@datarails-ai/dr-cli 1.6.172 → 1.6.174

package/README.md

@@ -302,10 +302,15 @@ interactively instead. An API-key file is different: see below.
 > `dr users can-login-as`, mints an impersonation JWT from the monolith
 > (`POST /jwt/api/loginas/`), and stores it as a switchable identity keyed by
 > `(server, email)` — so later commands target it with
-> `--account <email>`. The impersonated token refreshes silently, and a dead
-> refresh auto-remints from the operator, so you're never re-prompted until
-> the operator's own login expires. Use `--as <operator-email>` to pick the
-> operator when several are stored, or `--user-id <n>` to skip the lookup.
+> `--account <email>`. The impersonated token refreshes silently, and unless
+> the customer approves each login-as, a dead refresh auto-remints from the
+> operator, so you're never re-prompted until the operator's own login
+> expires. Where the customer does approve each login-as, the first
+> `dr login-as` sends their admins a request and exits 4 until it is
+> approved; once the access ends or can no longer be renewed, commands on
+> that identity exit 5, the identity is dropped and nothing re-logs in by
+> itself. Use `--as <operator-email>` to pick the operator when several are
+> stored, or `--user-id <n>` to skip the lookup.
 
 ### Tenant pin (one server, one account)
 

package/dist/cli.js

@@ -8,7 +8,7 @@ import { fileURLToPath as fileURLToPath3 } from "url";
 // package.json
 var package_default = {
   name: "@datarails-ai/dr-cli",
-  version: "1.6.172",
+  version: "1.6.174",
   description: "Datarails CLI",
   type: "module",
   engines: {
@@ -40,7 +40,7 @@ var package_default = {
     postinstall: "node scripts/postinstall.mjs"
   },
   dependencies: {
-    "@datarails-ai/dr-appspace-cli": "0.12.43",
+    "@datarails-ai/dr-appspace-cli": "0.12.47",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     commander: "^12.1.0",
@@ -69,7 +69,7 @@ var package_default = {
 };
 
