@skrr-ai/cli 0.1.80 → 0.1.82

package/dist/base-command.d.ts

@@ -52,6 +52,10 @@ export declare abstract class BaseCommand extends Command {
      * from here.
      */
     protected resolvedCredential: ResolvedCredential;
+    /** Re-authorize a long-lived transport using this command's credential
+     * source. A daemon handoff is redeemed again; its refresh family is never
+     * borrowed or written into the CLI's own login. */
+    protected refreshTransportToken(): Promise<string>;
     /**
      * Where `resolvedCredential` really came from when its `source` slot cannot
      * say — an in-memory daemon hand-off or Agent session token is recorded as
@@ -467,5 +471,21 @@ export declare function describeDaemonScopedCredential(bin: string, scope?: Inco
  * question. Merging the two is the mistake its own comment warns about.
  */
 export declare function isTypedServerRefusal(body: Record<string, unknown> | null): boolean;
+/**
+ * Did the API itself answer this gateway-class status (502/503/504) with a
+ * typed code?
+ *
+ * Those statuses mean "outage" only when something IN FRONT of the API wrote
+ * them — the load balancer or CDN, whose bodies are HTML or empty, and which
+ * `parseErrorBody` therefore reads as null. A JSON body carrying `code` or
+ * `errorType` was written by a route or middleware that ran and chose the
+ * status: the API was up, and the request did not time out at the gateway.
+ *
+ * Checked AFTER `isTypedServerRefusal`, which handles the subset that also
+ * explains itself; this covers the coded rest — including production bodies
+ * whose message the 5xx redaction boundary replaced. A JSON body with no code
+ * stays in the outage branch: it says nothing a reader could act on.
+ */
+export declare function isApplicationCodedUnavailable(status: number | undefined, body: Record<string, unknown> | null): boolean;
 export declare function isRetryableFailure(status: number | undefined, body: Record<string, unknown> | null): boolean;
 export { Flags };

