@skrr-ai/cli 0.1.86 → 0.1.88

package/dist/lib/keychain.js

@@ -43,6 +43,7 @@ exports.isLegacySlotCurrent = isLegacySlotCurrent;
 exports.__currentServiceForTest = __currentServiceForTest;
 exports.isAvailable = isAvailable;
 exports.resetAvailability = resetAvailability;
+exports.withKeychainReadPass = withKeychainReadPass;
 exports.readToken = readToken;
 exports.writeToken = writeToken;
 exports.readRefreshToken = readRefreshToken;
@@ -256,17 +257,56 @@ function isSecretAccount(account) {
     return account === ACCOUNT_TOKEN || account === ACCOUNT_REFRESH;
 }
 /**
- * `raw` returns the stored string exactly, with no envelope transform — for
- * copying another config's item, which may be sealed under a key we lack.
+ * One synchronous read of a bundle, memoised per (service, account).
+ *
+ * Every `security` call is a process spawn costing ~15-20ms, and a bundle read
+ * used to make eight of them for six items: each secret's envelope decrypt
+ * re-read the owner record (`foreignOwnerRootAt`), and the bundle read it a
+ * third time for itself. Measured on `skrr agents show`, that was 17 serial
+ * spawns and ~280ms before the first request could leave.
+ *
+ * A pass is SYNCHRONOUS by construction (`execFileSync` throughout, and the
+ * callback is not awaited), so nothing else in this process can interleave a
+ * write; a write made inside the pass drops the memo for that item. Another
+ * process's write is no more or less visible than before — the eight separate
+ * reads were never one atomic snapshot either. Outside a pass nothing is
+ * memoised: a later read always reaches the Keychain, which is what the
+ * refresh path's re-read under the auth lock depends on.
  */
-function readSlot(account, service = currentService(), raw_ = false) {
-    let raw;
+let readPassMemo = null;
+function withKeychainReadPass(fn) {
+    if (readPassMemo)
+        return fn();
+    readPassMemo = new Map();
+    try {
+        return fn();
+    }
+    finally {
+        readPassMemo = null;
+    }
+}
+function memoKey(service, account) {
+    return `${service}\u0000${account}`;
+}
+function forgetSlotInPass(account, service) {
+    readPassMemo?.delete(memoKey(service, account));
+}
+/** The stored string exactly as `security` returns it, or null. */
+function readRawSlot(account, service) {
+    const key = memoKey(service, account);
+    if (readPassMemo?.has(key))
+        return readPassMemo.get(key) ?? null;
+    const value = execReadSlot(account, service);
+    readPassMemo?.set(key, value);
+    return value;
+}
+function execReadSlot(account, service) {
     try {
         const out = (0, node_child_process_1.execFileSync)('security', ['find-generic-password', '-s', service, '-a', account, '-w'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' });
         const trimmed = out.replace(/\n$/, '');
         if (trimmed.length === 0)
             return null;
-        raw = trimmed;
+        return trimmed;
     }
     catch (err) {
         const status = err.status;
@@ -280,6 +320,15 @@ function readSlot(account, service = currentService(), raw_ = false) {
         }
         return null;
     }
+}
+/**
+ * `raw` returns the stored string exactly, with no envelope transform — for
+ * copying another config's item, which may be sealed under a key we lack.
+ */
+function readSlot(account, service = currentService(), raw_ = false) {
+    const raw = readRawSlot(account, service);
+    if (raw === null)
+        return null;
     if (raw_ || !isSecretAccount(account))
         return raw;
     // L12 — route secret slots through the envelope.
@@ -339,6 +388,7 @@ function quoteForSecurityInteractive(v) {
     return '"' + v.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
 }
 function writeSlot(account, value, service = currentService(), raw = false) {
+    forgetSlotInPass(account, service);
     try {
         // L12 — wrap secret-bearing slots through the envelope when active.
         // Empty / non-secret slots are passthrough, and so is a raw copy.
@@ -364,6 +414,7 @@ function writeSlot(account, value, service = currentService(), raw = false) {
     }
 }
 function deleteSlot(account, service = currentService()) {
+    forgetSlotInPass(account, service);
     try {
         (0, node_child_process_1.execFileSync)('security', ['delete-generic-password', '-s', service, '-a', account], {
             stdio: ['ignore', 'ignore', 'ignore'],
@@ -484,15 +535,17 @@ function readBundleAt(slot) {
     if (!isAvailable())
         return null;
     const service = serviceForSlot(slot);
-    const token = readEntryAt(service, ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
-    if (!token)
-        return null;
-    return {
-        token,
-        refresh: readEntryAt(service, ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES),
-        serverOrigin: readSlot(ACCOUNT_SERVER_ORIGIN, service) || null,
-        owner: readSlot(ACCOUNT_OWNER, service) || null,
-    };
+    return withKeychainReadPass(() => {
+        const token = readEntryAt(service, ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
+        if (!token)
+            return null;
+        return {
+            token,
+            refresh: readEntryAt(service, ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES),
+            serverOrigin: readSlot(ACCOUNT_SERVER_ORIGIN, service) || null,
+            owner: readSlot(ACCOUNT_OWNER, service) || null,
+        };
+    });
 }
 const BUNDLE_ACCOUNTS = [
     ACCOUNT_TOKEN,

