@skrr-ai/cli 0.1.49 → 0.1.51

package/dist/lib/node-adapter.js

@@ -271,10 +271,22 @@ function createNodeAdapter(opts = {}) {
             }
         }
         // Refresh the in-process override so the retry on the SAME request
-        // sees the new token. writeToBackend (called inside the broker)
-        // already wrote to the keychain/file — but the adapter caches the
-        // credential and only re-reads when explicitly told to.
+        // sees the new token. For a durable mint, writeToBackend (called inside
+        // the broker) already wrote to the keychain/file — but the adapter
+        // caches the credential and only re-reads when explicitly told to.
         const accessToken = outcome.outcome.accessToken;
+        if (outcome.outcome.brokered) {
+            // Broker-mode hand-off: an in-memory access token, nothing persisted.
+            // 'env-token' keeps `ensureFreshCliCredential` from trying to rotate a
+            // stored family that does not exist; renewal re-redeems the descriptor.
+            setAdapterCredentialOverride({
+                token: accessToken,
+                source: 'env-token',
+                kind: (0, auth_core_1.classifyTokenKind)(accessToken),
+            });
+            onTokenRefresh?.(accessToken);
+            return true;
+        }
         setAdapterCredentialOverride({
             token: accessToken,
             source: outcome.outcome.storedIn === 'keychain' ? 'keychain' : 'file',

package/dist/lib/tasks.d.ts

@@ -8,6 +8,25 @@ import type { ParsedDeliverableCoordinate, ParsedExpectationSpec } from '@skrr-a
  */
 export declare function resolveTaskGoalFlag(value: string | undefined): string | null | undefined;
 export declare const TASK_GOAL_NOT_FOUND = "TASK_GOAL_NOT_FOUND";
+/**
+ * `--working-directory` on `tasks create` / `update` / `upsert`. `none`,
+ * `null` and `clear` mean "no per-task override": on update the PATCH sends
+ * `workingDirectory: null` ($unset → inherit the agent default), on create it
+ * stores as absent. The sentinel set mirrors `resolveTaskGoalFlag` — it is the
+ * spelling a user who knows `--goal none` reaches for.
+ * Undefined means the flag was not passed.
+ */
+export declare function workingDirectoryFromFlag(value: string | undefined): string | null | undefined;
+/**
+ * Validate a RESOLVED `workingDirectory` payload value (post-merge, so flag
+ * and `--from-json` inputs are checked identically). `null`/`undefined` are
+ * always fine — they mean "no override". A string must be absolute: the path
+ * is resolved on the daemon's filesystem, so a relative value can neither be
+ * verified here nor trusted there — it would fall back, silently, at run
+ * time. Failing here is the same contract as every other bad spec in this
+ * file: refuse before the write, never store a value that cannot take effect.
+ */
+export declare function workingDirectoryValidationError(value: unknown): string | null;
 /**
  * The refusal for a goal id that names no goal, in CLI terms.
  *
@@ -91,6 +110,7 @@ export type TaskCreateFlagValues = {
     estimate?: number;
     tag?: string[];
     'label-id'?: string[];
+    'working-directory'?: string;
     worktree?: boolean;
     'lifecycle-definition'?: string;
     'lifecycle-version'?: string;

