN and
+        // OVERSKY_SKIP_DAEMON_BROKER=1 leave it untriggered.
+        result = await (0, daemonBroker_1.maybeAutoBroker)({ cliConfig, bareMode: false });
+    }
+    catch {
+        return { credential: null, failure: null };
+    }
+    const outcome = result.outcome;
+    if (!result.triggered || !outcome)
+        return { credential: null, failure: null };
+    if (!outcome.ok)
+        return { credential: null, failure: outcome };
+    if (result.updatedConfig) {
+        try {
+            (0, config_1.saveConfig)(result.updatedConfig);
+        }
+        catch {
+            /* non-fatal: the next process mints a new cliId (see BaseCommand.init) */
+        }
+    }
+    const accessToken = outcome.accessToken;
+    // Where a durable mint was written; a brokered hand-off is never stored.
+    const storedSource = !outcome.brokered && outcome.storedIn === 'keychain' ? 'keychain' : 'file';
+    // Say where the credential now comes from, once. The adapter slot records a
+    // brokered token as `env-token` (for refresh semantics), which a reader would
+    // take for OVERSKY_TOKEN; the label must name the descriptor (OSK-12185).
+    const label = outcome.brokered
+        ? (0, credential_resolver_1.describeCredentialSource)('env-token', {
+            kind: 'daemon-handoff',
+            ...(outcome.descriptorPath ? { descriptorPath: outcome.descriptorPath } : {}),
+        })
+        : `a new sign-in brokered by the local daemon, saved to ${(0, credential_resolver_1.describeCredentialSource)(storedSource)}`;
+    process.stderr.write(`[skrr] This CLI's own sign-in could not be renewed; using ${label} instead.\n`);
+    return {
+        credential: {
+            token: accessToken,
+            // A brokered hand-off is held in memory for this process only; the
+            // durable mint was written to the backend the broker reported.
+            source: outcome.brokered ? 'env-token' : storedSource,
+            kind: (0, credential_resolver_1.kindOf)(accessToken),
+        },
+        failure: null,
+    };
+}
+/** @internal test seam — forget this process's daemon hand-off attempt. */
+function __resetDaemonHandoffFallbackForTest() {
+    daemonHandoffFallback = null;
+}
 function trustedAutonomousBaseUrl() {
     // Only the daemon-owned alias is accepted. OVERSKY_BASE_URL is a normal
     // user/CLI override and may originate in request-carried provider env.

package/dist/lib/daemonBrokerRefusal.d.ts

@@ -49,3 +49,24 @@ export interface BrokerRefusalDescription {
  * (`base_url_mismatch`, `rate_limited`).
  */
 export declare function describeBrokerRefusal(failure: DaemonBrokerFailure, bin?: string): BrokerRefusalDescription | null;
+/**
+ * What to tell a person on a Dedicated Runtime guest when NO daemon answered
+ * the hand-off at all (OSK-12473).
+ *
+ * `describeBrokerRefusal` speaks only for a daemon that answered. On a guest
+ * the realistic broken state is a daemon that is absent: its credential was
+ * revoked and it exited by design, or systemd is cycling it, or it crashed and
+ * left its descriptor behind. The CLI then saw `no_bootstrap` / `network`, and
+ * fell to "Not signed in. Run `skrr login` first." — a login nobody performs
+ * on a guest, and which would only put a personal credential on a machine the
+ * daemon is meant to hold the account for. Say the machine's service is not
+ * running and name the owner's repair instead.
+ *
+ * Returns null off a guest, or for a daemon that answered (that is
+ * `describeBrokerRefusal`'s case).
+ */
+export declare function describeGuestDaemonUnavailable(failure: DaemonBrokerFailure | null, opts: {
+    bin?: string;
+    onGuest: boolean;
+    descriptorPresent?: boolean;
+}): BrokerRefusalDescription | null;

