@skrr-ai/cli 0.1.8 → 0.1.10

package/dist/commands/tasks/show.js

@@ -7,6 +7,7 @@ const session_task_endpoints_1 = require("../../lib/session-task-endpoints");
 const base_command_1 = require("../../base-command");
 const task_resolver_1 = require("../../lib/task-resolver");
 const web_url_1 = require("../../lib/web-url");
+const html_text_1 = require("../../lib/html-text");
 class TasksShow extends base_command_1.BaseCommand {
     static description = 'Show details for a single task (enriched)';
     static examples = [
@@ -115,6 +116,10 @@ class TasksShow extends base_command_1.BaseCommand {
         this.log(`Priority:    ${t.priority ?? '-'}`);
         this.log(`Parent:      ${t.parentId ?? '-'}`);
         this.log(`Space:       ${t.spaceId ?? '-'}`);
+        // Printed beside Space and Goal because `--project` is accepted on create
+        // and update, and this was the only place to confirm it landed — there
+        // was no way to tell an ignored flag from an honoured one.
+        this.log(`Project:     ${t.projectId ?? '-'}`);
         this.log(`Goal:        ${t.goalId ?? '-'}`);
         this.log(`Author:      ${t.author ?? '-'}`);
         const dri = t.dri;
@@ -199,7 +204,11 @@ class TasksShow extends base_command_1.BaseCommand {
         if (t.description) {
             this.log('');
             this.log('Description:');
-            this.log(`  ${t.description}`);
+            // Descriptions are stored as HTML, so printing the field verbatim showed
+            // the user `<p>` and `<code>` wrapped around the markdown they wrote.
+            for (const line of (0, html_text_1.htmlToDisplayText)(String(t.description)).split('\n')) {
+                this.log(`  ${line}`);
+            }
         }
         const ref = String(t.id ?? t._id ?? taskIdentity.id);
         this.log('');

package/dist/commands/tasks/triage.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
 const task_resolver_1 = require("../../lib/task-resolver");
+const tasks_1 = require("../../lib/tasks");
 /**
  * A deliberately thin decision façade. Triage has no state machine of its own:
  * accepting and declining are ordinary TYPE-resolved moves, duplicate is the
@@ -29,7 +30,7 @@ class TasksTriage extends base_command_1.BaseCommand {
     static flags = {
         reason: core_1.Flags.string({ description: 'Reason returned to the task source when declining' }),
         priority: core_1.Flags.string({
-            options: ['low', 'medium', 'high', 'critical'],
+            options: [...tasks_1.TASK_PRIORITIES],
             description: 'Priority to set before accepting',
         }),
         of: core_1.Flags.string({ description: 'Canonical task for the duplicate decision' }),

package/dist/commands/tasks/update.js

@@ -45,7 +45,10 @@ class TasksUpdate extends base_command_1.BaseCommand {
             description: 'Input format for --description or from-json description',
             options: ['html', 'markdown', 'plain'],
         }),
-        priority: core_1.Flags.string({ description: 'New priority' }),
+        priority: core_1.Flags.string({
+            description: 'New priority',
+            options: [...tasks_1.TASK_PRIORITIES],
+        }),
         'start-date': core_1.Flags.string({ description: 'New planned start date (ISO string)' }),
         'due-date': core_1.Flags.string({ description: 'New due date (ISO string)' }),
         estimate: core_1.Flags.integer({ description: 'New estimate value from the Space estimate scale' }),

package/dist/commands/tasks/upsert.js

@@ -31,7 +31,10 @@ class TasksUpsert extends base_command_1.BaseCommand {
             description: 'Input format for --description or from-json description',
             options: ['html', 'markdown', 'plain'],
         }),
-        priority: core_1.Flags.string({ description: 'Task priority' }),
+        priority: core_1.Flags.string({
+            description: 'Task priority',
+            options: [...tasks_1.TASK_PRIORITIES],
+        }),
         parent: core_1.Flags.string({ description: 'Parent task ID' }),
         space: core_1.Flags.string({ description: 'Space ID' }),
         goal: core_1.Flags.string({ description: 'Goal ID' }),

package/dist/commands/usage.js

@@ -5,7 +5,7 @@ const base_command_1 = require("../base-command");
 const command_manifest_1 = require("../lib/command-manifest");
 const usage_discovery_1 = require("../lib/usage-discovery");
 class Usage extends base_command_1.BaseCommand {
-    static description = 'Progressively discover Sky commands from the manifest, one token-budgeted domain at a time.';
+    static description = 'Progressively discover skrr commands from the manifest, one token-budgeted domain at a time.';
     static examples = [
         '<%= config.bin %> usage',
         '<%= config.bin %> usage tasks',

