@skrr-ai/cli 0.1.10 → 0.1.12

package/dist/lib/command-miss.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * What to say when a command id does not resolve — ONE description, shared by
+ * every surface that can produce a miss.
+ *
+ * There are two such surfaces, and they used to disagree. `skrr daemon reload`
+ * goes through the `command_not_found` hook and gets a message naming the real
+ * command, the mistake, and the next step. `skrr daemon reload --help` goes
+ * through oclif's HELP command, which does its own lookup and never reaches
+ * that hook — so it answered `Command daemon:reload not found.`: raw
+ * boilerplate naming an internal colon-form id the user never typed and cannot
+ * type, with no route forward.
+ *
+ * The audience is what makes that the wrong way round. Someone exploring a
+ * service-manager CLI types `--help` on a guessed subcommand FIRST. So the
+ * readers most likely to hit a miss were exactly the readers the good message
+ * was written for, and they systematically got the bad one.
+ *
+ * Keeping the text here rather than in either caller is the point: a fix to one
+ * phrasing reaches both, and neither surface can quietly drift from the other.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.editDistance = editDistance;
+exports.nearestCommands = nearestCommands;
+exports.describeCommandMiss = describeCommandMiss;
+exports.lookupFromConfig = lookupFromConfig;
+/** A uuid-ish token, which is what a stray space id looks like. */
+const LOOKS_LIKE_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Cheap edit distance, bounded — this runs only on a miss. */
+function editDistance(a, b) {
+    const rows = a.length + 1;
+    const cols = b.length + 1;
+    let prev = Array.from({ length: cols }, (_, j) => j);
+    for (let i = 1; i < rows; i += 1) {
+        const cur = [i, ...Array(cols - 1).fill(0)];
+        for (let j = 1; j < cols; j += 1) {
+            cur[j] = Math.min(prev[j] + 1, cur[j - 1] + 1, prev[j - 1] + (a[i - 1] === b[j - 1] ? 0 : 1));
+        }
+        prev = cur;
+    }
+    return prev[cols - 1];
+}
+/**
+ * The closest real command ids, so a typo gets a route forward rather than
+ * only a verdict.
+ */
+function nearestCommands(id, all, limit = 3) {
+    // Deduped, because oclif registers a TOPIC for a command path as well as the
+    // command itself — `daemon:status` is in `commandIDs` and in `topics`, so the
+    // combined candidate list held it twice and a near-miss was answered with
+    // "Did you mean: `skrr daemon status`, `skrr daemon status`, …?", spending
+    // two of the three suggestion slots saying one thing.
+    return ([...new Set(all)]
+        .map((candidate) => ({ candidate, d: editDistance(id, candidate) }))
+        // A third of the length keeps this to genuine near-misses; without a bound
+        // every miss suggests three unrelated commands, which is noise wearing the
+        // shape of help.
+        .filter(({ d }) => d <= Math.max(2, Math.floor(id.length / 3)))
+        .sort((x, y) => x.d - y.d)
+        .slice(0, limit)
+        .map(({ candidate }) => candidate));
+}
+/**
+ * The message for a colon-joined id that did not resolve.
+ *
+ * Two shapes, in order:
+ *
+ *  1. A PREFIX of the id is a real command, so the extra tokens are arguments
+ *     it did not want. Longest prefix first, because `a:b:c` should report
+ *     `a b`, not `a`.
+ *  2. Nothing resolved, so the command genuinely is not there — say so, and
+ *     suggest the nearest siblings under the same topic before falling back to
+ *     the whole command list.
+ */
+function describeCommandMiss(config, id) {
+    const parts = String(id ?? '')
+        .split(':')
+        .filter(Boolean);
+    for (let take = parts.length - 1; take >= 1; take -= 1) {
+        const found = config.findCommand(parts.slice(0, take).join(':'));
+        if (!found)
+            continue;
+        const extras = parts.slice(take);
+        const spoken = `${config.bin} ${parts.slice(0, take).join(' ')}`;
+        // Suggest the flag only when the command actually has it, so the hint can
+        // never point at something that does not exist.
+        const flags = Object.keys(found.flags ?? {});
+        const hint = extras.some((e) => LOOKS_LIKE_ID.test(e)) && flags.includes('space')
+            ? ` Pass it as \`--space ${extras[0]}\`.`
+            : flags.includes('space')
+                ? ' It takes `--space <id>`.'
+                : '';
+        const plural = extras.length === 1 ? 'argument' : 'arguments';
+        return (`\`${spoken}\` exists, but does not take the positional ${plural} ` +
+            `${extras.map((e) => `\`${e}\``).join(' ')}.${hint}\n` +
+            `See \`${spoken} --help\`.`);
+    }
+    // Topic names are candidates too, so a near-miss on a bare topic gets routed
+    // to the topic rather than nothing (OSK-4869): `skrr harness` (singular) is
+    // one edit from the `harnesses` topic, but that topic owns no command whose
+    // id is close to `harness`, so a command-id-only search suggests nothing.
+    //
+    // Siblings first: `commitments:archive:<id>` is a long way from every real
+    // command id, so a whole-string comparison finds nothing and the reader is
+    // told only that they are wrong — when the useful answer is "that topic
+    // exists and here is what it does have".
+    const siblings = config.commandIDs.filter((c) => c.startsWith(`${parts[0]}:`));
+    const suggestions = siblings.length
+        ? nearestCommands(parts.slice(0, 2).join(':'), siblings)
+        : nearestCommands(parts.join(':'), [...config.commandIDs, ...config.topicNames]);
+    return (`\`${config.bin} ${parts.join(' ')}\` is not a command.` +
+        (suggestions.length
+            ? `\nDid you mean: ${suggestions
+                .map((s) => `\`${config.bin} ${s.split(':').join(' ')}\``)
+                .join(', ')}?`
+            : `\nRun \`${config.bin} --help\` to see the topics.`));
+}
+/** Adapt an oclif `Config` to the lookup shape above. */
+function lookupFromConfig(config) {
+    return {
+        bin: config.bin,
+        findCommand: (id) => config.findCommand(id),
+        commandIDs: config.commandIDs.map((c) => String(c)),
+        topicNames: Array.isArray(config.topics)
+            ? config.topics.map((t) => String(t?.name ?? '')).filter(Boolean)
+            : [],
+    };
+}

