@skrr-ai/cli 0.1.81 → 0.1.82

package/dist/base-command.d.ts

@@ -471,5 +471,21 @@ export declare function describeDaemonScopedCredential(bin: string, scope?: Inco
  * question. Merging the two is the mistake its own comment warns about.
  */
 export declare function isTypedServerRefusal(body: Record<string, unknown> | null): boolean;
+/**
+ * Did the API itself answer this gateway-class status (502/503/504) with a
+ * typed code?
+ *
+ * Those statuses mean "outage" only when something IN FRONT of the API wrote
+ * them — the load balancer or CDN, whose bodies are HTML or empty, and which
+ * `parseErrorBody` therefore reads as null. A JSON body carrying `code` or
+ * `errorType` was written by a route or middleware that ran and chose the
+ * status: the API was up, and the request did not time out at the gateway.
+ *
+ * Checked AFTER `isTypedServerRefusal`, which handles the subset that also
+ * explains itself; this covers the coded rest — including production bodies
+ * whose message the 5xx redaction boundary replaced. A JSON body with no code
+ * stays in the outage branch: it says nothing a reader could act on.
+ */
+export declare function isApplicationCodedUnavailable(status: number | undefined, body: Record<string, unknown> | null): boolean;
 export declare function isRetryableFailure(status: number | undefined, body: Record<string, unknown> | null): boolean;
 export { Flags };

