@skrr-ai/cli 0.1.57 → 0.1.59

package/dist/lib/daemonBrokerRefusal.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isAnsweredBrokerRefusal = isAnsweredBrokerRefusal;
 exports.describeBrokerRefusal = describeBrokerRefusal;
+exports.describeGuestDaemonUnavailable = describeGuestDaemonUnavailable;
 /**
  * True when a daemon ANSWERED the hand-off and refused it — as opposed to no
  * daemon being there to ask (`no_bootstrap`, a stale descriptor nobody listens
@@ -81,8 +82,8 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
                 `if it persists, check the machine from your own computer with \`${bin} machines dedicated health-check <lease-id>\` ` +
                 `(\`${bin} machines dedicated list\` shows the lease id).`
             : 'Nobody signs in on a Dedicated Runtime: its daemon holds the account. From your own computer, run ' +
-                `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id), ` +
-                `and \`${bin} machines dedicated restart <lease-id>\` if the hand-off stays refused.`;
+                `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id). ` +
+                guestReissueRemedy(bin, 'If it stays refused');
     }
     else if (code === 'DEVICE_PROOF_PIN_MISMATCH') {
         remedy =
@@ -125,3 +126,87 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
         },
     };
 }
+/**
+ * The owner-side repair that issues a guest's daemon a fresh credential.
+ *
+ * `stop` then `start`, not `restart`: a restart keeps the instance, so its
+ * daemon re-enrolls through the attested re-issue, which the server refuses
+ * for a credential a person revoked (`REISSUE_REVOKE_REASON`). Observed on a
+ * revoked guest: `restart` sat in `restarting` for 16 minutes and ended
+ * `dedicated_runtime_guest_not_ready_after_restart`, while stop + start
+ * recovered it (OSK-12473).
+ */
+function guestReissueRemedy(bin, when) {
+    return (`${when}, \`${bin} machines dedicated stop <lease-id>\` then \`${bin} machines dedicated start <lease-id>\` ` +
+        'gives the machine a fresh credential (files under /workspace are kept; a restart does not re-issue one).');
+}
+/**
+ * What to tell a person on a Dedicated Runtime guest when NO daemon answered
+ * the hand-off at all (OSK-12473).
+ *
+ * `describeBrokerRefusal` speaks only for a daemon that answered. On a guest
+ * the realistic broken state is a daemon that is absent: its credential was
+ * revoked and it exited by design, or systemd is cycling it, or it crashed and
+ * left its descriptor behind. The CLI then saw `no_bootstrap` / `network`, and
+ * fell to "Not signed in. Run `skrr login` first." — a login nobody performs
+ * on a guest, and which would only put a personal credential on a machine the
+ * daemon is meant to hold the account for. Say the machine's service is not
+ * running and name the owner's repair instead.
+ *
+ * Returns null off a guest, or for a daemon that answered (that is
+ * `describeBrokerRefusal`'s case).
+ */
+function describeGuestDaemonUnavailable(failure, opts) {
+    const bin = opts.bin ?? 'skrr';
+    if (!opts.onGuest && failure?.dedicatedGuest !== true)
+        return null;
+    if (failure && isAnsweredBrokerRefusal(failure))
+        return null;
+    if (failure && (failure.reason === 'base_url_mismatch' || failure.reason === 'rate_limited')) {
+        return null;
+    }
+    const who = `This Dedicated Runtime's skrr service${failure?.daemonId ? ` (daemon ${failure.daemonId})` : ''}`;
+    let headline;
+    let transient = false;
+    const reason = failure?.reason ?? 'no_bootstrap';
+    if (reason === 'network') {
+        headline = `${who} is not running: its sign-in hand-off names a port nothing is listening on.`;
+    }
+    else if (reason === 'bootstrap_parse') {
+        headline = `${who} is not available: its sign-in hand-off file could not be read.`;
+    }
+    else if (reason === 'stale_bootstrap') {
+        // An uncoded 401 on the descriptor secret: the service rotated it, which
+        // it does when it restarts. Re-reading the file next time heals it.
+        headline = `${who} refused this CLI's hand-off secret, which it rotates when it restarts.`;
+        transient = true;
+    }
+    else if (opts.descriptorPresent) {
+        headline = `${who} is not running: its sign-in hand-off was left behind by a process that has exited.`;
+    }
+    else {
+        headline = `${who} is not running, so nothing on this machine can sign this CLI in.`;
+    }
+    const remedy = transient
+        ? 'Retry in a moment. Nobody signs in on a Dedicated Runtime, so `' +
+            `${bin} login\` is not the fix; if it persists, the machine's owner can run ` +
+            `\`${bin} machines dedicated health-check <lease-id>\` from their own computer.`
+        : `Nobody signs in on a Dedicated Runtime — its service holds the account — so \`${bin} login\` is not the fix. ` +
+            "If the machine is still starting, retry in a minute. Otherwise, from the owner's own computer: " +
+            `\`${bin} machines dedicated health-check <lease-id>\` shows why (\`${bin} machines dedicated list\` shows the lease id). ` +
+            guestReissueRemedy(bin, 'If the service stays down');
+    return {
+        headline,
+        remedy,
+        transient,
+        dedicatedGuest: true,
+        broker: {
+            reason,
+            ...(typeof failure?.status === 'number' ? { status: failure.status } : {}),
+            ...(failure?.code ? { code: failure.code } : {}),
+            ...(failure?.detail ? { detail: failure.detail } : {}),
+            ...(failure?.descriptorPath ? { descriptorPath: failure.descriptorPath } : {}),
+            ...(failure?.daemonId ? { daemonId: failure.daemonId } : {}),
+        },
+    };
+}

