@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/lib/cli-identity.js

@@ -0,0 +1,159 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.profileScopedCliId = profileScopedCliId;
+exports.hasStoredCredential = hasStoredCredential;
+exports.planLoginCliId = planLoginCliId;
+exports.cliIdForLogin = cliIdForLogin;
+exports.persistPresentedCliId = persistPresentedCliId;
+/**
+ * cli-identity.ts — which cliId a LOGIN presents, and when a profile gets its own.
+ *
+ * Reading the identity is `resolveCliId()` in `config.ts` (it has to live there:
+ * `auth-storage.ts` judges credential ownership by it, and this module reads
+ * auth-storage). This module owns the one decision a read must never make —
+ * issuing an identity — and the one write that restores a backed-up pair.
+ *
+ * Why a profile needs its own (OSK-12156): the server's `cli-handoff/confirm`
+ * retires every OTHER live cli family of (user, cliId) once a hand-off lands.
+ * That is right for one config replacing its own previous session, and wrong
+ * when every profile on the machine presents the same machine-scoped `cliId`:
+ * profile B's daemon-brokered login then revoked profile A's session, silently.
+ * The server scoping is already per cliId, so the fix is the id, not the route.
+ *
+ * Why only a profile with NO stored credential: an existing session was minted
+ * under the machine id, and the refresh route refuses a rotation that presents
+ * another. Re-identifying such a profile would log it out on its next refresh —
+ * and a re-login under a new id would leave its old family live (the confirm
+ * only sweeps the id it was minted for) in a bucket the server evicts
+ * oldest-first. So a profile keeps presenting the id its credential is bound
+ * to, and only a profile starting from nothing is issued one. That is also why
+ * an upgrade forces no re-login: nothing that already works changes id.
+ *
+ * The default profile keeps the machine id. It IS the machine file, and it is
+ * the identity every pre-profile install already presents.
+ */
+const node_crypto_1 = require("node:crypto");
+const node_os_1 = __importDefault(require("node:os"));
+const path = __importStar(require("node:path"));
+const auth_storage_1 = require("./auth-storage");
+const config_1 = require("./config");
+const cli_id_1 = require("./cli-id");
+const device_id_1 = require("./device-id");
+const keychain_1 = require("./keychain");
+/**
+ * A named profile's own identity. Deterministic in (host, user, config root,
+ * profile), so a profile that loses its config file and signs in again is
+ * issued the same id rather than scattering families, and two profiles — or the
+ * same profile name under two config roots — never share one. Same `cli_<12hex>`
+ * shape as the machine id: the server requires the `cli_` namespace.
+ */
+function profileScopedCliId(profile = (0, keychain_1.getActiveProfile)(), root = (0, config_1.configRoot)()) {
+    const hostname = node_os_1.default.hostname();
+    const username = node_os_1.default.userInfo().username || 'unknown';
+    const digest = (0, node_crypto_1.createHash)('sha256')
+        .update(`${hostname}|${username}|cli|profile:${profile}|root:${path.resolve(root)}`)
+        .digest('hex');
+    return `cli_${digest.slice(0, 12)}`;
+}
+/**
+ * Does this profile hold a credential it would present? Its own backend slot
+ * (ownership-checked, any origin) or a pre-migration token still in the config.
+ *
+ * A read that FAILS answers true: "keep the id you already present" is the
+ * outcome that cannot log anyone out, so doubt falls on that side.
+ */
+function hasStoredCredential(cfg) {
+    if (cfg.token || cfg.refreshToken)
+        return true;
+    try {
+        const read = (0, auth_storage_1.readFromBackend)();
+        return Boolean(read.bundle?.token || read.bundle?.refreshToken);
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Decide the id a login is about to present. Pure apart from the credential
+ * read; the caller persists `updatedConfig` (see `cliIdForLogin`).
+ */
+function planLoginCliId(cfg, deps = {}) {
+    const env = (0, cli_id_1.envCliIdOverride)();
+    if (env)
+        return { cliId: env, source: 'env' };
+    const issued = cfg.profileCliId?.trim();
+    if (issued)
+        return { cliId: issued, source: 'profile' };
+    if ((0, cli_id_1.isNamedProfile)() && !(deps.hasStoredCredential ?? hasStoredCredential)(cfg)) {
+        const cliId = profileScopedCliId();
+        return { cliId, source: 'issued', updatedConfig: { ...cfg, profileCliId: cliId } };
+    }
+    const machine = cfg.cliId?.trim();
+    if (machine)
+        return { cliId: machine, source: 'machine' };
+    const cliId = (0, device_id_1.generateCliId)();
+    return { cliId, source: 'machine', updatedConfig: { ...cfg, cliId } };
+}
+/**
+ * The id an interactive login presents, persisted BEFORE the exchange so a
+ * retry — or a sibling process — presents the same one.
+ */
+function cliIdForLogin(cfg = (0, config_1.loadConfig)()) {
+    const plan = planLoginCliId(cfg);
+    if (plan.updatedConfig)
+        (0, config_1.saveConfig)(plan.updatedConfig);
+    return plan.cliId;
+}
+/**
+ * Record that this profile now presents `cliId` — a restored (refresh token,
+ * cliId) pair. A named profile records it as its own identity; writing the
+ * machine field from a named profile would re-identify the default profile and
+ * every profile still on the machine id, whose next refresh would be refused.
+ */
+function persistPresentedCliId(cfg, cliId) {
+    if ((0, cli_id_1.isNamedProfile)()) {
+        const current = cfg.profileCliId?.trim() || cfg.cliId?.trim();
+        if (current === cliId)
+            return;
+        (0, config_1.saveConfig)({ ...cfg, profileCliId: cliId });
+        return;
+    }
+    if (cfg.cliId !== cliId)
+        (0, config_1.saveConfig)({ ...cfg, cliId });
+}

