@skrr-ai/cli 0.1.125 → 0.1.126

package/dist/commands/agents/chat.d.ts

@@ -25,6 +25,28 @@ export declare const DETACH_EXIT_CODE = 130;
  * answers true.
  */
 export declare const STREAM_LOST_EXIT_CODE = 75;
+/**
+ * The signals that stop a running chat.
+ *
+ * Ctrl-C was the only one handled (OSK-2938). SIGTERM (a CI cancel, `timeout`, a process manager) and
+ * SIGHUP (the terminal closing) killed the CLI in under 100 ms with no cancel sent, so the agent kept
+ * running tools on the person's machine with nobody watching and held the folder, and the next message
+ * was refused as `managed_task_workspace_busy` (OSK-20677). `machines dedicated cp` already treats all
+ * three as cancel and exits as a shell would; this does the same.
+ */
+export declare const INTERRUPT_SIGNALS: readonly ["SIGINT", "SIGTERM", "SIGHUP"];
+export type InterruptSignal = (typeof INTERRUPT_SIGNALS)[number];
+/** 128 plus the signal's number, as a shell reports a process the signal killed: 130, 143, 129. */
+export declare function interruptExitCode(signal: InterruptSignal | null): number;
+/**
+ * The cancel notice, in words that fit the signal. "Press Ctrl-C again" is wrong advice after a
+ * SIGTERM, and after SIGHUP nobody is looking: the terminal that would show it is gone.
+ */
+export declare function cancelNotice(input: {
+    signal: InterruptSignal;
+    sessionId: string;
+    graceSeconds: number;
+}): string | null;
 /**
  * Exit code for a streamed run that reached its terminal state: 1 when it
  * failed, 0 otherwise.

