@skrr-ai/cli 0.1.8

package/dist/lib/sky-code-agent.d.ts

@@ -0,0 +1,160 @@
+/**
+ * OSK-3892 — which AGENT a locally-hosted skrr Code session belongs to.
+ *
+ * ── Why a session needs an agent at all ────────────────────────────────────
+ *
+ * `skrr code` is the local arm of an agent's harness. The cloud dispatches to
+ * sky-code AS an agent, and a human running it here runs the same harness against
+ * the same server contract — so the session is attributed to an agent the user
+ * names.
+ *
+ * That is deliberately not "make agentId optional". `principal.agentId` has 22
+ * non-test consumers plus a `requiredString` CAS predicate in
+ * `redemptionIdentity`; loosening it is large, risky surgery for no gain, while
+ * naming an agent touches no CAS predicate and no claim vocabulary.
+ *
+ * ── Resolution order, and why it ends in a refusal ─────────────────────────
+ *
+ *   1. `--oversky-agent <id-or-name>`
+ *   2. `skyCodeAgentId` in `~/.skrr/cli-config.json`
+ *   3. the user's single agent, when they have exactly one AND AUTHORED IT
+ *   4. the user's own DEFAULT agent for this harness, created on first use
+ *
+ * and only then FAIL, naming the flag and listing the candidates. Never a silent
+ * pick: the agent decides whose statement the spend lands on and which timeline
+ * the work appears in, and a wrong guess is only visible weeks later in a bill.
+ *
+ * Step 4 is what makes the rest usable. Without it the order ended in a refusal
+ * that a real account — dozens of agents — hit every single time, so every
+ * unconfigured session fell back to BYOK and then failed outright for want of a
+ * local provider key. The rule the refusal protected is intact: an agent created
+ * FOR this purpose, owned by this user, is not a guess about which of their
+ * existing agents they meant.
+ *
+ * Step 3 carries the authorship condition because the roster is read at EDIT and
+ * `AGENT_EDITOR` is VIEW|EDIT — so an agent a colleague shared privately with you
+ * appears in it, and a user who owns nothing but has one shared agent used to be
+ * attributed to it silently. The server does not catch that: EDIT is exactly what
+ * `callerMayCommitAgentSpend` requires, so the lease is issued and the bill lands
+ * on the other person's agent. Steps 1 and 2 are NOT gated — naming a shared
+ * agent is a deliberate act, and gating it would break sharing to no purpose.
+ *
+ * ── Why this is not `agent-resolver.ts` ────────────────────────────────────
+ *
+ * That module resolves ids only (no name lookup), reaches the API through
+ * `dataService` — which needs the adapter installation only `BaseCommand.init`
+ * performs, and `skrr code` deliberately does not extend `BaseCommand` — and puts
+ * `OVERSKY_SESSION_AGENT_ID` ABOVE the explicit flag, which would make
+ * `--oversky-agent` fail inside any daemon-spawned CLI child. Its error TYPE and
+ * its habit of listing what it found are worth copying; its precedence is not.
+ */
+export type SkyCodeAgentSource = 'flag' | 'config' | 'sole-agent' | 'default-agent';
+export interface SkyCodeAgent {
+    id: string;
+    name?: string;
+    source: SkyCodeAgentSource;
+    /**
+     * True only on the run that actually minted the default agent, so the CLI can
+     * say so once instead of on every session. The server reports it as 201 vs
+     * 200; deriving it from a timestamp here would be guesswork.
+     */
+    createdNow?: boolean;
+}
+export type SkyCodeAgentFailure = 'agent-unknown' | 'agent-ambiguous' | 'agent-unset' | 'agent-lookup-failed';
+export declare class SkyCodeAgentError extends Error {
+    readonly code: SkyCodeAgentFailure;
+    constructor(code: SkyCodeAgentFailure, message: string);
+}
+interface AgentRow {
+    id?: string;
+    name?: string;
+    /**
+     * Owner id. Already on the wire — `AGENT_LIST_SUMMARY_PROJECTION` selects it
+     * (`api/models/Agent.js`) and the model stringifies it before it leaves.
