@skrr-ai/cli 0.1.49 → 0.1.50

package/dist/lib/commitments.js

@@ -26,6 +26,8 @@ exports.describeWakeDecision = describeWakeDecision;
 exports.renderCheckList = renderCheckList;
 exports.renderCommitmentLedger = renderCommitmentLedger;
 exports.renderCommitmentTrace = renderCommitmentTrace;
+exports.formatCommitmentCycles = formatCommitmentCycles;
+exports.formatCommitmentExplanation = formatCommitmentExplanation;
 exports.renderListPageHint = renderListPageHint;
 exports.renderCommitmentObservations = renderCommitmentObservations;
 exports.renderCommitmentHypotheses = renderCommitmentHypotheses;
@@ -236,6 +238,10 @@ exports.commitmentApi = {
     /** Un-delete. Returns the Commitment PAUSED, never active. */
     restore: (id) => data_provider_1.request.post(`${base(id)}/restore`, {}),
     trace: (id, query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${base(id)}/trace`, query)),
+    /** One Cycle per Check, newest first — the unit a person reads (D8). */
+    cycles: (id, query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${base(id)}/cycles`, query)),
+    /** The latest Cycle walked as six questions; the first "no" is where it stopped. */
+    explain: (id) => data_provider_1.request.get(`${base(id)}/explain`),
     ledger: (id, query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${base(id)}/ledger`, query)),
     wakeCapabilities: (id) => data_provider_1.request.get(`${base(id)}/wake-capabilities`),
     dailyMetrics: (id, query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${base(id)}/daily-metrics`, query)),
@@ -1160,23 +1166,131 @@ function renderCommitmentLedger(ledger, log) {
     }
 }
 /** Human view for the ordered commitment trace. */
+/**
+ * `question:reason` for a trace event's server-derived stop — which of the six
+ * questions (wake, fresh, turn, think, act, reach) the wake stopped at. `none`
+ * means an Agent turn was dispatched. Blank when the event carries no stop.
+ */
+function stopCell(item) {
+    const detail = item.detail;
+    const stop = detail && typeof detail === 'object' ? detail.stop : undefined;
+    if (!stop || typeof stop !== 'object')
+        return '';
+    const { question, gate, reason } = stop;
+    if (typeof question !== 'string')
+        return '';
+    let why = '';
+    if (typeof reason === 'string' && reason)
+        why = reason;
+    else if (typeof gate === 'string')
+        why = gate;
+    return why ? `${question}: ${why}` : question;
+}
 function renderCommitmentTrace(trace, log) {
     const events = records(trace.events);
     renderRows(events.map((item) => ({
         at: text(firstValue(item, ['occurredAt', 'createdAt', 'startedAt'])),
         type: text(firstValue(item, ['type', 'kind'])),
         status: text(item.status),
+        stop: stopCell(item),
         summary: text(firstValue(item, ['summary', 'reason', 'title']), ''),
     })), [
         { key: 'at', header: 'AT', maxWidth: 24 },
         { key: 'type', header: 'TYPE', maxWidth: 28 },
         { key: 'status', header: 'STATUS', maxWidth: 28 },
+        { key: 'stop', header: 'STOPPED AT', maxWidth: 48 },
         { key: 'summary', header: 'SUMMARY', maxWidth: 72 },
     ], 'No trace events recorded.', log);
     if (trace.has_more === true && trace.next_cursor) {
         log(`More events are available; continue with --cursor ${text(trace.next_cursor)}.`);
     }
 }
+const CYCLE_GLYPH = {
+    advanced: '✓',
+    stopped: '●',
+    quiet: '○',
+    in_flight: '◌',
+};
+/** `MM-DD HH:MM` in the reader's local time; `-` when the time is unknown. */
+function cycleTime(value) {
+    if (typeof value !== 'string')
+        return '-';
+    const date = new Date(value);
+    if (Number.isNaN(date.getTime()))
+        return '-';
+    const pad = (n) => String(n).padStart(2, '0');
+    return `${pad(date.getMonth() + 1)}-${pad(date.getDate())} ${pad(date.getHours())}:${pad(date.getMinutes())}`;
+}
+function cycleWake(cycle) {
+    const wake = cycle.wake || {};
+    if (wake.kind === 'fire')
+        return `${wake.source || 'trigger'} wake`;
+    return wake.source ? `${wake.kind} (${wake.source})` : String(wake.kind || '-');
+}
+/** What one Cycle came to, in a single line. */
+function cycleSummary(cycle) {
+    if (cycle.outcome === 'stopped' && cycle.stop) {
+        const { question, gate, reason, fix, detail } = cycle.stop;
+        return `${question}  ${reason || gate} — ${fix || detail || 'stopped'}`;
+    }
+    if (cycle.outcome === 'advanced') {
+        return cycle.advancementKinds?.length
+            ? cycle.advancementKinds.join(', ')
+            : 'applied an agent result';
+    }
+    if (cycle.outcome === 'in_flight') {
+        const runs = cycle.runs?.length || 0;
+        return runs ? `${runs} run(s) still going` : 'check still running';
+    }
+    return cycle.note || cycle.decision?.summary || cycle.decision?.posture || 'nothing to act on';
+}
+/**
+ * One line per Cycle:
+ * `09-22 12:04  ● stopped    act  commitment_execution_budget_exhausted — Raise maxRunsPerDay…`
+ * A run that failed is named under its Cycle with who has to move (machine
+ * or model), because that is the next question every reader asks.
