@skrr-ai/cli 0.1.53 → 0.1.54

package/dist/commands/tasks/approvals/list.d.ts

@@ -30,10 +30,46 @@ export declare function approvalRow(a: Record<string, unknown>): {
  * on an older run that a later run got past is history, not the current state.
  */
 export declare function permissionBlockedRun(runs: Array<Record<string, unknown>>): Record<string, unknown> | null;
+/** One refused call: the tool and its input, as the run recorded them. */
+export type PermissionRefusal = {
+    tool: string | null;
+    input: string;
+};
+/** One way forward, as a command a person or a script can run. */
+export type PermissionBlockRemedy = {
+    action: 'run_interactively' | 'allow_unattended' | 'restart';
+    command: string;
+    description: string;
+};
+/**
+ * The structured answer `--json` carries as `blockedRun` (OSK-12173). Before
+ * this the explanation existed only as prose, and with `--json` only on
+ * stderr, so a script reading the JSON saw `{"data":[]}` and nothing to act on.
+ */
+export type BlockedRunSummary = {
+    runId: string;
+    failureCode: string;
+    /** The cause, from the run's own sentence, without its generic remedy. */
+    reason: string | null;
+    agentId: string | null;
+    /**
+     * The refused calls with their inputs. Empty when the run recorded none
+     * (runs finalized before the server kept them, or evidence without an input
+     * preview). Never inferred.
+     */
+    refused: PermissionRefusal[];
+    remedies: PermissionBlockRemedy[];
+};
+/**
+ * The block as data: which run, why, what was refused, and the ways forward
+ * with the agent id filled in (`<agent>` only when the run recorded no agent).
+ */
+export declare function blockedRunSummary(run: Record<string, unknown>, bin?: string, taskRef?: string): BlockedRunSummary;
 /**
  * What to print for such a run: why it is blocked, what needed approval (the
- * run's own recorded sentence, which names the refused tool), that an
- * unattended run cannot prompt, and the two ways forward with exact commands.
+ * run's own sentence, plus each refused input it recorded), that an unattended
+ * run cannot prompt, and the ways forward, each stated once with the real
+ * agent id.
  */
 export declare function permissionBlockLines(run: Record<string, unknown>, bin?: string, taskRef?: string): string[];
 export default class TasksApprovalsList extends BaseCommand {