 // src/buildInfo.ts
-var BUILD_TIME = "2026-10-27T10:08:40.001Z";
+var BUILD_TIME = "2026-10-28T22:47:13.870Z";
 function formatBuildTime(iso) {
   if (iso === "") return "";
   const d = new Date(iso);
@@ -780,12 +780,16 @@ var LoginAsError = class _LoginAsError extends Error {
   httpStatus;
   errorCode;
   detail;
+  requestId;
+  expiresAt;
   constructor(httpStatus, info = {}) {
     super(_LoginAsError.buildMessage(httpStatus, info));
     this.name = "LoginAsError";
     this.httpStatus = httpStatus;
     this.errorCode = info.code;
     this.detail = info.detail;
+    this.requestId = info.requestId;
+    this.expiresAt = info.expiresAt;
   }
   /** Alias so callers/tests can read `.code` symmetrically with the sibling errors. */
   get code() {
@@ -800,6 +804,41 @@ var LoginAsError = class _LoginAsError extends Error {
     return `login-as failed: HTTP ${status2}${body}`;
   }
 };
+var LOGIN_AS_AWAITING_APPROVAL_EXIT_CODE = 4;
+var LOGIN_AS_GRANT_ENDED_EXIT_CODE = 5;
+var LoginAsAwaitingApprovalError = class _LoginAsAwaitingApprovalError extends Error {
+  exitCode = LOGIN_AS_AWAITING_APPROVAL_EXIT_CODE;
+  code;
+  requestId;
+  expiresAt;
+  constructor(err, targetEmail) {
+    super(_LoginAsAwaitingApprovalError.buildMessage(err, targetEmail), { cause: err });
+    this.name = "LoginAsAwaitingApprovalError";
+    this.code = err.code ?? "";
+    this.requestId = err.requestId;
+    this.expiresAt = err.expiresAt;
+  }
+  static isAwaitingCode(code) {
+    return code === "login_as_requested" || code === "login_as_pending";
+  }
+  static buildMessage(err, targetEmail) {
+    const facts = [
+      ...err.requestId !== void 0 ? [`request ${err.requestId}`] : [],
+      ...err.expiresAt !== void 0 ? [`expires ${err.expiresAt}`] : []
+    ];
+    const tail = facts.length > 0 ? ` (${facts.join(", ")})` : "";
+    const head = err.code === "login_as_requested" ? `Login as ${targetEmail} needs the customer's approval: a request was sent to their admins${tail}.` : `Login as ${targetEmail} is still waiting for the customer's admins to approve${tail}.`;
+    return `${head} Run dr login-as again once it is approved; do not retry before that. (${err.code ?? ""})`;
+  }
+};
+var LoginAsGrantEndedError = class extends Error {
+  code = "login_as_grant_ended";
+  exitCode = LOGIN_AS_GRANT_ENDED_EXIT_CODE;
+  constructor(message, options) {
+    super(message ?? "login-as access ended", options);
+    this.name = "LoginAsGrantEndedError";
+  }
+};
 var AmbiguousAccountError = class extends Error {
   code = "ERR_AMBIGUOUS_ACCOUNT";
   /** The emails stored for the server, sorted most-recently-used first. */
@@ -1061,6 +1100,21 @@ async function refreshJwt(host, refreshToken, options) {
   }
   return { access: out.access, refresh: out.refresh, expiresAt };
 }
+function isGrantEndedResponse(status2, text2) {
+  if (status2 !== 401) return false;
+  try {
+    const parsed2 = JSON.parse(text2);
+    return parsed2 !== null && typeof parsed2 === "object" && parsed2["code"] === "login_as_grant_ended";
+  } catch {
+    return false;
+  }
+}
+var RefreshRejectedError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "RefreshRejectedError";
+  }
+};
 async function refreshExternalJwt(host, refreshToken, options) {
   const base = trimTrailingSlash(host);
   const res = await fetch(`${base}/jwt/api/external/token/refresh/`, {
@@ -1070,8 +1124,12 @@ async function refreshExternalJwt(host, refreshToken, options) {
     signal: options?.signal
   });
   const text2 = await res.text();
+  if (isGrantEndedResponse(res.status, text2)) {
+    throw new LoginAsGrantEndedError("jwt external refresh: HTTP 401 (login_as_grant_ended)");
+  }
   if (!res.ok) {
-    throw new Error(`jwt external refresh: HTTP ${res.status}: ${truncate(text2, TRUNCATE)}`);
+    const message = `jwt external refresh: HTTP ${res.status}: ${truncate(text2, TRUNCATE)}`;
+    throw res.status === 401 ? new RefreshRejectedError(message) : new Error(message);
   }
   const out = parseTokenBody(text2, "refresh");
   if (out.access === "") {
@@ -1172,13 +1230,23 @@ async function loginAs(host, operatorAccessToken, userId, options) {
   if (!res.ok) {
     let code;
     let detail;
+    let requestId;
+    let expiresAt2;
     try {
       const parsed2 = JSON.parse(text2);
       if (typeof parsed2["code"] === "string") code = parsed2["code"];
       if (typeof parsed2["detail"] === "string") detail = parsed2["detail"];
+      if (Number.isSafeInteger(parsed2["request_id"])) requestId = parsed2["request_id"];
+      if (typeof parsed2["expires_at"] === "string") expiresAt2 = parsed2["expires_at"];
     } catch {
     }
-    throw new LoginAsError(res.status, { code, detail, body: truncate(text2, TRUNCATE) });
+    throw new LoginAsError(res.status, {
+      code,
+      detail,
+      requestId,
+      expiresAt: expiresAt2,
+      body: truncate(text2, TRUNCATE)
+    });
   }
   let raw2;
   try {
@@ -1531,7 +1599,42 @@ async function ensureJwt(store, serverKey, email, opts) {
   const detail = reasons.length > 0 ? reasons.join("; ") : "no recovery path available";
   throw new SessionExpiredError(`${serverKey}:${email} (${detail})`);
 }
+var APPROVAL_REQUIRED_GRANT_MODE = "approval_required";
+function isApprovalRequiredGrant(session) {
+  for (const token of [session.jwtAccess, session.jwtRefresh]) {
+    if (token === void 0 || token === "") continue;
+    try {
+      return decodeJwtClaims(token)["grant_mode"] === APPROVAL_REQUIRED_GRANT_MODE;
+    } catch {
+      continue;
+    }
+  }
+  return false;
+}
+async function dropLoginAs(store, serverKey, email, session) {
+  if (!hasApiKey(session)) {
+    await store.removeSession(serverKey, email).catch(() => false);
+    return;
+  }
+  await store.saveSession(serverKey, {
+    email,
+    sessionId: "",
+    csrfToken: "",
+    savedAt: /* @__PURE__ */ new Date(),
+    apiKey: session.apiKey,
+    ...session.apiKeyExpiresAt !== void 0 && { apiKeyExpiresAt: session.apiKeyExpiresAt }
+  }).catch(() => void 0);
+}
+async function endImpersonation(store, serverKey, email, session, message, cause) {
+  await dropLoginAs(store, serverKey, email, session);
+  return new LoginAsGrantEndedError(message, { cause });
+}
+function accessEndedMessage(serverKey, email) {
+  return `login-as access to ${serverKey}:${email} has ended (the customer's admin ended it, or it expired). Run dr login-as ${email} --server ${serverKey} to log in again; where the customer approves logins, that sends them a new request.`;
+}
 async function recoverImpersonatedJwt(store, serverKey, email, session, host, opts) {
+  let refreshRejected = session.jwtRefresh === void 0 || session.jwtRefresh === "";
+  let refreshErr = null;
   if (session.jwtRefresh !== void 0 && session.jwtRefresh !== "" && host !== "") {
     try {
       const tok = await refreshExternalJwt(host, session.jwtRefresh, { signal: opts.signal });
@@ -1543,9 +1646,37 @@ async function recoverImpersonatedJwt(store, serverKey, email, session, host, op
       };
       await store.saveSession(serverKey, next2);
       return next2;
-    } catch {
+    } catch (err) {
+      if (err instanceof LoginAsGrantEndedError) {
+        throw await endImpersonation(
+          store,
+          serverKey,
+          email,
+          session,
+          accessEndedMessage(serverKey, email),
+          err
+        );
+      }
+      refreshRejected = err instanceof RefreshRejectedError;
+      refreshErr = err;
     }
   }
+  if (isApprovalRequiredGrant(session)) {
+    if (!refreshRejected) {
+      throw new Error(
+        `login-as session ${serverKey}:${email} could not be renewed (${msgOf4(refreshErr)}); try again shortly.`,
+        { cause: refreshErr }
+      );
+    }
+    throw await endImpersonation(
+      store,
+      serverKey,
+      email,
+      session,
+      `login-as session ${serverKey}:${email} could not be renewed, and this customer approves each login, so dr does not log in again on its own. Run dr login-as ${email} --server ${serverKey}; if the access has ended, that sends the customer's admins a new request.`,
+      refreshErr
+    );
+  }
   const operatorEmail2 = session.impersonatorEmail;
   const userId = session.impersonatedUserId;
   if (userId === void 0) {
@@ -1570,10 +1701,29 @@ async function recoverImpersonatedJwt(store, serverKey, email, session, host, op
       `${serverKey}:${email} (operator ${operatorEmail2} has no JWT \u2014 re-run dr login --server ${serverKey})`
     );
   }
-  const result = await loginAs(host, operatorAccess, userId, {
-    prevRefresh: session.jwtRefresh,
-    signal: opts.signal
-  });
+  let result;
+  try {
+    result = await loginAs(host, operatorAccess, userId, {
+      prevRefresh: session.jwtRefresh,
+      signal: opts.signal
+    });
+  } catch (err) {
+    if (err instanceof LoginAsError && LoginAsAwaitingApprovalError.isAwaitingCode(err.code)) {
+      await dropLoginAs(store, serverKey, email, session);
+      throw new LoginAsAwaitingApprovalError(err, email);
+    }
+    if (err instanceof LoginAsError && err.code === "login_as_approval_required") {
+      throw await endImpersonation(
+        store,
+        serverKey,
+        email,
+        session,
+        accessEndedMessage(serverKey, email),
+        err
+      );
+    }
+    throw err;
+  }
   const next = {
     ...session,
     jwtAccess: result.access,