package/dist/lib/daemonHandoff.d.ts

@@ -40,7 +40,7 @@ export interface DaemonHandoffOutcome {
      * The two absent cases are separated because they need different work — one
      * needs a binary fetched, the other only needs the service registered.
      */
-    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused';
+    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'legacy-binary' | 'unsupported-daemon' | 'no-service' | 'foreign-root' | 'mint-refused' | 'platform-managed';
 }
 export declare function handOffToLocalDaemon(env?: NodeJS.ProcessEnv, opts?: {
     loginFlow?: string;

package/dist/lib/daemonHandoff.js

@@ -5,6 +5,7 @@ const node_child_process_1 = require("node:child_process");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
 const daemon_handoff_opt_out_1 = require("./daemon-handoff-opt-out");
+const dedicated_service_1 = require("./dedicated-service");
 const exec_runtime_binary_1 = require("./exec-runtime-binary");
 const keychain_1 = require("./keychain");
 /**
@@ -196,6 +197,23 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
             detail: 'the local daemon brokered this login, so it already has a working credential',
         };
     }
+    // A Dedicated Runtime guest's daemon belongs to the platform: the image
+    // installs it, the platform signs it in, and it runs as a uid the workload
+    // cannot touch. A person's login is theirs alone and is never handed to it,
+    // and there is nothing for them to install. Without this the workload found
+    // no daemon it could use and login ended by telling them to run
+    // `skrr daemon install` on a machine where that is wrong (OSK-12296).
+    //
+    // Detected the way the rest of the CLI detects a guest — the workload uid
+    // stamp, or the guest markers the image and daemon own, among them the
+    // hand-off descriptor directory under /run/skrr-dedicated-runtime.
+    if ((0, dedicated_service_1.runningOnDedicatedRuntimeGuest)(env)) {
+        return {
+            status: 'skipped',
+            reason: 'platform-managed',
+            detail: "this machine's daemon is managed by the platform",
+        };
+    }
     // A relocated config root (`SKRR_CONFIG_DIR`) is a second sign-in on this
     // machine, not the machine's sign-in. The installed daemon service carries no
     // config-root override, so it reads the DEFAULT root — its credential, its

package/dist/lib/dedicated-guest.d.ts

@@ -0,0 +1,13 @@
+/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
+export declare const GUEST_SERVICE_SOCKET_PATH = "/run/skrr-dedicated-runtime/service-propose/service-propose.sock";
+/**
+ * True when this process is running on a Dedicated Runtime guest — the
+ * workload-uid test, or the guest markers the image/daemon own. An SSH
+ * session may not carry the wrapper's env stamp, so the filesystem markers
+ * count too; the socket itself remains the authority.
+ */
+export declare function runningOnDedicatedRuntimeGuest(env?: NodeJS.ProcessEnv, getuid?: (() => number) | undefined, paths?: {
+    socketPath?: string;
+    attestationPath?: string;
+    runtimeDir?: string;
+}): boolean;

