@skrr-ai/cli 0.1.80 → 0.1.82

package/dist/lib/access-tokens.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ACCESS_TOKEN_REVOKED_REASON_LABELS = void 0;
+exports.createAccessToken = createAccessToken;
+exports.listAccessTokens = listAccessTokens;
+exports.revokeAccessToken = revokeAccessToken;
+exports.describeAccessTokenState = describeAccessTokenState;
+const api_fetch_1 = require("./api-fetch");
+/**
+ * The words for each stored revocation reason. Every member of the schema's
+ * `revokedReason` enum appears here, so the list shows WHY a token died —
+ * "revoked" alone cannot tell a deliberate revoke from a sign-out sweep.
+ */
+exports.ACCESS_TOKEN_REVOKED_REASON_LABELS = {
+    user: 'revoked by you',
+    sign_out_everywhere: 'revoked by sign-out everywhere / password or 2FA change',
+    admin: 'revoked by an administrator',
+    compromised: 'revoked as compromised',
+};
+async function createAccessToken(input) {
+    return (0, api_fetch_1.apiFetch)('/api/user/access-tokens', {
+        method: 'POST',
+        body: {
+            name: input.name,
+            ...(input.scopes ? { scopes: input.scopes } : {}),
+            ...(input.expiresInDays !== undefined ? { expiresInDays: input.expiresInDays } : {}),
+        },
+    });
+}
+/** Every token the caller owns, newest first, including revoked and expired rows. */
+async function listAccessTokens() {
+    const res = await (0, api_fetch_1.apiFetch)('/api/user/access-tokens');
+    return Array.isArray(res?.accessTokens) ? res.accessTokens : [];
+}
+/** Revoke one token. Irreversible: a revoked token is replaced, never re-enabled. */
+async function revokeAccessToken(id, opts = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/user/access-tokens/${encodeURIComponent(id)}`, {
+        method: 'DELETE',
+        ...(opts.compromised ? { body: { reason: 'compromised' } } : {}),
+    });
+}
+/** One-line status for a listed token. */
+function describeAccessTokenState(token) {
+    if (token.state === 'revoked') {
+        return exports.ACCESS_TOKEN_REVOKED_REASON_LABELS[token.revokedReason ?? ''] ?? 'revoked';
+    }
+    if (token.state === 'expired')
+        return 'expired';
+    return 'active';
+}

package/dist/lib/auth-core-init.d.ts

@@ -36,6 +36,12 @@ export declare function plainCredentialEnvelopeWarning(args: readonly unknown[])
  * own when a local daemon can hand a credential over.
  */
 export declare const CREDENTIAL_KEY_CHANGED_NOTICE: string;
+/**
+ * The one line an unreadable device key prints when no credential-key change
+ * explains it. The CLI never enrolls or requires a device key (OSK-12063), so
+ * this degrades a proof, not access — say exactly that.
+ */
+export declare const DEVICE_KEY_RECOVERY_REQUIRED_NOTICE: string;
 export declare function createCredentialEnvelopeWarningPresenter(): (args: readonly unknown[]) => string | null;
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;