package/dist/lib/commitments.d.ts

@@ -17,7 +17,7 @@
  * "hold this state", derived from a Compass invariant — not authored here).
  */
 import { COMMITMENT_WATCHED_SOURCES, COMMITMENT_TEMPLATE_IDS, COMMITMENT_CADENCE_MODES, COMMITMENT_CADENCE_TIME_PATTERN, COMMITMENT_CADENCE_MAX_TIMES, COMMITMENT_AUTONOMY_MODES, COMMITMENT_EXECUTION_ISOLATION_MODES, COMMITMENT_STATUSES, COMMITMENT_KIND_VALUES } from '@skrr-ai/data-provider';
-import type { CommitmentCheck, CommitmentChecksResponse, Commitment, CommitmentActionProposal, CommitmentListResponse, CommitmentPlanResponse, CommitmentStatusResponse, CommitmentWorkLink, CommitmentExecutionReceiptListResponse, CommitmentExecutionReceiptQuarterlyMetricsResponse, CommitmentCapabilitySource, CommitmentDeliveryPatchResponse, CommitmentDeliveryBundleResponse, CommitmentCyclesResponse, CommitmentExplanationResponse } from '@skrr-ai/data-provider';
+import type { CommitmentCheck, CommitmentChecksResponse, Commitment, CommitmentActionProposal, CommitmentListResponse, CommitmentPlanResponse, CommitmentStatusResponse, CommitmentWorkLink, CommitmentExecutionReceiptListResponse, CommitmentExecutionReceiptQuarterlyMetricsResponse, CommitmentCapabilitySource, CommitmentDeliveryPatchResponse, CommitmentDeliveryBundleResponse, CommitmentCyclesResponse, CommitmentExplanationResponse, CommitmentRunPermissions } from '@skrr-ai/data-provider';
 import { withQuery } from './triggers';
 export { COMMITMENT_WATCHED_SOURCES, COMMITMENT_TEMPLATE_IDS, COMMITMENT_CADENCE_MODES, COMMITMENT_CADENCE_TIME_PATTERN, COMMITMENT_CADENCE_MAX_TIMES, COMMITMENT_STATUSES, COMMITMENT_KIND_VALUES, };
 export type { CommitmentCheck, CommitmentChecksResponse, Commitment, CommitmentActionProposal, CommitmentListResponse, CommitmentPlanResponse, CommitmentStatusResponse, CommitmentWorkLink, };
@@ -99,7 +99,27 @@ export type CommitmentPreflightReport = {
         suppressedBy?: string | null;
         [key: string]: unknown;
     };
+    /** Whose permissions a run uses (OSK-11975). Absent from older servers. */
+    permissions?: CommitmentRunPermissions | null;
+    /** `retired` names the fence fields OSK-11975 made inert (OSK-12065). */
+    execution?: {
+        retired?: string[];
+        retiredReason?: string;
+    } & Record<string, unknown>;
 };
+/**
+ * The lines every Commitment read surface prints for "whose permissions does a
+ * run use?" — `show`, `effective-policy` and `preflight` share it so the three
+ * cannot phrase it three ways (OSK-12065). The sentence and the warnings are
+ * the server's; this only lays them out. `null` (an older server that does not
+ * report it) prints nothing rather than a guess.
+ */
+export declare function permissionLines(permissions: CommitmentRunPermissions | null | undefined): string[];
+/**
+ * One line naming fields that are still in the JSON but decide nothing any
+ * more. Deprecation, not removal: `--json` keeps them for scripts.
+ */
+export declare function retiredFieldsLine(retired: string[] | undefined, reason: string | undefined): string | null;
 /**
  * A Commitment Pack's readiness receipt.
  *
@@ -466,6 +486,10 @@ export interface CommitmentNextTickProjection {
         diagnosisKind?: string;
         terminalDispositionCensus?: {
             workFailures?: number;
+            /** Failed runs the runtime never started (`classifyRunFailure` machine). */
+            machineFailures?: number;
+            /** Failed runs whose result was rejected (`classifyRunFailure` contract). */
+            contractFailures?: number;
             budgetRefusals?: number;
             terminal?: number;
         };