package/dist/lib/commitment-analytics.d.ts

@@ -22,10 +22,18 @@ export declare const ANALYTICS_REPORTS: {
         readonly path: "/api/commitment-analytics/distribution";
         readonly summary: "How commitments are spread across agents, tiers and cadences";
     };
+    readonly 'distribution-tripwire': {
+        readonly path: "/api/commitment-analytics/distribution/tripwire";
+        readonly summary: "Persistent weekly confirmation of portfolio overload risk";
+    };
     readonly 'attention-budget': {
         readonly path: "/api/commitment-analytics/attention-budget";
         readonly summary: "How much user attention the fleet is actually spending";
     };
+    readonly 'decision-inbox': {
+        readonly path: "/api/commitment-analytics/decision-inbox";
+        readonly summary: "One ranked owner inbox across approvals, blockers, attention and held surfaces";
+    };
     readonly 'action-adapters-audit': {
         readonly path: "/api/commitment-analytics/action-adapters/audit";
         readonly summary: "Which action adapters are installed and what they are permitted to do";
@@ -54,7 +62,9 @@ export declare const commitmentAnalyticsApi: {
     operationsQueue: (query?: Query) => Promise<Record<string, unknown>>;
     governanceExceptions: (query?: Query) => Promise<Record<string, unknown>>;
     distribution: (query?: Query) => Promise<Record<string, unknown>>;
+    distributionTripwire: (query?: Query) => Promise<Record<string, unknown>>;
     attentionBudget: (query?: Query) => Promise<Record<string, unknown>>;
+    decisionInbox: () => Promise<Record<string, unknown>>;
     actionAdapterAudit: () => Promise<Record<string, unknown>>;
     recoveryMetrics: (query?: Query) => Promise<Record<string, unknown>>;
     recovery: (query?: Query) => Promise<Record<string, unknown>>;