package/dist/lib/daemonBrokerRefusal.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isAnsweredBrokerRefusal = isAnsweredBrokerRefusal;
 exports.describeBrokerRefusal = describeBrokerRefusal;
+exports.describeGuestDaemonUnavailable = describeGuestDaemonUnavailable;
 /**
  * True when a daemon ANSWERED the hand-off and refused it — as opposed to no
  * daemon being there to ask (`no_bootstrap`, a stale descriptor nobody listens
@@ -81,8 +82,8 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
                 `if it persists, check the machine from your own computer with \`${bin} machines dedicated health-check <lease-id>\` ` +
                 `(\`${bin} machines dedicated list\` shows the lease id).`
             : 'Nobody signs in on a Dedicated Runtime: its daemon holds the account. From your own computer, run ' +
-                `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id), ` +
-                `and \`${bin} machines dedicated restart <lease-id>\` if the hand-off stays refused.`;
+                `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id). ` +
+                guestReissueRemedy(bin, 'If it stays refused');
     }
     else if (code === 'DEVICE_PROOF_PIN_MISMATCH') {
         remedy =
@@ -125,3 +126,87 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
         },
     };
 }
+/**
+ * The owner-side repair that issues a guest's daemon a fresh credential.
+ *
+ * `stop` then `start`, not `restart`: a restart keeps the instance, so its
+ * daemon re-enrolls through the attested re-issue, which the server refuses
+ * for a credential a person revoked (`REISSUE_REVOKE_REASON`). Observed on a
+ * revoked guest: `restart` sat in `restarting` for 16 minutes and ended
+ * `dedicated_runtime_guest_not_ready_after_restart`, while stop + start
+ * recovered it (OSK-12473).
+ */
+function guestReissueRemedy(bin, when) {
+    return (`${when}, \`${bin} machines dedicated stop <lease-id>\` then \`${bin} machines dedicated start <lease-id>\` ` +
+        'gives the machine a fresh credential (files under /workspace are kept; a restart does not re-issue one).');
+}
+/**
+ * What to tell a person on a Dedicated Runtime guest when NO daemon answered
+ * the hand-off at all (OSK-12473).
+ *
+ * `describeBrokerRefusal` speaks only for a daemon that answered. On a guest
+ * the realistic broken state is a daemon that is absent: its credential was
+ * revoked and it exited by design, or systemd is cycling it, or it crashed and
+ * left its descriptor behind. The CLI then saw `no_bootstrap` / `network`, and
+ * fell to "Not signed in. Run `skrr login` first." — a login nobody performs
+ * on a guest, and which would only put a personal credential on a machine the
+ * daemon is meant to hold the account for. Say the machine's service is not
+ * running and name the owner's repair instead.
+ *
+ * Returns null off a guest, or for a daemon that answered (that is
+ * `describeBrokerRefusal`'s case).
+ */
+function describeGuestDaemonUnavailable(failure, opts) {
+    const bin = opts.bin ?? 'skrr';
+    if (!opts.onGuest && failure?.dedicatedGuest !== true)
+        return null;
+    if (failure && isAnsweredBrokerRefusal(failure))
+        return null;
+    if (failure && (failure.reason === 'base_url_mismatch' || failure.reason === 'rate_limited')) {
+        return null;
+    }
+    const who = `This Dedicated Runtime's skrr service${failure?.daemonId ? ` (daemon ${failure.daemonId})` : ''}`;
+    let headline;
+    let transient = false;
+    const reason = failure?.reason ?? 'no_bootstrap';
+    if (reason === 'network') {
+        headline = `${who} is not running: its sign-in hand-off names a port nothing is listening on.`;
+    }
+    else if (reason === 'bootstrap_parse') {
+        headline = `${who} is not available: its sign-in hand-off file could not be read.`;
+    }
+    else if (reason === 'stale_bootstrap') {
+        // An uncoded 401 on the descriptor secret: the service rotated it, which
+        // it does when it restarts. Re-reading the file next time heals it.
+        headline = `${who} refused this CLI's hand-off secret, which it rotates when it restarts.`;
+        transient = true;
+    }
+    else if (opts.descriptorPresent) {
+        headline = `${who} is not running: its sign-in hand-off was left behind by a process that has exited.`;
+    }
+    else {
+        headline = `${who} is not running, so nothing on this machine can sign this CLI in.`;
+    }
+    const remedy = transient
+        ? 'Retry in a moment. Nobody signs in on a Dedicated Runtime, so `' +
+            `${bin} login\` is not the fix; if it persists, the machine's owner can run ` +
+            `\`${bin} machines dedicated health-check <lease-id>\` from their own computer.`
+        : `Nobody signs in on a Dedicated Runtime — its service holds the account — so \`${bin} login\` is not the fix. ` +
+            "If the machine is still starting, retry in a minute. Otherwise, from the owner's own computer: " +
+            `\`${bin} machines dedicated health-check <lease-id>\` shows why (\`${bin} machines dedicated list\` shows the lease id). ` +
+            guestReissueRemedy(bin, 'If the service stays down');
+    return {
+        headline,
+        remedy,
+        transient,
+        dedicatedGuest: true,
+        broker: {
+            reason,
+            ...(typeof failure?.status === 'number' ? { status: failure.status } : {}),
+            ...(failure?.code ? { code: failure.code } : {}),
+            ...(failure?.detail ? { detail: failure.detail } : {}),
+            ...(failure?.descriptorPath ? { descriptorPath: failure.descriptorPath } : {}),
+            ...(failure?.daemonId ? { daemonId: failure.daemonId } : {}),
+        },
+    };
+}