+ */
+function formatCommitmentCycles(page) {
+    const cycles = Array.isArray(page.cycles) ? page.cycles : [];
+    if (!cycles.length)
+        return ['No cycles recorded yet.'];
+    const lines = [];
+    for (const cycle of cycles) {
+        const glyph = CYCLE_GLYPH[cycle.outcome] || '?';
+        lines.push(`${cycleTime(cycle.startedAt)}  ${glyph} ${String(cycle.outcome).padEnd(9)}  ${cycleWake(cycle).padEnd(18)}  ${cycleSummary(cycle)}`);
+        for (const run of cycle.runs || []) {
+            if (!['machine', 'contract', 'work'].includes(run.failureClass))
+                continue;
+            const owner = run.failureOwner === 'model' ? 'model' : run.failureOwner || 'work';
+            lines.push(`             run ${run.id} ${run.status} — ${owner}: ${run.failureCode || '-'}`);
+        }
+    }
+    if (page.has_more && page.next_cursor) {
+        lines.push(`More cycles are available; continue with --cursor ${page.next_cursor}.`);
+    }
+    return lines;
+}
+const ANSWER_GLYPH = { yes: '✓', no: '✗', 'n/a': '–' };
+/** The six questions for the latest Cycle, the first ✗ carrying its fix. */
+function formatCommitmentExplanation(explanation) {
+    const cycle = explanation.cycle;
+    const lines = [
+        cycle
+            ? `Latest cycle: ${cycleTime(cycle.startedAt)} ${cycle.outcome} (${cycle.id})`
+            : `No cycle yet (status: ${explanation.status || '-'})`,
+    ];
+    for (const answer of explanation.answers || []) {
+        lines.push(`  ${ANSWER_GLYPH[answer.answer] || '?'} ${answer.question}  ${answer.because}`);
+        if (answer.fix)
+            lines.push(`      Fix: ${answer.fix}`);
+    }
+    lines.push(!explanation.stoppedAt
+        ? 'Nothing stopped this cycle.'
+        : explanation.verdict === 'quiet'
+            ? `Chose to stay quiet at: ${explanation.stoppedAt}`
+            : `Stopped at: ${explanation.stoppedAt}`);
+    return lines;
+}
 /**
  * Print the continuation hint for a paged `object:'list'` response — the line
  * that makes history beyond the newest page reachable instead of invisible.

package/dist/lib/daemonBroker.d.ts

@@ -36,31 +36,25 @@
  * liveness with `process.kill(pid, 0)` to filter stale files left behind
  * by a force-killed daemon.
  */
+import { type CliHandoffDescriptor, type CliHandoffTokenResponse } from '@skrr-ai/auth-core/cli-handoff-wire';
 import { type AuthBackend } from './auth-storage';
 import { type CliConfig } from './config';
 /**
- * Wire-shape of the bootstrap file. Mirrors
- * `daemon/src/local-bootstrap.ts::LocalBootstrap`. Kept loose — fields
- * the CLI doesn't use are ignored, and a future addition (e.g. version
- * bump, new metadata) doesn't break this reader.
+ * Wire-shape of the bootstrap file — the shared declaration in
+ * `@skrr-ai/auth-core/cli-handoff-wire` (`CliHandoffDescriptor`), which the
+ * daemon's writers and this reader both parse against so the format cannot
+ * drift between two mirrored type declarations. `LocalBootstrap` stays the
+ * exported name so existing callers (`daemon-target`, `message-intent`,
+ * `dedicated-lease-command`) don't churn.
+ *
+ * Fields the CLI doesn't use are ignored by the parser, and a future
+ * addition (e.g. version bump, new metadata) doesn't break this reader.
+ * `handoffModes` (descriptor v2) advertises what the secret can redeem:
+ * absent reads as `['refresh_family']` — today's durable mint; a guest
+ * descriptor advertising `['access_token']` can only redeem short-lived
+ * access tokens from the daemon's in-memory broker.