package/dist/commands/whoami.js

@@ -130,7 +130,10 @@ class Whoami extends base_command_1.BaseCommand {
             : '-';
         this.log(`Workspace:      ${workspaceLabel}`);
         this.log(`Daemon ID:      ${daemonId ?? '-'}`);
-        this.log(`Server:         ${this.cliConfig.baseURL}`);
+        // Named, not just spelled: `oversky.dev` and `skrr.ai` do not read as a
+        // dev/prod pair to anyone who has not seen the constants, and `whoami` is
+        // where the login message sends you to find out where you are (OSK-301).
+        this.log(`Server:         ${(0, config_1.describeDeployment)(this.cliConfig.baseURL)}`);
         this.log(`Profile:        ${(0, keychain_1.getActiveProfile)()}`);
         if (this.cliConfig.cliId) {
             this.log(`CLI ID:         ${this.cliConfig.cliId}`);

package/dist/lib/agentic-stream.js

@@ -8,6 +8,8 @@ exports.toWebSocketOrigin = toWebSocketOrigin;
 const node_readline_1 = require("node:readline");
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
+const config_1 = require("./config");
+const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 /**
  * Small Node-side adapter for the existing Agentic Socket.IO contract.
  * It deliberately normalizes only lifecycle/text/tool events; the server's
@@ -458,9 +460,27 @@ class AgenticStreamClient {
     }
 }
 exports.AgenticStreamClient = AgenticStreamClient;
+/**
+ * Web apexes whose realtime traffic lives on their `api.` subdomain.
+ *
+ * Derived from the endpoint contract rather than written out, because the two
+ * hostnames used to be literals here and the domain cutover moved one of them:
+ * a CLI logged into the new prod apex fell through to `wss://<apex>`, which
+ * CloudFront cannot upgrade. Nothing errors at the call site — the socket just
+ * never connects, which reads as a network problem rather than a stale list.
+ *
+ * The retired prod apex stays, for the reverse reason: a config file written
+ * before the cutover still names it, and dropping it would strand exactly the
+ * sessions the entry exists to carry.
+ */
+const REALTIME_APEXES = new Set([
+    new URL(publicEndpoints_generated_1.OVERSKY_ENVIRONMENT_ENDPOINTS.prod.appUrl).hostname,
+    new URL(publicEndpoints_generated_1.OVERSKY_ENVIRONMENT_ENDPOINTS.dev.appUrl).hostname,
+    new URL(config_1.LEGACY_PROD_BASE_URL).hostname,
+]);
 function toWebSocketOrigin(baseURL) {
     const url = new URL(baseURL);
-    if (url.hostname === 'oversky.dev' || url.hostname === 'oversky.ai') {
+    if (REALTIME_APEXES.has(url.hostname)) {
         url.hostname = `api.${url.hostname}`;
     }
     url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';

package/dist/lib/api-fetch.d.ts

@@ -32,7 +32,7 @@ export declare class ApiFetchError extends Error {
     constructor(message: string, status: number, body?: string, code?: string);
 }
 /**
- * Call an skrr API endpoint with the current credential. Throws
+ * Call a skrr API endpoint with the current credential. Throws
  * `ApiFetchError` on any non-2xx status so callers can branch on
  * `err.status` / `err.code`.
  */

package/dist/lib/api-fetch.js

@@ -56,7 +56,7 @@ class ApiFetchError extends Error {
 }
 exports.ApiFetchError = ApiFetchError;
 /**
- * Call an skrr API endpoint with the current credential. Throws
+ * Call a skrr API endpoint with the current credential. Throws
  * `ApiFetchError` on any non-2xx status so callers can branch on
  * `err.status` / `err.code`.
  */