package/dist/base-command.js

@@ -15,6 +15,7 @@ exports.describeForbidden = describeForbidden;
 exports.isDaemonScopedCredential = isDaemonScopedCredential;
 exports.describeDaemonScopedCredential = describeDaemonScopedCredential;
 exports.isTypedServerRefusal = isTypedServerRefusal;
+exports.isApplicationCodedUnavailable = isApplicationCodedUnavailable;
 exports.isRetryableFailure = isRetryableFailure;
 const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
@@ -54,6 +55,7 @@ const edge_error_page_1 = require("./lib/edge-error-page");
 const step_up_1 = require("./lib/step-up");
 const delegated_cli_1 = require("./lib/delegated-cli");
 const dedicated_guest_1 = require("./lib/dedicated-guest");
+const harness_context_1 = require("./lib/harness-context");
 const tasks_1 = require("./lib/tasks");
 function assigneePayloadNeedsResolution(payload) {
     const fields = [
@@ -155,6 +157,30 @@ class BaseCommand extends core_1.Command {
      * from here.
      */
     resolvedCredential;
+    /** Re-authorize a long-lived transport using this command's credential
+     * source. A daemon handoff is redeemed again; its refresh family is never
+     * borrowed or written into the CLI's own login. */
+    async refreshTransportToken() {
+        if (this.credentialProvenance?.kind === 'daemon-handoff') {
+            const result = await (0, daemonBroker_1.redeemBrokeredHandoffToken)(true);
+            if (!result?.accessToken)
+                throw new Error('The local daemon could not renew CLI authentication.');
+            this.resolvedCredential = {
+                token: result.accessToken,
+                source: 'env-token',
+                kind: (0, auth_core_1.classifyTokenKind)(result.accessToken),
+            };
+        }
+        else {
+            this.resolvedCredential = (await (0, refresh_1.ensureFreshCliCredential)({
+                credential: this.resolvedCredential,
+                bareMode: this.bareMode,
+            })).credential;
+        }
+        if (!this.resolvedCredential.token)
+            throw new Error('CLI authentication is unavailable.');
+        return this.resolvedCredential.token;
+    }
     /**
      * Where `resolvedCredential` really came from when its `source` slot cannot
      * say — an in-memory daemon hand-off or Agent session token is recorded as
@@ -253,6 +279,21 @@ class BaseCommand extends core_1.Command {
             (0, data_provider_1.setHttpAdapter)((0, node_adapter_1.createNodeAdapter)());
             return;
         }
+        // OSK-13254 — a process the daemon started for an agent or tool borrows
+        // from the daemon and never owns the person's stored session, so the
+        // commands that create, replace or end that session are not its to run.
+        const harnessContext = (0, harness_context_1.isHarnessCliContext)();
+        if (harnessContext && this.id && harness_context_1.HARNESS_REFUSED_AUTH_COMMANDS.has(this.id)) {
+            this.failWithCliError({
+                message: `\`${this.config.bin} ${this.id}\` is not available here: this process was started by the skrr ` +
+                    'background service for an agent or tool, and skrr in it borrows short-lived tokens from ' +
+                    'that service instead of holding a sign-in. Run it in your own terminal.',
+                code: 'HARNESS_CONTEXT_AUTH_COMMAND',
+                exit: 2,
+                retryable: false,
+            });
+            return;
+        }
         // A replacement guest keeps its workspace but receives a fresh Linux
         // machine-id. Retire the prior instance's machine-bound CLI envelopes
         // before migration/prefetch reads them; the current daemon handoff below
@@ -261,7 +302,9 @@ class BaseCommand extends core_1.Command {
         // One-shot migration: legacy token/refreshToken in cli-config.json
         // → keychain (macOS) or cli-auth.json (elsewhere). Idempotent.
         try {
-            (0, migrate_1.migrateAuthOutOfConfig)();
+            // A borrower never writes the person's stored session (OSK-13254).
+            if (!harnessContext)
+                (0, migrate_1.migrateAuthOutOfConfig)();
         }
         catch {
             // Never block a command on migration failure; the resolver still
@@ -317,9 +360,18 @@ class BaseCommand extends core_1.Command {
             allowUnreadableStoredCredential: this.id === 'login' || this.id === 'logout' || this.id === 'pair',
         });
         let ignoredStoredCredential = null;
-        if (!this.resolvedCredential.token && !this.bareMode && !parsed.token) {
+        if (!this.resolvedCredential.token && !this.bareMode && !parsed.token && !harnessContext) {
             ignoredStoredCredential = (0, auth_storage_1.readFromBackend)(this.cliConfig.baseURL);
         }
+        // OSK-13254 — nothing at all is stored for this profile: a first sign-in,
+        // which may ADOPT a CLI session of its own through the daemon instead of
+        // borrowing per process. Anything stored — a refused session, another
+        // server's, another config root's — is left alone and the daemon lends.
+        const nothingStored = !harnessContext &&
+            !!ignoredStoredCredential &&
+            !ignoredStoredCredential.bundle &&
+            ignoredStoredCredential.ownerStatus !== 'foreign' &&