package/dist/lib/commitment-analytics.js

@@ -41,10 +41,18 @@ exports.ANALYTICS_REPORTS = {
         path: `${MOUNT}/distribution`,
         summary: 'How commitments are spread across agents, tiers and cadences',
     },
+    'distribution-tripwire': {
+        path: `${MOUNT}/distribution/tripwire`,
+        summary: 'Persistent weekly confirmation of portfolio overload risk',
+    },
     'attention-budget': {
         path: `${MOUNT}/attention-budget`,
         summary: 'How much user attention the fleet is actually spending',
     },
+    'decision-inbox': {
+        path: `${MOUNT}/decision-inbox`,
+        summary: 'One ranked owner inbox across approvals, blockers, attention and held surfaces',
+    },
     'action-adapters-audit': {
         path: `${MOUNT}/action-adapters/audit`,
         summary: 'Which action adapters are installed and what they are permitted to do',
@@ -72,7 +80,9 @@ exports.commitmentAnalyticsApi = {
     operationsQueue: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/operations/queue`, query)),
     governanceExceptions: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/governance/exceptions`, query)),
     distribution: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/distribution`, query)),
+    distributionTripwire: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/distribution/tripwire`, query)),
     attentionBudget: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/attention-budget`, query)),
+    decisionInbox: () => data_provider_1.request.get(`${MOUNT}/decision-inbox`),
     actionAdapterAudit: () => data_provider_1.request.get(`${MOUNT}/action-adapters/audit`),
     recoveryMetrics: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/recovery-metrics`, query)),
     recovery: (query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${MOUNT}/recovery`, query)),

package/dist/lib/config.js

@@ -51,6 +51,7 @@ const fs = __importStar(require("node:fs"));
 const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const keychain_1 = require("./keychain");
+const auth_core_1 = require("@skrr-ai/auth-core");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // Both from config/public-endpoints.json, the one domain contract, rather than a
 // fourth hand-copied pair. The CLI previously knew only about dev — there was no
@@ -256,8 +257,11 @@ function isEnvAuthOverride() {
  * resolver and every existing install read it.
  */
 function configRoot(env = process.env) {
-    const root = (env.SKRR_CONFIG_DIR || env.OVERSKY_CONFIG_DIR)?.trim();
-    return root || path.join(os.homedir(), '.skrr');
+    // Delegates. The variable list lives in ONE place (`@skrr-ai/auth-core`)
+    // because every copy of it became a place `skrr` and `skrrd` could disagree —
+    // twice in one day, each time as a correct local fix that created the next
+    // defect. `scripts/config-root-single-source.spec` fails if this is re-derived.
+    return (0, auth_core_1.resolveConfigRoot)(env);
 }
 function newConfigDir() {
     return configRoot();