package/dist/lib/dedicated-guest.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GUEST_SERVICE_SOCKET_PATH = void 0;
+exports.runningOnDedicatedRuntimeGuest = runningOnDedicatedRuntimeGuest;
+const node_fs_1 = require("node:fs");
+const first_party_harness_1 = require("./first-party-harness");
+/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
+exports.GUEST_SERVICE_SOCKET_PATH = '/run/skrr-dedicated-runtime/service-propose/service-propose.sock';
+/**
+ * True when this process is running on a Dedicated Runtime guest — the
+ * workload-uid test, or the guest markers the image/daemon own. An SSH
+ * session may not carry the wrapper's env stamp, so the filesystem markers
+ * count too; the socket itself remains the authority.
+ */
+function runningOnDedicatedRuntimeGuest(env = process.env, getuid = process.getuid?.bind(process), paths = {}) {
+    if ((0, first_party_harness_1.isDedicatedRuntimeWorkload)(env, getuid))
+        return true;
+    const socketPath = paths.socketPath ?? exports.GUEST_SERVICE_SOCKET_PATH;
+    const attestation = paths.attestationPath ?? '/etc/skrr-dedicated-runtime/attestation.json';
+    const runtimeDir = paths.runtimeDir ?? '/run/skrr-dedicated-runtime';
+    return (0, node_fs_1.existsSync)(socketPath) || (0, node_fs_1.existsSync)(attestation) || (0, node_fs_1.existsSync)(runtimeDir);
+}

package/dist/lib/dedicated-machines.js

@@ -1280,7 +1280,23 @@ function describeRefusalReasons(err, context = {}) {
     if (spend)
         return spend;
     const sentences = (0, harnesses_1.describeHealthReasonSentences)(details?.reasons, details?.state);
-    return sentences ? ` Reasons: ${sentences}` : '';
+    // A refusal whose public `reasons` came back empty used to print the bare
+    // sentence, which reads as "no reason" when the server said more: that it
+    // withheld reasons it does not publish, or that its own check did not finish
+    // (OSK-12473). Say which, so the person knows whether to retry.
+    const extra = [];
+    const incomplete = Array.isArray(details?.checkIncompleteReasons)
+        ? details.checkIncompleteReasons.length
+        : 0;
+    if (details?.checkIncomplete === true || incomplete > 0) {
+        extra.push('skrr could not finish checking the machine, so run the check again.');
+    }
+    const omitted = Number(details?.omittedReasonCount);
+    if (Number.isInteger(omitted) && omitted > 0) {
+        extra.push(`${omitted} further reason${omitted === 1 ? ' was' : 's were'} not published by the server.`);
+    }
+    const tail = [sentences, ...extra].filter(Boolean).join(' ');
+    return tail ? ` Reasons: ${tail}` : '';
 }
 /**
  * The numbers behind a cap refusal: the cap, this month's spend so far, and

package/dist/lib/dedicated-service.d.ts

@@ -373,16 +373,4 @@ export declare function mergeServiceTemplate(template: DedicatedServiceTemplate,
  * guest-local status commands so both read the same shape.
  */
 export declare function serviceDetailText(detail: unknown): string | undefined;
-/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
-export declare const GUEST_SERVICE_SOCKET_PATH = "/run/skrr-dedicated-runtime/service-propose/service-propose.sock";
-/**
- * True when this process is running on a Dedicated Runtime guest — the
- * workload-uid test, or the guest markers the image/daemon own. An SSH
- * session may not carry the wrapper's env stamp, so the filesystem markers
- * count too; the socket itself remains the authority.
- */
-export declare function runningOnDedicatedRuntimeGuest(env?: NodeJS.ProcessEnv, getuid?: (() => number) | undefined, paths?: {
-    socketPath?: string;
-    attestationPath?: string;
-    runtimeDir?: string;
-}): boolean;
+export { GUEST_SERVICE_SOCKET_PATH, runningOnDedicatedRuntimeGuest } from './dedicated-guest';