package/dist/lib/label-scope.d.ts

@@ -39,6 +39,18 @@ export declare const labelScopeFlags: {
     scope: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
     'scope-id': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
 };
+/**
+ * `--allow-duplicate-name`, shared by every command that can put a live name
+ * into a scope (create, rename, restore).
+ *
+ * The SERVER owns the rule (`LabelService.assertNameFreeInOtherScope`): a name
+ * another label you can use already carries is refused with
+ * `409 duplicate_name_other_scope`, and the refusal names that label. The CLI
+ * only relays the override, so every surface — web, MCP, CLI — gets one answer.
+ */
+export declare const allowDuplicateNameFlags: {
+    'allow-duplicate-name': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+};
 export interface ResolvedLabelScope {
     scope: LabelScope;
     scopeId?: string;

package/dist/lib/label-scope.js

@@ -11,7 +11,7 @@
  * id the server can infer (it falls back to the caller).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.labelScopeFlags = exports.HEX_COLOR_RE = exports.LABEL_APPLICABLE = exports.LABEL_SCOPES_INFERRED = exports.LABEL_SCOPES_REQUIRING_ID = exports.LABEL_SCOPES = void 0;
+exports.allowDuplicateNameFlags = exports.labelScopeFlags = exports.HEX_COLOR_RE = exports.LABEL_APPLICABLE = exports.LABEL_SCOPES_INFERRED = exports.LABEL_SCOPES_REQUIRING_ID = exports.LABEL_SCOPES = void 0;
 exports.normalizeLabelColor = normalizeLabelColor;
 exports.resolveLabelScope = resolveLabelScope;
 exports.resolveApplicableTo = resolveApplicableTo;
@@ -56,6 +56,20 @@ exports.labelScopeFlags = {
         description: `Scope owner ID — required for ${joinScopes(scopesRequiringId())}. Omit for ${joinScopes(exports.LABEL_SCOPES_INFERRED)} (defaults to you).`,
     }),
 };
+/**
+ * `--allow-duplicate-name`, shared by every command that can put a live name
+ * into a scope (create, rename, restore).
+ *
+ * The SERVER owns the rule (`LabelService.assertNameFreeInOtherScope`): a name
+ * another label you can use already carries is refused with
+ * `409 duplicate_name_other_scope`, and the refusal names that label. The CLI
+ * only relays the override, so every surface — web, MCP, CLI — gets one answer.
+ */
+exports.allowDuplicateNameFlags = {
+    'allow-duplicate-name': core_1.Flags.boolean({
+        description: 'Proceed even though another label you can use (your user scope, or a workspace you belong to) already has this name. Refused by default: two labels with one name make `--label <name>` ambiguous.',
+    }),
+};
 /**
  * Validate the scope pair. Throws a plain `Error` so callers can surface it
  * through `this.error(..., { exit: 1 })` with the rest of their flag checks.