@@ -2454,9 +2604,11 @@ var AuthorizedClient = class _AuthorizedClient {
         this._session = fresh;
         res = await this.doWithAuth(method, path13, body, options, true);
       } catch (err) {
+        _AuthorizedClient.throwIfLoginAsOutcome(err);
         _AuthorizedClient.logRefreshFailure("post-401 force-refresh", err);
       }
       await _AuthorizedClient.throwIfScopeDenied(method, path13, res);
+      await this.throwIfGrantEnded(method, path13, res);
     }
     if (!this.isAuthRejected(res) && res.ok) {
       try {
@@ -2466,6 +2618,12 @@ var AuthorizedClient = class _AuthorizedClient {
     }
     return res;
   }
+  /** A login-as outcome (DR-56077) is the answer, not a refresh failure to route around. */
+  static throwIfLoginAsOutcome(err) {
+    if (err instanceof LoginAsGrantEndedError || err instanceof LoginAsAwaitingApprovalError) {
+      throw err;
+    }
+  }
   /**
    * Surface an auto-refresh failure on stderr. Always logs (no env-var gate)
    * — silent failures here historically masked server-side issues (refresh
@@ -2808,12 +2966,14 @@ var AuthorizedClient = class _AuthorizedClient {
         refreshed = true;
         res = await this.doWithAuth(method, path13, body, options, true);
       } catch (err) {
+        _AuthorizedClient.throwIfLoginAsOutcome(err);
         refreshErr = err;
       }
     }
     if (this.isAuthRejected(res)) {
       const text3 = await res.text();
       _AuthorizedClient.throwIfScopeDeniedBody(method, path13, res.status, text3);
+      await this.throwIfGrantEndedBody(method, path13, res.status, text3);
       if (refreshed || triedSessionOnly) {
         const attempted = refreshed ? "session-only retry and JWT refresh" : "session-only retry";
         throw new Error(
@@ -2876,6 +3036,7 @@ var AuthorizedClient = class _AuthorizedClient {
       });
       this._session = fresh;
     } catch (err) {
+      _AuthorizedClient.throwIfLoginAsOutcome(err);
       _AuthorizedClient.logRefreshFailure("pre-flight", err);
     }
   }
@@ -2916,6 +3077,26 @@ var AuthorizedClient = class _AuthorizedClient {
     }
     _AuthorizedClient.throwIfScopeDeniedBody(method, path13, res.status, text2);
   }
+  /** The ladder ended on 401 `login_as_grant_ended` even though the refresh passed: drop the
+   *  identity and exit 5, as when the refresh itself reports the end. */
+  async throwIfGrantEnded(method, path13, res) {
+    if (res.status !== 401) return;
+    let text2;
+    try {
+      text2 = await res.clone().text();
+    } catch {
+      return;
+    }
+    await this.throwIfGrantEndedBody(method, path13, res.status, text2);
+  }
+  /** {@link AuthorizedClient.throwIfGrantEnded} for a body already in hand. */
+  async throwIfGrantEndedBody(method, path13, status2, text2) {
+    if (!isGrantEndedResponse(status2, text2)) return;
+    await dropLoginAs(this._store, this._serverKey, this._email, this._session);
+    throw new LoginAsGrantEndedError(
+      `${method} ${path13}: ${accessEndedMessage(this._serverKey, this._email)}`
+    );
+  }
   /** {@link AuthorizedClient.throwIfScopeDenied} for a body already in hand — the multipart
    *  methods and `requestJson`'s final branch have read theirs and must not read it twice. */
   static throwIfScopeDeniedBody(method, path13, status2, text2) {
@@ -6941,6 +7122,9 @@ function friendlyLoginAsError(err, targetEmail, explicitOperator) {
       explicitOperator
     );
   }
+  if (LoginAsAwaitingApprovalError.isAwaitingCode(err.code)) {
+    return new LoginAsAwaitingApprovalError(err, targetEmail);
+  }
   switch (err.code) {
     case "not_permitted":
       return new Error(`You are not permitted to impersonate ${targetEmail}.`);
@@ -6948,6 +7132,11 @@ function friendlyLoginAsError(err, targetEmail, explicitOperator) {
       return new Error(`${targetEmail} is inactive and cannot be impersonated.`);
     case "impersonation_unavailable":
       return new Error("Impersonation service is temporarily unavailable; try again shortly.");
+    case "login_as_approval_required":
+      return new Error(
+        `The approval for ${targetEmail} ended while logging in. Run dr login-as again; where the customer approves logins, that sends their admins a new request.`,
+        { cause: err }
+      );
     default:
       return err;
   }
@@ -79038,6 +79227,9 @@ function exitCodeFor(err) {
   if (err instanceof ScopeFilterError) return err.exitCode;
   if (err instanceof ScopeDeniedError) return SCOPE_EXIT_CODE;
   if (err instanceof TenantPinError) return err.exitCode;
+  if (err instanceof LoginAsAwaitingApprovalError || err instanceof LoginAsGrantEndedError) {
+    return err.exitCode;
+  }
   return 1;
 }
 var UNKNOWN_OPTION_PATTERN = /(unknown option ')(-[\s\S]*)'/g;

