@skrr-ai/cli 0.1.62 → 0.1.64

package/dist/commands/daemon/login.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const core_1 = require("@oclif/core");
 const daemon_binding_1 = require("../../lib/daemon-binding");
 const exec_runtime_binary_1 = require("../../lib/exec-runtime-binary");
+const live_runtime_binary_1 = require("../../lib/live-runtime-binary");
 /**
  * `skrr daemon login` — authenticate the local runtime.
  *
@@ -37,11 +38,28 @@ class DaemonLogin extends core_1.Command {
         // (OSK-296).
         const argv = this.argv;
         try {
+            const boundArgv = (0, daemon_binding_1.bindToCliSession)(argv);
+            // A re-login must prove the key the running service uses. A development
+            // skrrd earlier on PATH can have a different auth configuration and
+            // silently leave the service's server pin unchanged (OSK-12758).
+            const pathBinary = (0, exec_runtime_binary_1.findRuntimeBinary)();
+            const decision = pathBinary
+                ? (0, live_runtime_binary_1.decideStatusBinary)(pathBinary, (0, live_runtime_binary_1.profileFromArgs)(boundArgv), (0, live_runtime_binary_1.defaultLiveRuntimeDeps)())
+                : null;
+            if (decision?.kind === 'mismatch') {
+                this.error(`The live daemon runs ${decision.live}, but this command found ${decision.binary} on PATH. ` +
+                    'Run login with the live daemon program so it proves the same device key.');
+            }
+            if (decision?.kind === 'forward-live') {
+                this.warn(`Signing in with the live daemon binary ${decision.binary}.`);
+            }
             // `--cwd` is deliberately NOT defaulted here. `skrrd login` resolves it
             // from the installed service definition, which is the only authoritative
             // answer; guessing it from the CLI's cwd is exactly the mistake that made
             // the old default wrong.
-            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['login', ...(0, daemon_binding_1.bindToCliSession)(argv)]);
+            const code = await (0, exec_runtime_binary_1.execRuntimeBinary)(['login', ...boundArgv], {
+                binary: decision?.binary,
+            });
             this.exit(code);
         }
         catch (err) {

package/dist/commands/store/installs.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base-command';
+/** The buyer's installed copies, including stopped copies and their source releases. */
+export default class StoreInstalls extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/installs.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const format_1 = require("../../lib/format");
+/** The buyer's installed copies, including stopped copies and their source releases. */
+class StoreInstalls extends base_command_1.BaseCommand {
+    static description = 'List your Store installs and the releases they came from';
+    static examples = [
+        '<%= config.bin %> store installs',
+        '<%= config.bin %> store installs --json',
+    ];
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreInstalls);
+        let response;
+        try {
+            response = await data_provider_1.dataService.getStoreInstalls();
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        const installs = response?.installs ?? [];
+        if (flags.json) {
+            this.log(JSON.stringify({ object: 'list', data: installs }, null, 2));
+            return;
+        }
+        if (installs.length === 0) {
+            this.log('No Store installs found.');
+            return;
+        }
+        (0, format_1.renderTable)(installs.map((install) => ({
+            agent: install.agentId,
+            copy: install.installedAgentId ?? '-',
+            release: install.installedReleaseId ?? '-',
+            version: install.installedVersionLabel ?? '-',
+            state: install.copyMissing ? 'copy missing' : install.stopReason ? 'stopped' : 'installed',
+            reason: install.stopReason ?? '-',
+        })), [
+            { key: 'agent', header: 'LISTING' },
+            { key: 'copy', header: 'YOUR COPY' },
+            { key: 'release', header: 'RELEASE' },
+            { key: 'version', header: 'VERSION' },
+            { key: 'state', header: 'STATE' },
+            { key: 'reason', header: 'REASON', maxWidth: 40 },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = StoreInstalls;

package/dist/lib/exec-runtime-binary.js

@@ -214,8 +214,8 @@ function notInstalledMessage() {
  */
 function execRuntimeBinary(args, opts = {}) {
     return new Promise((resolve, reject) => {
-        // `binary` lets `status` render from the LIVE daemon's program rather than
-        // the first one on PATH (OSK-12102); every other verb forwards to PATH.
+        // `binary` lets status and login use the LIVE daemon's program rather than
+        // the first one on PATH (OSK-12102, OSK-12758).
         const bin = opts.binary ?? findRuntimeBinary();
         if (!bin) {
             reject(new Error('runtime-binary-not-installed'));

package/dist/lib/live-runtime-binary.d.ts

@@ -37,4 +37,10 @@ export declare function decideStatusBinary(pathBinary: string, profile: string,
 /** One stderr line naming the binary that rendered status, when it is not obvious. */
 export declare function describeStatusBinary(decision: StatusBinaryDecision): string | null;
 export declare function scriptFromArgs(exec: string, args: string): string | null;
+/**
+ * The daemon keeps its singleton holder while auth is latched, but removes the
+ * broker bootstrap because it cannot serve hand-offs. Status and login still
+ * need to address that live process during recovery (OSK-12807).
+ */
+export declare function livePidFromLockInfo(profile: string, homeDir?: string): number | null;
 export declare function defaultLiveRuntimeDeps(): LiveRuntimeDeps;