package/dist/lib/dedicated-guest.d.ts

@@ -0,0 +1,13 @@
+/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
+export declare const GUEST_SERVICE_SOCKET_PATH = "/run/skrr-dedicated-runtime/service-propose/service-propose.sock";
+/**
+ * True when this process is running on a Dedicated Runtime guest — the
+ * workload-uid test, or the guest markers the image/daemon own. An SSH
+ * session may not carry the wrapper's env stamp, so the filesystem markers
+ * count too; the socket itself remains the authority.
+ */
+export declare function runningOnDedicatedRuntimeGuest(env?: NodeJS.ProcessEnv, getuid?: (() => number) | undefined, paths?: {
+    socketPath?: string;
+    attestationPath?: string;
+    runtimeDir?: string;
+}): boolean;

package/dist/lib/dedicated-guest.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GUEST_SERVICE_SOCKET_PATH = void 0;
+exports.runningOnDedicatedRuntimeGuest = runningOnDedicatedRuntimeGuest;
+const node_fs_1 = require("node:fs");
+const first_party_harness_1 = require("./first-party-harness");
+/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
+exports.GUEST_SERVICE_SOCKET_PATH = '/run/skrr-dedicated-runtime/service-propose/service-propose.sock';
+/**
+ * True when this process is running on a Dedicated Runtime guest — the
+ * workload-uid test, or the guest markers the image/daemon own. An SSH
+ * session may not carry the wrapper's env stamp, so the filesystem markers
+ * count too; the socket itself remains the authority.
+ */
+function runningOnDedicatedRuntimeGuest(env = process.env, getuid = process.getuid?.bind(process), paths = {}) {
+    if ((0, first_party_harness_1.isDedicatedRuntimeWorkload)(env, getuid))
+        return true;
+    const socketPath = paths.socketPath ?? exports.GUEST_SERVICE_SOCKET_PATH;
+    const attestation = paths.attestationPath ?? '/etc/skrr-dedicated-runtime/attestation.json';
+    const runtimeDir = paths.runtimeDir ?? '/run/skrr-dedicated-runtime';
+    return (0, node_fs_1.existsSync)(socketPath) || (0, node_fs_1.existsSync)(attestation) || (0, node_fs_1.existsSync)(runtimeDir);
+}

package/dist/lib/dedicated-machines.js

@@ -1280,7 +1280,23 @@ function describeRefusalReasons(err, context = {}) {
     if (spend)
         return spend;
     const sentences = (0, harnesses_1.describeHealthReasonSentences)(details?.reasons, details?.state);
-    return sentences ? ` Reasons: ${sentences}` : '';
+    // A refusal whose public `reasons` came back empty used to print the bare
+    // sentence, which reads as "no reason" when the server said more: that it
+    // withheld reasons it does not publish, or that its own check did not finish
+    // (OSK-12473). Say which, so the person knows whether to retry.
+    const extra = [];
+    const incomplete = Array.isArray(details?.checkIncompleteReasons)
+        ? details.checkIncompleteReasons.length
+        : 0;
+    if (details?.checkIncomplete === true || incomplete > 0) {
+        extra.push('skrr could not finish checking the machine, so run the check again.');
+    }
+    const omitted = Number(details?.omittedReasonCount);
+    if (Number.isInteger(omitted) && omitted > 0) {
+        extra.push(`${omitted} further reason${omitted === 1 ? ' was' : 's were'} not published by the server.`);
+    }
+    const tail = [sentences, ...extra].filter(Boolean).join(' ');
+    return tail ? ` Reasons: ${tail}` : '';
 }
 /**
  * The numbers behind a cap refusal: the cap, this month's spend so far, and