package/dist/lib/auth-core-init.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CliCredentialInitializationError = exports.CREDENTIAL_KEY_CHANGED_NOTICE = void 0;
+exports.CliCredentialInitializationError = exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = exports.CREDENTIAL_KEY_CHANGED_NOTICE = void 0;
 exports.plainCredentialEnvelopeWarning = plainCredentialEnvelopeWarning;
 exports.createCredentialEnvelopeWarningPresenter = createCredentialEnvelopeWarningPresenter;
 exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
@@ -108,6 +108,20 @@ exports.CREDENTIAL_KEY_CHANGED_NOTICE = "note: this machine's credential key cha
  */
 /** auth-core's device-identity warning for a private key it could not open. */
 const DEVICE_KEY_DECRYPT_FAILED = '[deviceIdentity] private_key_decrypt_failed';
+/**
+ * auth-core's device-identity warning for a stored key it will NOT replace on
+ * ordinary boot (`b5e683280b`): minting a new key here would make the next
+ * refresh sign with a key the server never pinned. Only an explicit login with
+ * `recoverUnreadable` replaces it.
+ */
+const DEVICE_KEY_RECOVERY_REQUIRED = '[deviceIdentity] recovery_required';
+/**
+ * The one line an unreadable device key prints when no credential-key change
+ * explains it. The CLI never enrolls or requires a device key (OSK-12063), so
+ * this degrades a proof, not access — say exactly that.
+ */
+exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = "warning: this machine's stored device key could not be read, so skrr sends requests " +
+    'without a device proof until the local daemon signs in again. (DEBUG=1 shows the underlying error.)';
 function createCredentialEnvelopeWarningPresenter() {
     let keyChanged = false;
     return (args) => {
@@ -133,12 +147,20 @@ function createCredentialEnvelopeWarningPresenter() {
         if (keyChanged && event === 'cred_envelope.read.decrypt_failed')
             return '';
         // The device private key is one of those values: auth-core's device
-        // identity loads it next, cannot open it, and mints a new keypair. It
-        // logs that through its own `[deviceIdentity]` prefix, which reached the
-        // terminal as a raw `[auth-core warn]` line right under the notice. The
-        // notice covers it; without a key change it is a real fault and prints.
-        if (keyChanged && message === DEVICE_KEY_DECRYPT_FAILED)
+        // identity loads it next and cannot open it. Since `b5e683280b` it does
+        // NOT mint a replacement on ordinary boot — it parks in
+        // `recovery_required` until an explicit login recovers it. Both warnings
+        // come through the `[deviceIdentity]` prefix and reached the terminal as
+        // raw `[auth-core warn]` lines right under the notice, which already says
+        // the old key is gone and what replaces it.
+        if (keyChanged &&
+            (message === DEVICE_KEY_DECRYPT_FAILED || message === DEVICE_KEY_RECOVERY_REQUIRED)) {
             return '';
+        }
+        // Without a key change an unreadable device key is a real fault: one
+        // plain line instead of an object dump.
+        if (message === DEVICE_KEY_RECOVERY_REQUIRED)
+            return exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE;
         return plainCredentialEnvelopeWarning(args);
     };
 }

package/dist/lib/auth-storage.d.ts

@@ -124,6 +124,11 @@ export declare function describeForeignCredential(result: ReadResult): string |
  * a specific backend (bare mode, store-mode overrides) should call the
  * lower-level write helpers directly — not exported here to keep the
  * default path honest.
+ *
+ * Refuses in a process the daemon started for an agent or tool (OSK-13254):
+ * the person's stored session is theirs, and a borrower never writes it. This
+ * is the one choke point every persisting path goes through, so the policy
+ * cannot be missed by a new caller.
  */
 export declare function writeToBackend(bundle: AuthBundle, options?: WriteOptions): AuthBackend;
 /**

package/dist/lib/auth-storage.js

@@ -102,6 +102,7 @@ const keychain = __importStar(require("./keychain"));
 const cred_envelope_1 = require("./cred-envelope");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
+const harness_context_1 = require("./harness-context");
 /** Filename for the non-darwin file backend. Parallel to the daemon's
  *  `auth.json`, deliberately distinct so the two binaries never clobber
  *  each other's tokens (CLI holds scope=cli, daemon holds scope=daemon). */
@@ -759,8 +760,15 @@ function describeForeignCredential(result) {
  * a specific backend (bare mode, store-mode overrides) should call the
  * lower-level write helpers directly — not exported here to keep the
  * default path honest.
+ *
+ * Refuses in a process the daemon started for an agent or tool (OSK-13254):
+ * the person's stored session is theirs, and a borrower never writes it. This
+ * is the one choke point every persisting path goes through, so the policy
+ * cannot be missed by a new caller.
  */
 function writeToBackend(bundle, options = {}) {
+    if ((0, harness_context_1.isHarnessCliContext)())
+        throw new harness_context_1.HarnessCredentialPersistRefused();
     const requestedOrigin = options.serverOrigin ?? bundle.serverOrigin;
     let persistedBundle = bundle;
     if (requestedOrigin !== undefined) {