package/dist/lib/machine-audit.d.ts

@@ -0,0 +1,34 @@
+import { COMPUTER_AUDIT_KINDS, type ComputerAuditPage } from '@skrr-ai/data-provider';
+/**
+ * machine-audit.ts — request client for `GET /api/machines/:machineId/audit`
+ * (design §9, D8/D10; OSK-13607): who did what on a machine, after the
+ * daemon's live Activity window has rolled off.
+ *
+ * The owner reads it always; a grantee at any tier reads it too, without the
+ * `grant_*` events (those name the other people the machine is shared with).
+ * Vocabulary and the page shape are owned by `@skrr-ai/data-provider`.
+ *
+ * ## Inline path literal
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading this
+ * string; a helper that assembled the URL would read as unreachable.
+ */
+export { COMPUTER_AUDIT_KINDS };
+export type { ComputerAuditPage };
+export interface MachineAuditQuery {
+    kinds?: string[];
+    actorUserId?: string;
+    /** ISO time or epoch ms — occurredAt >= since. */
+    since?: string | number;
+    /** ISO time or epoch ms — occurredAt < until. */
+    until?: string | number;
+    cursor?: string;
+    limit?: number;
+}
+/**
+ * A `--since` / `--until` value as an ISO time: an absolute time as typed
+ * (`2026-09-24`, `2026-09-24T10:00:00Z`), or an age such as `90m`, `12h`,
+ * `7d`, `2w` counted back from `now`. Throws on anything else, naming the flag.
+ */
+export declare function parseAuditTime(value: string, flagName: string, now?: number): string;
+export declare function listMachineAudit(machineId: string, query?: MachineAuditQuery): Promise<ComputerAuditPage>;

package/dist/lib/machine-audit.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.COMPUTER_AUDIT_KINDS = void 0;
+exports.parseAuditTime = parseAuditTime;
+exports.listMachineAudit = listMachineAudit;
+const data_provider_1 = require("@skrr-ai/data-provider");
+Object.defineProperty(exports, "COMPUTER_AUDIT_KINDS", { enumerable: true, get: function () { return data_provider_1.COMPUTER_AUDIT_KINDS; } });
+const api_fetch_1 = require("./api-fetch");
+const DURATION_MS = {
+    s: 1000,
+    m: 60_000,
+    h: 3_600_000,
+    d: 86_400_000,
+    w: 7 * 86_400_000,
+};
+/**
+ * A `--since` / `--until` value as an ISO time: an absolute time as typed
+ * (`2026-09-24`, `2026-09-24T10:00:00Z`), or an age such as `90m`, `12h`,
+ * `7d`, `2w` counted back from `now`. Throws on anything else, naming the flag.
+ */
+function parseAuditTime(value, flagName, now = Date.now()) {
+    const trimmed = value.trim();
+    const age = trimmed.match(/^(\d+)([smhdw])$/i);
+    if (age) {
+        return new Date(now - Number(age[1]) * DURATION_MS[age[2].toLowerCase()]).toISOString();
+    }
+    const absolute = new Date(trimmed);
+    if (!trimmed || Number.isNaN(absolute.getTime())) {
+        throw new Error(`Invalid ${flagName} value: ${value}. Use a time such as 2026-09-24 or an age such as 7d.`);
+    }
+    return absolute.toISOString();
+}
+async function listMachineAudit(machineId, query = {}) {
+    const params = new URLSearchParams();
+    for (const kind of query.kinds ?? [])
+        params.append('kind', kind);
+    if (query.actorUserId)
+        params.set('actor', query.actorUserId);
+    if (query.since != null)
+        params.set('since', String(query.since));
+    if (query.until != null)
+        params.set('until', String(query.until));
+    if (query.cursor)
+        params.set('cursor', query.cursor);
+    if (query.limit != null)
+        params.set('limit', String(query.limit));
+    const qs = params.toString();
+    const suffix = qs ? `?${qs}` : '';
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/audit` + suffix);
+}