  */
-export interface LocalBootstrap {
-    version?: number;
-    pid?: number;
-    daemonId?: string;
-    host?: string;
-    port?: number;
-    /** Base64 32-byte handshake secret. */
-    secret?: string;
-    /**
-     * Server URL the daemon is authenticated against (e.g.
-     * `https://oversky.ai` or `http://localhost:3080`). Daemons that
-     * pre-date the baseURL-match check do not write this field — the
-     * broker pre-flight then refuses to call so we never mint against
-     * an unknown server.
-     */
-    serverUrl?: string;
-}
+export type LocalBootstrap = CliHandoffDescriptor;
 /**
  * Normalize a base URL for equality comparison. Mirrors the daemon-side
  * `normalizeBaseUrl` in `daemon/src/auth/cliHandoff.ts` so both ends
@@ -94,6 +88,33 @@ export interface DaemonBrokerResult {
      * the file.
      */
     storedIn?: Exclude<AuthBackend, 'none'>;
+    /**
+     * False on the legacy durable-mint shape so `outcome.brokered === true`
+     * narrows the outcome union. A durable mint is never brokered.
+     */
+    brokered?: false;
+}
+/**
+ * Broker-mode success: the descriptor advertised `access_token` and the
+ * daemon's loopback token route (`POST /v1/auth/cli-handoff-token`) answered
+ * a short-lived cli-scope access token minted from a refresh family the
+ * DAEMON holds in memory.
+ *
+ * This outcome carries no `refreshToken`, no `cliId`, no `userId` — nothing
+ * credential-shaped may be persisted for it. `brokered: true` is the tag the
+ * persist path keys on to skip `writeToBackend` entirely; the token is used
+ * in-memory for this process only, and the next `skrr` invocation re-redeems
+ * over loopback.
+ */
+export interface DaemonBrokeredOutcome {
+    ok: true;
+    brokered: true;
+    accessToken: string;
+    /** Absolute expiry in epoch ms, when the daemon reports it. */
+    accessExpiresAt?: number;
+    /** Server the minted credential belongs to (daemon-reported, else the
+     *  descriptor's own `serverUrl`). */
+    serverUrl?: string;
 }
 /**
  * Explicit reasons the broker path could fail. These exist to keep the
@@ -101,7 +122,7 @@ export interface DaemonBrokerResult {
  * fall through to PKCE; `ci_token_refused` is the one we surface
  * because re-driving it via PKCE would not change the outcome.
  */
-export type DaemonBrokerErrorReason = 'no_bootstrap' | 'stale_bootstrap' | 'bootstrap_parse' | 'base_url_mismatch' | 'daemon_not_authed' | 'ci_token_refused' | 'rate_limited' | 'server_error' | 'network' | 'timeout' | 'unknown';
+export type DaemonBrokerErrorReason = 'no_bootstrap' | 'stale_bootstrap' | 'bootstrap_parse' | 'base_url_mismatch' | 'daemon_not_authed' | 'ci_token_refused' | 'handoff_broker_only' | 'rate_limited' | 'server_error' | 'network' | 'timeout' | 'unknown';
 export interface DaemonBrokerFailure {
     ok: false;
     reason: DaemonBrokerErrorReason;
@@ -120,7 +141,7 @@ export interface DaemonBrokerFailure {
 }
 export type DaemonBrokerOutcome = (DaemonBrokerResult & {
     ok: true;
-}) | DaemonBrokerFailure;
+}) | DaemonBrokeredOutcome | DaemonBrokerFailure;
 export interface DaemonBrokerOptions {
     /** Stable per-machine cliId the CLI wants the new refresh row bound to. */
     cliId: string;
@@ -151,6 +172,22 @@ export interface DaemonBrokerOptions {
     candidatePathsOverride?: readonly string[];
     /** Override total request timeout. Tests use a short value. */
     timeoutMs?: number;
+    /**
+     * Which advertised mode to prefer when a descriptor offers both
+     * (`handoffModes: ['access_token', 'refresh_family']`, the laptop island
+     * shape during transition):
+     *
+     *   - `'access_token'` — broker mode: redeem a short-lived access token
+     *     and hold it in memory only. Used by `maybeAutoBroker`: nothing
+     *     credential-shaped lands on disk and each `skrr` process re-redeems
+     *     over loopback.
+     *   - `'refresh_family'` (default) — the legacy durable mint. Used by
+     *     explicit `skrr login`: a human login still writes a real,
+     *     user-owned refresh family. A descriptor that advertises ONLY
+     *     `access_token` (the Dedicated guest shape) redeems brokered
+     *     regardless — its secret cannot mint a family at all.