package/dist/lib/auth-core-init.js

@@ -85,6 +85,26 @@ function ensureAuthCoreConfigured() {
         // Phase D: share the daemon's config root so auth.lock and the
         // needs-reauth flag are coordinated across binaries.
         configDir: () => node_path_1.default.join(node_os_1.default.homedir(), '.skrr'),
+        /**
+         * The machine root, PINNED — never the active profile's directory.
+         *
+         * `machineConfigDir` defaults to `configDir()`, and while the CLI's
+         * `configDir` was unconditionally `~/.skrr` that default was correct and
+         * this line would have been noise. It stops being correct the moment
+         * `configDir` becomes profile-aware: machine identity would start drifting
+         * per profile, and the server binds `cliId` into the JWT `did` claim and
+         * REFUSES a rotation presented against a different one. A second profile
+         * would not degrade — it would fail to stay logged in.
+         *
+         * The daemon already learned this the expensive way. OSK-1478: pinning the
+         * machine UUID to a profile-scoped `configDir` silently killed the
+         * `legacyDaemonUuids()` fold safety net, because it scanned
+         * `<profileDir>/profiles/*`, which never exists.
+         *
+         * Wired ahead of the profile work rather than with it, so the landmine is
+         * gone before anything can step on it.
+         */
+        machineConfigDir: () => node_path_1.default.join(node_os_1.default.homedir(), '.skrr'),
         logger: cliLogger,
         killSwitches: {
             // CLI shares the same kill-switch surface as the daemon for ops parity.
@@ -139,13 +159,13 @@ async function settlesWithin(promise, timeoutMs, keepTimerRef = false) {
 function encryptedCredentialInitError(timedOut, cause) {
     const state = (0, cred_envelope_1.describeCredEnvelopeState)();
     if (timedOut) {
-        return new CliCredentialInitializationError('Stored Sky credentials are encrypted, but the local credential store did not ' +
+        return new CliCredentialInitializationError('Stored skrr credentials are encrypted, but the local credential store did not ' +
             `initialize within ${ENCRYPTED_CREDENTIAL_INIT_TIMEOUT_MS / 1000} seconds. ` +
-            'The credential remains protected; wait for other Sky processes to finish and retry.');
+            'The credential remains protected; wait for other skrr processes to finish and retry.');
     }
     const detail = state.kind === 'disabled' && state.reason ? `${state.kind} (${state.reason})` : state.kind;
     const causeMessage = cause instanceof Error ? cause.message.trim().slice(0, 200) : '';
-    return new CliCredentialInitializationError(`Stored Sky credentials are encrypted, but the local credential store is ${detail}. ` +
+    return new CliCredentialInitializationError(`Stored skrr credentials are encrypted, but the local credential store is ${detail}. ` +
         (causeMessage ? `Initialization failed: ${causeMessage}. ` : '') +
         'The credential remains protected; unlock or repair the OS credential store and retry.');
 }

package/dist/lib/auth-storage.d.ts

@@ -33,18 +33,6 @@ export interface WriteOptions {
  * function returns whatever is persisted.
  */
 export declare function readFromBackend(expectedServerOrigin?: string): ReadResult;
-/**
- * Persist a token bundle to the preferred backend.
- *
- * Writes to keychain when available, file otherwise. If keychain writes
- * fail mid-flight (e.g., user canceled the unlock prompt), we fall back
- * to the file backend so the CLI remains functional.
- *
- * Returns the backend that actually accepted the write. Callers wanting
- * a specific backend (bare mode, store-mode overrides) should call the
- * lower-level write helpers directly — not exported here to keep the
- * default path honest.
- */
 export declare function writeToBackend(bundle: AuthBundle, options?: WriteOptions): AuthBackend;
 /**
  * Clear both backends. Called on `skrr logout` (and internally during