package/dist/lib/dedicated-service.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GUEST_SERVICE_SOCKET_PATH = exports.DedicatedServiceChannel = exports.DedicatedServiceError = exports.SERVICE_ACTIONS = exports.SERVICE_RESTART_POLICIES = exports.SERVICE_RESERVED_NAMES = exports.SERVICE_SECRET_NAME_PATTERN = exports.SERVICE_NAME_PATTERN = exports.SERVICE_CALL_TIMEOUT_MS = exports.DEDICATED_PERSISTENT_TERMINAL_CAPABILITY = exports.DEDICATED_TERMINAL_NAME_PATTERN = exports.DEDICATED_TERMINAL_EVENTS = exports.DEDICATED_SERVICE_EVENTS = void 0;
+exports.runningOnDedicatedRuntimeGuest = exports.GUEST_SERVICE_SOCKET_PATH = exports.DedicatedServiceChannel = exports.DedicatedServiceError = exports.SERVICE_ACTIONS = exports.SERVICE_RESTART_POLICIES = exports.SERVICE_RESERVED_NAMES = exports.SERVICE_SECRET_NAME_PATTERN = exports.SERVICE_NAME_PATTERN = exports.SERVICE_CALL_TIMEOUT_MS = exports.DEDICATED_PERSISTENT_TERMINAL_CAPABILITY = exports.DEDICATED_TERMINAL_NAME_PATTERN = exports.DEDICATED_TERMINAL_EVENTS = exports.DEDICATED_SERVICE_EVENTS = void 0;
 exports.isServiceUnsupportedCode = isServiceUnsupportedCode;
 exports.describeServiceRefusal = describeServiceRefusal;
 exports.describeTerminalRefusal = describeTerminalRefusal;
@@ -19,7 +19,6 @@ exports.serviceTemplatesDir = serviceTemplatesDir;
 exports.loadLocalServiceTemplate = loadLocalServiceTemplate;
 exports.mergeServiceTemplate = mergeServiceTemplate;
 exports.serviceDetailText = serviceDetailText;
-exports.runningOnDedicatedRuntimeGuest = runningOnDedicatedRuntimeGuest;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
@@ -27,7 +26,6 @@ const node_path_1 = __importDefault(require("node:path"));
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agentic_stream_1 = require("./agentic-stream");
-const first_party_harness_1 = require("./first-party-harness");
 const format_1 = require("./format");
 /**
  * Declared services on a Dedicated Runtime — the CLI half of
@@ -801,19 +799,9 @@ function serviceDetailText(detail) {
         parts.push(d.detail);
     return parts.join(', ') || undefined;
 }
-/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
-exports.GUEST_SERVICE_SOCKET_PATH = '/run/skrr-dedicated-runtime/service-propose/service-propose.sock';
-/**
- * True when this process is running on a Dedicated Runtime guest — the
- * workload-uid test, or the guest markers the image/daemon own. An SSH
- * session may not carry the wrapper's env stamp, so the filesystem markers
- * count too; the socket itself remains the authority.
- */
-function runningOnDedicatedRuntimeGuest(env = process.env, getuid = process.getuid?.bind(process), paths = {}) {
-    if ((0, first_party_harness_1.isDedicatedRuntimeWorkload)(env, getuid))
-        return true;
-    const socketPath = paths.socketPath ?? exports.GUEST_SERVICE_SOCKET_PATH;
-    const attestation = paths.attestationPath ?? '/etc/skrr-dedicated-runtime/attestation.json';
-    const runtimeDir = paths.runtimeDir ?? '/run/skrr-dedicated-runtime';
-    return (0, node_fs_1.existsSync)(socketPath) || (0, node_fs_1.existsSync)(attestation) || (0, node_fs_1.existsSync)(runtimeDir);
-}
+// Guest detection lives in its own light module so the auth path (base-command,
+// login) can ask "is this a guest?" without loading socket.io and the stream
+// client this module needs (OSK-12473). Re-exported for existing callers.
+var dedicated_guest_1 = require("./dedicated-guest");
+Object.defineProperty(exports, "GUEST_SERVICE_SOCKET_PATH", { enumerable: true, get: function () { return dedicated_guest_1.GUEST_SERVICE_SOCKET_PATH; } });
+Object.defineProperty(exports, "runningOnDedicatedRuntimeGuest", { enumerable: true, get: function () { return dedicated_guest_1.runningOnDedicatedRuntimeGuest; } });