package/dist/base-command.js

@@ -15,6 +15,7 @@ exports.describeForbidden = describeForbidden;
 exports.isDaemonScopedCredential = isDaemonScopedCredential;
 exports.describeDaemonScopedCredential = describeDaemonScopedCredential;
 exports.isTypedServerRefusal = isTypedServerRefusal;
+exports.isApplicationCodedUnavailable = isApplicationCodedUnavailable;
 exports.isRetryableFailure = isRetryableFailure;
 const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
@@ -54,6 +55,7 @@ const edge_error_page_1 = require("./lib/edge-error-page");
 const step_up_1 = require("./lib/step-up");
 const delegated_cli_1 = require("./lib/delegated-cli");
 const dedicated_guest_1 = require("./lib/dedicated-guest");
+const harness_context_1 = require("./lib/harness-context");
 const tasks_1 = require("./lib/tasks");
 function assigneePayloadNeedsResolution(payload) {
     const fields = [
@@ -163,12 +165,17 @@ class BaseCommand extends core_1.Command {
             const result = await (0, daemonBroker_1.redeemBrokeredHandoffToken)(true);
             if (!result?.accessToken)
                 throw new Error('The local daemon could not renew CLI authentication.');
-            this.resolvedCredential = { token: result.accessToken, source: 'env-token',
-                kind: (0, auth_core_1.classifyTokenKind)(result.accessToken) };
+            this.resolvedCredential = {
+                token: result.accessToken,
+                source: 'env-token',
+                kind: (0, auth_core_1.classifyTokenKind)(result.accessToken),
+            };
         }
         else {
-            this.resolvedCredential = (await (0, refresh_1.ensureFreshCliCredential)({ credential: this.resolvedCredential,
-                bareMode: this.bareMode })).credential;
+            this.resolvedCredential = (await (0, refresh_1.ensureFreshCliCredential)({
+                credential: this.resolvedCredential,
+                bareMode: this.bareMode,
+            })).credential;
         }
         if (!this.resolvedCredential.token)
             throw new Error('CLI authentication is unavailable.');
@@ -272,6 +279,21 @@ class BaseCommand extends core_1.Command {
             (0, data_provider_1.setHttpAdapter)((0, node_adapter_1.createNodeAdapter)());
             return;
         }
+        // OSK-13254 — a process the daemon started for an agent or tool borrows
+        // from the daemon and never owns the person's stored session, so the
+        // commands that create, replace or end that session are not its to run.
+        const harnessContext = (0, harness_context_1.isHarnessCliContext)();
+        if (harnessContext && this.id && harness_context_1.HARNESS_REFUSED_AUTH_COMMANDS.has(this.id)) {
+            this.failWithCliError({
+                message: `\`${this.config.bin} ${this.id}\` is not available here: this process was started by the skrr ` +
+                    'background service for an agent or tool, and skrr in it borrows short-lived tokens from ' +
+                    'that service instead of holding a sign-in. Run it in your own terminal.',
+                code: 'HARNESS_CONTEXT_AUTH_COMMAND',
+                exit: 2,
+                retryable: false,
+            });
+            return;
+        }
         // A replacement guest keeps its workspace but receives a fresh Linux
         // machine-id. Retire the prior instance's machine-bound CLI envelopes
         // before migration/prefetch reads them; the current daemon handoff below
@@ -280,7 +302,9 @@ class BaseCommand extends core_1.Command {
         // One-shot migration: legacy token/refreshToken in cli-config.json
         // → keychain (macOS) or cli-auth.json (elsewhere). Idempotent.
         try {
-            (0, migrate_1.migrateAuthOutOfConfig)();
+            // A borrower never writes the person's stored session (OSK-13254).
+            if (!harnessContext)
+                (0, migrate_1.migrateAuthOutOfConfig)();
         }
         catch {
             // Never block a command on migration failure; the resolver still
@@ -336,9 +360,18 @@ class BaseCommand extends core_1.Command {
             allowUnreadableStoredCredential: this.id === 'login' || this.id === 'logout' || this.id === 'pair',
         });
         let ignoredStoredCredential = null;
-        if (!this.resolvedCredential.token && !this.bareMode && !parsed.token) {
+        if (!this.resolvedCredential.token && !this.bareMode && !parsed.token && !harnessContext) {
             ignoredStoredCredential = (0, auth_storage_1.readFromBackend)(this.cliConfig.baseURL);
         }
+        // OSK-13254 — nothing at all is stored for this profile: a first sign-in,
+        // which may ADOPT a CLI session of its own through the daemon instead of
+        // borrowing per process. Anything stored — a refused session, another
+        // server's, another config root's — is left alone and the daemon lends.
+        const nothingStored = !harnessContext &&
+            !!ignoredStoredCredential &&
+            !ignoredStoredCredential.bundle &&
+            ignoredStoredCredential.ownerStatus !== 'foreign' &&
+            (ignoredStoredCredential.originStatus ?? 'none') === 'none';
         // Daemon-as-broker auto-mint. When the resolver came up empty AND
         // a local `oversky` daemon is already authenticated for this user,
         // silently mint a sibling cli-scope refresh family via the daemon's
@@ -366,8 +399,14 @@ class BaseCommand extends core_1.Command {
                     cliConfig: this.cliConfig,
                     bareMode: this.bareMode,
                     commandId: this.id,
+                    adopt: nothingStored,
                 }));
-            if (autoResult.triggered && autoResult.outcome) {
+            if (autoResult.adoptedBySibling) {
+                // Another `skrr` adopted this profile's session while this one waited
+                // for the adoption lock: read it like any stored session.
+                this.resolvedCredential = await (0, credential_resolver_1.resolveCredential)({ bareMode: this.bareMode });
+            }
+            else if (autoResult.triggered && autoResult.outcome) {
                 if (autoResult.outcome.ok) {
                     // Persist the cliId now so a sibling skrr process spawned
                     // immediately after sees the same identity.
@@ -415,6 +454,14 @@ class BaseCommand extends core_1.Command {
                                 : {}),
                         }
                         : null;
+                    if (!autoResult.outcome.brokered && nothingStored) {
+                        // Said once, on stderr, the moment it happens: a session now exists