package/dist/commands/agents/chat.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_HANDOVER_WAIT_SECONDS = exports.DEFAULT_HANDOVER_WAIT_SECONDS = exports.STREAM_LOST_EXIT_CODE = exports.DETACH_EXIT_CODE = void 0;
+exports.MAX_HANDOVER_WAIT_SECONDS = exports.DEFAULT_HANDOVER_WAIT_SECONDS = exports.INTERRUPT_SIGNALS = exports.STREAM_LOST_EXIT_CODE = exports.DETACH_EXIT_CODE = void 0;
+exports.interruptExitCode = interruptExitCode;
+exports.cancelNotice = cancelNotice;
 exports.streamedResultExitCode = streamedResultExitCode;
 exports.interruptedDetachMessage = interruptedDetachMessage;
 exports.jsonlTextForm = jsonlTextForm;
@@ -49,6 +51,35 @@ exports.DETACH_EXIT_CODE = 130;
  * answers true.
  */
 exports.STREAM_LOST_EXIT_CODE = 75;
+/**
+ * The signals that stop a running chat.
+ *
+ * Ctrl-C was the only one handled (OSK-2938). SIGTERM (a CI cancel, `timeout`, a process manager) and
+ * SIGHUP (the terminal closing) killed the CLI in under 100 ms with no cancel sent, so the agent kept
+ * running tools on the person's machine with nobody watching and held the folder, and the next message
+ * was refused as `managed_task_workspace_busy` (OSK-20677). `machines dedicated cp` already treats all
+ * three as cancel and exits as a shell would; this does the same.
+ */
+exports.INTERRUPT_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+/** 128 plus the signal's number, as a shell reports a process the signal killed: 130, 143, 129. */
+function interruptExitCode(signal) {
+    if (signal === 'SIGTERM')
+        return 143;
+    if (signal === 'SIGHUP')
+        return 129;
+    return exports.DETACH_EXIT_CODE;
+}
+/**
+ * The cancel notice, in words that fit the signal. "Press Ctrl-C again" is wrong advice after a
+ * SIGTERM, and after SIGHUP nobody is looking: the terminal that would show it is gone.
+ */
+function cancelNotice(input) {
+    if (input.signal === 'SIGHUP')
+        return null;
+    const again = input.signal === 'SIGINT' ? 'press Ctrl-C again' : `send ${input.signal} again`;
+    return (`\nCancelling run ${input.sessionId}… (waiting up to ${input.graceSeconds}s; ${again} to detach). ` +
+        'A tool call already running on the runtime is not guaranteed to stop.');
+}
 /**
  * Exit code for a streamed run that reached its terminal state: 1 when it
  * failed, 0 otherwise.
@@ -882,10 +913,22 @@ class AgentsChat extends base_command_1.BaseCommand {
             detach = () => resolve('detached');
         });
         let interrupts = 0;
+        // The signal that started the stop. Its exit status is what a script reads (130, 143 or 129).
+        let interruptedBy = null;
+        // After SIGHUP the terminal is gone and a write to it throws; the notice is lost, the stop is not.
+        const writeNotice = (fd, text) => {
+            try {
+                (0, node_fs_1.writeSync)(fd, text);
+            }
+            catch (_error) {
+                /* the terminal that would show this is closed */
+            }
+        };
         let forcedDetachAnnounced = false;
         let graceTimer = null;
-        const onInterrupt = () => {
+        const onInterrupt = (signal = 'SIGINT') => {
             interrupts += 1;
+            interruptedBy ??= signal;
             const action = interruptAction({ interrupts, awaitingHandover: client.awaitingHandover() });
             if (action === 'stop-handover-wait') {
                 // Nothing to cancel and nothing to grace-wait for: stop at once.
@@ -896,7 +939,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                         conversationId: started.conversationId,
                     });
                     if (flags.jsonl) {
-                        (0, node_fs_1.writeSync)(process.stdout.fd, `${JSON.stringify({
+                        writeNotice(process.stdout.fd, `${JSON.stringify({
                             type: 'run.detached',
                             sessionId: started.sessionId,
                             conversationId: started.conversationId,
@@ -906,9 +949,9 @@ class AgentsChat extends base_command_1.BaseCommand {
                         })}\n`);
                     }
                     else {
-                        (0, node_fs_1.writeSync)(process.stderr.fd, `\n${message}\n`);
+                        writeNotice(process.stderr.fd, `\n${message}\n`);
                     }
-                    process.exitCode = exports.DETACH_EXIT_CODE;
+                    process.exitCode = interruptExitCode(interruptedBy);