+     */
+    preferHandoffMode?: 'access_token' | 'refresh_family';
 }
 /**
  * Compute the bootstrap file path. Exported for tests so they can assert
@@ -214,10 +251,60 @@ export declare function readBootstrap(filePath: string): LocalBootstrap | null;
  */
 export declare function attemptDaemonBrokerLogin(opts: DaemonBrokerOptions): Promise<DaemonBrokerOutcome>;
 /**
- * Convenience wrapper: run the broker call and, on success, persist the
- * returned bundle through the canonical Sky CLI auth backend (Keychain
- * on macOS, `cli-auth.json` elsewhere). Returns the same outcome shape
- * so the caller can branch on `ok`.
+ * True when `token` is the access token this process redeemed through the
+ * daemon's broker-mode hand-off. `api-fetch` uses this to pick the re-redeem
+ * recovery branch instead of the stored-family refresh (which would have
+ * nothing to rotate — brokered credentials are never persisted).
+ */
+export declare function isBrokeredHandoffToken(token: string | null | undefined): boolean;
+/**
+ * Re-redeem the brokered hand-off token — the 401-recovery path. The
+ * descriptor is re-read from disk when its source path is known, so a secret
+ * rotated by a daemon restart resolves to the fresh one. Returns null when
+ * this process holds no brokered credential or the redeem fails (the caller
+ * then surfaces the original 401).
+ */
+export declare function redeemBrokeredHandoffToken(forceRefresh?: boolean): Promise<CliHandoffTokenResponse | null>;
+/** @internal test seam — clears the module-scoped brokered credential. */
+export declare function __resetBrokeredHandoffForTest(): void;
+/**
+ * True when a live local descriptor advertises broker-mode access — i.e.
+ * this machine's CLI authority is platform-managed and `skrr logout` has no
+ * local credential to clear. Read-only: parses candidates, never redeems.
+ */
+export declare function findBrokeredHandoffDescriptor(profile?: string): LocalBootstrap | null;
+/**
+ * Migration cleanup: retire the refresh family a pre-broker-mode CLI
+ * generation persisted, now that this machine redeems access tokens from
+ * the daemon's in-memory broker.
+ *
+ * Provenance guard — locally we cannot tell a hand-off-minted family from a
+ * user's explicit `skrr login` family by shape (the distinguishing
+ * `daemonRefOverride` lives server-side). The safe rule, applied here:
+ * revoke + delete ONLY when all of these hold —
+ *
+ *   1. the descriptor that just redeemed IS the Dedicated Runtime guest
+ *      hand-off file (`/run/skrr-dedicated-runtime/...`),
+ *   2. `~/.skrr/cli-auth.json` reads cleanly and carries a refresh token,
+ *   3. its stored `serverOrigin` matches the descriptor's `serverUrl`.
+ *
+ * When provenance can't be proven the file is KEPT: an explicit `skrr login`
+ * on a guest is rare but real, and a stale extra family is bounded by the
+ * server's session cap and expires on its own. Best-effort throughout — a
+ * failed revoke still deletes the file (the whole point is that nothing
+ * credential-shaped should remain), and any failure leaves the working
+ * brokered credential untouched.
+ */
+export declare function maybeRetireStoredCliAuthFile(opts: {
+    descriptorPath?: string;
+    descriptorServerUrl?: string;
+}): Promise<void>;
+/**
+ * Convenience wrapper: run the broker call and, on a durable-mint success,
+ * persist the returned bundle through the canonical Sky CLI auth backend
+ * (Keychain on macOS, `cli-auth.json` elsewhere). A `brokered` outcome is
+ * returned WITHOUT persisting — that is the entire point of broker mode.
+ * Returns the same outcome shape so the caller can branch on `ok`/`brokered`.
  */
 export declare function attemptDaemonBrokerLoginAndPersist(opts: DaemonBrokerOptions): Promise<DaemonBrokerOutcome>;
 export interface MaybeAutoBrokerOptions {
@@ -275,10 +362,12 @@ export interface MaybeAutoBrokerResult {
  *   - `commandId` is in `AUTH_SELF_MANAGED_COMMANDS`
  *
  * Side effects:
- *   - Calls `attemptDaemonBrokerLoginAndPersist` which writes to the
- *     keychain / cli-auth.json on success (this is the whole point —
- *     subsequent commands read the persisted token via the normal
- *     resolver chain, no broker round-trip per command).
+ *   - Calls `attemptDaemonBrokerLoginAndPersist` with `preferHandoffMode:
+ *     'access_token'`. On a descriptor that advertises broker mode the
+ *     outcome is `brokered` — an in-memory access token, nothing written;
+ *     the caller holds it for this process and the next `skrr` re-redeems.
+ *     On a legacy/v1 descriptor the durable mint is persisted to the
+ *     keychain / cli-auth.json exactly as before.
  *   - May generate a new `cliId` if the config doesn't have one. The
  *     caller MUST persist `updatedConfig` so the next invocation
  *     presents the same id to the server's refresh rotator.