package/dist/lib/daemon-installer.d.ts

@@ -0,0 +1,62 @@
+import { type DaemonVersionManifest, type ReleaseKey } from '@skrr-ai/auth-core';
+/** Public CloudFront feed. Mirrors the daemon's own `CLOUDFRONT_FEED_BASE`. */
+export declare const DEFAULT_DAEMON_FEED_BASE = "https://updates.oversky.ai/daemon";
+/** Same override the daemon honours, so one env var steers both. */
+export declare const DAEMON_FEED_BASE_ENV = "OVERSKY_DAEMON_UPDATE_FEED_BASE";
+export type DaemonInstallFailureCode = 'unsupported_platform' | 'manifest_unreachable' | 'manifest_malformed' | 'manifest_unsigned' | 'platform_missing' | 'untrusted_artifact_origin' | 'download_failed' | 'checksum_mismatch' | 'artifact_unsigned' | 'write_failed';
+export type DaemonInstallResult = {
+    ok: true;
+    version: string;
+    platformKey: string;
+    binaryPath: string;
+} | {
+    ok: false;
+    code: DaemonInstallFailureCode;
+    error: string;
+};
+export interface DaemonInstallOptions {
+    env?: NodeJS.ProcessEnv;
+    /** Override the feed root. Tests point this at a local fixture server. */
+    feedBase?: string;
+    /** Injected for tests; defaults to global fetch. */
+    fetchImpl?: typeof fetch;
+    /**
+     * Trust anchors. Defaults to the pinned production set; tests substitute a
+     * generated keypair, exactly as the sky-code installer does. Passing an EMPTY
+     * set does not disable verification here — every non-`ok` verdict is a
+     * refusal, so an unconfigured trust root turns installs off rather than
+     * turning checking off.
+     */
+    keys?: readonly ReleaseKey[];
+}
+export declare function daemonFeedBase(env?: NodeJS.ProcessEnv): string;
+/**
+ * Where the fetched binary lands. `exec-oversky.ts` already looks here, so a
+ * daemon installed by this path is found by every `skrr daemon *` command
+ * without the user touching PATH.
+ */
+export declare function daemonBinaryPath(env?: NodeJS.ProcessEnv): string;
+/**
+ * `<platform>-<arch>`, the manifest's `platforms` key. Returns null for a
+ * combination the release does not build, which is a clearer refusal than a
+ * missing-key lookup one step later.
+ */
+export declare function daemonPlatformKey(platform?: string, arch?: string): string | null;
+/**
+ * True when `candidate` may serve an artifact for a feed rooted at `feedBase`.
+ * Same rule as the daemon's `isTrustedArtifactOrigin`: a signed manifest still
+ * does not get to point the download at another origin.
+ */
+export declare function isTrustedArtifactOrigin(candidate: string, feedBase: string): boolean;
+/** Fetch `<feedBase>/latest/daemon-version.json` and verify its signature. */
+export declare function fetchVerifiedDaemonManifest(opts?: DaemonInstallOptions): Promise<{
+    ok: true;
+    manifest: DaemonVersionManifest;
+} | (DaemonInstallResult & {
+    ok: false;
+})>;
+/**
+ * Download, verify and install the daemon binary. Returns a tagged result; it
+ * never throws, so the caller can render one refusal for every failure mode.
+ */
+export declare function installDaemon(opts?: DaemonInstallOptions): Promise<DaemonInstallResult>;