package/dist/commands/tasks/approvals/list.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.approvalRow = approvalRow;
 exports.permissionBlockedRun = permissionBlockedRun;
+exports.blockedRunSummary = blockedRunSummary;
 exports.permissionBlockLines = permissionBlockLines;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
@@ -46,28 +47,107 @@ function permissionBlockedRun(runs) {
     const code = latest.failureCode ?? latest.failureClass;
     return code === data_provider_1.PERMISSION_BLOCKED_FAILURE_CODE ? latest : null;
 }
+/**
+ * Where the run's own fix begins in its recorded sentence.
+ *
+ * The server writes `failureReason` as the cause followed by the fix
+ * (`permissionBlockedRun.PERMISSION_BLOCK_GUIDANCE`), and that fix names the
+ * agent only as `<agent>` because the sentence is shared by every surface.
+ * This command knows the agent, so it states the fix itself, with the real id,
+ * and keeps only the cause from the sentence (OSK-12173): printing both showed
+ * the remedy twice, once with a placeholder.
+ */
+const RECORDED_REMEDY_MARKER = 'Re-running will be refused';
+function refusalsOf(run) {
+    const raw = run.permissionRefusals;
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const entry of raw) {
+        if (!entry || typeof entry !== 'object')
+            continue;
+        const { tool, input } = entry;
+        if (typeof input !== 'string' || !input.trim())
+            continue;
+        out.push({ tool: typeof tool === 'string' && tool ? tool : null, input: input.trim() });
+    }
+    return out;
+}
+/** The cause, cut before the recorded remedy; `<agent>` filled in if any survives. */
+function blockReason(run, agentId) {
+    const full = typeof run.failureReason === 'string' ? run.failureReason.trim() : '';
+    if (!full)
+        return null;
+    const at = full.indexOf(RECORDED_REMEDY_MARKER);
+    const cause = at > 0 ? full.slice(0, at).trim() : full;
+    return agentId ? cause.split('<agent>').join(agentId) : cause;
+}
+/**
+ * The block as data: which run, why, what was refused, and the ways forward
+ * with the agent id filled in (`<agent>` only when the run recorded no agent).
+ */
+function blockedRunSummary(run, bin = 'skrr', taskRef = '<task-id>') {
+    const executor = run.executor;
+    const agentId = executor && typeof executor.agentId === 'string' && executor.agentId ? executor.agentId : null;
+    const agent = agentId ?? '<agent>';
+    const code = run.failureCode ?? run.failureClass;
+    return {
+        runId: String(run.runId ?? run.id ?? '-'),
+        failureCode: typeof code === 'string' ? code : data_provider_1.PERMISSION_BLOCKED_FAILURE_CODE,
+        reason: blockReason(run, agentId),
+        agentId,
+        refused: refusalsOf(run),
+        remedies: [
+            {
+                action: 'run_interactively',
+                command: `${bin} agents chat ${agent} --approve-tools --prompt "..."`,
+                description: 'Do the work interactively, approving each call.',
+            },
+            {
+                action: 'allow_unattended',
+                command: `${bin} agents update ${agent} --default-permission-mode bypassPermissions`,
+                description: 'Let unattended runs use the tool without asking.',
+            },
+            {
+                action: 'restart',
+                command: `${bin} tasks start ${taskRef}`,
+                description: 'Start the task again once its agent may use the tool (or pick an agent/harness whose mode allows it).',
+            },
+        ],
+    };
+}
+const SHELL_TOOL = /^(bash|shell|local_shell|exec_command|commandexecution|command_execution)$/i;
+function toolLabel(tool) {
+    if (!tool)
+        return '';
+    return SHELL_TOOL.test(tool) ? ' (shell)' : ` (${tool})`;
+}
 /**
  * What to print for such a run: why it is blocked, what needed approval (the
- * run's own recorded sentence, which names the refused tool), that an
- * unattended run cannot prompt, and the two ways forward with exact commands.
+ * run's own sentence, plus each refused input it recorded), that an unattended
+ * run cannot prompt, and the ways forward, each stated once with the real
+ * agent id.
  */
 function permissionBlockLines(run, bin = 'skrr', taskRef = '<task-id>') {
-    const runId = String(run.runId ?? run.id ?? '-');
-    const reason = typeof run.failureReason === 'string' ? run.failureReason.trim() : '';
-    const executor = run.executor;
-    const agent = executor && typeof executor.agentId === 'string' && executor.agentId
-        ? executor.agentId
-        : '<agent>';
+    const summary = blockedRunSummary(run, bin, taskRef);
+    const reason = summary.reason ?? '';
+    // The sentence already quotes a lone refused input (shortened); list an
+    // input only when the sentence does not already show it.
+    const refusedLines = summary.refused
+        .filter((refusal) => !reason.includes(refusal.input.slice(0, 60)))
+        .map((refusal) => `  Refused: ${refusal.input}${toolLabel(refusal.tool)}`);
+    const [chat, update, restart] = summary.remedies;
     return [
-        `The latest run (${runId}) is blocked on a permission, not on an approval request.`,
+        `The latest run (${summary.runId}) is blocked on a permission, not on an approval request.`,
         ...(reason ? [`  ${reason}`] : []),
+        ...refusedLines,
         'It ran unattended (`tasks start`), and an unattended run cannot prompt anyone to approve a',
         'tool call, so the ask was refused on the spot and no approval request was recorded here.',
         '',
         'To continue, either:',
-        `  ${bin} agents chat ${agent} --approve-tools --prompt "..."   do the work interactively, approving each call`,
-        `  ${bin} agents update ${agent} --default-permission-mode bypassPermissions   let unattended runs use the tool`,
-        `  then: ${bin} tasks start ${taskRef}   (or pick an agent/harness whose mode allows it)`,
+        `  ${chat.command}   do the work interactively, approving each call`,
+        `  ${update.command}   let unattended runs use the tool`,
+        `  then: ${restart.command}   (or pick an agent/harness whose mode allows it)`,
     ];
 }
 class TasksApprovalsList extends base_command_1.BaseCommand {
@@ -98,25 +178,37 @@ class TasksApprovalsList extends base_command_1.BaseCommand {
         // row, so the empty list alone would say "nothing to act on" about a task
         // that is waiting on exactly that. Read the latest run, best-effort: the
         // approvals list is still the answer if the runs read fails.
+        // `runsRead` separates "the latest run is not blocked" from "we could not
+        // look": only the first may be reported to a script as `blockedRun: null`.
         let blockedRun = null;
+        let runsRead = false;
         try {
             const runs = (await data_provider_1.dataService.getTaskRuns(args.id));
             blockedRun = permissionBlockedRun(runs?.data ?? []);
+            runsRead = true;
         }
         catch {
             blockedRun = null;
         }
-        const blockLines = blockedRun ? permissionBlockLines(blockedRun, this.config.bin, args.id) : [];
         if (flags.json) {
-            // The server payload stays byte-identical; the pointer goes to stderr so
-            // `--json` remains parseable and a script still learns the task is stuck.
-            if (blockedRun) {
-                this.warn(`The latest run is blocked on a permission an unattended run could not ask for; ` +
-                    `\`${this.config.bin} tasks approvals list ${args.id}\` (without --json) says what to do.`);
-            }
-            this.log(JSON.stringify(response, null, 2));
+            // OSK-12173 — the server payload is kept as it was (`data` unchanged)
+            // and the block is added beside it as data a script can act on:
+            // `blockedRun` is the summary, or null when the latest run is not
+            // blocked. It is omitted when the runs could not be read, because null
+            // would claim a state nobody checked.
+            const payload = response && typeof response === 'object' && !Array.isArray(response)
+                ? response
+                : { data: items };
+            const out = runsRead
+                ? {
+                    ...payload,
+                    blockedRun: blockedRun ? blockedRunSummary(blockedRun, this.config.bin, args.id) : null,
+                }
+                : payload;
+            this.log(JSON.stringify(out, null, 2));
             return;
         }
+        const blockLines = blockedRun ? permissionBlockLines(blockedRun, this.config.bin, args.id) : [];
         if (items.length === 0) {
             this.log('No approval requests.');
             if (blockLines.length > 0) {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -329,14 +329,18 @@ async function consolidateWrappedDek(profile, kek, aad) {
     };
     // The paths go in the MESSAGE, not only the metadata: a log pipeline that
     // drops structured fields would otherwise render this as an unactionable
-    // noun. Naming the remedy matters too — logging out on one side deletes that
-    // side's key and lets the next start adopt the other.
+    // noun. Naming the remedy matters too, and it has to be one that converges
+    // (OSK-12172). Only the CLI's logout deletes a key, and only the canonical
+    // one; a daemon logout deletes neither. So the CLI logs out, the daemon
+    // BINARY restarts and adopts its legacy key into the empty canonical slot,
+    // and the CLI logs back in on it. Not `skrr daemon restart`: any `skrr`
+    // command mints a fresh key into an empty slot before doing anything else.
     (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs; ` +
         `refusing to choose. Keeping ${_pathConflict.legacyPath} and leaving ` +
         `${_pathConflict.canonicalPath} untouched. Each side can still read its own ` +
-        "credentials, and neither can read the other's. To converge, log out on one " +
-        `side (\`${(0, runtime_js_1.getAuthBinaryName)()} logout\` here) and log back in; the surviving key ` +
-        'is then adopted by both.');
+        "credentials, and neither can read the other's. Do not delete " +
+        `${_pathConflict.legacyPath}: it is the key the daemon reads. To converge on it, ` +
+        'run `skrr logout && skrrd restart && skrr login`.');
 }
 /**
  * Initialize the envelope path. Idempotent — second call when state is