package/dist/lib/config.d.ts

@@ -46,6 +46,14 @@ export interface CliConfig {
      * `resolveCliId()` (`cli-id.ts`), the one resolver every caller goes through.
      */
     profileCliId?: string;
+    /**
+     * OSK-13254 — `false` once `skrr logout` has signed this profile out: from
+     * then on a command that finds no stored session BORROWS a short-lived token
+     * from the local daemon for that process and does not adopt a durable CLI
+     * session of its own. Absent means adoption is allowed. `skrr login` clears
+     * it. Read through `cliSessionAdoptionBlocker` (`daemonBroker.ts`).
+     */
+    adoptDaemonSession?: boolean;
     /**
      * OSK-3892 — the agent a locally-hosted `skrr code` session is attributed to.
      *

package/dist/lib/credential-resolver.d.ts

@@ -5,7 +5,7 @@
  * CLI-appropriate backends. The resolver walks the published chain:
  *
  *   1. flag         — --token <jwt> (debugging; BaseCommand parses)
- *   2. env-token    — OVERSKY_TOKEN (CI / static; kind='ci' detected)
+ *   2. env-token    — OVERSKY_TOKEN, then SKRR_TOKEN (CI / static; kind 'ci' or 'pat' detected)
  *   3. auth-helper  — OVERSKY_AUTH_HELPER script output
  *   4. fd-handoff   — N/A for CLI (skipped; no parent fd)
  *   5. keychain     — ai.skrr.cli.<profile>

package/dist/lib/credential-resolver.js

@@ -12,7 +12,7 @@ exports.formatCredentialSource = formatCredentialSource;
  * CLI-appropriate backends. The resolver walks the published chain:
  *
  *   1. flag         — --token <jwt> (debugging; BaseCommand parses)
- *   2. env-token    — OVERSKY_TOKEN (CI / static; kind='ci' detected)
+ *   2. env-token    — OVERSKY_TOKEN, then SKRR_TOKEN (CI / static; kind 'ci' or 'pat' detected)
  *   3. auth-helper  — OVERSKY_AUTH_HELPER script output
  *   4. fd-handoff   — N/A for CLI (skipped; no parent fd)
  *   5. keychain     — ai.skrr.cli.<profile>
@@ -31,6 +31,7 @@ const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
 const auth_storage_1 = require("./auth-storage");
 const cred_envelope_1 = require("./cred-envelope");
+const harness_context_1 = require("./harness-context");
 /**
  * Return the only credential an Agent-owned CLI process is allowed to use.
  *
@@ -68,7 +69,12 @@ async function resolveCredential(opts = {}) {
             return undefined;
         }
     })();
-    const storeMode = opts.storeModeOverride ?? cfg?.credentials?.store ?? 'auto';
+    // A process the daemon started for an agent or tool never reads the
+    // person's stored CLI session (OSK-13254): it borrows from the daemon, or
+    // uses a token it was explicitly given.
+    const storeMode = (0, harness_context_1.isHarnessCliContext)()
+        ? 'env-only'
+        : (opts.storeModeOverride ?? cfg?.credentials?.store ?? 'auto');
     const bareMode = opts.bareMode || ['1', 'true', 'TRUE', 'yes'].includes(process.env.OVERSKY_BARE_MODE ?? '');
     // Clear an observation left by a prior, unrelated direct backend probe in
     // this process. Only a blocked read made by THIS resolver should trigger the
@@ -78,6 +84,9 @@ async function resolveCredential(opts = {}) {
         flagToken: opts.flagToken,
         bareMode,
         storeMode,
+        // SKRR_TOKEN is the name the CI recipe uses (OSK-13208); OVERSKY_TOKEN still
+        // wins when both are set, as in the config overlay (config.ts).
+        envTokenNames: ['OVERSKY_TOKEN', 'SKRR_TOKEN'],
         // CLI never has an interactive slot — users run `skrr login` explicitly.
         isHeadless: () => true,
         // Stored credentials are only usable against the origin that issued
@@ -160,7 +169,10 @@ function formatCredentialSource(source) {
         case 'flag':
             return 'CLI --token flag';
         case 'env-token':
-            return 'OVERSKY_TOKEN';
+            // Name the variable that actually supplied it (OVERSKY_TOKEN wins).
+            return !process.env.OVERSKY_TOKEN?.trim() && process.env.SKRR_TOKEN?.trim()
+                ? 'SKRR_TOKEN'
+                : 'OVERSKY_TOKEN';
         case 'auth-helper':
             return 'OVERSKY_AUTH_HELPER';
         case 'fd-handoff':