package/dist/lib/daemon-installer.js

@@ -0,0 +1,247 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DAEMON_FEED_BASE_ENV = exports.DEFAULT_DAEMON_FEED_BASE = void 0;
+exports.daemonFeedBase = daemonFeedBase;
+exports.daemonBinaryPath = daemonBinaryPath;
+exports.daemonPlatformKey = daemonPlatformKey;
+exports.isTrustedArtifactOrigin = isTrustedArtifactOrigin;
+exports.fetchVerifiedDaemonManifest = fetchVerifiedDaemonManifest;
+exports.installDaemon = installDaemon;
+/**
+ * daemon-installer.ts — fetch, verify and place the signed `skrrd` binary.
+ *
+ * ## Why this exists
+ *
+ * `skrr daemon install` forwarded to `skrrd install`, and `findOverskyBinary()`
+ * refused with "install it with brew" when there was no `skrrd` to forward to.
+ * So the one command whose job is to set the machine up required the machine to
+ * already be set up, and onboarding's first step was a second install from a
+ * second distribution channel — before the user had signed in or seen anything
+ * work.
+ *
+ * npm is the front door now. `npm i -g @skrr-ai/cli` gives you `skrr`, and
+ * `skrr daemon install` gets the daemon itself.
+ *
+ * ## Why it downloads a binary instead of shipping one
+ *
+ * The daemon is a compiled per-platform executable that is codesigned,
+ * notarized, and auto-updates itself in the field from a signed CloudFront feed
+ * with rollout cohorts. Vendoring five platform binaries into an npm tarball
+ * would bloat every install to serve one platform, and — worse — would freeze a
+ * copy that the daemon's own updater cannot replace, because that updater swaps
+ * a binary in its release slot, not a file inside a node_modules tree. Fetching
+ * from the same feed the updater uses keeps ONE distribution channel for the
+ * daemon and leaves its update story intact.
+ *
+ * ## Trust
+ *
+ * This is the CLI downloading an executable and putting it on disk, so every
+ * gate the daemon's own self-updater applies is applied here too, against the
+ * SAME pinned keys (`@skrr-ai/auth-core`, moved there for this reason — a
+ * mirrored trust root is a second array that can be emptied):
+ *
+ *   1. the manifest's ed25519 signature, fail-closed;
+ *   2. the artifact URL must share the feed's origin. The signature already
+ *      covers the URL, so this is not about forgery — it bounds where a
+ *      LEGITIMATELY signed manifest can send us, which is what protects against
+ *      operator error and against a signer coerced into signing a redirect;
+ *   3. sha256 of the received bytes;
+ *   4. the artifact's own ed25519 signature over (platform, version, sha256, url).
+ *
+ * TLS alone is explicitly not enough: the sha256 travels in the same document
+ * over the same channel, so it defends against corruption in transit, not
+ * against a spoofed feed. (3) without (4) would be the same mistake.
+ *
+ * The write is staged then renamed, so an interrupted download can never leave
+ * a half-written executable at the path the CLI will later exec.
+ */
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
+const auth_core_1 = require("@skrr-ai/auth-core");
+/** Public CloudFront feed. Mirrors the daemon's own `CLOUDFRONT_FEED_BASE`. */
+exports.DEFAULT_DAEMON_FEED_BASE = 'https://updates.oversky.ai/daemon';
+/** Same override the daemon honours, so one env var steers both. */
+exports.DAEMON_FEED_BASE_ENV = 'OVERSKY_DAEMON_UPDATE_FEED_BASE';
+/** Refuse a manifest larger than this. It is a small JSON document. */
+const MAX_MANIFEST_BYTES = 1_024 * 1_024;
+/** Refuse an artifact larger than this regardless of what the manifest claims. */
+const MAX_ARTIFACT_BYTES = 256 * 1_024 * 1_024;
+const MANIFEST_TIMEOUT_MS = 30_000;
+const ARTIFACT_TIMEOUT_MS = 10 * 60_000;
+function daemonFeedBase(env = process.env) {
+    return (env[exports.DAEMON_FEED_BASE_ENV]?.trim() || exports.DEFAULT_DAEMON_FEED_BASE).replace(/\/+$/, '');
+}
+/**
+ * Where the fetched binary lands. `exec-oversky.ts` already looks here, so a
+ * daemon installed by this path is found by every `skrr daemon *` command
+ * without the user touching PATH.
+ */
+function daemonBinaryPath(env = process.env) {
+    const home = env.HOME || env.USERPROFILE || node_os_1.default.homedir();
+    const exe = process.platform === 'win32' ? 'skrrd.exe' : 'skrrd';
+    return node_path_1.default.join(home, '.skrr', 'bin', exe);
+}
+/**
+ * `<platform>-<arch>`, the manifest's `platforms` key. Returns null for a
+ * combination the release does not build, which is a clearer refusal than a
+ * missing-key lookup one step later.
+ */
+function daemonPlatformKey(platform = process.platform, arch = process.arch) {
+    const supported = new Set([
+        'darwin-arm64',
+        'darwin-x64',
+        'linux-arm64',
+        'linux-x64',
+        'win32-x64',
+    ]);
+    const key = `${platform}-${arch}`;
+    return supported.has(key) ? key : null;
+}
+/**
+ * True when `candidate` may serve an artifact for a feed rooted at `feedBase`.
+ * Same rule as the daemon's `isTrustedArtifactOrigin`: a signed manifest still
+ * does not get to point the download at another origin.
+ */
+function isTrustedArtifactOrigin(candidate, feedBase) {
+    try {
+        return new URL(candidate).origin === new URL(feedBase).origin;
+    }
+    catch {
+        return false;
+    }
+}
+function fail(code, error) {
+    return { ok: false, code, error };
+}
+async function getWithTimeout(url, timeoutMs, fetchImpl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        return await fetchImpl(url, {
+            signal: controller.signal,
+            headers: { 'User-Agent': 'skrr-cli (daemon install)' },