package/dist/lib/commitments.js

@@ -4,6 +4,8 @@ exports.COMMITMENT_CLI_EVALUATORS = exports.COMMITMENT_CREATE_KEYS = exports.COM
 exports.storedAutonomyModeForAuthoring = storedAutonomyModeForAuthoring;
 exports.authoringAutonomyModeForStored = authoringAutonomyModeForStored;
 exports.commitmentAutonomyLabel = commitmentAutonomyLabel;
+exports.permissionLines = permissionLines;
+exports.retiredFieldsLine = retiredFieldsLine;
 exports.readCommitmentAgentDirective = readCommitmentAgentDirective;
 exports.normalizeCreateBody = normalizeCreateBody;
 exports.parseCommitmentConcurrencyLimit = parseCommitmentConcurrencyLimit;
@@ -109,6 +111,33 @@ function commitmentAutonomyLabel(mode) {
  */
 exports.MIN_COMMITMENT_INTERVAL_MS = 60_000;
 exports.MAX_COMMITMENT_INTERVAL_MS = 365 * 24 * 60 * 60 * 1000;
+/**
+ * The lines every Commitment read surface prints for "whose permissions does a
+ * run use?" — `show`, `effective-policy` and `preflight` share it so the three
+ * cannot phrase it three ways (OSK-12065). The sentence and the warnings are
+ * the server's; this only lays them out. `null` (an older server that does not
+ * report it) prints nothing rather than a guess.
+ */
+function permissionLines(permissions) {
+    if (!permissions?.summary)
+        return [];
+    const lines = [`Permissions: ${permissions.summary}`];
+    for (const warning of permissions.warnings || []) {
+        lines.push(`Warning: ${warning.message}`);
+        if (warning.fix)
+            lines.push(`  Fix: ${warning.fix}`);
+    }
+    return lines;
+}
+/**
+ * One line naming fields that are still in the JSON but decide nothing any
+ * more. Deprecation, not removal: `--json` keeps them for scripts.
+ */
+function retiredFieldsLine(retired, reason) {
+    if (!Array.isArray(retired) || !retired.length)
+        return null;
+    return `Retired fields (no effect): ${retired.join(', ')}${reason ? ` — ${reason}` : ''}`;
+}
 function base(id) {
     return `/api/commitments/${encodeURIComponent(id)}`;
 }
@@ -626,6 +655,8 @@ function describeEvidenceHealth(health, criteriaCount) {
 const STALLED_DIAGNOSES = {
     scheduler_stalled: 'its expected checks are no longer arriving',
     work_failing: 'every recent run reached the agent and failed while doing the work',
+    runtime_failing: 'recent runs never started — the runtime refused them',
+    result_rejected: 'every recent run reached the agent, but its result was rejected',
     observation_unreadable: 'the latest check could not read every configured source',
     execution_budget_exhausted: 'recent planned work was skipped — the execution budget is exhausted',
     no_advancement: 'no server-recorded advancement exists inside the declared window',
@@ -645,8 +676,17 @@ function describeStalledHealth(commitment) {
     const kind = typeof liveness.diagnosisKind === 'string' ? liveness.diagnosisKind : undefined;
     const clause = (kind && STALLED_DIAGNOSES[kind]) ||
         'this loop has stopped producing; the reconciler did not record which check failed';
+    // What refused and what to change, when the reconciler recorded them
+    // (OSK-12137). A machine failure has a specific fix; printing only the
+    // verdict would send the owner to read run history for it.
+    const code = typeof liveness.diagnosisCode === 'string' && liveness.diagnosisCode
+        ? ` (${liveness.diagnosisCode})`
+        : '';
     const since = typeof liveness.unhealthySinceAt === 'string' ? ` (since ${liveness.unhealthySinceAt})` : '';
-    return `${clause}${since}`;
+    const fix = typeof liveness.diagnosisFix === 'string' && liveness.diagnosisFix
+        ? ` — ${liveness.diagnosisFix}`
+        : '';
+    return `${clause}${code}${since}${fix}`;
 }
 /** Render an interval back as a compact human string. */
 function describeIntervalMs(ms) {
@@ -1013,6 +1053,11 @@ function describeWakeDecision(check) {
     if (verdict === 'skipped') {
         const reason = typeof entry.reason === 'string' ? entry.reason : '';
         if (reason === 'posture_does_not_admit_agent_run') {
+            // The server names the commonest cause on the check's `stop`: nothing
+            // was open to act on. "record_only" alone read as a setting to change
+            // when the remedy was to give the Commitment some work (OSK-12090).
+            if (check.stop?.reason === 'no_open_loop')
+                return 'no — nothing open';
             const posture = typeof entry.posture === 'string' ? entry.posture : '';
             return posture ? `no — ${posture}` : 'no — posture';
         }

package/dist/lib/config.d.ts

@@ -29,6 +29,23 @@ export interface CliConfig {
      * different daemonId.
      */
     cliId?: string;
+    /**
+     * The CLI identity of ONE named profile (OSK-12156), stored in that profile's
+     * own file and never in the machine file.
+     *
+     * `cliId` above is machine-scoped, so every profile used to present it — and
+     * the server's `cli-handoff/confirm` retires every OTHER live family of
+     * (user, cliId), so one profile's daemon-brokered login silently ended
+     * another's session. This is issued ONLY to a named profile that holds no
+     * stored credential at the moment it signs in (`cli-identity.ts`), because
+     * an existing session was minted under the machine id and a refresh that
+     * presents another is refused: a profile that already has a session keeps
+     * presenting the id it was minted under, so an upgrade forces no re-login.
+     *
+     * Never read this field, or `cliId`, to decide what to PRESENT — call
+     * `resolveCliId()` (`cli-id.ts`), the one resolver every caller goes through.
+     */
+    profileCliId?: string;
     /**
      * OSK-3892 — the agent a locally-hosted `skrr code` session is attributed to.
      *

package/dist/lib/config.js

@@ -53,6 +53,7 @@ const os = __importStar(require("node:os"));
 const path = __importStar(require("node:path"));
 const keychain_1 = require("./keychain");
 const auth_core_1 = require("@skrr-ai/auth-core");
+const cli_id_1 = require("./cli-id");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // Both from config/public-endpoints.json, the one domain contract, rather than a
 // fourth hand-copied pair. The CLI previously knew only about dev — there was no
@@ -174,7 +175,8 @@ const ENV_VAR = {
     serverUrl: 'OVERSKY_SERVER_URL',
     token: 'OVERSKY_TOKEN',
     refreshToken: 'OVERSKY_REFRESH_TOKEN',
-    cliId: 'OVERSKY_CLI_ID',
+    // OVERSKY_CLI_ID / SKRR_CLI_ID: `envCliIdOverride` (cli-id.ts), which
+    // `resolveCliId` shares, so the overlay and the resolver cannot disagree.
 };
 /**
  * Read one overlay variable under either prefix.
@@ -215,8 +217,8 @@ function overlayEnv(cfg) {
     const rt = envOverlayValue('refreshToken');
     if (rt && rt.length > 0)
         out.refreshToken = rt;
-    const cid = envOverlayValue('cliId');
-    if (cid && cid.length > 0)
+    const cid = (0, cli_id_1.envCliIdOverride)();
+    if (cid)
         out.cliId = cid;
     return out;
 }
@@ -275,6 +277,16 @@ function newConfigDir() {
  * and rejects a rotation against a different one. Split it per profile and a
  * second profile does not degrade — it fails to stay logged in.
  *
+ * So `cliId` stays here, and a profile's OWN identity is a different key,
+ * `profileCliId`, which is profile-scoped (OSK-12156). Sharing the machine id
+ * meant the server's cli-handoff confirm — which retires the other families of
+ * (user, cliId) — could not tell two profiles of one user apart, so one
+ * profile's daemon-brokered login ended another's session. A named profile that
+ * signs in holding no credential is now issued its own id; a profile that
+ * already has a session keeps the machine id it was minted under, because a
+ * refresh presenting another is refused. `resolveCliId()` (`cli-id.ts`) is the
+ * one reader.
+ *
  * `credentials.store` is a machine posture (keychain / file / env-only), and
  * `migrated` is a breadcrumb about this machine's DISK LAYOUT. Neither is a
  * property of which deployment you are addressing.