package/dist/lib/login.js

@@ -37,6 +37,7 @@ const device_code_1 = require("./device-code");
 const device_identity_1 = require("./device-identity");
 const oauthLogin_1 = require("./oauthLogin");
 const daemonBroker_1 = require("./daemonBroker");
+const dedicated_guest_1 = require("./dedicated-guest");
 const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
 /**
  * What a shell with no terminal can do instead (OSK-12117). The refusal used to
@@ -119,8 +120,16 @@ async function cliLogin(opts = {}) {
                 // — the token lives for this process and the next `skrr` re-redeems
                 // over loopback. An explicit PKCE/device-code login further down
                 // still writes a real user-owned family, unchanged.
+                //
+                // Only a Dedicated guest's hand-off is the PLATFORM's. A laptop
+                // daemon's island file advertises `access_token` too, and there this
+                // sentence claimed a platform-managed machine that does not exist —
+                // the logout half of the same bug was OSK-12467 (c951446486).
                 console.log('');
-                console.log("  This machine is signed in through the platform's managed hand-off.");
+                console.log((0, dedicated_guest_1.runningOnDedicatedRuntimeGuest)()
+                    ? "  This machine is signed in through the platform's managed hand-off."
+                    : '  Signed in through the skrr background service on this computer (no browser needed). ' +
+                        'It lends this CLI short-lived tokens, so nothing was stored for this profile.');
                 return {
                     token: brokerResult.accessToken,
                     ...(brokerResult.accessExpiresAt !== undefined
@@ -332,7 +341,7 @@ async function cliLoginWithRefreshToken(opts) {
         ...(pair.accessExpiresAt !== undefined ? { expiresAt: pair.accessExpiresAt } : {}),
         refreshToken: pair.refreshToken,
         ...(pair.refreshExpiresAt !== undefined ? { refreshExpiresAt: pair.refreshExpiresAt } : {}),
-    }, { serverOrigin: serverUrl, clearReauth: true });
+    }, { serverOrigin: serverUrl, clearReauth: true, provenance: 'user_login' });
     return {
         token: accessToken,
         refreshToken: pair.refreshToken,
@@ -490,7 +499,7 @@ async function runDeviceCode(serverUrl, cliId, reason, ssh, errorMessage) {
                     : {}),
             }
             : {}),
-    }, { serverOrigin: serverUrl, clearReauth: true });
+    }, { serverOrigin: serverUrl, clearReauth: true, provenance: 'user_login' });
     console.log('  ✓ Authorized.');
     return {
         token: approved.token,

package/dist/lib/oauthLogin.js

@@ -366,7 +366,9 @@ async function runOAuthLogin(opts) {
                     // server URL — daemonBroker.ts:543, login.ts:322, refresh.ts:282 —
                     // so this was the lone outlier, and it only bites a deployment
                     // whose web and API origins differ.
-                    { serverOrigin: requestedServerUrl, clearReauth: true });
+                    // A person signed in on purpose: a brokered Dedicated guest must
+                    // keep this family rather than retire it as pre-broker (OSK-12293).
+                    { serverOrigin: requestedServerUrl, clearReauth: true, provenance: 'user_login' });
                     console.log('  ✓ Login successful! Token saved.');
                     finish({
                         ok: true,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.d.ts

@@ -23,6 +23,37 @@ export declare function __setStateForTest(next: CredEnvelopeState): CredEnvelope
 export declare function __getStateForTest(): CredEnvelopeState;
 /** @internal Test seam — each spec owns its warn-dedupe horizon. */
 export declare function __clearWarnDedupeForTest(): void;
+/**
+ * Run the OSK-10314 consolidation for this profile's wrapped DEK.
+ *
+ * Under the canonical lock, because the window it closes is real: a daemon
+ * copying its legacy DEK into an empty canonical slot must not race a CLI
+ * enrolling a fresh one there — the loser's key would be overwritten and
+ * anything already sealed under it lost. That is the same race the lock was
+ * introduced for, one layer up.
+ *
+ * Never fatal. A migration that cannot run leaves the process exactly where it
+ * was, which is the state it has been operating in all along.
+ */
+/**
+ * Whether a split profile may be converged onto the legacy (daemon) key.
+ *
+ * Only the daemon ever has a legacy location, so only the daemon runs this, and
+ * the legacy key is the one it signs with. Since OSK-12063 the CLI enrolls no
+ * device key and only an interactive daemon login re-pins, so the key the server
+ * pins for this machine is the daemon's, UNLESS the daemon has itself been
+ * refused over its device key. That is the one fact that proves otherwise, and
+ * then nothing here knows which key the server holds, so it refuses as before.
+ *
+ * Why converging matters (OSK-12462): a CLI credential brokered by the daemon
+ * is tied to the daemon's machine row, and the server checks its refresh proof
+ * against the key pinned there. A CLI signing with a different key has that
+ * refresh refused as DEVICE_PROOF_THUMBPRINT_MISMATCH at its first renewal.
+ */
+export declare function splitKeyConvergencePolicy(): {
+    converge: boolean;
+    reason: 'daemon_key_pinned' | 'daemon_key_refused';
+};
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.
@@ -96,6 +127,16 @@ export declare function describeCredEnvelopeState(): {
         canonicalPath: string;
         legacyPath: string;
     };
+    /**
+     * Set when THIS process converged a split profile onto the legacy (daemon)
+     * key (OSK-12462). `canonicalPath` held the key that is now retired.
+     */
+    convergedFrom?: {
+        canonicalPath: string;
+        legacyPath: string;
+    };
+    /** How many retired DEKs this process can still open old values with. */
+    retiredKeys?: number;
 };
 /**
  * Sync write transform. Returns the wrapped serialized form when active.