@skrr-ai/cli 0.1.57 → 0.1.59

package/dist/base-command.d.ts

@@ -20,22 +20,6 @@ type OclifFlagOutput = {
 type OclifArgOutput = {
     [name: string]: unknown;
 };
-/**
- * Base class for every CLI command.
- *
- * Responsibilities:
- * - Run the one-shot auth-out-of-config migration (Phase H).
- * - Parse global flags (`--bare`, `--token`) from argv once and thread
- *   them through the credential resolver and the HTTP adapter.
- * - Resolve the active credential via the CredentialResolver chain —
- *   flag → env → helper → keychain → file (Phase H.1). Returns the
- *   source name for display in `skrr whoami` / `skrr doctor`.
- * - Wire the Node HttpAdapter into @skrr-ai/data-provider so
- *   `dataService.*` calls use our fetch-based transport with bearer
- *   auth that matches what the resolver surfaced.
- * - Provide `requireAuth()` for commands that need a signed-in user,
- *   and `handleApiError()` for uniform error translation.
- */
 export declare abstract class BaseCommand extends Command {
     /** Add the owning agent's web detail link without overwriting resource URLs. */
     protected withAgentContext<T>(agentId: string, value: T): T & {

package/dist/base-command.js

@@ -16,6 +16,7 @@ exports.isDaemonScopedCredential = isDaemonScopedCredential;
 exports.describeDaemonScopedCredential = describeDaemonScopedCredential;
 exports.isTypedServerRefusal = isTypedServerRefusal;
 exports.isRetryableFailure = isRetryableFailure;
+const node_fs_1 = require("node:fs");
 const core_1 = require("@oclif/core");
 Object.defineProperty(exports, "Flags", { enumerable: true, get: function () { return core_1.Flags; } });
 const option_hint_1 = require("./lib/option-hint");
@@ -51,6 +52,7 @@ const update_check_1 = require("./lib/update-check");
 const web_url_1 = require("./lib/web-url");
 const edge_error_page_1 = require("./lib/edge-error-page");
 const delegated_cli_1 = require("./lib/delegated-cli");
+const dedicated_guest_1 = require("./lib/dedicated-guest");
 const tasks_1 = require("./lib/tasks");
 function assigneePayloadNeedsResolution(payload) {
     const fields = [
@@ -82,6 +84,25 @@ function assigneePayloadNeedsResolution(payload) {
  * - Provide `requireAuth()` for commands that need a signed-in user,
  *   and `handleApiError()` for uniform error translation.
  */
+/**
+ * On a Dedicated Runtime guest, the description of a daemon that did not
+ * answer the hand-off at all — revoked and exited, cycling under systemd, or
+ * gone behind a stale descriptor (OSK-12473). Null anywhere else, where "Not
+ * signed in. Run `skrr login` first." is the right sentence.
+ */
+function describeAbsentGuestDaemon(outcome, bin) {
+    const onGuest = outcome.dedicatedGuest === true || (0, dedicated_guest_1.runningOnDedicatedRuntimeGuest)();
+    if (!onGuest)
+        return null;
+    let descriptorPresent = false;
+    try {
+        descriptorPresent = (0, node_fs_1.existsSync)(daemonBroker_1.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR);
+    }
+    catch {
+        /* unreadable reads as absent */
+    }
+    return (0, daemonBrokerRefusal_1.describeGuestDaemonUnavailable)(outcome, { bin, onGuest, descriptorPresent });
+}
 class BaseCommand extends core_1.Command {
     /** Add the owning agent's web detail link without overwriting resource URLs. */
     withAgentContext(agentId, value) {
@@ -375,7 +396,9 @@ class BaseCommand extends core_1.Command {
                         }
                         : null;
                 }
-                else if ((this.brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin))) {
+                else if ((this.brokerRefusal =
+                    (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin) ??
+                        describeAbsentGuestDaemon(autoResult.outcome, this.config.bin))) {
                     // Reported by requireAuth(); nothing to print here.
                 }
                 else if (autoResult.outcome.reason === 'rate_limited') {
@@ -1140,19 +1163,45 @@ class BaseCommand extends core_1.Command {
                         bin: this.config.bin,
                         cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
                     });
-                this.failWithCliError({
-                    message: say(presentedCiToken
-                        ? `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
+                // OSK-12474 — `apiFetch` asked the local daemon for a hand-off after the
+                // refused refresh, and the daemon refused too. Its reason decides the
+                // repair (OSK-12149, OSK-12151), and on a Dedicated guest there is no
+                // login to run, so its remedy replaces the generic "Run login".
+                const brokerRefusal = presentedCiToken || !e.brokerFailure
+                    ? null
+                    : (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin);
+                const renewal = refreshRefusal
+                    ? refreshRefusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
+                    : "This CLI's own sign-in could not be renewed.";
+                const details = {
+                    ...(refreshRefusal && bodyCode ? { accessTokenCode: bodyCode } : {}),
+                    ...(brokerRefusal
+                        ? { broker: brokerRefusal.broker, suggestion: brokerRefusal.remedy }
+                        : {}),
+                };
+                let authMessage;
+                if (presentedCiToken) {
+                    authMessage =
+                        `Authentication failed: this is an \`osk_ci_*\` token, which only bootstraps a ` +
                             `daemon (\`OVERSKY_TOKEN=<token> skrrd start\`). ${this.config.bin} commands do ` +
-                            `not accept it — sign in with \`${this.config.bin} login\` instead.`
-                        : refreshRefusal
-                            ? `Authentication failed. ${refreshRefusal.message}`
-                            : `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`),
+                            `not accept it — sign in with \`${this.config.bin} login\` instead.`;
+                }
+                else if (brokerRefusal) {
+                    authMessage = `Authentication failed. ${renewal} ${brokerRefusal.headline}\n→ ${brokerRefusal.remedy}`;
+                }
+                else if (refreshRefusal) {
+                    authMessage = `Authentication failed. ${refreshRefusal.message}`;
+                }
+                else {
+                    authMessage = `Authentication failed. Run \`${this.config.bin} login\` to sign in again.`;
+                }
+                this.failWithCliError({
+                    message: say(authMessage),
                     code: refreshRefusal?.code || bodyCode || 'AUTHENTICATION_FAILED',
                     status: e.status,
                     exit: exitCode,
                     retryable: true,
-                    ...(refreshRefusal && bodyCode ? { details: { accessTokenCode: bodyCode } } : {}),
+                    ...(Object.keys(details).length > 0 ? { details } : {}),
                 });
             }
             else if ((e.status === 403 || e.status === 504) &&
@@ -1438,9 +1487,14 @@ class BaseCommand extends core_1.Command {
                 bin: this.config.bin,
                 cliId: this.cliConfig ? (0, cli_id_1.resolveCliId)(this.cliConfig) : undefined,
             });
-            const why = refusal
+            const brokerRefusal = e.brokerFailure
+                ? (0, daemonBrokerRefusal_1.describeBrokerRefusal)(e.brokerFailure, this.config.bin)
+                : null;
+            const why = (refusal
                 ? refusal.message.replace(/\s*Run `[^`]+` to sign in again\.$/, '')
-                : 'The server did not accept this sign-in.';
+                : 'The server did not accept this sign-in.') +
+                // OSK-12474 — the daemon was asked for a hand-off and refused; say why.
+                (brokerRefusal ? ` ${brokerRefusal.headline}` : '');
             this.failWithCliError({
                 message: `Authentication failed${statusSuffix}. ${why} Your ${write.summary} was not applied; it ` +
                     `was saved locally as ${queuedId} so it is not lost. Sign in with ` +