package/dist/lib/daemonBroker.d.ts

@@ -1,5 +1,5 @@
 /**
- * daemonBroker.ts — Sky CLI client for the local `oversky` daemon's
+ * daemonBroker.ts — skrr CLI client for the local `skrrd` daemon's
  * cli-handoff endpoint.
  *
  * When the daemon is already authenticated for the user on this machine,
@@ -199,7 +199,7 @@ export interface DaemonBrokerOptions {
     /** Stable per-machine cliId the CLI wants the new refresh row bound to. */
     cliId: string;
     /**
-     * The Sky CLI's currently-configured baseURL (e.g. `https://oversky.ai`).
+     * The skrr CLI's currently-configured baseURL (e.g. `https://skrr.ai`).
      * Two roles:
      *   1. Pre-flight check vs `bootstrap.serverUrl` — when they don't
      *      match, we refuse to call the daemon so we never mint a token
@@ -246,6 +246,14 @@ export interface DaemonBrokerOptions {
      *     regardless — its secret cannot mint a family at all.
      */
     preferHandoffMode?: 'access_token' | 'refresh_family';
+    /**
+     * Never take the durable mint, whatever the descriptor offers (OSK-13254).
+     * Set for a process the daemon started for an agent or tool
+     * (`harness-context.ts`): it borrows an access token or nothing. A v1
+     * descriptor, which offers only the durable mint, is reported as unable to
+     * lend rather than minting a family nobody would hold.
+     */
+    borrowOnly?: boolean;
     /**
      * Overrides for the bounded wait on a restarting local daemon (OSK-13222):
      * budgets, the clock and the supervisor probe. Tests use it; production
@@ -461,6 +469,33 @@ export interface MaybeAutoBrokerOptions {
      * everywhere else. Production callers omit it and behave exactly as before.
      */
     bootstrapPathOverride?: string;
+    /**
+     * The profile whose daemon may be borrowed. Defaults to the active profile.
+     *
+     * A silent hand-off must never cross profiles (OSK-13257). The `default`
+     * candidate list falls through to any running daemon, and every daemon is
+     * signed in as whoever started it — so `--profile buyer`, with its own
+     * session refused, used to run as the machine owner after one stderr line.
+     * A named profile now borrows only a daemon started under that same
+     * profile, and otherwise reports NOT_SIGNED_IN for the profile it was given.
+     */
+    profile?: string;
+    /**
+     * Adopt a CLI session of this profile's own instead of borrowing (OSK-13254).
+     *
+     * Set by `BaseCommand.init` ONLY when the resolver found no stored
+     * credential at all — a first sign-in. The 401-recovery callers leave it
+     * unset: a stored session that was refused may have been revoked on purpose
+     * (Active Sessions, a password change), and re-adopting a new one behind
+     * that decision would undo it. They borrow, as before.
+     *
+     * Ignored (borrow instead) in a harness context, after `skrr logout`
+     * (`cliConfig.adoptDaemonSession === false`), and under
+     * `SKRR_NO_CLI_SESSION_ADOPTION=1`. See {@link cliSessionAdoptionBlocker}.
+     */
+    adopt?: boolean;
+    /** Test seam: lock-acquisition budget for the adoption lock. */
+    adoptionLockRetries?: number;
 }
 export interface MaybeAutoBrokerResult {
     /**
@@ -478,7 +513,18 @@ export interface MaybeAutoBrokerResult {
      * and end up with a divergent refresh family.
      */
     updatedConfig?: CliConfig;
+    /**
+     * True when this process waited on the adoption lock and found that a
+     * sibling `skrr` had adopted a session for this profile meanwhile. Nothing
+     * was minted; the caller re-reads the stored credential (OSK-13254).
+     */
+    adoptedBySibling?: boolean;
 }
+/**
+ * Why this invocation must borrow instead of adopting a CLI session of its
+ * own, or null when it may adopt (OSK-13254).
+ */
+export declare function cliSessionAdoptionBlocker(cliConfig: Pick<CliConfig, 'adoptDaemonSession'>, env?: NodeJS.ProcessEnv): 'harness_context' | 'signed_out' | 'opted_out' | null;
 /**
  * Auto-broker pre-flight for `BaseCommand.init()`. When the credential
  * resolver returns no token, this attempts a silent daemon broker so