package/dist/lib/machine-grants.d.ts

@@ -0,0 +1,70 @@
+/**
+ * machine-grants.ts — request client for `/api/machines/:machineId/grants`
+ * (design §9, D10; OSK-13558): who the owner shares a machine with.
+ *
+ * A grant gives one person, on one machine, one of two fixed tiers — `watch`
+ * (see every surface and its activity; no input, no file browsing) or
+ * `operate` (everything watch has, plus control and file read/write). `power`,
+ * closing other people's surfaces and grant management stay with the owner,
+ * which is why every verb here resolves machine OWNERSHIP server-side rather
+ * than checking a grant. The grantee may be any user, inside the owner's
+ * workspace or not.
+ *
+ * ## Inline path literals
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading these
+ * strings. A helper that assembles the URL is opaque to it, so the endpoint
+ * would read as unreachable and get allow-listed — a check going green on an
+ * assertion it never made.
+ */
+export declare const MACHINE_GRANT_TIERS: readonly ["watch", "operate"];
+export type MachineGrantTier = (typeof MACHINE_GRANT_TIERS)[number];
+/** One grant, as `ComputerGrantService.publicGrant` emits it. */
+export interface MachineGrant {
+    grantId: string;
+    machineId: string;
+    ownerUserId: string;
+    granteeUserId: string;
+    tier: MachineGrantTier;
+    createdAt?: number;
+    updatedAt?: number;
+}
+export interface MachineGrantList {
+    version: number;
+    grants: MachineGrant[];
+}
+export interface MachineGrantMutation {
+    grant: MachineGrant;
+    version: number;
+    /** POST only: false when the person already held this exact grant. */
+    created?: boolean;
+    /** PATCH only: false when the grant already held this tier. */
+    changed?: boolean;
+}
+export interface MachineGrantRevocation {
+    revoked: MachineGrant;
+    version: number;
+}
+export declare function listMachineGrants(machineId: string): Promise<MachineGrantList>;
+export declare function shareMachine(machineId: string, granteeUserId: string, tier: MachineGrantTier): Promise<MachineGrantMutation>;
+export declare function changeMachineGrant(machineId: string, granteeUserId: string, tier: MachineGrantTier): Promise<MachineGrantMutation>;
+export declare function unshareMachine(machineId: string, granteeUserId: string): Promise<MachineGrantRevocation>;
+export interface SharedMachine {
+    machineId: string;
+    name: string | null;
+    owner: {
+        userId: string;
+        name: string;
+        username?: string;
+        avatar?: string;
+    } | null;
+    tier: MachineGrantTier;
+    grantedAt?: number;
+    power?: {
+        phase: string;
+    } | null;
+}
+export interface SharedMachineList {
+    machines: SharedMachine[];
+}
+export declare function listSharedMachines(): Promise<SharedMachineList>;

package/dist/lib/machine-grants.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MACHINE_GRANT_TIERS = void 0;
+exports.listMachineGrants = listMachineGrants;
+exports.shareMachine = shareMachine;
+exports.changeMachineGrant = changeMachineGrant;
+exports.unshareMachine = unshareMachine;
+exports.listSharedMachines = listSharedMachines;
+const api_fetch_1 = require("./api-fetch");
+/**
+ * machine-grants.ts — request client for `/api/machines/:machineId/grants`
+ * (design §9, D10; OSK-13558): who the owner shares a machine with.
+ *
+ * A grant gives one person, on one machine, one of two fixed tiers — `watch`
+ * (see every surface and its activity; no input, no file browsing) or
+ * `operate` (everything watch has, plus control and file read/write). `power`,
+ * closing other people's surfaces and grant management stay with the owner,
+ * which is why every verb here resolves machine OWNERSHIP server-side rather
+ * than checking a grant. The grantee may be any user, inside the owner's
+ * workspace or not.
+ *
+ * ## Inline path literals
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading these
+ * strings. A helper that assembles the URL is opaque to it, so the endpoint
+ * would read as unreachable and get allow-listed — a check going green on an
+ * assertion it never made.
+ */
+exports.MACHINE_GRANT_TIERS = ['watch', 'operate'];
+async function listMachineGrants(machineId) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/grants`);
+}
+async function shareMachine(machineId, granteeUserId, tier) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/grants`, {
+        method: 'POST',
+        body: { granteeUserId, tier },
+    });
+}
+async function changeMachineGrant(machineId, granteeUserId, tier) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/grants/${encodeURIComponent(granteeUserId)}`, { method: 'PATCH', body: { tier } });
+}
+async function unshareMachine(machineId, granteeUserId) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/grants/${encodeURIComponent(granteeUserId)}`, { method: 'DELETE' });
+}
+async function listSharedMachines() {
+    return (0, api_fetch_1.apiFetch)('/api/machines/shared-with-me');
+}