package/dist/lib/dedicated-service.d.ts

@@ -373,16 +373,4 @@ export declare function mergeServiceTemplate(template: DedicatedServiceTemplate,
  * guest-local status commands so both read the same shape.
  */
 export declare function serviceDetailText(detail: unknown): string | undefined;
-/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
-export declare const GUEST_SERVICE_SOCKET_PATH = "/run/skrr-dedicated-runtime/service-propose/service-propose.sock";
-/**
- * True when this process is running on a Dedicated Runtime guest — the
- * workload-uid test, or the guest markers the image/daemon own. An SSH
- * session may not carry the wrapper's env stamp, so the filesystem markers
- * count too; the socket itself remains the authority.
- */
-export declare function runningOnDedicatedRuntimeGuest(env?: NodeJS.ProcessEnv, getuid?: (() => number) | undefined, paths?: {
-    socketPath?: string;
-    attestationPath?: string;
-    runtimeDir?: string;
-}): boolean;
+export { GUEST_SERVICE_SOCKET_PATH, runningOnDedicatedRuntimeGuest } from './dedicated-guest';

package/dist/lib/dedicated-service.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GUEST_SERVICE_SOCKET_PATH = exports.DedicatedServiceChannel = exports.DedicatedServiceError = exports.SERVICE_ACTIONS = exports.SERVICE_RESTART_POLICIES = exports.SERVICE_RESERVED_NAMES = exports.SERVICE_SECRET_NAME_PATTERN = exports.SERVICE_NAME_PATTERN = exports.SERVICE_CALL_TIMEOUT_MS = exports.DEDICATED_PERSISTENT_TERMINAL_CAPABILITY = exports.DEDICATED_TERMINAL_NAME_PATTERN = exports.DEDICATED_TERMINAL_EVENTS = exports.DEDICATED_SERVICE_EVENTS = void 0;
+exports.runningOnDedicatedRuntimeGuest = exports.GUEST_SERVICE_SOCKET_PATH = exports.DedicatedServiceChannel = exports.DedicatedServiceError = exports.SERVICE_ACTIONS = exports.SERVICE_RESTART_POLICIES = exports.SERVICE_RESERVED_NAMES = exports.SERVICE_SECRET_NAME_PATTERN = exports.SERVICE_NAME_PATTERN = exports.SERVICE_CALL_TIMEOUT_MS = exports.DEDICATED_PERSISTENT_TERMINAL_CAPABILITY = exports.DEDICATED_TERMINAL_NAME_PATTERN = exports.DEDICATED_TERMINAL_EVENTS = exports.DEDICATED_SERVICE_EVENTS = void 0;
 exports.isServiceUnsupportedCode = isServiceUnsupportedCode;
 exports.describeServiceRefusal = describeServiceRefusal;
 exports.describeTerminalRefusal = describeTerminalRefusal;
@@ -19,7 +19,6 @@ exports.serviceTemplatesDir = serviceTemplatesDir;
 exports.loadLocalServiceTemplate = loadLocalServiceTemplate;
 exports.mergeServiceTemplate = mergeServiceTemplate;
 exports.serviceDetailText = serviceDetailText;
-exports.runningOnDedicatedRuntimeGuest = runningOnDedicatedRuntimeGuest;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
@@ -27,7 +26,6 @@ const node_path_1 = __importDefault(require("node:path"));
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agentic_stream_1 = require("./agentic-stream");
-const first_party_harness_1 = require("./first-party-harness");
 const format_1 = require("./format");
 /**
  * Declared services on a Dedicated Runtime — the CLI half of
@@ -801,19 +799,9 @@ function serviceDetailText(detail) {
         parts.push(d.detail);
     return parts.join(', ') || undefined;
 }
-/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
-exports.GUEST_SERVICE_SOCKET_PATH = '/run/skrr-dedicated-runtime/service-propose/service-propose.sock';
-/**
- * True when this process is running on a Dedicated Runtime guest — the
- * workload-uid test, or the guest markers the image/daemon own. An SSH
- * session may not carry the wrapper's env stamp, so the filesystem markers
- * count too; the socket itself remains the authority.
- */
-function runningOnDedicatedRuntimeGuest(env = process.env, getuid = process.getuid?.bind(process), paths = {}) {
-    if ((0, first_party_harness_1.isDedicatedRuntimeWorkload)(env, getuid))
-        return true;
-    const socketPath = paths.socketPath ?? exports.GUEST_SERVICE_SOCKET_PATH;
-    const attestation = paths.attestationPath ?? '/etc/skrr-dedicated-runtime/attestation.json';
-    const runtimeDir = paths.runtimeDir ?? '/run/skrr-dedicated-runtime';
-    return (0, node_fs_1.existsSync)(socketPath) || (0, node_fs_1.existsSync)(attestation) || (0, node_fs_1.existsSync)(runtimeDir);
-}
+// Guest detection lives in its own light module so the auth path (base-command,
+// login) can ask "is this a guest?" without loading socket.io and the stream
+// client this module needs (OSK-12473). Re-exported for existing callers.
+var dedicated_guest_1 = require("./dedicated-guest");
+Object.defineProperty(exports, "GUEST_SERVICE_SOCKET_PATH", { enumerable: true, get: function () { return dedicated_guest_1.GUEST_SERVICE_SOCKET_PATH; } });
+Object.defineProperty(exports, "runningOnDedicatedRuntimeGuest", { enumerable: true, get: function () { return dedicated_guest_1.runningOnDedicatedRuntimeGuest; } });

