@skrr-ai/cli 0.1.63 → 0.1.65

package/dist/commands/tasks/lifecycle/transition.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
 const task_lifecycle_output_1 = require("../../../lib/task-lifecycle-output");
+const prompt_1 = require("../../../lib/prompt");
 class TasksLifecycleTransition extends base_command_1.BaseCommand {
     static description = 'Apply a declared lifecycle transition — records effects and advances the stage';
     static args = {
@@ -33,10 +34,12 @@ class TasksLifecycleTransition extends base_command_1.BaseCommand {
         let payload;
         if (flags.payload) {
             try {
-                payload = JSON.parse(flags.payload);
+                payload = (0, prompt_1.parseJsonFlag)(flags.payload, '--payload');
             }
-            catch {
-                this.error('--payload must be valid JSON.', { exit: 2 });
+            catch (err) {
+                this.error(err instanceof Error ? err.message : '--payload must be valid JSON.', {
+                    exit: 2,
+                });
             }
             if (!payload || typeof payload !== 'object' || Array.isArray(payload)) {
                 this.error('--payload must be a JSON object.', { exit: 2 });

package/dist/commands/tasks/plan/run-update.js

@@ -60,7 +60,7 @@ class TasksPlanRunUpdate extends base_command_1.BaseCommand {
         let body;
         try {
             if (flags.patch !== undefined) {
-                const parsed = JSON.parse(flags.patch);
+                const parsed = (0, prompt_1.parseJsonFlag)(flags.patch, '--patch');
                 if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
                     throw new Error('--patch must be a JSON object');
                 }

package/dist/commands/tasks/result/submit.js

@@ -210,7 +210,7 @@ class TasksResultSubmit extends base_command_1.BaseCommand {
         // which the call did not carry. Submitting a Result is not closing a Task;
         // the response now reports where it stands and this prints exactly that.
         this.log(`Submitted Result v${result.result.version} for ${task.id}.`);
-        for (const line of (0, task_closure_1.closureReport)(result.closure))
+        for (const line of (0, task_closure_1.closureReport)(result.closure, { closing: false }))
             this.log(line);
         if (url)
             this.log(`Task: ${url}`);

package/dist/commands/tasks/resume/save.js

@@ -7,6 +7,7 @@ const outbox_1 = require("../../../lib/outbox");
 const task_resolver_1 = require("../../../lib/task-resolver");
 const api_fetch_1 = require("../../../lib/api-fetch");
 const session_task_endpoints_1 = require("../../../lib/session-task-endpoints");
+const prompt_1 = require("../../../lib/prompt");
 class TasksResumeSave extends base_command_1.BaseCommand {
     static description = 'Save recovery state without publishing a visible Task Update';
     static args = {
@@ -36,10 +37,12 @@ class TasksResumeSave extends base_command_1.BaseCommand {
         const task = (0, task_resolver_1.resolveTaskIdentity)({ positionalId: args.task, flagTask: flags.task });
         let resume;
         try {
-            resume = JSON.parse(flags.snapshot);
+            resume = (0, prompt_1.parseJsonFlag)(flags.snapshot, '--snapshot');
         }
-        catch {
-            this.error('--snapshot must be a JSON object', { exit: 1 });
+        catch (err) {
+            this.error(err instanceof Error ? err.message : '--snapshot must be a JSON object', {
+                exit: 1,
+            });
         }
         let result;
         try {

package/dist/commands/tasks/updates/add.js

@@ -43,7 +43,17 @@ const session_task_endpoints_1 = require("../../../lib/session-task-endpoints");
 function parseJsonObject(value, label) {
     if (!value)
         return undefined;
-    const parsed = JSON.parse(value);
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch (err) {
+        // A bare SyntaxError ("Unexpected token …") never says WHICH flag was
+        // malformed — name it, the same way readJsonValue names its file
+        // (OSK-12753).
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid JSON in ${label}: ${msg}`);
+    }
     if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
         throw new Error(`${label} must be a JSON object`);
     }

package/dist/lib/file-mime.js

@@ -63,6 +63,7 @@ const MIME_TYPES = {
     '.jpg': 'image/jpeg',
     '.js': 'text/javascript',
     '.json': 'application/json',
+    '.log': 'text/plain',
     '.m4a': 'audio/m4a',
     '.m4v': 'video/m4v',
     '.md': 'text/markdown',