package/dist/lib/daemonBroker.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * daemonBroker.ts — Sky CLI client for the local `oversky` daemon's
+ * daemonBroker.ts — skrr CLI client for the local `skrrd` daemon's
  * cli-handoff endpoint.
  *
  * When the daemon is already authenticated for the user on this machine,
@@ -70,6 +70,9 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HOSTED_MACHINE_CLI_HANDOFF_DESCRIPTOR = exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR = void 0;
 exports.normalizeBaseUrl = normalizeBaseUrl;
@@ -89,18 +92,22 @@ exports.findBrokeredHandoffDescriptor = findBrokeredHandoffDescriptor;
 exports.maybeRetireStoredCliAuthFile = maybeRetireStoredCliAuthFile;
 exports.shouldBrokerBeforeStoredCredential = shouldBrokerBeforeStoredCredential;
 exports.attemptDaemonBrokerLoginAndPersist = attemptDaemonBrokerLoginAndPersist;
+exports.cliSessionAdoptionBlocker = cliSessionAdoptionBlocker;
 exports.maybeAutoBroker = maybeAutoBroker;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
+const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
 const auth_core_1 = require("@skrr-ai/auth-core");
 const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
 const cli_handoff_wire_1 = require("@skrr-ai/auth-core/cli-handoff-wire");
 const brokered_dpop_1 = require("./brokered-dpop");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
+const harness_context_1 = require("./harness-context");
 const cli_identity_1 = require("./cli-identity");
 const daemonRestartWait_1 = require("./daemonRestartWait");
+const keychain_1 = require("./keychain");
 const REQUEST_TIMEOUT_MS = 20_000;
 /**
  * Normalize a base URL for equality comparison. Mirrors the daemon-side
@@ -247,9 +254,9 @@ exports.HOSTED_MACHINE_CLI_HANDOFF_DESCRIPTOR = '/run/skrr-hosted-machine/cli-ha
 /** Where the cli-handoff broker looks, in order. */
 function resolveCliHandoffCandidatePaths(profile = 'default') {
     const candidates = resolveBootstrapCandidatePaths(profile);
-    // Any profile: a guest runs one daemon, and the auto-broker resolves the
-    // default profile regardless of `--profile`, so a narrower condition here would
-    // only describe behaviour production never reaches.
+    // Any profile: a guest runs one daemon holding the one account the guest
+    // serves, so every profile on it is that account. On a laptop a named profile
+    // reaches only its own island file above (OSK-13257).
     if (process.platform === 'linux') {
         candidates.push(exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR, exports.HOSTED_MACHINE_CLI_HANDOFF_DESCRIPTOR);
     }
@@ -561,8 +568,19 @@ async function brokerThrough(bootstrap, opts, sourcePath) {
     // would either break explicit login or be bypassed by anyone who calls it
     // the way login does. It is not a boundary, so it is not attempted. What the
     // CLI CAN guarantee is that its own automatic path never mints and persists
-    // a refresh family: when `access_token` is advertised, a failed redeem is
-    // the answer, and the daemon's outage is reported with its repair.
+    // a refresh family on a borrower's behalf: when `access_token` is advertised,
+    // a failed redeem is the answer, and the daemon's outage is reported with its
+    // repair.
+    //
+    // OSK-13254 narrowed "the automatic path" to mean a BORROWER. A person's
+    // first `skrr` on a profile with nothing stored now ADOPTS a CLI session of
+    // its own (`maybeAutoBroker` with `adopt`, `preferHandoffMode:
+    // 'refresh_family'`), because a sign-in that lived only as long as the daemon
+    // read as "signed out" every time the daemon restarted. What OSK-12018 was
+    // guarding against — an agent-originated implicit sign-in persisting a family
+    // — is now refused by name: a process the daemon started for an agent or tool