package/dist/lib/tasks.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RECOGNIZED_TASK_VERDICTS = exports.DELIVERABLE_LIFECYCLE_VALUES = exports.EXPECT_FLAG_HELP = exports.TASK_WORK_EVENT_KINDS = exports.TASK_PRIORITIES = exports.TASK_GOAL_NOT_FOUND = void 0;
 exports.resolveTaskGoalFlag = resolveTaskGoalFlag;
+exports.workingDirectoryFromFlag = workingDirectoryFromFlag;
+exports.workingDirectoryValidationError = workingDirectoryValidationError;
 exports.describeTaskGoalNotFound = describeTaskGoalNotFound;
 exports.releasePinRepairGuard = releasePinRepairGuard;
 exports.taskUpdateMutationGuard = taskUpdateMutationGuard;
@@ -38,6 +40,7 @@ exports.verdictIsRecognized = verdictIsRecognized;
 const data_provider_1 = require("@skrr-ai/data-provider");
 const prompt_1 = require("./prompt");
 const projects_1 = require("./projects");
+const node_path_1 = require("node:path");
 /**
  * `--goal` on `tasks update`. `none`, `null` and `clear` detach the goal: PATCH
  * sends `goalId: null`. Anything else names a goal. `clear` is accepted because
@@ -54,6 +57,47 @@ function resolveTaskGoalFlag(value) {
     return v;
 }
 exports.TASK_GOAL_NOT_FOUND = 'TASK_GOAL_NOT_FOUND';
+/**
+ * `--working-directory` on `tasks create` / `update` / `upsert`. `none`,
+ * `null` and `clear` mean "no per-task override": on update the PATCH sends
+ * `workingDirectory: null` ($unset → inherit the agent default), on create it
+ * stores as absent. The sentinel set mirrors `resolveTaskGoalFlag` — it is the
+ * spelling a user who knows `--goal none` reaches for.
+ * Undefined means the flag was not passed.
+ */
+function workingDirectoryFromFlag(value) {
+    if (value === undefined)
+        return undefined;
+    const v = value.trim();
+    if (!v || ['none', 'null', 'clear'].includes(v.toLowerCase()))
+        return null;
+    return v;
+}
+/**
+ * Validate a RESOLVED `workingDirectory` payload value (post-merge, so flag
+ * and `--from-json` inputs are checked identically). `null`/`undefined` are
+ * always fine — they mean "no override". A string must be absolute: the path
+ * is resolved on the daemon's filesystem, so a relative value can neither be
+ * verified here nor trusted there — it would fall back, silently, at run
+ * time. Failing here is the same contract as every other bad spec in this
+ * file: refuse before the write, never store a value that cannot take effect.
+ */
+function workingDirectoryValidationError(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (typeof value !== 'string' || !value.trim()) {
+        return 'workingDirectory must be an absolute path string (or null for no override)';
+    }
+    if (value.length > 1024) {
+        return 'workingDirectory must be at most 1024 characters';
+    }
+    if (!(0, node_path_1.isAbsolute)(value.trim())) {
+        return (`workingDirectory must be an absolute path on the daemon's filesystem ` +
+            `(got '${value}'). ` +
+            'A relative path cannot be resolved there — pass the full path, or "none" to clear.');
+    }
+    return null;
+}
 /**
  * The refusal for a goal id that names no goal, in CLI terms.
  *
@@ -331,6 +375,8 @@ function buildTaskCreatePayload(body, flags = {}) {
         // is a Task→Task edge rather than a pointer at a chat message.
         spawnedByTaskId: flags['spawned-by'],
         spawnReason: flags['spawn-reason'],
+        // Per-task working-directory override; 'none' ⇒ null (no override).
+        workingDirectory: workingDirectoryFromFlag(flags['working-directory']),
         // Worktree isolation opt-in. --worktree ⇒ 'ephemeral', --no-worktree ⇒
         // 'shared', omitted ⇒ undefined (inherit space policy / global default).
         executionIsolation: executionIsolationFromWorktreeFlag(flags.worktree),
@@ -409,6 +455,9 @@ function validateTaskCreatePayload(payload) {
     if (payload.templateId !== undefined && !isBoundedString(payload.templateId, 1, 100)) {
         errors.push('templateId must be a non-empty string at most 100 characters');
     }
+    const workingDirectoryError = workingDirectoryValidationError(payload.workingDirectory);
+    if (workingDirectoryError)
+        errors.push(workingDirectoryError);
     if (payload.lifecycle !== undefined) {
         const binding = payload.lifecycle;
         if (!binding || typeof binding !== 'object' || Array.isArray(binding)) {
@@ -756,6 +805,11 @@ function createPatchFromCreatePayload(payload) {
         'executionMode',
         'tags',
         'labelIds',
+        // Per-task working-directory override — part of the same execution shape
+        // the create payload carries, and equally meaningful on the update leg of
+        // an upsert. Absent here, `upsert --working-directory` silently no-ops on
+        // an existing task.
+        'workingDirectory',
     ];
     for (const field of copyFields) {
         if (payload[field] !== undefined)