package/dist/lib/machine-services.d.ts

@@ -0,0 +1,64 @@
+/**
+ * machine-services.ts — request client for `/api/machines/:machineId/services`
+ * (design §20.5; 9-17, OSK-13579): a machine's declared services, the web
+ * services an agent or a person started on it, named so the computer can open
+ * them in its own browser.
+ *
+ * Not the same thing as `skrr machines dedicated service`: those are always-on
+ * WORKLOADS a Dedicated Runtime keeps running. A declared service is an
+ * address — a port on the machine's own loopback, and an optional path — on
+ * any computer, a personal machine's included. Declaring one starts nothing.
+ *
+ * Who may: the owner and an `operate` grantee declare and withdraw; a `watch`
+ * grantee may list. The server decides (`ComputerAccess`), and so does the
+ * machine's daemon, against the grant set it holds.
+ *
+ * ## Inline path literals
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading these
+ * strings, so each one is written out here rather than assembled by a helper.
+ */
+export declare const DECLARED_SERVICE_PROTOCOLS: readonly ["http", "https"];
+export type DeclaredServiceProtocol = (typeof DECLARED_SERVICE_PROTOCOLS)[number];
+export type DeclaredServiceActor = {
+    kind: 'agent';
+    agentId: string;
+    sessionId: string;
+    label: string;
+} | {
+    kind: 'human';
+    userId: string;
+    label: string;
+};
+/** One declared service, as the machine's manifest carries it. */
+export interface DeclaredService {
+    name: string;
+    port: number;
+    path: string;
+    protocol: DeclaredServiceProtocol;
+    declaredBy: DeclaredServiceActor;
+    declaredAt: number;
+}
+export interface DeclaredServicesResult {
+    services: DeclaredService[];
+    service?: DeclaredService;
+    replaced?: boolean;
+    withdrawn?: DeclaredService;
+}
+/** Where a service opens: always the machine's own loopback. */
+export declare function declaredServiceAddress(service: Pick<DeclaredService, 'port' | 'path' | 'protocol'>): string;
+export declare function listMachineServices(machineId: string): Promise<DeclaredServicesResult>;
+export declare function declareMachineService(machineId: string, service: {
+    name: string;
+    port: number;
+    path?: string;
+    protocol?: DeclaredServiceProtocol;
+}): Promise<DeclaredServicesResult>;
+export declare function withdrawMachineService(machineId: string, name: string): Promise<DeclaredServicesResult>;
+/**
+ * The machine id a services command addresses. A machine the person owns
+ * resolves from their inventory by any of its names; a machine shared WITH
+ * them is not in that inventory, so a full machine id (`lease:…`,
+ * `daemon:…`, `machine:…`) is taken as written — the server decides access.
+ */
+export declare function servicesMachineId(ref: string): Promise<string>;

package/dist/lib/machine-services.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DECLARED_SERVICE_PROTOCOLS = void 0;
+exports.declaredServiceAddress = declaredServiceAddress;
+exports.listMachineServices = listMachineServices;
+exports.declareMachineService = declareMachineService;
+exports.withdrawMachineService = withdrawMachineService;
+exports.servicesMachineId = servicesMachineId;
+const api_fetch_1 = require("./api-fetch");
+const machines_1 = require("./machines");
+/**
+ * machine-services.ts — request client for `/api/machines/:machineId/services`
+ * (design §20.5; 9-17, OSK-13579): a machine's declared services, the web
+ * services an agent or a person started on it, named so the computer can open
+ * them in its own browser.
+ *
+ * Not the same thing as `skrr machines dedicated service`: those are always-on
+ * WORKLOADS a Dedicated Runtime keeps running. A declared service is an
+ * address — a port on the machine's own loopback, and an optional path — on
+ * any computer, a personal machine's included. Declaring one starts nothing.
+ *
+ * Who may: the owner and an `operate` grantee declare and withdraw; a `watch`
+ * grantee may list. The server decides (`ComputerAccess`), and so does the
+ * machine's daemon, against the grant set it holds.
+ *
+ * ## Inline path literals
+ *
+ * `domain-api-parity` resolves a command to an endpoint by reading these
+ * strings, so each one is written out here rather than assembled by a helper.
+ */
+exports.DECLARED_SERVICE_PROTOCOLS = ['http', 'https'];
+/** Where a service opens: always the machine's own loopback. */
+function declaredServiceAddress(service) {
+    return `${service.protocol}://localhost:${service.port}${service.path}`;
+}
+async function listMachineServices(machineId) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/services`);
+}
+async function declareMachineService(machineId, service) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/services`, { method: 'POST', body: { service } });
+}
+async function withdrawMachineService(machineId, name) {
+    return (0, api_fetch_1.apiFetch)(`/api/machines/${encodeURIComponent(machineId)}/services/${encodeURIComponent(name)}`, { method: 'DELETE' });
+}
+/**
+ * The machine id a services command addresses. A machine the person owns
+ * resolves from their inventory by any of its names; a machine shared WITH
+ * them is not in that inventory, so a full machine id (`lease:…`,
+ * `daemon:…`, `machine:…`) is taken as written — the server decides access.
+ */
+async function servicesMachineId(ref) {
+    try {
+        return (0, machines_1.resolveMachineRef)(await (0, machines_1.listMachines)(), ref).id;
+    }
+    catch (error) {
+        if (/^(lease|daemon|machine|stable-daemon):\S+$/.test(ref))
+            return ref;
+        throw error;
+    }
+}