+    // carries `SKRR_DAEMON_CHILD` / `OVERSKY_AUTONOMOUS_SESSION`
+    // (`harness-context.ts`), sets `borrowOnly`, and `writeToBackend` refuses it.
     //
     // COMPATIBILITY WINDOW: a v1 descriptor (no `handoffModes`, so no
     // `access_token`) still takes the durable mint on the automatic path below,
@@ -577,7 +595,17 @@ async function brokerThrough(bootstrap, opts, sourcePath) {
     const offersAccessToken = (0, cli_handoff_wire_1.descriptorOffersAccessToken)(bootstrap);
     const offersRefreshFamily = modes.includes('refresh_family');
     const preferAccessToken = opts.preferHandoffMode === 'access_token';
-    if (offersAccessToken && (preferAccessToken || !offersRefreshFamily)) {
+    if (opts.borrowOnly && !offersAccessToken) {
+        return {
+            ok: false,
+            reason: 'unknown',
+            refusedBy: 'daemon',
+            code: 'HANDOFF_BORROW_UNAVAILABLE',
+            detail: 'The skrr background service on this computer is too old to lend this agent process a ' +
+                'short-lived token, and a process it started for an agent never stores a sign-in. Update skrrd.',
+        };
+    }
+    if (offersAccessToken && (preferAccessToken || opts.borrowOnly || !offersRefreshFamily)) {
         const redeem = await redeemCliHandoffToken(bootstrap, {
             forceRefresh: false,
             timeoutMs: opts.timeoutMs,
@@ -1149,6 +1177,16 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
     // Callers use the token in-memory for this process only.
     if (outcome.brokered)
         return outcome;
+    // Unreachable through `brokerThrough`, which never mints for a borrower;
+    // kept so a future route cannot persist on a borrower's behalf.
+    if (opts.borrowOnly) {
+        return {
+            ok: false,
+            reason: 'unknown',
+            code: 'HANDOFF_BORROW_UNAVAILABLE',
+            detail: 'A borrower was handed a durable credential; it was not stored.',
+        };
+    }
     const serverOrigin = normalizeBaseUrl(opts.baseURL);
     if (!serverOrigin) {
         throw new Error('Daemon-broker credential persistence requires a valid CLI baseURL.');
@@ -1198,6 +1236,123 @@ const AUTH_SELF_MANAGED_COMMANDS = new Set([
     'pair',
     'generate-recovery-code',
 ]);
+/**
+ * Why this invocation must borrow instead of adopting a CLI session of its
+ * own, or null when it may adopt (OSK-13254).
+ */
+function cliSessionAdoptionBlocker(cliConfig, env = process.env) {
+    if ((0, harness_context_1.isHarnessCliContext)(env))
+        return 'harness_context';
+    if (env.SKRR_NO_CLI_SESSION_ADOPTION === '1')
+        return 'opted_out';
+    // `skrr logout` said "this CLI is signed out". The daemon may still LEND
+    // tokens (logout says so), but a durable session does not reappear behind
+    // that statement; the next `skrr login` clears the flag.
+    if (cliConfig.adoptDaemonSession === false)
+        return 'signed_out';
+    return null;
+}
+/**
+ * Failures that mean no daemon answered (or answered for another server) —
+ * a second attempt on the token route cannot do better and would only wait
+ * out the restart window twice.
+ */
+function daemonDidNotAnswer(failure) {
+    switch (failure.reason) {
+        case 'no_bootstrap':
+        case 'stale_bootstrap':
+        case 'bootstrap_parse':
+        case 'base_url_mismatch':
+        case 'network':
+        case 'timeout':
+            return true;
+        default:
+            return false;
+    }
+}
+/** The adoption lock: one per config root and profile. */
+function adoptionLockPath(profile) {
+    const safe = profile.replace(/[^A-Za-z0-9._-]/g, '_') || 'default';
+    return path.join((0, config_1.configRoot)(), `cli-session-adopt.${safe}.lock`);
+}
+function storedAccessToken(baseURL) {
