@skrr-ai/cli 0.1.63 → 0.1.64

package/dist/commands/store/installs.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base-command';
+/** The buyer's installed copies, including stopped copies and their source releases. */
+export default class StoreInstalls extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/installs.js

@@ -0,0 +1,54 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../base-command");
+const format_1 = require("../../lib/format");
+/** The buyer's installed copies, including stopped copies and their source releases. */
+class StoreInstalls extends base_command_1.BaseCommand {
+    static description = 'List your Store installs and the releases they came from';
+    static examples = [
+        '<%= config.bin %> store installs',
+        '<%= config.bin %> store installs --json',
+    ];
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output as JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(StoreInstalls);
+        let response;
+        try {
+            response = await data_provider_1.dataService.getStoreInstalls();
+        }
+        catch (error) {
+            this.handleApiError(error);
+            return;
+        }
+        const installs = response?.installs ?? [];
+        if (flags.json) {
+            this.log(JSON.stringify({ object: 'list', data: installs }, null, 2));
+            return;
+        }
+        if (installs.length === 0) {
+            this.log('No Store installs found.');
+            return;
+        }
+        (0, format_1.renderTable)(installs.map((install) => ({
+            agent: install.agentId,
+            copy: install.installedAgentId ?? '-',
+            release: install.installedReleaseId ?? '-',
+            version: install.installedVersionLabel ?? '-',
+            state: install.copyMissing ? 'copy missing' : install.stopReason ? 'stopped' : 'installed',
+            reason: install.stopReason ?? '-',
+        })), [
+            { key: 'agent', header: 'LISTING' },
+            { key: 'copy', header: 'YOUR COPY' },
+            { key: 'release', header: 'RELEASE' },
+            { key: 'version', header: 'VERSION' },
+            { key: 'state', header: 'STATE' },
+            { key: 'reason', header: 'REASON', maxWidth: 40 },
+        ], (line) => this.log(line));
+    }
+}
+exports.default = StoreInstalls;

package/dist/lib/live-runtime-binary.d.ts

@@ -37,4 +37,10 @@ export declare function decideStatusBinary(pathBinary: string, profile: string,
 /** One stderr line naming the binary that rendered status, when it is not obvious. */
 export declare function describeStatusBinary(decision: StatusBinaryDecision): string | null;
 export declare function scriptFromArgs(exec: string, args: string): string | null;
+/**
+ * The daemon keeps its singleton holder while auth is latched, but removes the
+ * broker bootstrap because it cannot serve hand-offs. Status and login still
+ * need to address that live process during recovery (OSK-12807).
+ */
+export declare function livePidFromLockInfo(profile: string, homeDir?: string): number | null;
 export declare function defaultLiveRuntimeDeps(): LiveRuntimeDeps;

package/dist/lib/live-runtime-binary.js

@@ -7,6 +7,7 @@ exports.profileFromArgs = profileFromArgs;
 exports.decideStatusBinary = decideStatusBinary;
 exports.describeStatusBinary = describeStatusBinary;
 exports.scriptFromArgs = scriptFromArgs;
+exports.livePidFromLockInfo = livePidFromLockInfo;
 exports.defaultLiveRuntimeDeps = defaultLiveRuntimeDeps;
 /**
  * Which runtime binary is the LIVE daemon running, and is it the one
@@ -29,6 +30,7 @@ exports.defaultLiveRuntimeDeps = defaultLiveRuntimeDeps;
  */
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const daemonBroker_1 = require("./daemonBroker");
 const exec_runtime_binary_1 = require("./exec-runtime-binary");
@@ -163,6 +165,35 @@ function scriptFromArgs(exec, args) {
     }
     return null;
 }
+/**
+ * The daemon keeps its singleton holder while auth is latched, but removes the
+ * broker bootstrap because it cannot serve hand-offs. Status and login still
+ * need to address that live process during recovery (OSK-12807).
+ */
+function livePidFromLockInfo(profile, homeDir = node_os_1.default.homedir()) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(profile) || profile === '..')
+        return null;
+    try {
+        const lockInfoPath = node_path_1.default.join(homeDir, '.skrr', 'profiles', profile, 'daemon.lock.info.json');
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(lockInfoPath, 'utf8'));
+        const pid = parsed?.pid;
+        if (typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0)
+            return null;
+        try {
+            process.kill(pid, 0);
+        }
+        catch (error) {
+            // EPERM still means a process holds the PID; all other probe failures
+            // leave this untrusted, potentially stale sidecar out of the decision.
+            if (error.code !== 'EPERM')
+                return null;
+        }
+        return pid;
+    }
+    catch {
+        return null;
+    }
+}
 function defaultLiveRuntimeDeps() {
     return {
         livePid(profile) {
@@ -171,7 +202,7 @@ function defaultLiveRuntimeDeps() {
                 if (typeof bootstrap?.pid === 'number' && bootstrap.pid > 0)
                     return bootstrap.pid;
             }
-            return null;
+            return livePidFromLockInfo(profile);
         },
         programOf(pid) {
             if (process.platform === 'darwin')

package/dist/lib/node-adapter.js

@@ -239,11 +239,16 @@ function createNodeAdapter(opts = {}) {
         const cred = currentCredential();
         if (cred.kind === 'ci')
             return false;
-        // Bare-mode signal is on the resolved credential when populated by
-        // BaseCommand. We don't have direct access here; instead we look at
-        // the override's source — `bareMode` produces tokens sourced from
-        // `flag` or `env-token`, both of which we already filter above. The
-        // remaining bareMode case (no token at all) wouldn't reach this
+        // An operator-supplied `--token` is that operator's explicit
+        // authority: when the server refuses it, the honest answer is the
+        // 401 — not a silent retry under the daemon's principal (OSK-12801).
+        // `isEnvAuthOverride` above covers OVERSKY_TOKEN; the flag slot was
+        // missed because `kind` stays 'standard' for arbitrary flag strings.
+        // Broker-minted overrides carry 'env-token' too but are the daemon's
+        // own principal — re-recovering them preserves today's renewal path.
+        if (_credOverride?.source === 'flag')
+            return false;
+        // The remaining bareMode case (no token at all) wouldn't reach this
         // function — the adapter only retries on 401, which presupposes a
         // request was made with SOME bearer.
         let outcome;