+                        // that the person did not type a command to create (OSK-13254).
+                        process.stderr.write(`[skrr] Signed this CLI in through the skrr background service on this computer. ` +
+                            `The session is saved to ${(0, credential_resolver_1.describeCredentialSource)(this.resolvedCredential.source)} ` +
+                            `and renews itself, so skrr keeps working while the service restarts. ` +
+                            `It is listed under Active Sessions; \`${this.config.bin} logout\` ends it.\n`);
+                    }
                 }
                 else if ((this.brokerRefusal =
                     (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin) ??
@@ -1215,7 +1262,7 @@ class BaseCommand extends core_1.Command {
                 // login to run, so its remedy replaces the generic "Run login".
                 const brokerRefusal = presentedCiToken || presentedPat || !e.brokerFailure
                     ? null
-                    : (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin);
+                    : (0, daemonBrokerRefusal_1.describeBrokerFailure)(e.brokerFailure, this.config.bin);
                 const renewal = refreshRefusal
                     ? refreshRefusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
                     : "This CLI's own sign-in could not be renewed.";
@@ -1361,6 +1408,45 @@ class BaseCommand extends core_1.Command {
                     requestId: stringProp(body, 'requestId') || e.requestId,
                 });
             }
+            else if (isApplicationCodedUnavailable(e.status, body)) {
+                // A 502/503/504 the API ITSELF wrote, with a typed code — not a page
+                // from the load balancer or CDN. The outage branch below would say the
+                // platform is down, absolve this command, and (for a write) call the
+                // outcome unknown because "the gateway may have timed out after the
+                // server committed it". None of that holds when the API answered.
+                //
+                // Observed 2026-10-01: `skrr agents chat --daemon <id>` printed exactly
+                // that outage paragraph for `POST /api/agentic/chat` → 503
+                // `preferred_daemon_unavailable` — "The selected local daemon is not
+                // connected" — a synchronous refusal before anything was enqueued,
+                // while skrr.ai served every other request. The reader went looking
+                // for a platform outage.
+                //
+                // No incident is recorded: one route refusing in its own words is not
+                // evidence the control plane is failing. `isOutageFailure` is left
+                // alone because it also decides whether the outbox queues a write.
+                const retryable = isRetryableFailure(e.status, body);
+                const authored = bodyMessage && !isRedactedServerMessage(bodyMessage) ? bodyMessage : '';
+                const requestId = stringProp(body, 'requestId') || e.requestId;
+                this.failWithCliError({
+                    message: say(`${this.cliConfig.baseURL} refused this request (HTTP ${e.status}, ${bodyCode})` +
+                        `${authored ? `: ${authored}` : '.'} ` +
+                        'The API answered this itself, so the request did not time out at the gateway. ' +
+                        (authored ? '' : 'It did not say why in this response. ') +
+                        (retryable
+                            ? 'Retrying may succeed once that condition clears.'
+                            : 'Retrying the same request will not help until that condition changes.') +
+                        (requestId && !authored
+                            ? ` Request id ${requestId} — quote it when reporting this.`
+                            : '')),
+                    code: bodyCode,
+                    status: e.status,
+                    exit: retryable ? 5 : 1,
+                    retryable,
+                    details: body ?? undefined,
+                    ...(requestId ? { requestId } : {}),
+                });
+            }
             else if ((0, outbox_1.isOutageFailure)(e)) {
                 // A gateway/unavailable status is an OUTAGE, and saying so is the whole
                 // point. During the OSK-2806 incident these surfaced as bare
@@ -1541,7 +1627,7 @@ class BaseCommand extends core_1.Command {
                 cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
             });
             const brokerRefusal = e.brokerFailure
-                ? (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin)
+                ? (0, daemonBrokerRefusal_1.describeBrokerFailure)(e.brokerFailure, this.config.bin)
                 : null;
             const why = (refusal
                 ? refusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
@@ -2059,6 +2145,35 @@ function isTypedServerRefusal(body) {
         return false;
     return (typeof body.cause === 'string' || typeof body.remedy === 'string' || body.retryable === false);
 }
+/**
+ * Did the API itself answer this gateway-class status (502/503/504) with a
+ * typed code?
+ *
+ * Those statuses mean "outage" only when something IN FRONT of the API wrote
+ * them — the load balancer or CDN, whose bodies are HTML or empty, and which
+ * `parseErrorBody` therefore reads as null. A JSON body carrying `code` or
+ * `errorType` was written by a route or middleware that ran and chose the
+ * status: the API was up, and the request did not time out at the gateway.
+ *
+ * Checked AFTER `isTypedServerRefusal`, which handles the subset that also
+ * explains itself; this covers the coded rest — including production bodies
+ * whose message the 5xx redaction boundary replaced. A JSON body with no code
+ * stays in the outage branch: it says nothing a reader could act on.
+ */
+function isApplicationCodedUnavailable(status, body) {
+    if (status !== 502 && status !== 503 && status !== 504)
+        return false;
+    return Boolean(stringProp(body, 'code') || stringProp(body, 'errorType'));
+}
+/**
+ * The sentence `redactServerErrorResponses` substitutes for a 5xx message in
+ * production. It is the boundary's, not the route's, so it is never relayed as
+ * if it explained anything.
+ */
+const REDACTED_SERVER_MESSAGE = 'An unexpected error occurred.';
+function isRedactedServerMessage(message) {
+    return message.trim() === REDACTED_SERVER_MESSAGE;
+}
 function isRetryableFailure(status, body) {
     const declared = body?.retryable;
     if (typeof declared === 'boolean')