+        });
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** Fetch `<feedBase>/latest/daemon-version.json` and verify its signature. */
+async function fetchVerifiedDaemonManifest(opts = {}) {
+    const env = opts.env ?? process.env;
+    const feedBase = opts.feedBase ?? daemonFeedBase(env);
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const keys = opts.keys ?? auth_core_1.OVERSKY_RELEASE_PUBLIC_KEYS;
+    const url = `${feedBase}/latest/daemon-version.json`;
+    let res;
+    try {
+        res = await getWithTimeout(url, MANIFEST_TIMEOUT_MS, fetchImpl);
+    }
+    catch (err) {
+        return fail('manifest_unreachable', `${url}: ${err.message}`);
+    }
+    if (!res.ok) {
+        return fail('manifest_unreachable', `${url} returned HTTP ${res.status}`);
+    }
+    const text = await res.text();
+    if (text.length > MAX_MANIFEST_BYTES) {
+        return fail('manifest_malformed', 'release manifest is implausibly large');
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(text);
+    }
+    catch {
+        return fail('manifest_malformed', `${url} did not return JSON`);
+    }
+    if (!manifest || typeof manifest.version !== 'string' || !manifest.platforms) {
+        return fail('manifest_malformed', 'release manifest is missing version/platforms');
+    }
+    // Fail-closed by construction: the pinned key set is non-empty, so `disabled`
+    // cannot be reached here. Treating it as a refusal anyway means emptying that
+    // array turns installs OFF rather than turning verification off silently.
+    const verdict = (0, auth_core_1.verifyManifest)(manifest, keys);
+    if (!('ok' in verdict) || verdict.ok !== true) {
+        const reason = 'reason' in verdict ? verdict.reason : 'no release signing key is pinned';
+        return fail('manifest_unsigned', `release manifest failed verification: ${reason}`);
+    }
+    return { ok: true, manifest };
+}
+/**
+ * Download, verify and install the daemon binary. Returns a tagged result; it
+ * never throws, so the caller can render one refusal for every failure mode.
+ */
+async function installDaemon(opts = {}) {
+    const env = opts.env ?? process.env;
+    const feedBase = opts.feedBase ?? daemonFeedBase(env);
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    const keys = opts.keys ?? auth_core_1.OVERSKY_RELEASE_PUBLIC_KEYS;
+    const platformKey = daemonPlatformKey();
+    if (!platformKey) {
+        return fail('unsupported_platform', `no daemon build for ${process.platform}-${process.arch}`);
+    }
+    const fetched = await fetchVerifiedDaemonManifest({ env, feedBase, fetchImpl, keys });
+    if (!('manifest' in fetched))
+        return fetched;
+    const { manifest } = fetched;
+    const artifact = manifest.platforms[platformKey];
+    if (!artifact?.url || !artifact.sha256) {
+        return fail('platform_missing', `release ${manifest.version} publishes no artifact for ${platformKey}`);
+    }
+    if (!isTrustedArtifactOrigin(artifact.url, feedBase)) {
+        return fail('untrusted_artifact_origin', `manifest points ${platformKey} at ${artifact.url}, which is not on the feed's origin`);
+    }
+    const artifactVerdict = (0, auth_core_1.verifyArtifact)(platformKey, manifest.version, artifact, keys);
+    if (!('ok' in artifactVerdict) || artifactVerdict.ok !== true) {
+        const reason = 'reason' in artifactVerdict ? artifactVerdict.reason : 'no key pinned';
+        return fail('artifact_unsigned', `${platformKey} artifact failed verification: ${reason}`);
+    }
+    if (typeof artifact.size === 'number' && artifact.size > MAX_ARTIFACT_BYTES) {
+        return fail('download_failed', `manifest declares an implausible size (${artifact.size} bytes)`);
+    }
+    let bytes;
+    try {
+        const res = await getWithTimeout(artifact.url, ARTIFACT_TIMEOUT_MS, fetchImpl);
+        if (!res.ok) {
+            return fail('download_failed', `${artifact.url} returned HTTP ${res.status}`);
+        }
+        const buf = Buffer.from(await res.arrayBuffer());
+        if (buf.byteLength > MAX_ARTIFACT_BYTES) {
+            return fail('download_failed', 'downloaded artifact exceeds the size ceiling');
+        }
+        bytes = buf;
+    }
+    catch (err) {
+        return fail('download_failed', `${artifact.url}: ${err.message}`);
+    }
+    const actual = (0, node_crypto_1.createHash)('sha256').update(bytes).digest('hex');
+    if (actual !== artifact.sha256.toLowerCase()) {
+        return fail('checksum_mismatch', `sha256 mismatch for ${platformKey}: expected ${artifact.sha256}, received ${actual}`);
+    }
+    // Staged then renamed. A rename within one directory is atomic, so the path
+    // the CLI later execs is either the previous binary or the fully-written new
+    // one — never a truncated download wearing the executable bit.
+    const binaryPath = daemonBinaryPath(env);
+    const stagingPath = `${binaryPath}.staging-${process.pid}`;
+    try {
+        (0, node_fs_1.mkdirSync)(node_path_1.default.dirname(binaryPath), { recursive: true });
+        (0, node_fs_1.writeFileSync)(stagingPath, bytes, { mode: 0o755 });
+        (0, node_fs_1.chmodSync)(stagingPath, 0o755);
+        (0, node_fs_1.renameSync)(stagingPath, binaryPath);
+    }
+    catch (err) {
+        try {
+            (0, node_fs_1.rmSync)(stagingPath, { force: true });
+        }
+        catch {
+            /* best-effort staging cleanup */
+        }
+        return fail('write_failed', `could not install to ${binaryPath}: ${err.message}`);
+    }
+    return { ok: true, version: manifest.version, platformKey, binaryPath };
+}