+     */
+    author?: string;
+    /**
+     * Set when this row IS the caller's auto-created default for a harness. Also
+     * already on the wire, for the same reason — which is what lets a read-only
+     * caller recognise an existing default without asking the get-or-create
+     * endpoint to establish one.
+     */
+    defaultForHarness?: string;
+}
+export interface SkyCodeAgentDeps {
+    /** Agents this user may run. Bounded; see `ROSTER_LIMIT`. */
+    listAgents?: (signal?: AbortSignal) => Promise<AgentRow[]>;
+    /** Direct read, for an id outside the bounded roster. `null` when unreadable. */
+    getAgent?: (id: string, signal?: AbortSignal) => Promise<AgentRow | null>;
+    configuredAgentId?: () => string | undefined;
+    /**
+     * The caller's own user id, for the authorship gate. `null` when unknowable —
+     * which is treated as "cannot prove ownership", never as "owns it".
+     */
+    currentUserId?: (signal?: AbortSignal) => Promise<string | null>;
+    /** Get-or-create this user's default agent for the harness. */
+    ensureDefaultAgent?: (harness: string, signal?: AbortSignal) => Promise<DefaultAgentRow | null>;
+}
+interface DefaultAgentRow extends AgentRow {
+    /** Whether THIS call created it (server 201) rather than found it (200). */
+    created?: boolean;
+}
+export interface SkyCodeAgentOptions {
+    /**
+     * OSK-3892 — the CALLER's deadline for the whole managed acquisition.
+     *
+     * Threaded rather than owned here: resolution is one to two `/api/agents`
+     * calls out of three round trips, and `skrr code` promises the user a single
+     * bound for all of them. Without it these calls inherited undici's 300s
+     * headersTimeout while the stated bound was 15s.
+     */
+    signal?: AbortSignal;
+    /**
+     * May resolution CREATE the default agent when nothing else answers?
+     *
+     * Defaults to true, because a session that cannot name an agent cannot run.
+     * `skrr code oversky-agent` (with no `--create`) passes false: a command whose
+     * job is to report what would happen must not make it happen.
+     */
+    createDefault?: boolean;
+    /**
+     * How a refusal NAMES an explicitly-supplied reference.
+     *
+     * Defaults to `--oversky-agent`, which is how a session receives one. `skrr code
+     * oversky-agent --set` passes its own spelling so a bad value does not send the
+     * user to fix a flag they never typed.
+     */
+    explicitLabel?: string;
+}
+/**
+ * Resolve the agent for this session, or refuse with something actionable.
+ *
+ * What this decides is ATTRIBUTION, not permission. Permission is enforced
+ * server-side and fails closed: `callerMayCommitAgentSpend`
+ * (`sessionInferenceRelay.js`) loads the agent and checks the caller against its
+ * ACL on every admission, answering 503 rather than guessing. An earlier version
+ * of this comment claimed the roster read WAS the ownership check because
+ * `session-token/issue` did not validate one — that was wrong, and believing it
+ * would justify weakening the server gate. See
+ * `docs/architecture/managed-inference-execution-shapes-2026-08-12.md`: "A roster
+ * read is a lookup. An attacker does not use the roster."
+ *
+ * So the roster is here to decide WHICH of the caller's agents pays, and to make
+ * a refusal listable. That is worth just as much care — a wrong pick is not a
+ * breach, it is a bill someone else reads weeks later — but it is a different job.
+ */
+export declare function resolveSkyCodeAgent(explicit?: string, deps?: SkyCodeAgentDeps, options?: SkyCodeAgentOptions): Promise<SkyCodeAgent>;
+/** The stored value, unresolved — for a `--show` that must report "unset" honestly. */
+export declare function readConfiguredAgentId(): string | undefined;
+/**
+ * Persist the agent `skrr code` runs as when no flag is passed.
+ *
+ * Resolves through the SAME roster `resolveSkyCodeAgent` uses, for two reasons: a
+ * typo is refused while the user is still looking at it rather than at the start
+ * of some later session, and what lands on disk is always a canonical id. Storing
+ * the display name a user typed would silently break on the next rename.