package/dist/commands/agents/show.js

@@ -54,8 +54,19 @@ function agentPermissionLines(agent, harness) {
         return [`Permission:  ${stored} — enforced by the ${harness} harness`];
     }
     const lines = [];
-    if (typeof effective.mode === 'string' && effective.mode) {
-        const from = PERMISSION_SOURCE_LABELS[effective.source] ?? effective.source;
+    const from = PERMISSION_SOURCE_LABELS[effective.source] ?? effective.source;
+    if (typeof effective.refusedMode === 'string' && effective.refusedMode) {
+        // OSK-12316: a mode the harness could only honour by WIDENING it is refused
+        // at dispatch (OSK-12154); it does not "run as" anything.
+        const required = typeof effective.requiredMode === 'string' && effective.requiredMode
+            ? effective.requiredMode
+            : null;
+        lines.push(`Permission:  ${effective.refusedMode} (from ${from}) — turns are REFUSED: the ${harness} harness cannot run it without allowing more`);
+        if (required) {
+            lines.push(`${pad}Set ${required} to run (skrr agents update <agent> --default-permission-mode ${required}), or pass --permission-mode for a turn.`);
+        }
+    }
+    else if (typeof effective.mode === 'string' && effective.mode) {
         lines.push(`Permission:  ${effective.mode} (from ${from}) — enforced by the ${harness} harness`);
     }
     else {