                 }
                 client.close();
                 detach?.();
@@ -917,9 +960,13 @@ class AgentsChat extends base_command_1.BaseCommand {
             if (action === 'cancel') {
                 client.cancel();
                 if (!flags.jsonl) {
-                    this.log(`\nCancelling run ${started.sessionId}… (waiting up to ${CANCEL_GRACE_MS / 1000}s; ` +
-                        'press Ctrl-C again to detach). A tool call already running on the runtime is ' +
-                        'not guaranteed to stop.');
+                    const notice = cancelNotice({
+                        signal,
+                        sessionId: started.sessionId,
+                        graceSeconds: CANCEL_GRACE_MS / 1000,
+                    });
+                    if (notice)
+                        writeNotice(process.stdout.fd, `${notice}\n`);
                 }
                 graceTimer = setTimeout(() => detach?.(), CANCEL_GRACE_MS);
                 graceTimer.unref?.();
@@ -933,7 +980,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                     forced: true,
                 });
                 if (flags.jsonl) {
-                    (0, node_fs_1.writeSync)(process.stdout.fd, `${JSON.stringify({
+                    writeNotice(process.stdout.fd, `${JSON.stringify({
                         type: 'run.detached',
                         sessionId: started.sessionId,
                         conversationId: started.conversationId,
@@ -942,13 +989,14 @@ class AgentsChat extends base_command_1.BaseCommand {
                     })}\n`);
                 }
                 else {
-                    (0, node_fs_1.writeSync)(process.stderr.fd, `\n${message}\n`);
+                    writeNotice(process.stderr.fd, `\n${message}\n`);
                 }
-                process.exitCode = exports.DETACH_EXIT_CODE;
+                process.exitCode = interruptExitCode(interruptedBy);
             }
             detach?.();
         };
-        process.on('SIGINT', onInterrupt);
+        for (const name of exports.INTERRUPT_SIGNALS)
+            process.on(name, onInterrupt);
         try {
             // OSK-2944 — the run was ACCEPTED before we ever tried to attach. If the
             // stream cannot be attached, that is a lost view of a live run, not a
@@ -988,7 +1036,7 @@ class AgentsChat extends base_command_1.BaseCommand {
                 // 130 only when a signal actually caused this; otherwise the stream was
                 // lost and claiming SIGINT lies to every script reading the code
                 // (OSK-7660).
-                const exit = interrupts > 0 ? exports.DETACH_EXIT_CODE : exports.STREAM_LOST_EXIT_CODE;
+                const exit = interrupts > 0 ? interruptExitCode(interruptedBy) : exports.STREAM_LOST_EXIT_CODE;
                 if (flags.jsonl) {
                     (0, agentic_stream_1.writeJsonLine)(process.stdout, {
                         type: 'run.detached',
@@ -1039,15 +1087,23 @@ class AgentsChat extends base_command_1.BaseCommand {
                     this.error(noOutput, { exit: 1 });
                 this.log(result.text);
             }
-            else if (result.status === 'aborted') {
+            else if (result.status === 'aborted' && interruptedBy !== 'SIGHUP') {
                 // Streaming human mode: say the cancel took, rather than leave the keypress warning last.
+                // (Not after SIGHUP: the terminal that would show it is gone.)
                 this.log(`\n${cancelledRunMessage({ sessionId: started.sessionId, conversationId: started.conversationId })}`);
             }
+            // A run stopped by SIGTERM or SIGHUP ends the way a shell reports a process the signal killed,
+            // so a script can tell a cancelled run from one that finished. Ctrl-C keeps its existing status
+            // (a cancel that took is a success, a detach is 130).
+            if (interruptedBy === 'SIGTERM' || interruptedBy === 'SIGHUP') {
+                process.exitCode = interruptExitCode(interruptedBy);
+            }
         }
         finally {
             if (graceTimer)
                 clearTimeout(graceTimer);
-            process.removeListener('SIGINT', onInterrupt);
+            for (const name of exports.INTERRUPT_SIGNALS)
+                process.removeListener(name, onInterrupt);
             client.close();
         }
     }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/scheduled-stream-wire.cjs