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.d.ts

@@ -0,0 +1,90 @@
+/**
+ * cliHandoffWire.ts — the ONE declaration of the CLI↔daemon hand-off wire
+ * contracts, shared by the daemon (writer/server) and the CLI (reader).
+ *
+ * Two contracts live here:
+ *
+ *   1. The hand-off descriptor file (`descriptor.json` on Dedicated guests,
+ *      `daemon-island.<profile>.json` on laptops). Until now the shape was
+ *      declared twice — `DedicatedCliHandoffDescriptor` daemon-side and
+ *      `LocalBootstrap` CLI-side — two type declarations for one file format,
+ *      the same drift disease `sessionPermissionAuthority` fixed.
+ *   2. The broker-mode redeem exchange: `POST /v1/auth/cli-handoff-token`
+ *      request/response plus its error codes.
+ *
+ * Readers stay loose (unknown fields ignored, absent `handoffModes` reads as
+ * refresh-family-only) so a new field never breaks an older peer; writers
+ * must produce the full shape.
+ */
+/**
+ * What a caller may redeem the descriptor secret for.
+ *  - `refresh_family`: the legacy durable mint (90-day cli-scope family).
+ *  - `access_token`:   broker mode — a short-lived access token from a
+ *                      daemon-owned family; nothing durable leaves the daemon.
+ */
+export declare const CLI_HANDOFF_MODES: readonly ["refresh_family", "access_token"];
+export type CliHandoffMode = (typeof CLI_HANDOFF_MODES)[number];
+/** Broker-mode redeem route on the daemon's loopback server. */
+export declare const CLI_HANDOFF_TOKEN_PATH = "/v1/auth/cli-handoff-token";
+/** Error codes this contract emits. String literals so both ends compare
+ *  without importing a symbol they may not have. */
+export declare const CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = "HANDOFF_TOKEN_UNAVAILABLE";
+/** Emitted by the LEGACY /v1/auth/cli-handoff route when a hand-off-secret
+ *  caller asks for a refresh family the daemon no longer mints for it. */
+export declare const CLI_HANDOFF_ERROR_BROKER_ONLY = "HANDOFF_BROKER_ONLY";
+/**
+ * The descriptor file format. `version` is absent on the oldest island files
+ * and `1` on the first dedicated-guest descriptors; `handoffModes` first
+ * appears at version 2. Every field the CLI needs to dial is validated; the
+ * rest ride along untyped.
+ */
+export interface CliHandoffDescriptor {
+    version?: number;
+    pid?: number;
+    daemonId?: string;
+    host?: string;
+    port?: number;
+    /** Base64 handshake secret — hand-off-only on guests, island on laptops. */
+    secret?: string;
+    /** Server URL the daemon is authenticated against. Older daemons omit it;
+     *  readers refuse to broker without it (never mint against an unknown
+     *  server). */
+    serverUrl?: string;
+    /** Daemon-authored epoch counter; bumped when the descriptor is republished. */
+    epoch?: number;
+    handoffModes?: CliHandoffMode[];
+}
+/**
+ * Parse an untrusted descriptor JSON value. Returns null when the fields the
+ * caller cannot proceed without — host, port, secret — are absent or
+ * mistyped. Unknown fields and future `version` values are tolerated: the
+ * reader ignores them, which is what makes additive evolution safe.
+ */
+export declare function parseCliHandoffDescriptor(value: unknown): CliHandoffDescriptor | null;
+/**
+ * Untrusted `handoffModes` input → known literals only, deduped. An
+ * unrecognized future mode is dropped rather than widening by coercion.
+ */
+export declare function normalizeHandoffModes(value: unknown): CliHandoffMode[];
+/**
+ * The versioned-default rule: a descriptor that never declares modes offers
+ * only the durable mint it has always offered. Mode negotiation is purely
+ * additive — a daemon advertises the new mode, it never un-advertises the
+ * old one by accident.
+ */
+export declare function advertisedHandoffModes(d: CliHandoffDescriptor): CliHandoffMode[];
+export declare function descriptorOffersAccessToken(d: CliHandoffDescriptor): boolean;
+export interface CliHandoffTokenRequest {
+    /** Bypass the daemon broker's cached token (the 401-recovery path). */
+    forceRefresh?: boolean;
+}
+export interface CliHandoffTokenResponse {
+    accessToken: string;
+    /** Absolute expiry in ms since epoch, when the daemon knows it. */
+    accessExpiresAt?: number;
+    /** Server the minted credential belongs to — lets the caller verify it is
+     *  about to use a token for the API it thinks it is talking to. */
+    serverUrl?: string;
+}
+/** Parse the redeem response; null when the token itself is absent. */
+export declare function parseCliHandoffTokenResponse(value: unknown): CliHandoffTokenResponse | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.js

@@ -0,0 +1,113 @@
+"use strict";
+/**
+ * cliHandoffWire.ts — the ONE declaration of the CLI↔daemon hand-off wire
+ * contracts, shared by the daemon (writer/server) and the CLI (reader).
+ *
+ * Two contracts live here:
+ *
+ *   1. The hand-off descriptor file (`descriptor.json` on Dedicated guests,
+ *      `daemon-island.<profile>.json` on laptops). Until now the shape was
+ *      declared twice — `DedicatedCliHandoffDescriptor` daemon-side and
+ *      `LocalBootstrap` CLI-side — two type declarations for one file format,
+ *      the same drift disease `sessionPermissionAuthority` fixed.
+ *   2. The broker-mode redeem exchange: `POST /v1/auth/cli-handoff-token`
+ *      request/response plus its error codes.
+ *
+ * Readers stay loose (unknown fields ignored, absent `handoffModes` reads as
+ * refresh-family-only) so a new field never breaks an older peer; writers
+ * must produce the full shape.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLI_HANDOFF_ERROR_BROKER_ONLY = exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = exports.CLI_HANDOFF_TOKEN_PATH = exports.CLI_HANDOFF_MODES = void 0;
+exports.parseCliHandoffDescriptor = parseCliHandoffDescriptor;
+exports.normalizeHandoffModes = normalizeHandoffModes;
+exports.advertisedHandoffModes = advertisedHandoffModes;
+exports.descriptorOffersAccessToken = descriptorOffersAccessToken;
+exports.parseCliHandoffTokenResponse = parseCliHandoffTokenResponse;
+/**
+ * What a caller may redeem the descriptor secret for.
+ *  - `refresh_family`: the legacy durable mint (90-day cli-scope family).
+ *  - `access_token`:   broker mode — a short-lived access token from a
+ *                      daemon-owned family; nothing durable leaves the daemon.
+ */
+exports.CLI_HANDOFF_MODES = ['refresh_family', 'access_token'];
+/** Broker-mode redeem route on the daemon's loopback server. */
+exports.CLI_HANDOFF_TOKEN_PATH = '/v1/auth/cli-handoff-token';
+/** Error codes this contract emits. String literals so both ends compare
+ *  without importing a symbol they may not have. */
+exports.CLI_HANDOFF_TOKEN_ERROR_UNAVAILABLE = 'HANDOFF_TOKEN_UNAVAILABLE';
+/** Emitted by the LEGACY /v1/auth/cli-handoff route when a hand-off-secret
+ *  caller asks for a refresh family the daemon no longer mints for it. */
+exports.CLI_HANDOFF_ERROR_BROKER_ONLY = 'HANDOFF_BROKER_ONLY';
+/**
+ * Parse an untrusted descriptor JSON value. Returns null when the fields the
+ * caller cannot proceed without — host, port, secret — are absent or
+ * mistyped. Unknown fields and future `version` values are tolerated: the
+ * reader ignores them, which is what makes additive evolution safe.
+ */
+function parseCliHandoffDescriptor(value) {
+    if (value == null || typeof value !== 'object')
+        return null;
+    const v = value;
+    if (typeof v.host !== 'string' || v.host.length === 0)
+        return null;
+    if (typeof v.port !== 'number' || !Number.isInteger(v.port) || v.port <= 0)
+        return null;
+    if (typeof v.secret !== 'string' || v.secret.length === 0)
+        return null;
+    return {
+        ...(typeof v.version === 'number' ? { version: v.version } : {}),
+        ...(typeof v.pid === 'number' ? { pid: v.pid } : {}),
+        ...(typeof v.daemonId === 'string' ? { daemonId: v.daemonId } : {}),
+        host: v.host,
+        port: v.port,
+        secret: v.secret,
+        ...(typeof v.serverUrl === 'string' ? { serverUrl: v.serverUrl } : {}),
+        ...(typeof v.epoch === 'number' ? { epoch: v.epoch } : {}),
+        ...(Array.isArray(v.handoffModes)
+            ? { handoffModes: normalizeHandoffModes(v.handoffModes) }
+            : {}),
+    };
+}
+/**
+ * Untrusted `handoffModes` input → known literals only, deduped. An
+ * unrecognized future mode is dropped rather than widening by coercion.
+ */
+function normalizeHandoffModes(value) {
+    if (!Array.isArray(value))
+        return [];
+    const out = [];
+    for (const m of value) {
+        if (exports.CLI_HANDOFF_MODES.includes(m) &&
+            !out.includes(m)) {
+            out.push(m);
+        }
+    }
+    return out;
+}
+/**
+ * The versioned-default rule: a descriptor that never declares modes offers
+ * only the durable mint it has always offered. Mode negotiation is purely
+ * additive — a daemon advertises the new mode, it never un-advertises the
+ * old one by accident.
+ */
+function advertisedHandoffModes(d) {
+    const declared = normalizeHandoffModes(d.handoffModes);
+    return declared.length > 0 ? declared : ['refresh_family'];
+}
+function descriptorOffersAccessToken(d) {
+    return advertisedHandoffModes(d).includes('access_token');
+}
+/** Parse the redeem response; null when the token itself is absent. */
+function parseCliHandoffTokenResponse(value) {
+    if (value == null || typeof value !== 'object')
+        return null;
+    const v = value;
+    if (typeof v.accessToken !== 'string' || v.accessToken.length === 0)
+        return null;
+    return {
+        accessToken: v.accessToken,
+        ...(typeof v.accessExpiresAt === 'number' ? { accessExpiresAt: v.accessExpiresAt } : {}),
+        ...(typeof v.serverUrl === 'string' ? { serverUrl: v.serverUrl } : {}),
+    };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.d.ts

@@ -21,6 +21,8 @@ type DisabledReason = 'kek_unavailable' | 'init_failed' | 'platform_unsupported'
 export declare function __setStateForTest(next: CredEnvelopeState): CredEnvelopeState;
 /** @internal Test seam — read state for assertions. */
 export declare function __getStateForTest(): CredEnvelopeState;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+export declare function __clearWarnDedupeForTest(): void;
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.__setStateForTest = __setStateForTest;
 exports.__getStateForTest = __getStateForTest;
+exports.__clearWarnDedupeForTest = __clearWarnDedupeForTest;
 exports.initCredEnvelope = initCredEnvelope;
 exports.resetCredEnvelope = resetCredEnvelope;
 exports.shutdownCredEnvelope = shutdownCredEnvelope;
@@ -141,7 +142,21 @@ function atomicWrite0600(target, value) {
  * The event name passed in is the FULLY-QUALIFIED `cred_envelope.*` form
  * because daemon-side telemetry consumers (`event-log.ts`, dashboards,
  * spec assertions) key off the prefixed name. Do not strip the prefix.
+ *
+ * Identical failure warnings hit the logger only once per process.
+ * Telemetry still records every occurrence — the dedupe exists because a
+ * single unreadable envelope produced the same warning once per stored
+ * field (token, refresh token, expiry…), which read to users as three
+ * crashes rather than one stale credential (OSK-12074). The signature is
+ * event + kek identity + message, so a genuinely different failure mode
+ * still gets its own line.
  */
+const warnedSignatures = new Set();
+const MAX_WARNED_SIGNATURES = 64;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+function __clearWarnDedupeForTest() {
+    warnedSignatures.clear();
+}
 function emit(eventName, success, metadata) {
     (0, runtime_js_1.emitAuthTelemetry)({
         timestamp: new Date().toISOString(),
@@ -150,7 +165,13 @@ function emit(eventName, success, metadata) {
         metadata: { event: eventName, ...metadata },
     });
     if (!success) {
-        (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] ${eventName}`, metadata);
+        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}`;
+        if (!warnedSignatures.has(signature)) {
+            if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
+                warnedSignatures.clear();
+            warnedSignatures.add(signature);
+            (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] ${eventName}`, metadata);
+        }
     }
 }
 // ---------------------------------------------------------------------------
@@ -763,6 +784,10 @@ function maybeDecryptOnRead(stored) {
                 kekId: _state.kekId,
                 kekKind: _state.kekKind,
                 message: err?.message ?? 'unknown',
+                // The crypto error alone reads as a crash; the actionable truth is
+                // that this stored credential is unreadable by THIS binary (usually
+                // a signing-identity or profile drift) and re-login rebuilds it.
+                hint: 'stored credential is unreadable on this machine — signing in again rebuilds it',
             });
             return { plaintext: null, needsMigration: false };
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialSession.d.ts

@@ -0,0 +1,47 @@
+/**
+ * credentialSession.ts — the shared credential-lifecycle kernel (policy half).
+ *
+ * A credential lifecycle is policy × mechanism. The policy — serve a cached
+ * token until its expiry-skew window, collapse concurrent acquires onto one
+ * in-flight operation, invalidate on a resource-side 401 — is identical for
+ * every surface and was being re-implemented per consumer (task token-broker,
+ * delegated-cli redemption, the human CLI refresh path). The mechanism —
+ * WHERE the durable secret lives and HOW a token is acquired — legitimately
+ * differs (in-memory daemon family vs file+envelope+lock vs loopback redeem)
+ * and stays behind the `acquire` seam.
+ *
+ * Deliberately thin: no persistence, no retry policy, no logging. Callers
+ * own their store and their error surfaces; this owns the cache/single-
+ * flight/invalidate invariants so they cannot drift between surfaces.
+ */
+/** What an acquire returns. `expiresAtMs` absent means "no known expiry" —
+ *  the token is served until `invalidate()` or an acquire replaces it. */
+export interface AcquiredCredential {
+    accessToken: string;
+    /** Absolute expiry in ms since epoch, when the issuer tells us. */
+    expiresAtMs?: number;
+}
+export interface CredentialSessionOptions {
+    /**
+     * The mechanism. Called with `forceRefresh: true` when the caller asked to
+     * bypass the cache (the 401-recovery path) — implementations should renew
+     * rather than serve their own cache. A rejected promise propagates to every
+     * waiter and is never cached.
+     */
+    acquire: (forceRefresh: boolean) => Promise<AcquiredCredential>;
+    /** Serve the cached token until this many ms before expiry. Default 30s. */
+    skewMs?: number;
+    /** Injectable clock for tests. */
+    now?: () => number;
+}
+export interface CredentialSession {
+    /**
+     * Resolves a usable access token: the cached one while it is inside its
+     * freshness window, otherwise a single shared acquire. `forceRefresh`
+     * discards the cache first (use after a resource 401).
+     */
+    getToken(forceRefresh?: boolean): Promise<string>;
+    /** Drop the cached token; the next getToken() acquires. */
+    invalidate(): void;
+}
+export declare function createCredentialSession(opts: CredentialSessionOptions): CredentialSession;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialSession.js

@@ -0,0 +1,69 @@
+"use strict";
+/**
+ * credentialSession.ts — the shared credential-lifecycle kernel (policy half).
+ *
+ * A credential lifecycle is policy × mechanism. The policy — serve a cached
+ * token until its expiry-skew window, collapse concurrent acquires onto one
+ * in-flight operation, invalidate on a resource-side 401 — is identical for
+ * every surface and was being re-implemented per consumer (task token-broker,
+ * delegated-cli redemption, the human CLI refresh path). The mechanism —
+ * WHERE the durable secret lives and HOW a token is acquired — legitimately
+ * differs (in-memory daemon family vs file+envelope+lock vs loopback redeem)
+ * and stays behind the `acquire` seam.
+ *
+ * Deliberately thin: no persistence, no retry policy, no logging. Callers
+ * own their store and their error surfaces; this owns the cache/single-
+ * flight/invalidate invariants so they cannot drift between surfaces.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createCredentialSession = createCredentialSession;
+const DEFAULT_SKEW_MS = 30_000;
+function createCredentialSession(opts) {
+    const skewMs = opts.skewMs ?? DEFAULT_SKEW_MS;
+    const now = opts.now ?? Date.now;
+    let cached = null;
+    let inFlight = null;
+    let inFlightForced = false;
+    // Monotonic generation so a superseded in-flight acquire (a forceRefresh
+    // launched while a plain acquire was still running) cannot write its stale
+    // result back over the newer one.
+    let generation = 0;
+    const fresh = (t) => t.expiresAtMs == null || now() < t.expiresAtMs - skewMs;
+    const acquireShared = (force) => {
+        // A forced acquire must not join a non-forced in-flight one — that would
+        // serve the very credential a 401 just invalidated. A forced in-flight
+        // DOES satisfy non-forced waiters: it is already renewing.
+        if (inFlight && (inFlightForced || !force))
+            return inFlight;
+        const gen = ++generation;
+        const p = opts.acquire(force).then((t) => {
+            if (gen === generation)
+                cached = t;
+            return t;
+        });
+        inFlight = p;
+        inFlightForced = force;
+        // `then(cleanup, cleanup)` not `.finally(cleanup)`: finally propagates the
+        // rejection into a derived promise nobody awaits — an unhandledRejection.
+        const cleanup = () => {
+            if (inFlight === p) {
+                inFlight = null;
+                inFlightForced = false;
+            }
+        };
+        p.then(cleanup, cleanup);
+        return p;
+    };
+    return {
+        async getToken(forceRefresh = false) {
+            if (forceRefresh)
+                cached = null;
+            if (cached && fresh(cached))
+                return cached.accessToken;
+            return (await acquireShared(forceRefresh)).accessToken;
+        },
+        invalidate() {
+            cached = null;
+        },
+    };
+}