package/dist/commands/harnesses/ping.d.ts

@@ -8,6 +8,8 @@ import { BaseCommand } from '../../base-command';
  * sends, and testing for them alone is what made the success branch dead code.
  */
 export declare function isPingSuccess(status: string | undefined): boolean;
+/** The server declared a completed probe failure, not a still-pending poll. */
+export declare function describePingFailure(status: string, error?: string | null): string;
 export default class HarnessesPing extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/harnesses/ping.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isPingSuccess = isPingSuccess;
+exports.describePingFailure = describePingFailure;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../base-command");
 const harnesses_1 = require("../../lib/harnesses");
@@ -31,6 +32,14 @@ const POLL_INTERVAL_MS = 300;
 function isPingSuccess(status) {
     return status === 'completed' || status === 'ok' || status === 'success';
 }
+/** The server declared a completed probe failure, not a still-pending poll. */
+function describePingFailure(status, error) {
+    const detail = typeof error === 'string' && error.trim() ? `: ${error.trim()}` : '.';
+    if (status === 'timeout') {
+        return `Ping timed out${detail} The daemon is registered but may be offline or not responding.`;
+    }
+    return `Ping ${status}${detail} The daemon is registered but may be offline or not responding.`;
+}
 class HarnessesPing extends base_command_1.BaseCommand {
     static description = 'Ping a harness and wait for its daemon to answer (local only)';
     static examples = [
@@ -90,7 +99,7 @@ class HarnessesPing extends base_command_1.BaseCommand {
                     await this.logReadiness(args.harness);
                 }
                 else {
-                    this.log(`Ping ${result.status}${result.error ? `: ${result.error}` : ''}.`);
+                    this.error(describePingFailure(result.status, result.error), { exit: 1 });
                 }
                 return;
             }

package/dist/commands/login.js

@@ -234,6 +234,11 @@ class Login extends base_command_1.BaseCommand {
                 if (handoff.status === 'delivered') {
                     this.log(`The local daemon was signed in too — ${handoff.detail}.`);
                 }
+                else if (handoff.reason === 'platform-managed') {
+                    // A Dedicated guest: its daemon is the platform's, so there is
+                    // nothing to install and nothing to hand over (OSK-12296).
+                    this.log("This machine's daemon is managed by the platform; there is nothing to set up here.");
+                }
                 else if (handoff.reason === 'foreign-root') {
                     // Not a failure and not a hint to re-login anything: the daemon is
                     // the default root's, and this is a second root (OSK-12189).
@@ -391,7 +396,7 @@ class Login extends base_command_1.BaseCommand {
             refreshExpiresAt: result.refreshExpiresAt
                 ? new Date(result.refreshExpiresAt).getTime()
                 : undefined,
-        }, { serverOrigin: this.cliConfig.baseURL, clearReauth: true });
+        }, { serverOrigin: this.cliConfig.baseURL, clearReauth: true, provenance: 'user_login' });
         this.log('');
         this.log(`Signed in as ${result.user.email} via recovery code on ` +
             `${(0, config_1.describeDeployment)(this.cliConfig.baseURL)}.`);

package/dist/commands/logout.d.ts

@@ -5,52 +5,6 @@ export declare function shouldSkipLocalLogout(input: {
     hasUnreadableEncryptedToken: boolean;
     allDevices: boolean;
 }): boolean;
-/**
- * `skrr logout` / `skrr logout --all-devices`
- *
- * Default mode (no flags): revokes the current CLI refresh session on the
- * server (best-effort) and clears every local backend (Keychain on macOS,
- * cli-auth.json fallback, and any legacy token fields in cli-config.json).
- * `baseURL` and `cliId` are preserved so the next `skrr login` defaults to
- * the same host and reuses the per-machine identity (which becomes a new
- * refresh family — server-side revocation invalidated the prior family).
- *
- * `--all-devices` (L7 fleet-grade logout): in addition to the local
- * cleanup, iterate the user's registered daemons and revoke each one
- * server-side. This is the threat-model-correct response for a stolen-
- * laptop scenario where the user wants every persistent daemon credential
- * gone immediately, regardless of which machine they're calling from.
- *
- * Architectural note: the L7 server-side has a bulk endpoint
- * (`POST /api/auth/sessions/revoke-all`) but it requires a user-scope JWT.
- * CLI sessions are minted with `scope: 'cli'` (interactive single-machine
- * use), so they cannot directly hit the bulk endpoint — that's by design,
- * preventing a leaked CLI credential from kicking the user out of every
- * other device. We instead iterate `DELETE /api/daemon-resources/:id`
- * which CLI scope CAN hit (per-resource ownership check, not scope check).
- * N round trips for N daemons; for typical fleet sizes (< 20) this is
- * sub-second. Each per-daemon DELETE produces its own audit row keyed by
- * `'user_initiated_per_device'`, which preserves forensic granularity.
- *
- * The CLI's own refresh session is NOT a Daemon resource (it's a
- * `scope='cli'` refresh-session row with no Daemon FK), so it's invisible
- * to `/api/daemon-resources`. We revoke it separately via
- * `revokeCurrentRefreshToken()`.
- *
- * Ordering rationale for `--all-devices`:
- *   1. `runAllDevices` is attempted first (remote sweep).
- *   2. If it throws (network error, API unreachable), the error is captured
- *      and a warning is emitted — but execution CONTINUES to step 3.
- *      Rationale: a user who runs `logout --all-devices` after a security
- *      incident must not be left with live tokens on disk just because the
- *      API was momentarily unreachable. Local cleanup is always the safer
- *      default; re-running --all-devices later from a connected machine is
- *      idempotent and cleans up whatever the first attempt missed.
- *   3. If the user explicitly declines the confirmation prompt inside
- *      `runAllDevices`, that path calls `this.exit(1)` which invokes
- *      `process.exit` — the try/catch is never reached, so local cleanup
- *      is correctly skipped (user said "abort").
- */
 export default class Logout extends BaseCommand {
     static description: string;
     static flags: {