package/dist/lib/auth-storage.js

@@ -357,6 +357,37 @@ function readFromBackend(expectedServerOrigin) {
  * lower-level write helpers directly — not exported here to keep the
  * default path honest.
  */
+/**
+ * Clear the DAEMON's needs-reauth latch as well as the CLI's own.
+ *
+ * `clearReauthState()` resolves `getAuthConfigDir()`, and the two binaries wire
+ * that differently: the CLI points auth-core at the machine root (`~/.skrr`),
+ * the daemon at its PROFILE dir (`~/.skrr/profiles/<profile>`). So the daemon
+ * latched at one path while `skrr login` cleared another — a file that on most
+ * machines does not exist at all, which made the clear a silent no-op.
+ *
+ * The visible cost was a loop with no exit: `skrr daemon status` reported
+ * "Cause: TOKEN_INVALID · Remedy: run `skrr login`", the login succeeded, and
+ * the flag never moved, so the daemon's realtime channel stayed down and it
+ * could not execute tasks. `auth-core-init.ts` states the intent — "share the
+ * daemon's config root so auth.lock and the needs-reauth flag are coordinated
+ * across binaries" — which stopped being true when the daemon became
+ * profile-scoped.
+ *
+ * The ACTIVE profile only, deliberately: a per-profile latch is correct because
+ * different profiles can hold different credentials, and a login re-authorises
+ * exactly the one it just wrote.
+ */
+function clearDaemonProfileReauthState() {
+    try {
+        const target = path.join(os.homedir(), '.skrr', 'profiles', keychain.getActiveProfile(), 'needs-reauth.json');
+        fs.rmSync(target, { force: true });
+    }
+    catch {
+        // Best effort: the CLI's own latch is already cleared, and failing to
+        // remove the daemon's must not fail a login that otherwise succeeded.
+    }
+}
 function writeToBackend(bundle, options = {}) {
     const requestedOrigin = options.serverOrigin ?? bundle.serverOrigin;
     let persistedBundle = bundle;
@@ -373,8 +404,10 @@ function writeToBackend(bundle, options = {}) {
             // Remove any stale file copy so we don't have two sources of truth.
             deleteFileBackend();
             backend = 'keychain';
-            if (options.clearReauth)
+            if (options.clearReauth) {
                 (0, auth_core_1.clearReauthState)();
+                clearDaemonProfileReauthState();
+            }
             return backend;
         }
         // Keychain failed — fall through to the file backend rather than
@@ -386,8 +419,10 @@ function writeToBackend(bundle, options = {}) {
     }
     writeToFile(persistedBundle);
     backend = 'file';
-    if (options.clearReauth)
+    if (options.clearReauth) {
         (0, auth_core_1.clearReauthState)();
+        clearDaemonProfileReauthState();
+    }
     return backend;
 }
 /**

package/dist/lib/config.d.ts

@@ -119,6 +119,19 @@ export declare function environmentForBaseURL(value: string): 'dev' | 'prod' | '
  * display and not harmless for routing, because two spellings of prod are two
  * different keys to anything comparing base URLs.
  */
+/**
+ * A deployment, written so a human can tell which one it is.
+ *
+ * A published `npm i -g @skrr-ai/cli` defaults to the DEV deployment, and nothing
+ * in the login flow said so — you got "Signed in via browser" and no indication
+ * of which backend now holds your account (OSK-301). Naming the environment as
+ * well as the URL matters because `oversky.dev` and `skrr.ai` do not look like a
+ * dev/prod pair to anyone who has not read this file.
+ *
+ * Falls back to the bare URL for a deployment we do not recognise — a
+ * self-hosted or local server is legitimate, and labelling it would be a guess.
+ */
+export declare function describeDeployment(baseURL: string): string;
 export declare function canonicalizeKnownBaseURL(value: string): string;
 /**
  * True when any auth-carrying env var is set. In this mode credentials are
@@ -128,9 +141,36 @@ export declare function canonicalizeKnownBaseURL(value: string): string;
  */
 export declare function isEnvAuthOverride(): boolean;
 /**
- * Read the config file. Returns defaults if missing. Throws on corrupt
- * JSON. Performs a one-shot legacy → new copy when only the legacy file
- * exists, so existing users don't have to re-login.
+ * Storage layout (Phase H+).
+ *
+ * Canonical:  ~/.skrr/cli-config.json  (metadata only)
+ *            ~/.skrr/cli-auth.json    (file-backend auth storage)
+ *            Keychain                    (darwin-preferred auth storage)
+ * Legacy:    ~/.sky/config.json          (read-only fallback, copied forward once)
+ *
+ * The CLI shares the daemon's config root so `auth.lock` and
+ * `needs-reauth.json` are coordinated across binaries.
+ */
+/**
+ * The skrr root for this process — the ONE place every root-derived path comes
+ * from.
+ *
+ * It is exported and takes `env` because the alternative is what this replaced:
+ * two functions each deriving the root themselves, one honouring the override
+ * and one not, disagreeing only when someone relocated their root (OSK-300).
+ * Fixing that by teaching the second function the same two variable names would
+ * have re-created the split the moment a third name appeared — and did, briefly,
+ * when `SKRR_CONFIG_DIR` was added to one side only.
+ *
+ * `SKRR_CONFIG_DIR` is the spelling for anything new (root CLAUDE.md) and wins
+ * when both are set. `OVERSKY_CONFIG_DIR` keeps working: the daemon, the engine
+ * resolver and every existing install read it.
+ */
+export declare function configRoot(env?: NodeJS.ProcessEnv): string;
+/**
+ * Read the config file. Returns defaults if missing. Throws on corrupt JSON.
+ * Performs a one-shot legacy → new copy when only the legacy file exists, so
+ * existing users don't have to re-login.
  */
 export declare function loadConfig(): CliConfig;
 /** Write the config file with mode 0600 inside a 0700 directory. */