package/dist/commands/followups/checkin.js

@@ -49,7 +49,7 @@ class FollowupsCheckin extends base_command_1.BaseCommand {
         catch (err) {
             this.failWithCliError({
                 message: err instanceof Error ? err.message : String(err),
-                code: 'FOLLOWUP_SUBJECT_INVALID',
+                code: 'FOLLOWUP_INVALID_FIELD',
                 exit: 2,
                 retryable: false,
             });

package/dist/commands/login.js

@@ -126,6 +126,16 @@ class Login extends base_command_1.BaseCommand {
                 `(${explicitBaseUrl}). Pass one of them.`, { exit: 2 });
         }
         const requestedBaseUrl = envBaseUrl ?? explicitBaseUrl;
+        // OSK-13254 — an explicit sign-in lifts what `skrr logout` set: from here a
+        // command that finds no stored session may adopt one through the daemon
+        // again. Cleared up front, because asking to sign in is the decision.
+        {
+            const current = (0, config_1.loadConfig)();
+            if (current.adoptDaemonSession === false) {
+                const { adoptDaemonSession: _cleared, ...rest } = current;
+                (0, config_1.saveConfig)(rest);
+            }
+        }
         /**
          * Undo the base-URL write if this login does not complete.
          *

package/dist/commands/logout.js

@@ -260,6 +260,10 @@ class Logout extends base_command_1.BaseCommand {
             ...(agentSetting.value ? { [first_party_harness_managed_1.AGENT_CONFIG_KEY]: agentSetting.value } : {}),
             ...(cfg.credentials ? { credentials: cfg.credentials } : {}),
             migrated: { ...(cfg.migrated ?? {}), authOutOfConfig: true },
+            // OSK-13254 — signed out means no durable session reappears behind this
+            // command. The daemon may still LEND this CLI short-lived tokens (said
+            // below); `skrr login` clears the flag.
+            adoptDaemonSession: false,
         });
         const finalMessage = flags['all-devices']
             ? allDevicesError

package/dist/commands/store/installs.js

@@ -44,7 +44,12 @@ class StoreInstalls extends base_command_1.BaseCommand {
             release: install.installedReleaseId ?? '-',
             version: install.installedVersionLabel ?? '-',
             state: install.copyMissing ? 'copy missing' : install.stopReason ? 'stopped' : 'installed',
-            reason: install.stopReason ?? '-',
+            // The server's projection decides both (OSK-13290): `stopReason` is
+            // the shared stop vocabulary (`recalled`, `revoked`, …). An advisory
+            // that does not stop the copy outright (a `revoke` recall still lets
+            // its owner chat with it) is named rather than shown as '-'.
+            reason: install.stopReason ??
+                (install.advisory?.remedy ? `advisory: ${install.advisory.remedy}` : '-'),
         })), [
             { key: 'agent', header: 'LISTING' },
             { key: 'copy', header: 'YOUR COPY' },

package/dist/lib/auth-storage.d.ts

@@ -124,6 +124,11 @@ export declare function describeForeignCredential(result: ReadResult): string |
  * a specific backend (bare mode, store-mode overrides) should call the
  * lower-level write helpers directly — not exported here to keep the
  * default path honest.
+ *
+ * Refuses in a process the daemon started for an agent or tool (OSK-13254):
+ * the person's stored session is theirs, and a borrower never writes it. This
+ * is the one choke point every persisting path goes through, so the policy
+ * cannot be missed by a new caller.
  */
 export declare function writeToBackend(bundle: AuthBundle, options?: WriteOptions): AuthBackend;
 /**

package/dist/lib/auth-storage.js

@@ -102,6 +102,7 @@ const keychain = __importStar(require("./keychain"));
 const cred_envelope_1 = require("./cred-envelope");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
+const harness_context_1 = require("./harness-context");
 /** Filename for the non-darwin file backend. Parallel to the daemon's
  *  `auth.json`, deliberately distinct so the two binaries never clobber
  *  each other's tokens (CLI holds scope=cli, daemon holds scope=daemon). */
@@ -759,8 +760,15 @@ function describeForeignCredential(result) {
  * a specific backend (bare mode, store-mode overrides) should call the
  * lower-level write helpers directly — not exported here to keep the
  * default path honest.
+ *
+ * Refuses in a process the daemon started for an agent or tool (OSK-13254):
+ * the person's stored session is theirs, and a borrower never writes it. This
+ * is the one choke point every persisting path goes through, so the policy
+ * cannot be missed by a new caller.
  */
 function writeToBackend(bundle, options = {}) {
+    if ((0, harness_context_1.isHarnessCliContext)())
+        throw new harness_context_1.HarnessCredentialPersistRefused();
     const requestedOrigin = options.serverOrigin ?? bundle.serverOrigin;
     let persistedBundle = bundle;
     if (requestedOrigin !== undefined) {

package/dist/lib/config.d.ts

@@ -46,6 +46,14 @@ export interface CliConfig {
      * `resolveCliId()` (`cli-id.ts`), the one resolver every caller goes through.
      */
     profileCliId?: string;
+    /**
+     * OSK-13254 — `false` once `skrr logout` has signed this profile out: from
+     * then on a command that finds no stored session BORROWS a short-lived token
+     * from the local daemon for that process and does not adopt a durable CLI
+     * session of its own. Absent means adoption is allowed. `skrr login` clears
+     * it. Read through `cliSessionAdoptionBlocker` (`daemonBroker.ts`).
+     */
+    adoptDaemonSession?: boolean;
     /**
      * OSK-3892 — the agent a locally-hosted `skrr code` session is attributed to.
      *

package/dist/lib/credential-resolver.js

@@ -31,6 +31,7 @@ const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
 const auth_storage_1 = require("./auth-storage");
 const cred_envelope_1 = require("./cred-envelope");
+const harness_context_1 = require("./harness-context");
 /**
  * Return the only credential an Agent-owned CLI process is allowed to use.
  *
@@ -68,7 +69,12 @@ async function resolveCredential(opts = {}) {
             return undefined;
         }
     })();
-    const storeMode = opts.storeModeOverride ?? cfg?.credentials?.store ?? 'auto';
+    // A process the daemon started for an agent or tool never reads the
+    // person's stored CLI session (OSK-13254): it borrows from the daemon, or
+    // uses a token it was explicitly given.
+    const storeMode = (0, harness_context_1.isHarnessCliContext)()
+        ? 'env-only'
+        : (opts.storeModeOverride ?? cfg?.credentials?.store ?? 'auto');
     const bareMode = opts.bareMode || ['1', 'true', 'TRUE', 'yes'].includes(process.env.OVERSKY_BARE_MODE ?? '');
     // Clear an observation left by a prior, unrelated direct backend probe in
     // this process. Only a blocked read made by THIS resolver should trigger the

package/dist/lib/daemonBroker.d.ts

@@ -246,6 +246,14 @@ export interface DaemonBrokerOptions {
      *     regardless — its secret cannot mint a family at all.
      */
     preferHandoffMode?: 'access_token' | 'refresh_family';
+    /**
+     * Never take the durable mint, whatever the descriptor offers (OSK-13254).
+     * Set for a process the daemon started for an agent or tool
+     * (`harness-context.ts`): it borrows an access token or nothing. A v1
+     * descriptor, which offers only the durable mint, is reported as unable to
+     * lend rather than minting a family nobody would hold.
+     */
+    borrowOnly?: boolean;
     /**
      * Overrides for the bounded wait on a restarting local daemon (OSK-13222):
      * budgets, the clock and the supervisor probe. Tests use it; production
@@ -472,6 +480,22 @@ export interface MaybeAutoBrokerOptions {
      * profile, and otherwise reports NOT_SIGNED_IN for the profile it was given.
      */
     profile?: string;
+    /**
+     * Adopt a CLI session of this profile's own instead of borrowing (OSK-13254).
+     *
+     * Set by `BaseCommand.init` ONLY when the resolver found no stored
+     * credential at all — a first sign-in. The 401-recovery callers leave it
+     * unset: a stored session that was refused may have been revoked on purpose
+     * (Active Sessions, a password change), and re-adopting a new one behind
+     * that decision would undo it. They borrow, as before.
+     *
+     * Ignored (borrow instead) in a harness context, after `skrr logout`
+     * (`cliConfig.adoptDaemonSession === false`), and under
+     * `SKRR_NO_CLI_SESSION_ADOPTION=1`. See {@link cliSessionAdoptionBlocker}.
+     */
+    adopt?: boolean;
+    /** Test seam: lock-acquisition budget for the adoption lock. */
+    adoptionLockRetries?: number;
 }
 export interface MaybeAutoBrokerResult {
     /**
@@ -489,7 +513,18 @@ export interface MaybeAutoBrokerResult {
      * and end up with a divergent refresh family.
      */
     updatedConfig?: CliConfig;
+    /**
+     * True when this process waited on the adoption lock and found that a
+     * sibling `skrr` had adopted a session for this profile meanwhile. Nothing
+     * was minted; the caller re-reads the stored credential (OSK-13254).
+     */
+    adoptedBySibling?: boolean;
 }
+/**
+ * Why this invocation must borrow instead of adopting a CLI session of its
+ * own, or null when it may adopt (OSK-13254).
+ */
+export declare function cliSessionAdoptionBlocker(cliConfig: Pick<CliConfig, 'adoptDaemonSession'>, env?: NodeJS.ProcessEnv): 'harness_context' | 'signed_out' | 'opted_out' | null;
 /**
  * Auto-broker pre-flight for `BaseCommand.init()`. When the credential
  * resolver returns no token, this attempts a silent daemon broker so