+            (ignoredStoredCredential.originStatus ?? 'none') === 'none';
         // Daemon-as-broker auto-mint. When the resolver came up empty AND
         // a local `oversky` daemon is already authenticated for this user,
         // silently mint a sibling cli-scope refresh family via the daemon's
@@ -347,8 +399,14 @@ class BaseCommand extends core_1.Command {
                     cliConfig: this.cliConfig,
                     bareMode: this.bareMode,
                     commandId: this.id,
+                    adopt: nothingStored,
                 }));
-            if (autoResult.triggered && autoResult.outcome) {
+            if (autoResult.adoptedBySibling) {
+                // Another `skrr` adopted this profile's session while this one waited
+                // for the adoption lock: read it like any stored session.
+                this.resolvedCredential = await (0, credential_resolver_1.resolveCredential)({ bareMode: this.bareMode });
+            }
+            else if (autoResult.triggered && autoResult.outcome) {
                 if (autoResult.outcome.ok) {
                     // Persist the cliId now so a sibling skrr process spawned
                     // immediately after sees the same identity.
@@ -396,6 +454,14 @@ class BaseCommand extends core_1.Command {
                                 : {}),
                         }
                         : null;
+                    if (!autoResult.outcome.brokered && nothingStored) {
+                        // Said once, on stderr, the moment it happens: a session now exists
+                        // that the person did not type a command to create (OSK-13254).
+                        process.stderr.write(`[skrr] Signed this CLI in through the skrr background service on this computer. ` +
+                            `The session is saved to ${(0, credential_resolver_1.describeCredentialSource)(this.resolvedCredential.source)} ` +
+                            `and renews itself, so skrr keeps working while the service restarts. ` +
+                            `It is listed under Active Sessions; \`${this.config.bin} logout\` ends it.\n`);
+                    }
                 }
                 else if ((this.brokerRefusal =
                     (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin) ??
@@ -1176,11 +1242,15 @@ class BaseCommand extends core_1.Command {
                 // `login` sends a CI job to do the one thing it cannot, and hides the
                 // real mistake (dogfood OSK-4693). Name the credential instead.
                 const presentedCiToken = Boolean(this.resolvedCredential?.token?.startsWith('osk_ci_'));
+                // A personal access token (OSK-13208) has no session behind it to renew
+                // and no daemon to ask: the server's own reason (expired, revoked) IS
+                // the answer, and the repair is a new token, not `login`.
+                const presentedPat = Boolean(this.resolvedCredential?.token?.startsWith('osk_pat_'));
                 // OSK-12116 — the 401 is usually the SECOND failure: the token expired
                 // (routine) and renewing it was refused (the fault). The server's code
                 // for the retry is `TOKEN_EXPIRED`, which names the routine half; the
                 // latched refresh refusal names the half the reader can act on.
-                const refreshRefusal = presentedCiToken
+                const refreshRefusal = presentedCiToken || presentedPat
                     ? null
                     : (0, auth_failure_1.describeRefreshRefusal)(readRefreshRefusal(), {
                         bin: this.config.bin,
@@ -1190,9 +1260,9 @@ class BaseCommand extends core_1.Command {
                 // refused refresh, and the daemon refused too. Its reason decides the
                 // repair (OSK-12149, OSK-12151), and on a Dedicated guest there is no
                 // login to run, so its remedy replaces the generic "Run login".
-                const brokerRefusal = presentedCiToken || !e.brokerFailure
+                const brokerRefusal = presentedCiToken || presentedPat || !e.brokerFailure
                     ? null
-                    : (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin);
+                    : (0, daemonBrokerRefusal_1.describeBrokerFailure)(e.brokerFailure, this.config.bin);
                 const renewal = refreshRefusal
                     ? refreshRefusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
                     : "This CLI's own sign-in could not be renewed.";
@@ -1209,6 +1279,12 @@ class BaseCommand extends core_1.Command {
                             `daemon (\`OVERSKY_TOKEN=<token> skrrd start\`). ${this.config.bin} commands do ` +
                             `not accept it — sign in with \`${this.config.bin} login\` instead.`;
                 }
+                else if (presentedPat) {
+                    authMessage =
+                        `Authentication failed: ${bodyMessage || 'the personal access token was refused.'} ` +
+                            `Create a new token with \`${this.config.bin} tokens create\` from a signed-in terminal ` +
+                            `and update the secret that sets SKRR_TOKEN.`;
+                }
                 else if (brokerRefusal) {