package/dist/scopes-map.json

@@ -1,6 +1,6 @@
 {
   "version": 1,
-  "cliVersion": "1.6.172",
+  "cliVersion": "1.6.174",
   "_contract": "Resolve a command path through `aliases` (canonical prefix + alias segment -> canonical path) before any lookup. A path listed in `pendingCommands`, or whose first segment is a key of `pending`, is UNDECIDED, not unrestricted: fail closed or skip it, and never read a path's absence from `commands` as 'no requirement'. An entry carrying `denied` is UNAVAILABLE to any AGENT-SCOPED credential — one whose `scopes` claim carries at least one `resource:action` entry; a claim that is absent, empty, capability-only or wholly unparseable is UNRESTRICTED, and this mark does not apply to it — whatever else that entry says: it is not a ceiling and it is not always-available, its `denied.reason` says why and `denied.until` names the ticket that lifts it, and the absence of `requires` on it must NEVER be read as 'no requirement'. Only an entry in `commands` with an empty `requires` means always-available.",
   "commands": {
     "login": {

package/dist/skills/dr-cli/SKILL.md

@@ -75,7 +75,10 @@ per server can be logged in at once.
   browser**. Needs an operator `login` first; stores a switchable identity you
   then target with `--account <email>`. `--as <operator-email>` picks the
   operator if several are stored; `--user-id <n>` skips the email lookup.
-  Refreshes/auto-remints silently — no re-prompt until the operator expires.
+  Refreshes/auto-remints silently — no re-prompt until the operator expires,
+  except where the customer approves each login-as: exit **4** means it awaits
+  that approval, exit **5** that the access ended. Do not retry either; see
+  `dr-switch-user`.
 - `dr whoami --server US` — confirm who/where you are. Offline (decodes the local
   JWT, no network) — **except** an API-key credential holding no token its current
   key minted (a key written straight into a session file — e.g. a managed-agent
@@ -192,9 +195,11 @@ permission / tenant / feature-flag refusal, still exits **1**, and is worth a
 second look at `--server`, the org context, and the request body.
 
 **JWT refresh is automatic** — the CLI refreshes before each request and on
-401/403, except on the two scope codes above, which no refresh can lift. Only
-re-`login` when you see `session expired` as the *final* error after an
-auto-refresh attempt. Do not re-login proactively on an expiry countdown.
+401/403, except on the two scope codes above, which no refresh can lift, and
+on an impersonated identity that exits **4** or **5** (see `dr login-as`
+above). Only re-`login` when you see `session expired` as the *final* error
+after an auto-refresh attempt. Do not re-login proactively on an expiry
+countdown.
 
 **Connectors over VPN (TLS):** `dr connectors …` reaches the control-plane over
 the corporate VPN. A TLS/certificate error there (`self signed certificate in

package/dist/skills/dr-switch-user/SKILL.md

@@ -153,6 +153,17 @@ switchable `(server, email)` identity — no browser, no TTY prompt.
 - **Denials** surface as clear messages — *not permitted to impersonate*,
   *inactive*, *impersonation service unavailable*. Surface verbatim; do not
   retry; do not record a default.
+- **Exit 4 — waiting for the customer's approval.** Some customers approve
+  each login-as. The first `dr login-as` sends their admins a request; until
+  an admin approves it, every run exits 4 with *a request was sent* or
+  *still waiting*. Surface it, stop, and tell the user to run `dr login-as`
+  again after the approval. Never retry in a loop.
+- **Exit 5 — access ended.** Any command on an impersonated identity exits 5
+  when the customer's admin ends the access or it expires, or when an
+  approved login-as can no longer be renewed. The CLI drops the identity and
+  does not log in again by itself. Surface the message and stop; run
+  `dr login-as` again only if the user asks (it may send the customer's
+  admins a new request).
 - **`login-as` needs dr ≥ 1.3.24.** Older installs answer `unknown command
   'login-as'`. If the browser Login-As works but the CLI "can't", check
   `dr --version` / `dr update` first — that's the common cause, not permissions.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datarails-ai/dr-cli",
-  "version": "1.6.172",
+  "version": "1.6.174",
   "description": "Datarails CLI",
   "type": "module",
   "engines": {
@@ -17,7 +17,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@datarails-ai/dr-appspace-cli": "0.12.43",
+    "@datarails-ai/dr-appspace-cli": "0.12.47",
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@napi-rs/keyring": "^1.3.0",
     "commander": "^12.1.0",