@@ -0,0 +1,98 @@
+'use strict';
+
+// Content-addressed source-envelope manifest. A manifest is completeness
+// evidence only after an authenticated native response binds it to its exact
+// dispatch, and every listed envelope has been independently retained.
+const { createHash } = require('node:crypto');
+const MAX_EVENTS = 1024;
+const MAX_EVENT_BYTES = 256 * 1024;
+const MAX_TOTAL_BYTES = 8 * 1024 * 1024;
+const HASH = /^[0-9a-f]{64}$/;
+const id = value => typeof value === 'string' && value.length > 0 && value.length <= 240;
+const digest = value => createHash('sha256').update(value, 'utf8').digest('hex');
+
+function sorted(value) {
+  if (Array.isArray(value)) return value.map(sorted);
+  if (value && typeof value === 'object') return Object.fromEntries(
+    Object.keys(value).sort().map(key => [key, sorted(value[key])]));
+  return value;
+}
+function normalize(envelope) {
+  // JSON round-trip defines the wire representation, rejects cycles, and
+  // removes undefined properties in the same way as the uploader.
+  const value = JSON.parse(JSON.stringify(envelope));
+  if (!value || typeof value !== 'object' || Array.isArray(value) ||
+      !id(value.id) || !value.ev || typeof value.ev !== 'object' || Array.isArray(value.ev))
+    throw new TypeError('Invalid scheduled stream envelope');
+  // These fields are owned by the server or are independently authenticated
+  // native receipts, not part of the replayable provider stream.
+  for (const key of ['__seq', 'userSeq', '__degraded', 'messageId', 'managedEventType']) delete value[key];
+  for (const key of ['autonomousSourceExecutorTerminal', 'autonomousSourceExecutorNotStarted',
+    'ordinaryExecutorTerminal', 'personalContextInvocationTerminal', 'personalContextInvocationNotStarted'])
+    delete value.ev[key];
+  return JSON.stringify(sorted(value));
+}
+function fingerprint(envelope) {
+  const json = normalize(envelope);
+  const bytes = Buffer.byteLength(json, 'utf8');
+  if (bytes > MAX_EVENT_BYTES) throw new RangeError('Scheduled stream envelope exceeds the limit');
+  return { hash: digest(json), bytes, json };
+}
+function create(binding) {
+  if (!binding || ![binding.runId, binding.sessionId, binding.requestId, binding.dispatchId].every(id))
+    throw new TypeError('Invalid scheduled stream binding');
+  let closed = false;
+  let unavailable = null;
+  let totalBytes = 0;
+  const hashes = [];
+  return {
+    add(envelopes) {
+      if (closed) throw new Error('Scheduled stream manifest is already closed');
+      if (unavailable || !Array.isArray(envelopes)) return;
+      for (const envelope of envelopes) {
+        if (hashes.length >= MAX_EVENTS) { unavailable = 'event_limit'; break; }
+        let entry;
+        try { entry = fingerprint(envelope); }
+        catch { unavailable = 'invalid_or_oversize_event'; break; }
+        if (totalBytes + entry.bytes > MAX_TOTAL_BYTES) { unavailable = 'byte_limit'; break; }
+        hashes.push(entry.hash);
+        totalBytes += entry.bytes;
+      }
+      // A partial prefix is never a manifest.
+      if (unavailable) { hashes.length = 0; totalBytes = 0; }
+    },
+    finish() {
+      if (closed) throw new Error('Scheduled stream manifest is already closed');
+      closed = true;
+      if (unavailable) return { unavailable };
+      return { manifest: { version: 1, algorithm: 'sha256', runId: binding.runId,
+        sessionId: binding.sessionId, requestId: binding.requestId, dispatchId: binding.dispatchId,
+        count: hashes.length, totalBytes, hashes: [...hashes] } };
+    },
+  };
+}
+function validate(manifest, binding) {
+  return Boolean(manifest && typeof manifest === 'object' && !Array.isArray(manifest) &&
+    Object.keys(manifest).sort().join(',') === 'algorithm,count,dispatchId,hashes,requestId,runId,sessionId,totalBytes,version' &&
+    manifest.version === 1 && manifest.algorithm === 'sha256' &&
+    ['runId', 'sessionId', 'requestId', 'dispatchId'].every(key => id(binding?.[key]) && manifest[key] === binding[key]) &&
+    Number.isSafeInteger(manifest.count) && manifest.count >= 0 && manifest.count <= MAX_EVENTS &&
+    Number.isSafeInteger(manifest.totalBytes) && manifest.totalBytes >= 0 && manifest.totalBytes <= MAX_TOTAL_BYTES &&
+    Array.isArray(manifest.hashes) && manifest.hashes.length === manifest.count &&
+    manifest.hashes.every(value => typeof value === 'string' && HASH.test(value)));
+}
+function verify(manifest, binding, envelopes) {
+  if (!validate(manifest, binding) || !Array.isArray(envelopes) || envelopes.length !== manifest.count)
+    return false;
+  let totalBytes = 0;
+  try {
+    for (let index = 0; index < envelopes.length; index += 1) {
+      const entry = fingerprint(envelopes[index]);
+      if (entry.hash !== manifest.hashes[index]) return false;
+      totalBytes += entry.bytes;
+      if (totalBytes > MAX_TOTAL_BYTES) return false;
+    }
+  } catch { return false; }
+  return totalBytes === manifest.totalBytes;
+}
+module.exports = { MAX_EVENTS, MAX_EVENT_BYTES, MAX_TOTAL_BYTES, normalize, fingerprint, create, validate, verify };