+ */
+export declare function setConfiguredAgentId(ref: string, deps?: SkyCodeAgentDeps, options?: SkyCodeAgentOptions): Promise<SkyCodeAgent>;
+/** Remove the setting. Returns what was there, so the caller can say so. */
+export declare function clearConfiguredAgentId(): string | undefined;
+export {};

package/dist/lib/sky-code-agent.js

@@ -0,0 +1,417 @@
+"use strict";
+/**
+ * OSK-3892 — which AGENT a locally-hosted skrr Code session belongs to.
+ *
+ * ── Why a session needs an agent at all ────────────────────────────────────
+ *
+ * `skrr code` is the local arm of an agent's harness. The cloud dispatches to
+ * sky-code AS an agent, and a human running it here runs the same harness against
+ * the same server contract — so the session is attributed to an agent the user
+ * names.
+ *
+ * That is deliberately not "make agentId optional". `principal.agentId` has 22
+ * non-test consumers plus a `requiredString` CAS predicate in
+ * `redemptionIdentity`; loosening it is large, risky surgery for no gain, while
+ * naming an agent touches no CAS predicate and no claim vocabulary.
+ *
+ * ── Resolution order, and why it ends in a refusal ─────────────────────────
+ *
+ *   1. `--oversky-agent <id-or-name>`
+ *   2. `skyCodeAgentId` in `~/.skrr/cli-config.json`
+ *   3. the user's single agent, when they have exactly one AND AUTHORED IT
+ *   4. the user's own DEFAULT agent for this harness, created on first use
+ *
+ * and only then FAIL, naming the flag and listing the candidates. Never a silent
+ * pick: the agent decides whose statement the spend lands on and which timeline
+ * the work appears in, and a wrong guess is only visible weeks later in a bill.
+ *
+ * Step 4 is what makes the rest usable. Without it the order ended in a refusal
+ * that a real account — dozens of agents — hit every single time, so every
+ * unconfigured session fell back to BYOK and then failed outright for want of a
+ * local provider key. The rule the refusal protected is intact: an agent created
+ * FOR this purpose, owned by this user, is not a guess about which of their
+ * existing agents they meant.
+ *
+ * Step 3 carries the authorship condition because the roster is read at EDIT and
+ * `AGENT_EDITOR` is VIEW|EDIT — so an agent a colleague shared privately with you
+ * appears in it, and a user who owns nothing but has one shared agent used to be
+ * attributed to it silently. The server does not catch that: EDIT is exactly what
+ * `callerMayCommitAgentSpend` requires, so the lease is issued and the bill lands
+ * on the other person's agent. Steps 1 and 2 are NOT gated — naming a shared
+ * agent is a deliberate act, and gating it would break sharing to no purpose.
+ *
+ * ── Why this is not `agent-resolver.ts` ────────────────────────────────────
+ *
+ * That module resolves ids only (no name lookup), reaches the API through
+ * `dataService` — which needs the adapter installation only `BaseCommand.init`
+ * performs, and `skrr code` deliberately does not extend `BaseCommand` — and puts
+ * `OVERSKY_SESSION_AGENT_ID` ABOVE the explicit flag, which would make
+ * `--oversky-agent` fail inside any daemon-spawned CLI child. Its error TYPE and
+ * its habit of listing what it found are worth copying; its precedence is not.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SkyCodeAgentError = void 0;
+exports.resolveSkyCodeAgent = resolveSkyCodeAgent;
+exports.readConfiguredAgentId = readConfiguredAgentId;
+exports.setConfiguredAgentId = setConfiguredAgentId;
+exports.clearConfiguredAgentId = clearConfiguredAgentId;
+const data_provider_1 = require("@skrr-ai/data-provider");
+const api_fetch_1 = require("./api-fetch");
+const config_1 = require("./config");
+const sky_code_managed_1 = require("./sky-code-managed");
+/**
+ * How many agents the refusal is allowed to look at.
+ *
+ * A bound rather than pagination: this list exists to answer "did you mean one of
+ * these?", and a user with more agents than this is a user who will pass the flag.