                     authMessage = `Authentication failed. ${renewal} ${brokerRefusal.headline}\n→ ${brokerRefusal.remedy}`;
                 }
@@ -1332,6 +1408,45 @@ class BaseCommand extends core_1.Command {
                     requestId: stringProp(body, 'requestId') || e.requestId,
                 });
             }
+            else if (isApplicationCodedUnavailable(e.status, body)) {
+                // A 502/503/504 the API ITSELF wrote, with a typed code — not a page
+                // from the load balancer or CDN. The outage branch below would say the
+                // platform is down, absolve this command, and (for a write) call the
+                // outcome unknown because "the gateway may have timed out after the
+                // server committed it". None of that holds when the API answered.
+                //
+                // Observed 2026-10-01: `skrr agents chat --daemon <id>` printed exactly
+                // that outage paragraph for `POST /api/agentic/chat` → 503
+                // `preferred_daemon_unavailable` — "The selected local daemon is not
+                // connected" — a synchronous refusal before anything was enqueued,
+                // while skrr.ai served every other request. The reader went looking
+                // for a platform outage.
+                //
+                // No incident is recorded: one route refusing in its own words is not
+                // evidence the control plane is failing. `isOutageFailure` is left
+                // alone because it also decides whether the outbox queues a write.
+                const retryable = isRetryableFailure(e.status, body);
+                const authored = bodyMessage && !isRedactedServerMessage(bodyMessage) ? bodyMessage : '';
+                const requestId = stringProp(body, 'requestId') || e.requestId;
+                this.failWithCliError({
+                    message: say(`${this.cliConfig.baseURL} refused this request (HTTP ${e.status}, ${bodyCode})` +
+                        `${authored ? `: ${authored}` : '.'} ` +
+                        'The API answered this itself, so the request did not time out at the gateway. ' +
+                        (authored ? '' : 'It did not say why in this response. ') +
+                        (retryable
+                            ? 'Retrying may succeed once that condition clears.'
+                            : 'Retrying the same request will not help until that condition changes.') +
+                        (requestId && !authored
+                            ? ` Request id ${requestId} — quote it when reporting this.`
+                            : '')),
+                    code: bodyCode,
+                    status: e.status,
+                    exit: retryable ? 5 : 1,
+                    retryable,
+                    details: body ?? undefined,
+                    ...(requestId ? { requestId } : {}),
+                });
+            }
             else if ((0, outbox_1.isOutageFailure)(e)) {
                 // A gateway/unavailable status is an OUTAGE, and saying so is the whole
                 // point. During the OSK-2806 incident these surfaced as bare
@@ -1512,7 +1627,7 @@ class BaseCommand extends core_1.Command {
                 cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
             });
             const brokerRefusal = e.brokerFailure
-                ? (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin)
+                ? (0, daemonBrokerRefusal_1.describeBrokerFailure)(e.brokerFailure, this.config.bin)
                 : null;
             const why = (refusal
                 ? refusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
@@ -2030,6 +2145,35 @@ function isTypedServerRefusal(body) {
         return false;
     return (typeof body.cause === 'string' || typeof body.remedy === 'string' || body.retryable === false);
 }
+/**
+ * Did the API itself answer this gateway-class status (502/503/504) with a
+ * typed code?
+ *
+ * Those statuses mean "outage" only when something IN FRONT of the API wrote
+ * them — the load balancer or CDN, whose bodies are HTML or empty, and which
+ * `parseErrorBody` therefore reads as null. A JSON body carrying `code` or
+ * `errorType` was written by a route or middleware that ran and chose the
+ * status: the API was up, and the request did not time out at the gateway.
+ *
+ * Checked AFTER `isTypedServerRefusal`, which handles the subset that also
+ * explains itself; this covers the coded rest — including production bodies
+ * whose message the 5xx redaction boundary replaced. A JSON body with no code
+ * stays in the outage branch: it says nothing a reader could act on.
+ */
+function isApplicationCodedUnavailable(status, body) {
+    if (status !== 502 && status !== 503 && status !== 504)
+        return false;
+    return Boolean(stringProp(body, 'code') || stringProp(body, 'errorType'));
+}
+/**
+ * The sentence `redactServerErrorResponses` substitutes for a 5xx message in
+ * production. It is the boundary's, not the route's, so it is never relayed as
+ * if it explained anything.
+ */
+const REDACTED_SERVER_MESSAGE = 'An unexpected error occurred.';
+function isRedactedServerMessage(message) {
+    return message.trim() === REDACTED_SERVER_MESSAGE;
+}
 function isRetryableFailure(status, body) {
     const declared = body?.retryable;
     if (typeof declared === 'boolean')

package/dist/commands/agents/visibility.d.ts

@@ -1,3 +1,4 @@
+import type { StoreReleaseLicense } from '@skrr-ai/data-provider';
 import { BaseCommand } from '../../base-command';
 /**
  * `--capability-rationale <permission-key>=<note>` → the publisher notes a
@@ -18,6 +19,16 @@ export declare function parseReleaseDependencies(entries: readonly string[] | un
     }>;
     error?: string;
 };
+/**
+ * `--license` / `--remix` → the `license` declaration a public release carries
+ * (SUP11). Values are already constrained by the flags' `options`; this only
+ * enforces the pairing the flags cannot express: a remix grant is part of a
+ * license declaration, so it is meaningless without one.
+ */
+export declare function buildReleaseLicense(licenseId: string | undefined, remix: string | undefined): {
+    license?: StoreReleaseLicense;
+    error?: string;
+};
 export default class AgentsVisibility extends BaseCommand {
     static description: string;
     static examples: string[];
@@ -36,6 +47,9 @@ export default class AgentsVisibility extends BaseCommand {
         'capability-rationale': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         language: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         dependency: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        license: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        remix: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'source-visibility': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
     };
     run(): Promise<void>;
 }

package/dist/commands/agents/visibility.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.parseCapabilityRationales = parseCapabilityRationales;
 exports.parseReleaseDependencies = parseReleaseDependencies;
+exports.buildReleaseLicense = buildReleaseLicense;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -48,6 +49,25 @@ function parseReleaseDependencies(entries) {
     }
     return { dependencies };
 }
+/**
+ * `--license` / `--remix` → the `license` declaration a public release carries
+ * (SUP11). Values are already constrained by the flags' `options`; this only
+ * enforces the pairing the flags cannot express: a remix grant is part of a
+ * license declaration, so it is meaningless without one.
+ */
+function buildReleaseLicense(licenseId, remix) {
+    if (!licenseId) {
+        return remix
+            ? { error: '--remix is part of a license declaration; pass it with --license <id>.' }
+            : {};
+    }
+    return {
+        license: {
+            id: licenseId,
+            ...(remix ? { remix: remix } : {}),
+        },
+    };
+}
 class AgentsVisibility extends base_command_1.BaseCommand {
     static description = 'Set the visibility of an agent';
     static examples = [
@@ -57,6 +77,8 @@ class AgentsVisibility extends base_command_1.BaseCommand {
         '<%= config.bin %> agents visibility <agent-id> --public --capability-rationale "network:*=Looks up flight prices on the web"',
         '<%= config.bin %> agents visibility <agent-id> --public --language en --language zh-Hans',
         '<%= config.bin %> agents visibility <agent-id> --public --dependency skill:<skill-id>@<store-release-id>',
+        '<%= config.bin %> agents visibility <agent-id> --public --license mit --remix attributed --source-visibility public',
+        '<%= config.bin %> agents visibility <agent-id> --public --license proprietary --source-visibility sealed',
     ];
     static args = {
         id: core_1.Args.string({ description: 'Agent ID', required: true, ignoreStdin: true }),
@@ -96,6 +118,18 @@ class AgentsVisibility extends base_command_1.BaseCommand {
             description: 'Pin an attached Skill or Action to its immutable Store release: skill:<id>@<store-release-id> (repeatable)',
             multiple: true,
         }),
+        license: core_1.Flags.string({
+            description: 'The license the public release is offered under. Recorded on the release and shown on the listing; proprietary grants no reuse',
+            options: [...data_provider_1.STORE_RELEASE_LICENSE_IDS],
+        }),
+        remix: core_1.Flags.string({
+            description: "Whether a buyer's installed copy may be published as a derived listing: attributed (the fork credits this release) or none. Needs --license; defaults to none",
+            options: [...data_provider_1.STORE_RELEASE_REMIX_GRANTS],
+        }),
+        'source-visibility': core_1.Flags.string({
+            description: "Who may read the release's source, independent of price: licensed (license holders), public (anyone who sees the listing) or sealed (you only). Omit to keep the price-derived rule",
+            options: [...data_provider_1.STORE_RELEASE_SOURCE_VISIBILITIES],
+        }),
     };
     async run() {
         this.requireAuth();
@@ -128,6 +162,15 @@ class AgentsVisibility extends base_command_1.BaseCommand {
                 exit: 1,
             });
         }
+        const { license, error: licenseError } = buildReleaseLicense(flags.license, flags.remix);
+        if (licenseError)
+            this.error(licenseError, { exit: 1 });
+        const sourceVisibility = flags['source-visibility'];
+        // The server refuses both declarations with isPublic: false — they are
+        // terms of a public release, and an unpublish creates none.
+        if ((license || sourceVisibility) && !isPublic) {
+            this.error('--license, --remix and --source-visibility are terms of a public release; pass them with --public.', { exit: 1 });
+        }
         let result;
         try {
             result = await data_provider_1.dataService.setAgentVisibility({
@@ -141,6 +184,8 @@ class AgentsVisibility extends base_command_1.BaseCommand {
                 capabilityRationales,
                 supportedLanguages: flags.language,
                 dependencies,
+                license,
+                sourceVisibility,
             });
         }
         catch (err) {
@@ -152,6 +197,13 @@ class AgentsVisibility extends base_command_1.BaseCommand {
         }
         const label = isPublic ? 'public' : 'private';
         this.log(`Set agent ${args.id} visibility: ${label}`);
+        const recorded = result;
+        if (recorded?.license) {
+            this.log(`License: ${recorded.license.id} (remix: ${recorded.license.remix})`);
+        }
+        if (recorded?.sourceVisibility) {
+            this.log(`Source visibility: ${recorded.sourceVisibility}`);
+        }
     }
 }
 exports.default = AgentsVisibility;