package/dist/commands/logout.js

@@ -40,6 +40,7 @@ const config_1 = require("../lib/config");
 const first_party_harness_managed_1 = require("../lib/first-party-harness-managed");
 const auth_storage_1 = require("../lib/auth-storage");
 const daemonBroker_1 = require("../lib/daemonBroker");
+const dedicated_service_1 = require("../lib/dedicated-service");
 const refresh_1 = require("../lib/refresh");
 const api_fetch_1 = require("../lib/api-fetch");
 const cred_envelope_1 = require("../lib/cred-envelope");
@@ -97,6 +98,18 @@ function shouldSkipLocalLogout(input) {
  *      `process.exit` — the try/catch is never reached, so local cleanup
  *      is correctly skipped (user said "abort").
  */
+/**
+ * True only on a Dedicated Runtime guest whose platform hand-off can still
+ * serve this CLI. A laptop daemon's island file ALSO advertises
+ * `access_token`, so the descriptor alone is not evidence of a platform-managed
+ * machine: on a laptop, gating on it alone told a person who had just signed
+ * out that "skrr keeps working here through the platform's managed hand-off"
+ * (OSK-12467). The guest markers are what make that sentence true.
+ */
+function platformManagedHandoff() {
+    return (0, dedicated_service_1.runningOnDedicatedRuntimeGuest)() && Boolean((0, daemonBroker_1.findBrokeredHandoffDescriptor)());
+}
+const SIGN_IN_AGAIN = 'To sign in again, run `skrr login`.';
 class Logout extends base_command_1.BaseCommand {
     static description = 'Sign out and clear locally-stored tokens. ' +
         '--all-devices also revokes every registered daemon for this account.';
@@ -134,12 +147,12 @@ class Logout extends base_command_1.BaseCommand {
             // `access_token`) there IS no local credential to clear — the CLI holds
             // a per-process token redeemed over loopback and nothing is persisted.
             // Say that honestly rather than reporting a logout that did not happen.
-            if ((0, daemonBroker_1.findBrokeredHandoffDescriptor)()) {
+            if (platformManagedHandoff()) {
                 this.log("This machine is signed in through the platform's managed hand-off; " +
                     'there is no local credential to clear.');
             }
             else {
-                this.log('Not signed in. Nothing to do.');
+                this.log(`Not signed in. Nothing to do. ${SIGN_IN_AGAIN}`);
             }
             return;
         }
@@ -257,6 +270,19 @@ class Logout extends base_command_1.BaseCommand {
                 : 'Signed out from all devices.'
             : 'Signed out.';
         this.log(finalMessage);
+        // On a brokered Dedicated guest the sign-in just removed was the person's
+        // OWN (an explicit `skrr login`); the machine's platform-managed access is
+        // untouched and skrr keeps working through it. Say both, so "Signed out."
+        // is not read as "this machine can no longer reach skrr" (OSK-12043).
+        // Anywhere else there is no such hand-off, so say how to sign back in
+        // instead (OSK-12467).
+        if (platformManagedHandoff()) {
+            this.log('Removed your own sign-in from this machine. ' +
+                "skrr keeps working here through the platform's managed hand-off.");
+        }
+        else {
+            this.log(SIGN_IN_AGAIN);
+        }
         if (sweptLegacy.length > 0) {
             this.log(`Also removed ${sweptLegacy.length} credential${sweptLegacy.length === 1 ? '' : 's'} left by the previous product identity:`);
             for (const service of sweptLegacy)