package/dist/lib/live-runtime-binary.js

@@ -7,10 +7,12 @@ exports.profileFromArgs = profileFromArgs;
 exports.decideStatusBinary = decideStatusBinary;
 exports.describeStatusBinary = describeStatusBinary;
 exports.scriptFromArgs = scriptFromArgs;
+exports.livePidFromLockInfo = livePidFromLockInfo;
 exports.defaultLiveRuntimeDeps = defaultLiveRuntimeDeps;
 /**
  * Which runtime binary is the LIVE daemon running, and is it the one
- * `skrr daemon status` is about to forward to? (OSK-12102)
+ * `skrr daemon status` or `skrr daemon login` is about to forward to?
+ * (OSK-12102, OSK-12758)
  *
  * `execRuntimeBinary` forwards to the first `skrrd` on PATH. That is right for
  * lifecycle verbs, where PATH order is the person's choice of install. It is
@@ -28,6 +30,7 @@ exports.defaultLiveRuntimeDeps = defaultLiveRuntimeDeps;
  */
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const daemonBroker_1 = require("./daemonBroker");
 const exec_runtime_binary_1 = require("./exec-runtime-binary");
@@ -162,6 +165,35 @@ function scriptFromArgs(exec, args) {
     }
     return null;
 }
+/**
+ * The daemon keeps its singleton holder while auth is latched, but removes the
+ * broker bootstrap because it cannot serve hand-offs. Status and login still
+ * need to address that live process during recovery (OSK-12807).
+ */
+function livePidFromLockInfo(profile, homeDir = node_os_1.default.homedir()) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(profile) || profile === '..')
+        return null;
+    try {
+        const lockInfoPath = node_path_1.default.join(homeDir, '.skrr', 'profiles', profile, 'daemon.lock.info.json');
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(lockInfoPath, 'utf8'));
+        const pid = parsed?.pid;
+        if (typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0)
+            return null;
+        try {
+            process.kill(pid, 0);
+        }
+        catch (error) {
+            // EPERM still means a process holds the PID; all other probe failures
+            // leave this untrusted, potentially stale sidecar out of the decision.
+            if (error.code !== 'EPERM')
+                return null;
+        }
+        return pid;
+    }
+    catch {
+        return null;
+    }
+}
 function defaultLiveRuntimeDeps() {
     return {
         livePid(profile) {
@@ -170,7 +202,7 @@ function defaultLiveRuntimeDeps() {
                 if (typeof bootstrap?.pid === 'number' && bootstrap.pid > 0)
                     return bootstrap.pid;
             }
-            return null;
+            return livePidFromLockInfo(profile);
         },
         programOf(pid) {
             if (process.platform === 'darwin')

package/dist/lib/node-adapter.js

@@ -239,11 +239,16 @@ function createNodeAdapter(opts = {}) {
         const cred = currentCredential();
         if (cred.kind === 'ci')
             return false;
-        // Bare-mode signal is on the resolved credential when populated by
-        // BaseCommand. We don't have direct access here; instead we look at
-        // the override's source — `bareMode` produces tokens sourced from
-        // `flag` or `env-token`, both of which we already filter above. The
-        // remaining bareMode case (no token at all) wouldn't reach this
+        // An operator-supplied `--token` is that operator's explicit
+        // authority: when the server refuses it, the honest answer is the
+        // 401 — not a silent retry under the daemon's principal (OSK-12801).
+        // `isEnvAuthOverride` above covers OVERSKY_TOKEN; the flag slot was
+        // missed because `kind` stays 'standard' for arbitrary flag strings.
+        // Broker-minted overrides carry 'env-token' too but are the daemon's
+        // own principal — re-recovering them preserves today's renewal path.
+        if (_credOverride?.source === 'flag')
+            return false;
+        // The remaining bareMode case (no token at all) wouldn't reach this
         // function — the adapter only retries on 401, which presupposes a
         // request was made with SOME bearer.
         let outcome;

package/dist/node_modules/@skrr-ai/data-provider/index.js

@@ -48514,7 +48514,7 @@ exports.ACCEPTED_AGENT_TRIGGER_FIRE_OUTCOMES = ["succeeded", "in_progress", "awa
   var r2 = null === (t2 = e2.resolution) || void 0 === t2 ? void 0 : t2.closure;
   return r2 ? (null !== (o2 = null === (n2 = r2.overrode) || void 0 === n2 ? void 0 : n2.length) && void 0 !== o2 ? o2 : 0) > 0 ? "overridden" : false === r2.closable ? "open_items" : r2.degraded ? "unrecorded" : "clean" : "unrecorded";
 }, exports.deriveTaskCompletion = function(e2) {
-  var t2, n2 = (function(e3) {
+  var t2, n2, o2 = (function(e3) {
     for (var t3 = false !== e3.evidenceRead, n3 = (e3.deliverables || []).filter(function(e4) {
       return gb(e4);
     }), o3 = null, r3 = 0, a3 = n3; r3 < a3.length; r3++) {
@@ -48526,23 +48526,23 @@ exports.ACCEPTED_AGENT_TRIGGER_FIRE_OUTCOMES = ["succeeded", "in_progress", "awa
   if (!(function(e3) {
     return e3.statusType ? "completed" === e3.statusType : "done" === e3.status;
   })(e2)) {
-    var o2 = Sb(e2);
-    return { state: "not_done", label: hb.not_done, sentence: "".concat(hb.not_done, ", because ").concat(Tb(o2.text)), reason: o2, alsoOutstanding: [], evidence: n2 };
+    var r2 = Sb(e2);
+    return { state: "not_done", label: hb.not_done, sentence: "".concat(hb.not_done, ", because ").concat(Tb(r2.text)), reason: r2, alsoOutstanding: [], evidence: o2 };
   }
-  var r2 = [], a2 = e2.closure;
-  n2.read || r2.push("The record of what was produced could not be read just now."), (null === (t2 = null == a2 ? void 0 : a2.overrode) || void 0 === t2 ? void 0 : t2.length) && r2.push("Someone closed it past a gate its owner had declared.");
-  for (var i2 = 0, s2 = Gy(a2); i2 < s2.length; i2++) {
-    var c2 = s2[i2];
-    r2.push(c2);
+  var a2 = [], i2 = e2.closure;
+  o2.read || a2.push("The record of what was produced could not be read just now."), (null === (t2 = null == i2 ? void 0 : i2.overrode) || void 0 === t2 ? void 0 : t2.length) && a2.push("Someone closed it past a gate its owner had declared.");
+  for (var s2 = 0, c2 = Gy(i2); s2 < c2.length; s2++) {
+    var l2 = c2[s2];
+    a2.push(l2);
   }
-  if (a2 || r2.push("It was closed before the platform recorded what it was closed over."), n2.read && (0 === n2.arrived ? r2.push("Nothing it produced was recorded, so there is nothing here to look at.") : n2.aboveSelfReport || r2.push("The only thing standing behind what it produced is ".concat(lb(n2.highestLevel), "."))), 0 === r2.length) {
-    var l2 = "".concat((function(e3) {
+  if (i2 || a2.push("It was closed before the platform recorded what it was closed over."), o2.read && (0 === o2.arrived ? a2.push((null === (n2 = e2.deliverables) || void 0 === n2 ? void 0 : n2.some(Boolean)) ? "A deliverable is recorded, but its availability has not been confirmed." : "No deliverable is recorded for this task.") : o2.aboveSelfReport || a2.push("The only thing standing behind what it produced is ".concat(lb(o2.highestLevel), "."))), 0 === a2.length) {
+    var u2 = "".concat((function(e3) {
       return e3 ? e3[0].toUpperCase() + e3.slice(1) : e3;
-    })(lb(n2.highestLevel)), " stands behind what it produced.");
-    return { state: "done_and_checked", label: hb.done_and_checked, sentence: "".concat(hb.done_and_checked, " \u2014 ").concat(Tb(l2)), reason: { text: l2, phrased: true, code: null }, alsoOutstanding: [], evidence: n2 };
+    })(lb(o2.highestLevel)), " stands behind what it produced.");
+    return { state: "done_and_checked", label: hb.done_and_checked, sentence: "".concat(hb.done_and_checked, " \u2014 ").concat(Tb(u2)), reason: { text: u2, phrased: true, code: null }, alsoOutstanding: [], evidence: o2 };
   }
-  var u2 = r2[0], d2 = r2.slice(1);
-  return { state: "done_needs_your_eyes", label: hb.done_needs_your_eyes, sentence: "".concat(hb.done_needs_your_eyes, " \u2014 ").concat(Tb(u2)), reason: { text: u2, phrased: true, code: null }, alsoOutstanding: d2, evidence: n2 };
+  var d2 = a2[0], p2 = a2.slice(1);
+  return { state: "done_needs_your_eyes", label: hb.done_needs_your_eyes, sentence: "".concat(hb.done_needs_your_eyes, " \u2014 ").concat(Tb(d2)), reason: { text: d2, phrased: true, code: null }, alsoOutstanding: p2, evidence: o2 };
 }, exports.deriveWorkEdges = function(e2) {
   for (var t2, n2, o2 = /* @__PURE__ */ new Map(), r2 = 0, a2 = e2; r2 < a2.length; r2++) {
     var i2 = a2[r2];