package/dist/commands/create-token.d.ts

@@ -43,7 +43,6 @@ import { BaseCommand } from '../base-command';
  */
 export default class CreateToken extends BaseCommand {
     static description: string;
-    static aliases: string[];
     static examples: string[];
     static flags: {
         name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;

package/dist/commands/create-token.js

@@ -49,7 +49,9 @@ const api_fetch_1 = require("../lib/api-fetch");
 class CreateToken extends base_command_1.BaseCommand {
     static description = 'Create a long-lived token for bootstrapping a daemon on a CI/headless machine. ' +
         'Printed exactly once. Not accepted by `skrr` commands themselves.';
-    static aliases = ['tokens:create'];
+    // `tokens:create` used to alias this command. It now names personal access
+    // tokens (OSK-13208), the credential `skrr` itself accepts; this one only
+    // bootstraps a daemon, and sharing the name is what sent CI here.
     static examples = [
         '<%= config.bin %> create-token --name "github-actions-prod" --ttl 1y',
         '<%= config.bin %> create-token --name "local-ci" --ttl 30d',

package/dist/commands/followups/checkin.js

@@ -49,7 +49,7 @@ class FollowupsCheckin extends base_command_1.BaseCommand {
         catch (err) {
             this.failWithCliError({
                 message: err instanceof Error ? err.message : String(err),
-                code: 'FOLLOWUP_SUBJECT_INVALID',
+                code: 'FOLLOWUP_INVALID_FIELD',
                 exit: 2,
                 retryable: false,
             });

package/dist/commands/list-tokens.d.ts

@@ -8,7 +8,6 @@ import { BaseCommand } from '../base-command';
  */
 export default class ListTokens extends BaseCommand {
     static description: string;
-    static aliases: string[];
     static flags: {
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         all: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;

package/dist/commands/list-tokens.js

@@ -13,7 +13,7 @@ const api_fetch_1 = require("../lib/api-fetch");
  */
 class ListTokens extends base_command_1.BaseCommand {
     static description = 'List your long-lived CI tokens';
-    static aliases = ['tokens:list'];
+    // No `tokens:list` alias: `skrr tokens` is personal access tokens (OSK-13208).
     static flags = {
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
         all: core_1.Flags.boolean({

package/dist/commands/login.js

@@ -126,6 +126,16 @@ class Login extends base_command_1.BaseCommand {
                 `(${explicitBaseUrl}). Pass one of them.`, { exit: 2 });
         }
         const requestedBaseUrl = envBaseUrl ?? explicitBaseUrl;
+        // OSK-13254 — an explicit sign-in lifts what `skrr logout` set: from here a
+        // command that finds no stored session may adopt one through the daemon
+        // again. Cleared up front, because asking to sign in is the decision.
+        {
+            const current = (0, config_1.loadConfig)();
+            if (current.adoptDaemonSession === false) {
+                const { adoptDaemonSession: _cleared, ...rest } = current;
+                (0, config_1.saveConfig)(rest);
+            }
+        }
         /**
          * Undo the base-URL write if this login does not complete.
          *

package/dist/commands/logout.js

@@ -260,6 +260,10 @@ class Logout extends base_command_1.BaseCommand {
             ...(agentSetting.value ? { [first_party_harness_managed_1.AGENT_CONFIG_KEY]: agentSetting.value } : {}),
             ...(cfg.credentials ? { credentials: cfg.credentials } : {}),
             migrated: { ...(cfg.migrated ?? {}), authOutOfConfig: true },
+            // OSK-13254 — signed out means no durable session reappears behind this
+            // command. The daemon may still LEND this CLI short-lived tokens (said
+            // below); `skrr login` clears the flag.
+            adoptDaemonSession: false,
         });
         const finalMessage = flags['all-devices']
             ? allDevicesError

package/dist/commands/machines/dedicated/ssh-proxy.js

@@ -44,6 +44,7 @@ class DedicatedMachinesSshProxy extends dedicated_lease_command_1.DedicatedLease
             code = await (0, dedicated_ssh_1.runSshProxy)({
                 baseURL: this.cliConfig.baseURL,
                 token: this.resolvedCredential.token,
+                getToken: () => this.refreshTransportToken(),
                 leaseId: lease,
                 input: process.stdin,
                 output: process.stdout,

package/dist/commands/revoke-token.d.ts

@@ -11,7 +11,6 @@ import { BaseCommand } from '../base-command';
  */
 export default class RevokeToken extends BaseCommand {
     static description: string;
-    static aliases: string[];
     static args: {
         id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
     };

package/dist/commands/revoke-token.js

@@ -15,7 +15,7 @@ const api_fetch_1 = require("../lib/api-fetch");
  */
 class RevokeToken extends base_command_1.BaseCommand {
     static description = 'Revoke a long-lived CI token by ID or unique prefix';
-    static aliases = ['tokens:revoke'];
+    // No `tokens:revoke` alias: `skrr tokens` is personal access tokens (OSK-13208).
     static args = {
         id: core_1.Args.string({
             name: 'id',

package/dist/commands/store/follow.d.ts

@@ -8,6 +8,7 @@ export default class StoreFollow extends BaseCommand {
     };
     static flags: {
         undo: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        status: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
         json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<void>;

package/dist/commands/store/follow.js

@@ -18,13 +18,19 @@ class StoreFollow extends base_command_1.BaseCommand {
         }),
     };
     static flags = {
-        undo: core_1.Flags.boolean({ description: 'Unfollow the publisher' }),
+        undo: core_1.Flags.boolean({ description: 'Unfollow the publisher', exclusive: ['status'] }),
+        status: core_1.Flags.boolean({ description: 'Show whether you follow the publisher; change nothing' }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
     };
     async run() {
         this.requireAuth();
         const { args, flags } = await this.parse(StoreFollow);
         try {
+            if (flags.status) {
+                const overlay = await data_provider_1.dataService.getStorePublisherFollowOverlay(args.handle);
+                this.log(JSON.stringify(overlay, null, 2));
+                return;
+            }
             const result = flags.undo
                 ? await data_provider_1.dataService.unfollowStorePublisherByHandle(args.handle)
                 : await data_provider_1.dataService.followStorePublisherByHandle(args.handle);

package/dist/commands/store/follows/list.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base-command';
+/** The publishers you follow, newest first, one page at a time. */
+export default class StoreFollowsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        cursor: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/follows/list.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+/** The publishers you follow, newest first, one page at a time. */
+class StoreFollowsList extends base_command_1.BaseCommand {
+    static description = 'List the store publishers you follow';
+    static examples = [
+        '<%= config.bin %> store follows list',
+        '<%= config.bin %> store follows list --cursor <next>',
+    ];
+    static flags = {
+        cursor: core_1.Flags.string({ description: 'Continue from a previous page' }),
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreFollowsList);
+        try {
+            const result = await data_provider_1.dataService.getStorePublisherFollows(flags.cursor);
+            this.log(JSON.stringify(result, null, 2));
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = StoreFollowsList;

package/dist/commands/store/follows/remove.d.ts

@@ -0,0 +1,16 @@
+import { BaseCommand } from '../../../base-command';
+/**
+ * Remove a follow by its follow id — the one way to drop a follow whose
+ * publisher has since renamed, hidden or lost its handle.
+ */
+export default class StoreFollowsRemove extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        followId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}