package/dist/lib/daemon-setup.d.ts

@@ -0,0 +1,49 @@
+/**
+ * daemon-setup.ts — offer to set this machine up, at the moment we can.
+ *
+ * ## Why login and not `npm install`
+ *
+ * The obvious way to remove a step is a `postinstall` that installs the daemon
+ * when the CLI is installed. It cannot work, and the reason is specific rather
+ * than aesthetic: installing the daemon BINDS it to a deployment and profile,
+ * taken from the CLI's session (`bindToCliSession`, OSK-279 — a daemon on a
+ * different deployment than its CLI is the failure that binding exists to
+ * prevent). At `npm install` time there is no session.
+ *
+ * It would not even fail loudly. With no config on disk `loadConfig()` returns
+ * DEFAULT_CONFIG, whose baseURL is the DEV deployment — so a postinstall would
+ * quietly bind the machine to dev, and the first `skrr login` against
+ * production would produce exactly the split. That is the default path on a
+ * clean machine, not an edge case.
+ *
+ * Login is the first moment the answer exists. It is also where the credential
+ * handoff already runs, so this is not a new path through the program; it is
+ * the branch where that path used to give up.
+ *
+ * ## Why it asks
+ *
+ * Signing in and "run a process on this machine that can execute bash, read and
+ * write files, and drive a browser" are not the same size of decision. Doing
+ * the second as a silent consequence of the first is the class of surprise this
+ * whole area has been removing. So: asked when there is someone to ask, skipped
+ * with an instruction when there is not, and never on the opt-out.
+ */
+import { confirm } from './prompt';
+export interface DaemonSetupOutcome {
+    status: 'installed' | 'declined' | 'skipped' | 'failed';
+    detail: string;
+}
+export interface DaemonSetupOptions {
+    env?: NodeJS.ProcessEnv;
+    /** True when only the OS service is missing and the binary is already here. */
+    binaryPresent?: boolean;
+    /** Injected by tests. */
+    confirmImpl?: typeof confirm;
+    interactive?: boolean;
+    log?: (line: string) => void;
+}
+/**
+ * Ask, then install. Returns without touching anything when there is nobody to
+ * ask or the operator has opted out.
+ */
+export declare function offerDaemonSetup(opts?: DaemonSetupOptions): Promise<DaemonSetupOutcome>;