+    try {
+        return (0, auth_storage_1.readFromBackend)(baseURL).bundle?.token ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Adopt a CLI session through the local daemon (OSK-13254): the durable mint
+ * (`/v1/auth/cli-handoff` → `POST /api/daemons/cli-handoff`), persisted like a
+ * browser login, so that the next `skrr` reads it from the Keychain/file and
+ * renews it itself — the daemon restarting no longer reads as signed out.
+ *
+ * Serialized across processes. The confirm that follows a mint retires every
+ * OTHER live family of this cliId, so two concurrent adopters would each
+ * revoke the other's session mid-command. Under the lock a process that
+ * finds a session a sibling stored while it waited uses that one instead.
+ *
+ * Never worse than borrowing: if the lock cannot be taken in time, or the
+ * daemon answered but would not mint (rate limit, a server refusal, a
+ * broker-only descriptor), this borrows an access token for this process
+ * exactly as before.
+ */
+async function adoptCliSessionThroughDaemon(base, lockRetries) {
+    const profile = base.profile ?? 'default';
+    const baseURL = base.baseURL ?? '';
+    const borrow = () => attemptDaemonBrokerLoginAndPersist({
+        ...base,
+        preferHandoffMode: 'access_token',
+        borrowOnly: true,
+    });
+    // Adopt only from a live descriptor that can mint a family. One that
+    // cannot (the Dedicated guest's access-token-only shape), or none at all (a
+    // daemon that is down or restarting), has nothing to adopt: borrow without
+    // taking the lock, so concurrent commands never queue behind it and the
+    // borrow path's own restart wait and outage reporting apply unchanged.
+    const usable = listUsableBootstraps(base);
+    if (!usable.some(({ bootstrap }) => (0, cli_handoff_wire_1.advertisedHandoffModes)(bootstrap).includes('refresh_family'))) {
+        return { outcome: await borrow() };
+    }
+    const before = storedAccessToken(baseURL);
+    const lockPath = adoptionLockPath(profile);
+    let release = null;
+    try {
+        fs.mkdirSync(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+        if (!fs.existsSync(lockPath))
+            fs.writeFileSync(lockPath, '', { mode: 0o600 });
+        release = await proper_lockfile_1.default.lock(lockPath, {
+            // Longer than one mint (20s loopback + 10s confirm), so a holder that
+            // is still working is never judged stale.
+            stale: 60_000,
+            retries: { retries: lockRetries, minTimeout: 250, maxTimeout: 1_000, factor: 1.5 },
+        });
+    }
+    catch {
+        // Could not serialize: do not race a sibling's mint. Borrow.
+        return { outcome: await borrow() };
+    }
+    let durable;
+    try {
+        const now = storedAccessToken(baseURL);
+        if (now && now !== before)
+            return { adoptedBySibling: true };
+        durable = await attemptDaemonBrokerLoginAndPersist({
+            ...base,
+            preferHandoffMode: 'refresh_family',
+        });
+    }
+    finally {
+        await release().catch(() => undefined);
+    }
+    if (durable.ok || daemonDidNotAnswer(durable))
+        return { outcome: durable };
+    // The daemon answered but would not mint a family. The token route is a
+    // different door with different limits; take it for this process.
+    return { outcome: await borrow() };
+}
 /**
  * Auto-broker pre-flight for `BaseCommand.init()`. When the credential
  * resolver returns no token, this attempts a silent daemon broker so
@@ -1243,20 +1398,43 @@ async function maybeAutoBroker(opts) {
     // confirm cannot retire another profile's session. Persisted by the caller on
     // success so the rotation row stays bound across processes.