package/dist/lib/followups.d.ts

@@ -120,6 +120,13 @@ export type ResolvedFollowUpAgent = {
      */
     boundToSession: boolean;
 };
+/**
+ * A trigger subject becomes a durable concurrency key, so it cannot be prose.
+ * Keep this grammar aligned with TriggerEngine's subject validation and the
+ * FollowUpService storage limit.
+ */
+export declare const FOLLOWUP_SUBJECT_EXTERNAL_KEY_RE: RegExp;
+export declare const FOLLOWUP_SUBJECT_FLAG_HELP = "Subject ref: type:externalKey (externalKey: letters, digits, _ - . : / # @ + ~; no spaces)";
 /**
  * Which agent a follow-up belongs to.
  *

package/dist/lib/followups.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.followupsApi = exports.WATCH_WAIT_KINDS = exports.FOLLOWUP_RESOLVE_OUTCOMES = exports.FOLLOWUP_STATES = exports.FOLLOWUP_KINDS = exports.followUpIdArg = void 0;
+exports.followupsApi = exports.FOLLOWUP_SUBJECT_FLAG_HELP = exports.FOLLOWUP_SUBJECT_EXTERNAL_KEY_RE = exports.WATCH_WAIT_KINDS = exports.FOLLOWUP_RESOLVE_OUTCOMES = exports.FOLLOWUP_STATES = exports.FOLLOWUP_KINDS = exports.followUpIdArg = void 0;
 exports.settledLine = settledLine;
 exports.recipeWatchBoundsRefusal = recipeWatchBoundsRefusal;
 exports.resolveFollowUpAgent = resolveFollowUpAgent;
@@ -115,6 +115,13 @@ function recipeWatchBoundsRefusal(waitKind, passed) {
             : 'A recipe watch ends through its --wait.',
     ].join(' ');
 }
+/**
+ * A trigger subject becomes a durable concurrency key, so it cannot be prose.
+ * Keep this grammar aligned with TriggerEngine's subject validation and the
+ * FollowUpService storage limit.
+ */
+exports.FOLLOWUP_SUBJECT_EXTERNAL_KEY_RE = /^[A-Za-z0-9_\-.:/#@+~]{1,300}$/;
+exports.FOLLOWUP_SUBJECT_FLAG_HELP = 'Subject ref: type:externalKey (externalKey: letters, digits, _ - . : / # @ + ~; no spaces)';
 /**
  * Which agent a follow-up belongs to.
  *
@@ -154,11 +161,17 @@ function resolveFollowUpAgent(explicitAgentId, env = process.env) {
 }
 /** A `type:externalKey` subject ref → the subject block the API wants. */
 function parseSubjectRef(ref) {
-    const idx = ref.indexOf(':');
-    if (idx <= 0 || idx === ref.length - 1) {
+    const value = ref.trim();
+    const idx = value.indexOf(':');
+    if (idx <= 0 || idx === value.length - 1) {
         throw new Error(`--subject must be "type:externalKey" (e.g. task:OSK-42, conversation:conv_123), got "${ref}"`);
     }
-    return { type: ref.slice(0, idx), externalKey: ref.slice(idx + 1) };
+    const type = value.slice(0, idx);
+    const externalKey = value.slice(idx + 1);
+    if (!exports.FOLLOWUP_SUBJECT_EXTERNAL_KEY_RE.test(externalKey)) {
+        throw new Error('--subject has an invalid external key. Use type:externalKey; the key may contain only letters, digits, _ - . : / # @ + ~ (no spaces). Put descriptive text in --why.');
+    }
+    return { type, externalKey };
 }
 /* ------------------------------------------------------------------ *
  * API                                                                  *