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/scheduled-stream-wire.d.cts

@@ -0,0 +1,15 @@
+export interface ScheduledStreamBinding { runId: string; sessionId: string; requestId: string; dispatchId: string }
+export interface ScheduledStreamManifest extends ScheduledStreamBinding {
+  version: 1; algorithm: 'sha256'; count: number; totalBytes: number; hashes: string[];
+}
+export const MAX_EVENTS: number;
+export const MAX_EVENT_BYTES: number;
+export const MAX_TOTAL_BYTES: number;
+export function normalize(envelope: unknown): string;
+export function fingerprint(envelope: unknown): { hash: string; bytes: number; json: string };
+export function create(binding: ScheduledStreamBinding): {
+  add(envelopes: unknown): void;
+  finish(): { manifest: ScheduledStreamManifest } | { unavailable: string };
+};
+export function validate(manifest: unknown, binding: ScheduledStreamBinding): boolean;
+export function verify(manifest: unknown, binding: ScheduledStreamBinding, envelopes: unknown): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/telemetryRedaction.js

@@ -34,7 +34,7 @@ const TOKEN_CHAR = "(?:[A-Za-z0-9._-]|%(?:25)*(?:2[DdEe]|3[0-9]|4[1-9A-Fa-f]|5[0
 const PREVIEW_TOKEN = new RegExp(`pvw(?:_|%(?:25)*5[Ff])${TOKEN_CHAR}+`, "g");
 const UNDERSCORE = "(?:_|%(?:25)*5[Ff])";
 const DOT = "(?:\\.|%(?:25)*2[Ee])";
-const SIGNED_CREDENTIAL = new RegExp(`(wsi|pinv|usr|adm2)${UNDERSCORE}(?=[0-9a-f]{32}${DOT})${TOKEN_CHAR}+`, "g");
+const SIGNED_CREDENTIAL = new RegExp(`(wsi|pinv|iinv|usr|adm2)${UNDERSCORE}(?=[0-9a-f]{32}${DOT})${TOKEN_CHAR}+`, "g");
 const LEGACY_OPERATOR_CODE = new RegExp(`(adm)${UNDERSCORE}(?=[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-]))[A-Za-z0-9_-]{43}`, "g");
 const QR_SIGN_IN_REDACTION = "[redacted]";
 const escapedLiteral = (value) => [...value].map((char) => {
@@ -72,7 +72,7 @@ function redactQrSignInText(value) {
   const standaloneQuery = /(?:^|[?&])direction=(?:mobile_approves_web|web_approves_mobile)(?:&|$)/.test(value) ? value.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`) : value;
   return standaloneQuery.replace(QR_REQUEST_PATH, `$1${QR_SIGN_IN_REDACTION}`).replace(QR_LINK_QUERY, (_match, prefix, query) => prefix + query.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`)).replace(QR_SECRET_ASSIGNMENT, `$1${QR_SIGN_IN_REDACTION}`);
 }
-const CREDENTIAL_HINTS = ["pvw", "wsi", "pinv", "usr", "adm"];
+const CREDENTIAL_HINTS = ["pvw", "wsi", "pinv", "iinv", "usr", "adm"];
 const credentialMarker = (_match, prefix) => `${prefix}_[redacted]`;
 function redactPreviewTokens(value) {
   if (typeof value !== "string")

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/telemetryRedaction.js

@@ -82,7 +82,7 @@ const DOT = '(?:\\.|%(?:25)*2[Ee])';
  * prefix is captured so the marker can say which kind it was. `usr_<40 hex>`, `usr_00000001` and `/usr_profile` have no
  * dot after exactly 32 hex characters, so they match nothing.
  */
-const SIGNED_CREDENTIAL = new RegExp(`(wsi|pinv|usr|adm2)${UNDERSCORE}(?=[0-9a-f]{32}${DOT})${TOKEN_CHAR}+`, 'g');
+const SIGNED_CREDENTIAL = new RegExp(`(wsi|pinv|iinv|usr|adm2)${UNDERSCORE}(?=[0-9a-f]{32}${DOT})${TOKEN_CHAR}+`, 'g');
 /**
  * The older operator code: `adm_` and exactly 43 base64url characters (32 random bytes), not followed by another one.
  * A shorter or longer run of letters is a name, not this credential. The characters are the plain alphabet and not
@@ -134,7 +134,7 @@ function redactQrSignInText(value) {
         .replace(QR_SECRET_ASSIGNMENT, `$1${QR_SIGN_IN_REDACTION}`);
 }
 /** Cheap test before the older prefix-based credential expressions. */
-const CREDENTIAL_HINTS = ['pvw', 'wsi', 'pinv', 'usr', 'adm'];
+const CREDENTIAL_HINTS = ['pvw', 'wsi', 'pinv', 'iinv', 'usr', 'adm'];
 const credentialMarker = (_match, prefix) => `${prefix}_[redacted]`;
 export function redactPreviewTokens(value) {
     if (typeof value !== 'string')

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -4,6 +4,10 @@
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {
+    "./scheduled-stream-wire": {
+      "types": "./dist/cjs/scheduled-stream-wire.d.cts",
+      "default": "./dist/cjs/scheduled-stream-wire.cjs"
+    },
     "./desktop-daemon-proof": {
       "import": {
         "types": "./dist/esm/desktopDaemonProof.d.ts",