+ */
+const ROSTER_LIMIT = 100;
+/** How many candidates a refusal prints before it summarizes the rest. */
+const CANDIDATES_SHOWN = 12;
+class SkyCodeAgentError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'SkyCodeAgentError';
+        this.code = code;
+    }
+}
+exports.SkyCodeAgentError = SkyCodeAgentError;
+/**
+ * Resolve the agent for this session, or refuse with something actionable.
+ *
+ * What this decides is ATTRIBUTION, not permission. Permission is enforced
+ * server-side and fails closed: `callerMayCommitAgentSpend`
+ * (`sessionInferenceRelay.js`) loads the agent and checks the caller against its
+ * ACL on every admission, answering 503 rather than guessing. An earlier version
+ * of this comment claimed the roster read WAS the ownership check because
+ * `session-token/issue` did not validate one — that was wrong, and believing it
+ * would justify weakening the server gate. See
+ * `docs/architecture/managed-inference-execution-shapes-2026-08-12.md`: "A roster
+ * read is a lookup. An attacker does not use the roster."
+ *
+ * So the roster is here to decide WHICH of the caller's agents pays, and to make
+ * a refusal listable. That is worth just as much care — a wrong pick is not a
+ * breach, it is a bill someone else reads weeks later — but it is a different job.
+ */
+async function resolveSkyCodeAgent(explicit, deps = {}, options = {}) {
+    const configured = deps.configuredAgentId ?? (() => (0, config_1.loadConfig)().skyCodeAgentId);
+    const explicitLabel = options.explicitLabel ?? sky_code_managed_1.OVERSKY_AGENT_FLAG;
+    let cached = null;
+    const roster = async () => {
+        if (cached)
+            return cached;
+        try {
+            cached = (await (deps.listAgents ?? listAgents)(options.signal)).filter((row) => Boolean(row?.id));
+        }
+        catch (err) {
+            throw new SkyCodeAgentError('agent-lookup-failed', `could not read your agents — ${message(err)}`);
+        }
+        return cached;
+    };
+    const named = async (ref, source) => {
+        const rows = await roster();
+        const byId = rows.find((row) => row.id === ref);
+        if (byId)
+            return { id: byId.id, ...(byId.name ? { name: byId.name } : {}), source };
+        // Case-insensitive because a display name is prose, not an identifier. Exact
+        // only, though: a prefix match that picks "Engineer" for "Eng" would be the
+        // silent pick this whole module exists to avoid.
+        const byName = rows.filter((row) => (row.name ?? '').toLowerCase() === ref.toLowerCase());
+        if (byName.length === 1) {
+            return { id: byName[0].id, ...(byName[0].name ? { name: byName[0].name } : {}), source };
+        }
+        if (byName.length > 1) {
+            throw new SkyCodeAgentError('agent-ambiguous', `${describeSource(source, ref, explicitLabel)} matches ${byName.length} agents. ` +
+                `Pass ${sky_code_managed_1.OVERSKY_AGENT_FLAG} with an id instead: ${candidates(byName)}`);
+        }
+        // Not in the bounded roster. It may still be a real id belonging to a user with
+        // more agents than the roster shows, so ask directly before refusing.
+        const direct = await (deps.getAgent ?? getAgent)(ref, options.signal);
+        if (direct?.id) {
+            return { id: direct.id, ...(direct.name ? { name: direct.name } : {}), source };
+        }
+        throw new SkyCodeAgentError('agent-unknown', `${describeSource(source, ref, explicitLabel)} is not an agent you can run. ` +
+            (rows.length ? `Yours: ${candidates(rows)}` : 'You have no agents yet.'));
+    };
+    /**
+     * Did the caller author this row?
+     *
+     * Only consulted on the sole-agent branch. The flag and the config key are
+     * DELIBERATE choices — a user naming a colleague's shared agent means it, and
+     * the server will accept it — so gating those would break sharing for no
+     * safety gain. What needs a gate is the branch that picks for you.