package/dist/lib/refresh.d.ts

@@ -38,6 +38,13 @@ export interface EnsureFreshCliCredentialOptions {
     force?: boolean;
     /** Respect `--bare`: do not mutate persisted credentials in bare mode. */
     bareMode?: boolean;
+    /**
+     * `credential` was produced by the resolver a moment ago; decide from the
+     * Keychain read it made rather than reading every slot again
+     * (`takeResolvedKeychainRead`). Falls back to a fresh read whenever that read
+     * does not describe exactly this credential.
+     */
+    reuseResolvedRead?: boolean;
 }
 export interface EnsureFreshCliCredentialResult {
     credential: ResolvedCredential;

package/dist/lib/refresh.js

@@ -133,7 +133,8 @@ async function ensureFreshCliCredential(opts = {}) {
         return { credential, refreshed: false, skippedReason: 'external_source' };
     }
     const cfg = (0, config_1.loadConfig)();
-    const read = (0, auth_storage_1.readFromBackend)(cfg.baseURL);
+    const read = (opts.reuseResolvedRead ? (0, auth_storage_1.takeResolvedKeychainRead)(credential, cfg.baseURL) : null) ??
+        (0, auth_storage_1.readFromBackend)(cfg.baseURL);
     // If a sibling process already rotated the stored access token, adopt it
     // instead of needlessly consuming the latest refresh token again.
     if (read.bundle?.token && read.bundle.token !== credential.token) {

package/dist/lib/task-view-render.d.ts

@@ -19,6 +19,8 @@ export interface TaskViewFilters {
     priorities?: string[];
     assignees?: string[];
     labels?: string[];
+    /** How `labels` combine; absent means `any`. */
+    labelMatch?: string;
     goalIds?: string[];
     projectIds?: string[];
     cycleIds?: string[];

package/dist/lib/task-view-render.js

@@ -113,7 +113,7 @@ function describeTaskView(view) {
         ['status types', f.statusTypes],
         ['priorities', f.priorities],
         ['assignees', f.assignees],
-        ['labels', f.labels],
+        [f.labelMatch === 'all' ? 'labels (all)' : 'labels (any)', f.labels],
         ['goals', f.goalIds],
         ['projects', f.projectIds],
         ['cycles', f.cycleIds],