package/dist/commands/pair.js

@@ -273,7 +273,7 @@ function persistPairCredentials(plaintext, serverOrigin) {
     (0, auth_storage_1.writeToBackend)({
         token: plaintext.token,
         ...(plaintext.refreshToken ? { refreshToken: plaintext.refreshToken } : {}),
-    }, { serverOrigin, clearReauth: true });
+    }, { serverOrigin, clearReauth: true, provenance: 'user_login' });
     if (plaintext.dataEncryptionKey) {
         // The unified `writeToBackend` API only carries token+refresh
         // today. For now, persist the DEK as a sibling field on the next

package/dist/lib/agentic-stream.d.ts

@@ -93,7 +93,35 @@ export type AgenticStreamOptions = {
     idleTerminalProbeMs?: number;
     /** How long to keep trying to attach before reporting a detach. Default 30s. */
     attachTimeoutMs?: number;
+    /**
+     * How long a prompt listens to (and throws away) input before it is shown.
+     * Default {@link TYPE_AHEAD_DISCARD_MS}. See {@link discardTypeAhead}.
+     */
+    typeAheadDiscardMs?: number;
 };
+/**
+ * How long input arriving just before a prompt is shown is thrown away.
+ *
+ * Long enough for bytes already typed into the terminal to be read out of the
+ * kernel once stdin starts flowing (one event-loop turn in practice), short
+ * enough that nobody waits for it.
+ */
+export declare const TYPE_AHEAD_DISCARD_MS = 60;
+/**
+ * Throw away whatever was typed BEFORE a prompt is shown (OSK-12468).
+ *
+ * A key pressed while the turn was still streaming sits in the stream's buffer
+ * or the terminal's, and the first `readline.question` read it as the answer:
+ * an owner typed `y` before any `[y/N]` was visible and approved a Bash command
+ * they had never seen. An approval is only consent to what was on the screen,
+ * so every prompt now starts from an empty input: bytes the stream already
+ * holds are read and dropped, then stdin flows into a discarding listener for
+ * `windowMs` so the terminal's own buffer is drained too. Raw mode is switched
+ * on for that window because a half-typed line (`y`, no Enter) is invisible to
+ * a read in canonical mode and would otherwise surface as soon as readline
+ * enters raw mode itself. A Ctrl-C in the discarded input is still honoured.
+ */
+export declare function discardTypeAhead(input: NodeJS.ReadableStream, windowMs?: number): Promise<void>;
 /**
  * What a permission request would DO, in one line a person can judge.
  *
@@ -371,6 +399,12 @@ export declare class AgenticStreamClient {
      * (OSK-12197) instead of leaving `[y/N]` open after the run stopped asking.
      */
     private readonly openPermissionPrompts;
+    /**
+     * Question prompts on the terminal still waiting for an answer, by
+     * questionId, so a server `question:cancel` can close the one it names
+     * (OSK-12208) the same way `permission:cancel` closes a permission prompt.
+     */
+    private readonly openQuestionPrompts;
     /** Text already written to the terminal, for suffix-only rendering. */
     private renderedText;
     private idleTimer;
@@ -455,7 +489,27 @@ export declare class AgenticStreamClient {
      * and close the terminal prompt if this client is still showing it.
      */
     private handlePermissionCancel;
+    /**
+     * The server closed a question (OSK-12208): nobody answered it in time, or
+     * the turn ended first. Say so, and close the terminal prompt if this
+     * client is still showing it — the question twin of handlePermissionCancel.
+     */
+    private handleQuestionCancel;
+    /** Prompts run one at a time: two readlines on one stdin would both read a line. */
+    private askQueue;
     private ask;
+    /**
+     * One prompt, on a readline that exists only while the prompt is on screen.
+     *
+     * The interface used to be created at the first prompt and kept until the
+     * run closed, and it was created AFTER stdin had been accumulating whatever
+     * the person typed while the turn streamed — so the first question answered
+     * itself from that type-ahead (OSK-12468). Now the input is emptied first
+     * ({@link discardTypeAhead}), only then is the question shown, and the
+     * interface is closed with the answer, so nothing typed between two prompts
+     * can answer the second one either.
+     */
+    private askNow;
     /**
      * True the first time this (kind, identity) pair is seen; false afterwards.
      * The identity is the event's OWN — a tool-use id, a message id — never a