+     */
+    const owns = async (row) => {
+        if (!row.author)
+            return 'unprovable';
+        const me = await (deps.currentUserId ?? currentUserId)(options.signal);
+        if (!me)
+            return 'unprovable';
+        return String(row.author) === me ? 'mine' : 'not-mine';
+    };
+    const flag = explicit?.trim();
+    if (flag)
+        return named(flag, 'flag');
+    const fromConfig = configured()?.trim();
+    if (fromConfig)
+        return named(fromConfig, 'config');
+    const rows = await roster();
+    if (rows.length === 1) {
+        // AUTHORSHIP, not visibility. The roster is read at EDIT and `AGENT_EDITOR`
+        // is VIEW|EDIT, so an agent a colleague shared privately with you is in it —
+        // and being the only row does not make it yours. Taking it would put your
+        // session's spend and its timeline on someone else's agent, and the server
+        // accepts that quite happily, because EDIT is exactly what
+        // `callerMayCommitAgentSpend` asks for. The one thing that makes "the only
+        // one" mean "mine" is the author field.
+        const only = rows[0];
+        if ((await owns(only)) === 'mine') {
+            return {
+                id: only.id,
+                ...(only.name ? { name: only.name } : {}),
+                source: 'sole-agent',
+            };
+        }
+    }
+    // 4. This user's own default agent for this harness — established server-side,
+    //    idempotently, the first time a session needs one.
+    //
+    //    This is what replaced the refusal that used to end this function. That
+    //    refusal was correct in principle and useless in practice: a real account
+    //    has dozens of agents, so it fired every time, the session fell back to
+    //    BYOK, and with no local provider key the engine's first request simply
+    //    failed. The rule it protected — never silently spend under an agent the
+    //    user did not choose — is kept, by picking an agent that exists for
+    //    exactly this and belongs to nobody else.
+    //    `createDefault: false` makes this a READ: the endpoint is get-or-create
+    //    and has no read-only mode, so a caller that is only ASKING
+    //    (`skrr code oversky-agent`) recognises an existing default from the roster
+    //    it has already fetched instead. `defaultForHarness` rides the same
+    //    summary projection `author` does, so this costs no extra request.
+    //
+    //    Skipping the branch outright would have been wrong in the way that is
+    //    hardest to notice: "do not create" is not "do not look", and `--show`
+    //    would report "no default agent yet" while staring at the row.
+    if (options.createDefault === false) {
+        const existing = rows.find((row) => row.defaultForHarness === sky_code_managed_1.SKY_CODE_HARNESS);
+        if (existing?.id) {
+            return {
+                id: existing.id,
+                ...(existing.name ? { name: existing.name } : {}),
+                source: 'default-agent',
+            };
+        }
+    }
+    try {
+        const created = options.createDefault === false
+            ? null
+            : await (deps.ensureDefaultAgent ?? ensureDefaultAgent)(sky_code_managed_1.SKY_CODE_HARNESS, options.signal);
+        if (created?.id) {
+            return {
+                id: created.id,
+                ...(created.name ? { name: created.name } : {}),
+                source: 'default-agent',
+                ...(created.created ? { createdNow: true } : {}),
+            };
+        }
+    }
+    catch (err) {
+        if (isAbortError(err))
+            throw err;
+        throw new SkyCodeAgentError('agent-unset', `could not establish your default skrr Code agent — ${message(err)}. ` +
+            `Pass ${sky_code_managed_1.OVERSKY_AGENT_FLAG} <id-or-name>, or set one with ` +
+            '`skrr code oversky-agent --set <id>`' +
+            (rows.length ? `. Yours: ${candidates(rows)}` : ''));
+    }
+    // Asked, not told: the caller opted out of creation, so "no default" is a fact
+    // about this machine rather than a failure, and the remedy is a real command.
+    if (options.createDefault === false) {
+        throw new SkyCodeAgentError('agent-unset', 'nothing is configured and you have no skrr Code default agent yet. ' +
+            'One is created automatically the first time you run a managed session — ' +
+            'or make it now with `skrr code oversky-agent --create`' +
+            (rows.length ? `. Yours: ${candidates(rows)}` : ''));
+    }
+    // The endpoint answered without an agent. Nothing here can repair that, but
+    // the user still has every ordinary way to name one.
+    throw new SkyCodeAgentError('agent-unset', rows.length
+        ? `skrr Code has no default agent for you and will not pick one of your ${rows.length}. ` +
+            `Pass ${sky_code_managed_1.OVERSKY_AGENT_FLAG} <id-or-name>, or set "${sky_code_managed_1.AGENT_CONFIG_KEY}" in ` +
+            `${configPathHint()}. Yours: ${candidates(rows)}`
+        : 'you have no agents and no default could be created, yet a managed skrr Code session ' +
+            'runs as one. Create an agent in the skrr app first');
+}
+function describeSource(source, ref, explicitLabel) {
+    return source === 'config' ? `"${sky_code_managed_1.AGENT_CONFIG_KEY}": "${ref}"` : `${explicitLabel} "${ref}"`;
+}
+function candidates(rows) {
+    const shown = rows
+        .slice(0, CANDIDATES_SHOWN)
+        .map((row) => (row.name ? `${row.name} (${row.id})` : String(row.id)));
+    const rest = rows.length - shown.length;
+    return shown.join(', ') + (rest > 0 ? `, +${rest} more` : '');
+}
+function configPathHint() {
+    try {
+        return (0, config_1.getConfigPath)();
+    }
+    catch {
+        // A refusal message must never become a second failure. `getConfigPath` only
+        // joins strings today, so this is belt-and-braces rather than a known case.
+        return '~/.skrr/cli-config.json';
+    }
+}
+/** The stored value, unresolved — for a `--show` that must report "unset" honestly. */
+function readConfiguredAgentId() {
+    return (0, config_1.loadConfig)().skyCodeAgentId?.trim() || undefined;
+}
+/**
+ * Persist the agent `skrr code` runs as when no flag is passed.
+ *
+ * Resolves through the SAME roster `resolveSkyCodeAgent` uses, for two reasons: a
+ * typo is refused while the user is still looking at it rather than at the start
+ * of some later session, and what lands on disk is always a canonical id. Storing
+ * the display name a user typed would silently break on the next rename.
+ */
+async function setConfiguredAgentId(ref, deps = {}, options = {}) {
+    const resolved = await resolveSkyCodeAgent(ref, deps, {
+        // Name the thing the user actually typed. Without this a bad `--set` value
+        // is refused with "--oversky-agent \"typo\" is not an agent you can run",
+        // pointing at a flag that was never on the command line.
+        explicitLabel: 'skrr code oversky-agent --set',
+        ...options,
+    });
+    writeConfigKey(resolved.id);
+    return resolved;
+}
+/** Remove the setting. Returns what was there, so the caller can say so. */
+function clearConfiguredAgentId() {
+    const previous = readRawConfigKey();
+    writeConfigKey(undefined);
+    return previous;
+}
+function readRawConfigKey() {
+    const value = (0, config_1.loadRawConfig)()[sky_code_managed_1.AGENT_CONFIG_KEY];
+    return typeof value === 'string' && value.trim() ? value : undefined;
+}
+/**
+ * Read-modify-write through the RAW accessors, never `loadConfig`/`saveConfig`.
+ *
+ * `loadConfig()` overlays `OVERSKY_TOKEN` / `OVERSKY_REFRESH_TOKEN` onto the
+ * object it returns, and `saveConfig()` does not strip them back out despite what
+ * its docstring says. So the obvious `saveConfig({ ...loadConfig(), ... })` would
+ * persist an env-injected token into `cli-config.json` — undoing the migration
+ * that moved credentials to the keychain, on a command about an agent id. The raw
+ * pair also preserves operator-added keys the typed shape does not enumerate.
+ */
+function writeConfigKey(id) {
+    const raw = (0, config_1.loadRawConfig)();
+    if (id)
+        raw[sky_code_managed_1.AGENT_CONFIG_KEY] = id;
+    else
+        delete raw[sky_code_managed_1.AGENT_CONFIG_KEY];
+    (0, config_1.saveRawConfig)(raw);
+}
+/**
+ * The roster, at EDIT.
+ *
+ * EDIT rather than VIEW for the same reason `agent-resolver.ts` uses it: a
+ * view-only public agent appears in a VIEW roster and cannot actually be run as,
+ * so offering it as a candidate — or auto-selecting it as the "single" agent —
+ * would produce a session the server then refuses.
+ *
+ * `fields=summary` drops the prompt-sized fields; this needs an id and a name.
+ */
+async function listAgents(signal) {
+    const response = await (0, api_fetch_1.apiFetch)(`/api/agents?limit=${ROSTER_LIMIT}&fields=summary&requiredPermission=${data_provider_1.PermissionBits.EDIT}`, signal ? { signal } : {});
+    if (Array.isArray(response))
+        return response;
+    if (Array.isArray(response?.data))
+        return response.data;
+    if (Array.isArray(response?.agents))
+        return response.agents;
+    return [];
+}
+/**
+ * The caller's own user id, memoized FOR THIS PROCESS ONLY.
+ *
+ * Read lazily rather than written at login. There are five ways to sign this CLI
+ * in (PKCE, device code, daemon broker, restored refresh token, recovery code)
+ * and each persists its own subset of config; stamping the id at each of them
+ * means a sixth added later silently skips it, and the authorship gate then fails
+ * without anything looking broken.
+ *
+ * Deliberately NOT cached on disk. A persisted id is a claim about who the
+ * current credential belongs to, and nothing keeps the two together: no login
+ * path refreshes it, the credential store is origin-bound while the config is
+ * not, and `skrr logout` is its only clearer. So a disk cache can outlive the
+ * session it describes, and this is the gate that decides whether the caller may
+ * be silently attributed to a shared agent — exactly where a stale identity is
+ * worst. One extra request per process, on a branch that only runs when the
+ * caller has precisely one visible agent, is the right trade.
+ *
+ * `null`, never a throw: an unreadable identity means "cannot prove ownership",
+ * which the caller turns into a fall-through. An ABORT still propagates, because
+ * a caller whose deadline expired must not be told it does not own its agent.
+ */
+let memoizedUserId;
+async function currentUserId(signal) {
+    if (memoizedUserId !== undefined)
+        return memoizedUserId;
+    try {
+        const user = await (0, api_fetch_1.apiFetch)('/api/user', signal ? { signal } : {});
+        const id = String(user?.id ?? user?._id ?? '').trim();
+        memoizedUserId = id || null;
+        return memoizedUserId;
+    }
+    catch (err) {
+        if (isAbortError(err))
+            throw err;
+        // Not memoized: a transient failure must not pin "unknown" for the rest of
+        // the process.
+        return null;
+    }
+}
+/**
+ * Get-or-create this user's default agent for `harness`.
+ *
+ * The endpoint is idempotent server-side — `(author, defaultForHarness)` is
+ * uniquely indexed and the handler converges on a concurrent writer — so calling
+ * it on every unconfigured session is correct, not wasteful. It reaches this
+ * function only after the flag, the config key, and the sole-owned-agent branch
+ * have all declined, which is why the extra round trip is acceptable.
+ */
+async function ensureDefaultAgent(harness, signal) {
+    const response = await (0, api_fetch_1.apiFetch)('/api/agents/default', {
+        method: 'POST',
+        body: { harness },
+        ...(signal ? { signal } : {}),
+    });
+    if (!response?.agent?.id)
+        return null;
+    return { ...response.agent, created: response.created === true };
+}
+async function getAgent(id, signal) {
+    try {
+        return await (0, api_fetch_1.apiFetch)(`/api/agents/${encodeURIComponent(id)}`, signal ? { signal } : {});
+    }
+    catch (err) {
+        // A 403/404 here is the answer, not an error: this call exists only to
+        // distinguish "an id outside the roster page" from "not yours".
+        //
+        // An ABORT is not an answer, though. Swallowing it would report "not an
+        // agent you can run" for a caller whose deadline expired, which sends the
+        // user to fix the wrong thing — and would hide the timeout the acquisition
+        // is trying to name.
+        if (isAbortError(err))
+            throw err;
+        return null;
+    }
+}
+function isAbortError(err) {
+    return err?.name === 'AbortError';
+}
+function message(err) {
+    const text = err instanceof Error ? err.message : String(err);
+    return text.trim() || 'unknown error';
+}