package/dist/lib/views/vocabulary.d.ts

@@ -5,4 +5,4 @@
  * a re-export, not a second CLI vocabulary: adding a saved-view capability is
  * one data-provider registration followed by renderer work on each surface.
  */
-export { SPACE_RENDERABLE_VIEW_TYPES, TASK_VIEW_DEFAULT_GROUP_BY, TASK_VIEW_DEFAULT_TYPE, TASK_RENDERABLE_VIEW_TYPES, VIEW_GROUP_BY_REGISTRY, VIEW_GROUP_BY_VALUES, VIEW_QUICK_FILTER_REGISTRY, VIEW_QUICK_FILTERS, VIEW_SORT_DIRECTIONS, VIEW_SORT_KEY_REGISTRY, VIEW_SORT_KEYS, VIEW_TYPE_REGISTRY, VIEW_TYPES, viewTypesForSurface, } from '@skrr-ai/data-provider';
+export { SPACE_RENDERABLE_VIEW_TYPES, TASK_VIEW_DEFAULT_GROUP_BY, TASK_VIEW_DEFAULT_TYPE, TASK_RENDERABLE_VIEW_TYPES, VIEW_GROUP_BY_REGISTRY, VIEW_GROUP_BY_VALUES, VIEW_LABEL_MATCH_VALUES, VIEW_QUICK_FILTER_REGISTRY, VIEW_QUICK_FILTERS, VIEW_SORT_DIRECTIONS, VIEW_SORT_KEY_REGISTRY, VIEW_SORT_KEYS, VIEW_TYPE_REGISTRY, VIEW_TYPES, viewTypesForSurface, } from '@skrr-ai/data-provider';

package/dist/lib/views/vocabulary.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.viewTypesForSurface = exports.VIEW_TYPES = exports.VIEW_TYPE_REGISTRY = exports.VIEW_SORT_KEYS = exports.VIEW_SORT_KEY_REGISTRY = exports.VIEW_SORT_DIRECTIONS = exports.VIEW_QUICK_FILTERS = exports.VIEW_QUICK_FILTER_REGISTRY = exports.VIEW_GROUP_BY_VALUES = exports.VIEW_GROUP_BY_REGISTRY = exports.TASK_RENDERABLE_VIEW_TYPES = exports.TASK_VIEW_DEFAULT_TYPE = exports.TASK_VIEW_DEFAULT_GROUP_BY = exports.SPACE_RENDERABLE_VIEW_TYPES = void 0;
+exports.viewTypesForSurface = exports.VIEW_TYPES = exports.VIEW_TYPE_REGISTRY = exports.VIEW_SORT_KEYS = exports.VIEW_SORT_KEY_REGISTRY = exports.VIEW_SORT_DIRECTIONS = exports.VIEW_QUICK_FILTERS = exports.VIEW_QUICK_FILTER_REGISTRY = exports.VIEW_LABEL_MATCH_VALUES = exports.VIEW_GROUP_BY_VALUES = exports.VIEW_GROUP_BY_REGISTRY = exports.TASK_RENDERABLE_VIEW_TYPES = exports.TASK_VIEW_DEFAULT_TYPE = exports.TASK_VIEW_DEFAULT_GROUP_BY = exports.SPACE_RENDERABLE_VIEW_TYPES = void 0;
 /**
  * CLI parity re-export for persisted task views.
  *
@@ -15,6 +15,7 @@ Object.defineProperty(exports, "TASK_VIEW_DEFAULT_TYPE", { enumerable: true, get
 Object.defineProperty(exports, "TASK_RENDERABLE_VIEW_TYPES", { enumerable: true, get: function () { return data_provider_1.TASK_RENDERABLE_VIEW_TYPES; } });
 Object.defineProperty(exports, "VIEW_GROUP_BY_REGISTRY", { enumerable: true, get: function () { return data_provider_1.VIEW_GROUP_BY_REGISTRY; } });
 Object.defineProperty(exports, "VIEW_GROUP_BY_VALUES", { enumerable: true, get: function () { return data_provider_1.VIEW_GROUP_BY_VALUES; } });
+Object.defineProperty(exports, "VIEW_LABEL_MATCH_VALUES", { enumerable: true, get: function () { return data_provider_1.VIEW_LABEL_MATCH_VALUES; } });
 Object.defineProperty(exports, "VIEW_QUICK_FILTER_REGISTRY", { enumerable: true, get: function () { return data_provider_1.VIEW_QUICK_FILTER_REGISTRY; } });
 Object.defineProperty(exports, "VIEW_QUICK_FILTERS", { enumerable: true, get: function () { return data_provider_1.VIEW_QUICK_FILTERS; } });
 Object.defineProperty(exports, "VIEW_SORT_DIRECTIONS", { enumerable: true, get: function () { return data_provider_1.VIEW_SORT_DIRECTIONS; } });