package/dist/lib/login.js

@@ -37,6 +37,7 @@ const device_code_1 = require("./device-code");
 const device_identity_1 = require("./device-identity");
 const oauthLogin_1 = require("./oauthLogin");
 const daemonBroker_1 = require("./daemonBroker");
+const dedicated_guest_1 = require("./dedicated-guest");
 const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
 /**
  * What a shell with no terminal can do instead (OSK-12117). The refusal used to
@@ -119,8 +120,16 @@ async function cliLogin(opts = {}) {
                 // — the token lives for this process and the next `skrr` re-redeems
                 // over loopback. An explicit PKCE/device-code login further down
                 // still writes a real user-owned family, unchanged.
+                //
+                // Only a Dedicated guest's hand-off is the PLATFORM's. A laptop
+                // daemon's island file advertises `access_token` too, and there this
+                // sentence claimed a platform-managed machine that does not exist —
+                // the logout half of the same bug was OSK-12467 (c951446486).
                 console.log('');
-                console.log("  This machine is signed in through the platform's managed hand-off.");
+                console.log((0, dedicated_guest_1.runningOnDedicatedRuntimeGuest)()
+                    ? "  This machine is signed in through the platform's managed hand-off."
+                    : '  Signed in through the skrr background service on this computer (no browser needed). ' +
+                        'It lends this CLI short-lived tokens, so nothing was stored for this profile.');
                 return {
                     token: brokerResult.accessToken,
                     ...(brokerResult.accessExpiresAt !== undefined

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.d.ts

@@ -23,6 +23,37 @@ export declare function __setStateForTest(next: CredEnvelopeState): CredEnvelope
 export declare function __getStateForTest(): CredEnvelopeState;
 /** @internal Test seam — each spec owns its warn-dedupe horizon. */
 export declare function __clearWarnDedupeForTest(): void;
+/**
+ * Run the OSK-10314 consolidation for this profile's wrapped DEK.
+ *
+ * Under the canonical lock, because the window it closes is real: a daemon
+ * copying its legacy DEK into an empty canonical slot must not race a CLI
+ * enrolling a fresh one there — the loser's key would be overwritten and
+ * anything already sealed under it lost. That is the same race the lock was
+ * introduced for, one layer up.
+ *
+ * Never fatal. A migration that cannot run leaves the process exactly where it
+ * was, which is the state it has been operating in all along.
+ */
+/**
+ * Whether a split profile may be converged onto the legacy (daemon) key.
+ *
+ * Only the daemon ever has a legacy location, so only the daemon runs this, and
+ * the legacy key is the one it signs with. Since OSK-12063 the CLI enrolls no
+ * device key and only an interactive daemon login re-pins, so the key the server
+ * pins for this machine is the daemon's, UNLESS the daemon has itself been
+ * refused over its device key. That is the one fact that proves otherwise, and
+ * then nothing here knows which key the server holds, so it refuses as before.
+ *
+ * Why converging matters (OSK-12462): a CLI credential brokered by the daemon
+ * is tied to the daemon's machine row, and the server checks its refresh proof
+ * against the key pinned there. A CLI signing with a different key has that
+ * refresh refused as DEVICE_PROOF_THUMBPRINT_MISMATCH at its first renewal.
+ */
+export declare function splitKeyConvergencePolicy(): {
+    converge: boolean;
+    reason: 'daemon_key_pinned' | 'daemon_key_refused';
+};
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.
@@ -96,6 +127,16 @@ export declare function describeCredEnvelopeState(): {
         canonicalPath: string;
         legacyPath: string;
     };
+    /**
+     * Set when THIS process converged a split profile onto the legacy (daemon)
+     * key (OSK-12462). `canonicalPath` held the key that is now retired.
+     */
+    convergedFrom?: {
+        canonicalPath: string;
+        legacyPath: string;
+    };
+    /** How many retired DEKs this process can still open old values with. */
+    retiredKeys?: number;
 };
 /**
  * Sync write transform. Returns the wrapped serialized form when active.