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -47,7 +47,7 @@ import lockfile from 'proper-lockfile';
 import { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, isEnvelopeString as isCredEnvelopeString, generateDek, serialize as credEnvelopeSerialize, } from './credentialEnvelope.js';
 import { getKekStrategy, zeroizeKekCaches } from './kek/index.js';
 import { consolidateProfileState, profileStateDir, profileStateFilePathsToClear, resolveProfileStateFile, } from './profileStateDir.js';
-import { emitAuthTelemetry, getAuthBinaryName, getAuthLogger, getCredEnvelopeFailClosed, } from './runtime.js';
+import { emitAuthTelemetry, getAuthLogger, getCredEnvelopeFailClosed } from './runtime.js';
 /**
  * Account name the wrapped DEK lives under (file fallback). Keeping the
  * literal here so a future rename surfaces as a single grep target.
@@ -309,14 +309,18 @@ async function consolidateWrappedDek(profile, kek, aad) {
     };
     // The paths go in the MESSAGE, not only the metadata: a log pipeline that
     // drops structured fields would otherwise render this as an unactionable
-    // noun. Naming the remedy matters too — logging out on one side deletes that
-    // side's key and lets the next start adopt the other.
+    // noun. Naming the remedy matters too, and it has to be one that converges
+    // (OSK-12172). Only the CLI's logout deletes a key, and only the canonical
+    // one; a daemon logout deletes neither. So the CLI logs out, the daemon
+    // BINARY restarts and adopts its legacy key into the empty canonical slot,
+    // and the CLI logs back in on it. Not `skrr daemon restart`: any `skrr`
+    // command mints a fresh key into an empty slot before doing anything else.
     getAuthLogger().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs; ` +
         `refusing to choose. Keeping ${_pathConflict.legacyPath} and leaving ` +
         `${_pathConflict.canonicalPath} untouched. Each side can still read its own ` +
-        "credentials, and neither can read the other's. To converge, log out on one " +
-        `side (\`${getAuthBinaryName()} logout\` here) and log back in; the surviving key ` +
-        'is then adopted by both.');
+        "credentials, and neither can read the other's. Do not delete " +
+        `${_pathConflict.legacyPath}: it is the key the daemon reads. To converge on it, ` +
+        'run `skrr logout && skrrd restart && skrr login`.');
 }
 /**
  * Initialize the envelope path. Idempotent — second call when state is

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.6",
+  "version": "0.4.7",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {