@skrr-ai/cli 0.1.56 → 0.1.58

package/dist/lib/daemonHandoff.js

@@ -5,6 +5,7 @@ const node_child_process_1 = require("node:child_process");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
 const daemon_handoff_opt_out_1 = require("./daemon-handoff-opt-out");
+const dedicated_service_1 = require("./dedicated-service");
 const exec_runtime_binary_1 = require("./exec-runtime-binary");
 const keychain_1 = require("./keychain");
 /**
@@ -196,6 +197,41 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
             detail: 'the local daemon brokered this login, so it already has a working credential',
         };
     }
+    // A Dedicated Runtime guest's daemon belongs to the platform: the image
+    // installs it, the platform signs it in, and it runs as a uid the workload
+    // cannot touch. A person's login is theirs alone and is never handed to it,
+    // and there is nothing for them to install. Without this the workload found
+    // no daemon it could use and login ended by telling them to run
+    // `skrr daemon install` on a machine where that is wrong (OSK-12296).
+    //
+    // Detected the way the rest of the CLI detects a guest — the workload uid
+    // stamp, or the guest markers the image and daemon own, among them the
+    // hand-off descriptor directory under /run/skrr-dedicated-runtime.
+    if ((0, dedicated_service_1.runningOnDedicatedRuntimeGuest)(env)) {
+        return {
+            status: 'skipped',
+            reason: 'platform-managed',
+            detail: "this machine's daemon is managed by the platform",
+        };
+    }
+    // A relocated config root (`SKRR_CONFIG_DIR`) is a second sign-in on this
+    // machine, not the machine's sign-in. The installed daemon service carries no
+    // config-root override, so it reads the DEFAULT root — its credential, its
+    // deployment, its account belong there. Offering this root's login to it would
+    // re-point the machine at whatever this root signed in as, and when the server
+    // refused the offer the CLI used to report a healthy, signed-in daemon as
+    // "not signed in" and send the user to re-login it (OSK-12189).
+    //
+    // Decided on the root alone, before anything is spawned or minted: nothing
+    // about this machine's daemon should change because a second root signed in.
+    if (!(0, config_1.isDefaultConfigRoot)(env)) {
+        return {
+            status: 'skipped',
+            reason: 'foreign-root',
+            detail: `this login is in the config root ${(0, config_1.configRoot)(env)}; the local daemon ` +
+                `belongs to ${(0, config_1.defaultConfigRoot)()} and keeps its own sign-in`,
+        };
+    }
     const binary = (0, exec_runtime_binary_1.findRuntimeBinary)();
     if (!binary) {
         return { status: 'skipped', reason: 'no-binary', detail: 'no local daemon installed' };
@@ -264,7 +300,9 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
         }));
     }
     catch (err) {
-        return { status: 'failed', detail: err.message };
+        // Refused BEFORE the daemon was touched: it still holds exactly the
+        // credential it had, so this is "not handed this login", never "signed out".
+        return { status: 'failed', reason: 'mint-refused', detail: err.message };
     }
     const payload = JSON.stringify({
         refreshToken: bundle.refreshToken,

package/dist/lib/internal-id.d.ts

@@ -0,0 +1,28 @@
+/**
+ * The internal Mongo `_id` handed back where a command wants the `id`.
+ *
+ * `--json` prints every row's `_id` FIRST, so it is the value a person or a
+ * script copies. Spaces and Tasks are addressed by `id` (a UUID) everywhere in
+ * the API, and no resolver accepts both forms, so `spaces show <_id>`,
+ * `tasks show <_id>` and `tasks create --space <_id>` answered with not-found
+ * or a raw HTTP 404 — true, and no help: nothing said which field to use
+ * (OSK-12205).
+ *
+ * Only the refusal lives here. Finding the `id` that goes with an `_id` needs
+ * a listing, so the caller does that (it holds the API) and passes the answer
+ * in when it has one.
+ */
+/** A 24-hex Mongo ObjectId, the shape of `_id`. */
+export declare function looksLikeInternalObjectId(value: string): boolean;
+/**
+ * The sentence for an `_id` passed where the `id` belongs.
+ *
+ * `canonicalId` is the row's `id` when the caller could find it — then the
+ * remedy is the exact value to use. Without it the remedy names the field.
+ */
+export declare function describeInternalIdMisuse(opts: {
+    value: string;
+    noun: 'space' | 'task';
+    canonicalId?: string | null;
+    bin: string;
+}): string;

package/dist/lib/internal-id.js

@@ -0,0 +1,41 @@
+"use strict";
+/**
+ * The internal Mongo `_id` handed back where a command wants the `id`.
+ *
+ * `--json` prints every row's `_id` FIRST, so it is the value a person or a
+ * script copies. Spaces and Tasks are addressed by `id` (a UUID) everywhere in
+ * the API, and no resolver accepts both forms, so `spaces show <_id>`,
+ * `tasks show <_id>` and `tasks create --space <_id>` answered with not-found
+ * or a raw HTTP 404 — true, and no help: nothing said which field to use
+ * (OSK-12205).
+ *
+ * Only the refusal lives here. Finding the `id` that goes with an `_id` needs
+ * a listing, so the caller does that (it holds the API) and passes the answer
+ * in when it has one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.looksLikeInternalObjectId = looksLikeInternalObjectId;
+exports.describeInternalIdMisuse = describeInternalIdMisuse;
+const OBJECT_ID_RE = /^[0-9a-fA-F]{24}$/;
+/** A 24-hex Mongo ObjectId, the shape of `_id`. */
+function looksLikeInternalObjectId(value) {
+    return OBJECT_ID_RE.test(value.trim());
+}
+/**
+ * The sentence for an `_id` passed where the `id` belongs.
+ *
+ * `canonicalId` is the row's `id` when the caller could find it — then the
+ * remedy is the exact value to use. Without it the remedy names the field.
+ */
+function describeInternalIdMisuse(opts) {
+    const { value, noun, canonicalId, bin } = opts;
+    const head = `"${value.trim()}" is the internal _id of a ${noun}; commands take its \`id\``;
+    if (canonicalId) {
+        return `${head}. Use \`id\` ${canonicalId}.`;
+    }
+    const alternatives = noun === 'task'
+        ? 'the `id` field (a UUID) or the `identifier` (OSK-123) from the same --json output'
+        : 'the `id` field (a UUID) or the `identifier` (OSK-S-12) from the same --json output';
+    return (`${head}.\n` +
+        `  → use ${alternatives}; \`${bin} ${noun === 'task' ? 'tasks' : 'spaces'} list --json\` prints both.`);
+}

package/dist/lib/login.js

@@ -332,7 +332,7 @@ async function cliLoginWithRefreshToken(opts) {
         ...(pair.accessExpiresAt !== undefined ? { expiresAt: pair.accessExpiresAt } : {}),
         refreshToken: pair.refreshToken,
         ...(pair.refreshExpiresAt !== undefined ? { refreshExpiresAt: pair.refreshExpiresAt } : {}),
-    }, { serverOrigin: serverUrl, clearReauth: true });
+    }, { serverOrigin: serverUrl, clearReauth: true, provenance: 'user_login' });
     return {
         token: accessToken,
         refreshToken: pair.refreshToken,
@@ -490,7 +490,7 @@ async function runDeviceCode(serverUrl, cliId, reason, ssh, errorMessage) {
                     : {}),
             }
             : {}),
-    }, { serverOrigin: serverUrl, clearReauth: true });
+    }, { serverOrigin: serverUrl, clearReauth: true, provenance: 'user_login' });
     console.log('  ✓ Authorized.');
     return {
         token: approved.token,

package/dist/lib/oauthLogin.js

@@ -366,7 +366,9 @@ async function runOAuthLogin(opts) {
                     // server URL — daemonBroker.ts:543, login.ts:322, refresh.ts:282 —
                     // so this was the lone outlier, and it only bites a deployment
                     // whose web and API origins differ.
-                    { serverOrigin: requestedServerUrl, clearReauth: true });
+                    // A person signed in on purpose: a brokered Dedicated guest must
+                    // keep this family rather than retire it as pre-broker (OSK-12293).
+                    { serverOrigin: requestedServerUrl, clearReauth: true, provenance: 'user_login' });
                     console.log('  ✓ Login successful! Token saved.');
                     finish({
                         ok: true,

package/dist/lib/workflow-state-hint.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The remedy for `tasks move --status <unknown>` (OSK-12205).
+ *
+ * Workflow states are Space-local, so the CLI cannot declare them as flag
+ * options and cannot list them ahead of the refusal. The server now names the
+ * accepted states in its message (and in `details.validStates`); this adds the
+ * command that lists them with their types, and quotes the states itself when
+ * a server sent them only in `details`.
+ */
+export declare function describeUnknownWorkflowState(body: Record<string, unknown> | undefined, bin: string): string | null;

package/dist/lib/workflow-state-hint.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeUnknownWorkflowState = describeUnknownWorkflowState;
+/**
+ * The remedy for `tasks move --status <unknown>` (OSK-12205).
+ *
+ * Workflow states are Space-local, so the CLI cannot declare them as flag
+ * options and cannot list them ahead of the refusal. The server now names the
+ * accepted states in its message (and in `details.validStates`); this adds the
+ * command that lists them with their types, and quotes the states itself when
+ * a server sent them only in `details`.
+ */
+function describeUnknownWorkflowState(body, bin) {
+    if (!body || body.code !== 'WORKFLOW_STATE_UNKNOWN')
+        return null;
+    const details = (body.details ?? {});
+    const valid = Array.isArray(details.validStates)
+        ? details.validStates.filter((v) => typeof v === 'string')
+        : [];
+    let message = typeof body.error === 'string' && body.error ? body.error : 'Unknown workflow state';
+    if (valid.length > 0 && !message.includes(valid[0])) {
+        message += `. This Space accepts: ${valid.join(', ')}.`;
+    }
+    return (`${message}\n` +
+        `  → \`${bin} spaces states list <space-id>\` lists this Space's states with their types; ` +
+        '`--status` takes a state id or its display name.');
+}