package/dist/lib/daemonBroker.d.ts

@@ -122,7 +122,7 @@ export interface DaemonBrokeredOutcome {
  * fall through to PKCE; `ci_token_refused` is the one we surface
  * because re-driving it via PKCE would not change the outcome.
  */
-export type DaemonBrokerErrorReason = 'no_bootstrap' | 'stale_bootstrap' | 'bootstrap_parse' | 'base_url_mismatch' | 'daemon_not_authed' | 'ci_token_refused' | 'handoff_broker_only' | 'rate_limited' | 'server_error' | 'network' | 'timeout' | 'unknown';
+export type DaemonBrokerErrorReason = 'no_bootstrap' | 'stale_bootstrap' | 'bootstrap_parse' | 'base_url_mismatch' | 'daemon_not_authed' | 'ci_token_refused' | 'handoff_broker_only' | 'rate_limited' | 'upstream_refused' | 'server_error' | 'network' | 'timeout' | 'unknown';
 export interface DaemonBrokerFailure {
     ok: false;
     reason: DaemonBrokerErrorReason;
@@ -132,12 +132,40 @@ export interface DaemonBrokerFailure {
     status?: number;
     /** Server-supplied error code when present (e.g. 'CI_TOKEN_REFUSED'). */
     code?: string;
+    /**
+     * Who refused, when the daemon answered at all: `daemon` for a refusal the
+     * local service made itself (not signed in, broker-only, its own outage),
+     * `server` for the skrr server's refusal of the daemon's request, carried
+     * through the loopback route (`upstreamCode` on the token route, the
+     * verbatim body on the legacy one). The two have different repairs, and a
+     * caller that cannot tell them apart can only say "Not signed in"
+     * (OSK-12149).
+     */
+    refusedBy?: 'daemon' | 'server';
     /**
      * For `base_url_mismatch`: the daemon's serverUrl, so the caller can
      * surface a helpful hint like "run `skrr login --base-url <X>` to use
      * the daemon".
      */
     daemonServerUrl?: string;
+    /**
+     * The descriptor file the outcome came from. For `base_url_mismatch` found
+     * locally it is the file that named `daemonServerUrl`, so a message can say
+     * what was read rather than assert where "the" daemon is logged in
+     * (OSK-12117). For a refusal it is the descriptor whose daemon answered —
+     * which is how a caller knows the answer came from a Dedicated Runtime
+     * guest's daemon (`DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR`), where nobody
+     * signs in and the repair is the machine, not a login.
+     */
+    descriptorPath?: string;
+    /** The answering daemon's id, from its descriptor, when it published one. */
+    daemonId?: string;
+    /**
+     * True when the answering descriptor is a Dedicated Runtime guest's
+     * (`DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR`): nobody signs in there, so
+     * the repair for a refusal is the machine, never a login.
+     */
+    dedicatedGuest?: boolean;
 }
 export type DaemonBrokerOutcome = (DaemonBrokerResult & {
     ok: true;
@@ -224,6 +252,14 @@ export declare function resolveBootstrapCandidatePaths(profile?: string): string
 export declare const DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR = "/run/skrr-dedicated-runtime/cli-handoff/descriptor.json";
 /** Where the cli-handoff broker looks, in order. */
 export declare function resolveCliHandoffCandidatePaths(profile?: string): string[];
+/**
+ * The island files that belong to exactly `profile` — its canonical path and
+ * the pre-rename darwin location — and never another profile's. The broker's
+ * candidate list for `default` deliberately falls through to any running
+ * profile, which is right for borrowing a credential and wrong for naming
+ * which daemon a profile's status describes (OSK-12102).
+ */
+export declare function resolveExactProfileBootstrapPaths(profile?: string): string[];
 /**
  * Resolve the first live daemon bootstrap for a profile. Message-intent
  * submission reuses the same authenticated loopback discovery as the login