     const { cliId, updatedConfig } = (0, cli_identity_1.planLoginCliId)(opts.cliConfig);
-    const outcome = await attemptDaemonBrokerLoginAndPersist({
+    const base = {
         cliId,
         baseURL: opts.cliConfig.baseURL,
-        // Auto-broker prefers the brokered access-token mode when the descriptor
-        // advertises it: nothing credential-shaped is persisted, and the next
-        // `skrr` process simply re-redeems over loopback. The legacy refresh-
-        // family mint remains the fallback for v1 descriptors and the redeem
-        // path for explicit `skrr login`.
-        preferHandoffMode: 'access_token',
+        profile: opts.profile ?? (0, keychain_1.getActiveProfile)(),
         ...(opts.bootstrapPathOverride ? { bootstrapPathOverride: opts.bootstrapPathOverride } : {}),
+    };
+    const harness = (0, harness_context_1.isHarnessCliContext)();
+    // OSK-13254 — a person's first `skrr` on a machine whose daemon is signed in
+    // ADOPTS a CLI session of its own: a separate cli-scope family, minted by the
+    // daemon's hand-off and stored like a browser login, so later commands do
+    // not depend on the daemon being up. Everything else borrows a short-lived
+    // token for this process, which is what the automatic path always did
+    // (OSK-12018): a process the daemon started for an agent or tool, a 401
+    // recovery, a profile signed out with `skrr logout`, and the opt-out.
+    if (opts.adopt && !cliSessionAdoptionBlocker(opts.cliConfig)) {
+        const adopted = await adoptCliSessionThroughDaemon(base, opts.adoptionLockRetries ?? 40);
+        if (adopted.adoptedBySibling)
+            return { triggered: true, adoptedBySibling: true };
+        const outcome = adopted.outcome;
+        return {
+            triggered: true,
+            outcome,
+            ...(updatedConfig && outcome.ok ? { updatedConfig } : {}),
+        };
+    }
+    const outcome = await attemptDaemonBrokerLoginAndPersist({
+        ...base,
+        // Borrow: the access-token mode, held in memory for this process; the next
+        // `skrr` re-redeems over loopback. A v1 descriptor still takes the durable
+        // mint here (the compatibility window in `brokerThrough`), except for a
+        // harness-context process, which never stores a sign-in.
+        preferHandoffMode: 'access_token',
+        ...(harness ? { borrowOnly: true } : {}),
     });
     return {
         triggered: true,
         outcome,
-        ...(updatedConfig && outcome.ok ? { updatedConfig } : {}),
+        ...(updatedConfig && outcome.ok && !harness ? { updatedConfig } : {}),
     };
 }

package/dist/lib/daemonBrokerRefusal.d.ts

@@ -96,3 +96,17 @@ export declare function describeGuestDaemonUnavailable(failure: DaemonBrokerFail
  * nothing waited for): "Not signed in" is then the true sentence.
  */
 export declare function describeLocalDaemonUnavailable(failure: DaemonBrokerFailure, bin?: string): BrokerRefusalDescription | null;
+/**
+ * The one description of a laptop or guest broker failure for every surface
+ * that has no separate guest probe of its own: a daemon that answered and
+ * refused (`describeBrokerRefusal`), else a daemon whose descriptor is on disk
+ * but which did not answer — down, crashed or mid-restart
+ * (`describeLocalDaemonUnavailable`).
+ *
+ * `requireAuth` composed these two by hand; `skrr login`'s progress line and
+ * headless refusal, and the mid-command 401 paths, consulted only the first,
+ * so a daemon that was restarting read there as "no daemon at all" — the
+ * generic browser refusal, or a bare "Run `skrr login`" (OSK-13099). Returns
+ * null only when there is genuinely nothing to say about a daemon.
+ */
+export declare function describeBrokerFailure(failure: DaemonBrokerFailure, bin?: string): BrokerRefusalDescription | null;