package/dist/lib/live-runtime-binary.d.ts

@@ -37,4 +37,10 @@ export declare function decideStatusBinary(pathBinary: string, profile: string,
 /** One stderr line naming the binary that rendered status, when it is not obvious. */
 export declare function describeStatusBinary(decision: StatusBinaryDecision): string | null;
 export declare function scriptFromArgs(exec: string, args: string): string | null;
+/**
+ * The daemon keeps its singleton holder while auth is latched, but removes the
+ * broker bootstrap because it cannot serve hand-offs. Status and login still
+ * need to address that live process during recovery (OSK-12807).
+ */
+export declare function livePidFromLockInfo(profile: string, homeDir?: string): number | null;
 export declare function defaultLiveRuntimeDeps(): LiveRuntimeDeps;

package/dist/lib/live-runtime-binary.js

@@ -7,6 +7,7 @@ exports.profileFromArgs = profileFromArgs;
 exports.decideStatusBinary = decideStatusBinary;
 exports.describeStatusBinary = describeStatusBinary;
 exports.scriptFromArgs = scriptFromArgs;
+exports.livePidFromLockInfo = livePidFromLockInfo;
 exports.defaultLiveRuntimeDeps = defaultLiveRuntimeDeps;
 /**
  * Which runtime binary is the LIVE daemon running, and is it the one
@@ -29,6 +30,7 @@ exports.defaultLiveRuntimeDeps = defaultLiveRuntimeDeps;
  */
 const node_child_process_1 = require("node:child_process");
 const node_fs_1 = require("node:fs");
+const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const daemonBroker_1 = require("./daemonBroker");
 const exec_runtime_binary_1 = require("./exec-runtime-binary");
@@ -163,6 +165,35 @@ function scriptFromArgs(exec, args) {
     }
     return null;
 }
+/**
+ * The daemon keeps its singleton holder while auth is latched, but removes the
+ * broker bootstrap because it cannot serve hand-offs. Status and login still
+ * need to address that live process during recovery (OSK-12807).
+ */
+function livePidFromLockInfo(profile, homeDir = node_os_1.default.homedir()) {
+    if (!/^[a-zA-Z0-9][a-zA-Z0-9._-]*$/.test(profile) || profile === '..')
+        return null;
+    try {
+        const lockInfoPath = node_path_1.default.join(homeDir, '.skrr', 'profiles', profile, 'daemon.lock.info.json');
+        const parsed = JSON.parse((0, node_fs_1.readFileSync)(lockInfoPath, 'utf8'));
+        const pid = parsed?.pid;
+        if (typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0)
+            return null;
+        try {
+            process.kill(pid, 0);
+        }
+        catch (error) {
+            // EPERM still means a process holds the PID; all other probe failures
+            // leave this untrusted, potentially stale sidecar out of the decision.
+            if (error.code !== 'EPERM')
+                return null;
+        }
+        return pid;
+    }
+    catch {
+        return null;
+    }
+}
 function defaultLiveRuntimeDeps() {
     return {
         livePid(profile) {
@@ -171,7 +202,7 @@ function defaultLiveRuntimeDeps() {
                 if (typeof bootstrap?.pid === 'number' && bootstrap.pid > 0)
                     return bootstrap.pid;
             }
-            return null;
+            return livePidFromLockInfo(profile);
         },
         programOf(pid) {
             if (process.platform === 'darwin')

package/dist/lib/node-adapter.js

@@ -239,11 +239,16 @@ function createNodeAdapter(opts = {}) {
         const cred = currentCredential();
         if (cred.kind === 'ci')
             return false;
-        // Bare-mode signal is on the resolved credential when populated by
-        // BaseCommand. We don't have direct access here; instead we look at
-        // the override's source — `bareMode` produces tokens sourced from
-        // `flag` or `env-token`, both of which we already filter above. The
-        // remaining bareMode case (no token at all) wouldn't reach this
+        // An operator-supplied `--token` is that operator's explicit
+        // authority: when the server refuses it, the honest answer is the
+        // 401 — not a silent retry under the daemon's principal (OSK-12801).
+        // `isEnvAuthOverride` above covers OVERSKY_TOKEN; the flag slot was
+        // missed because `kind` stays 'standard' for arbitrary flag strings.
+        // Broker-minted overrides carry 'env-token' too but are the daemon's
+        // own principal — re-recovering them preserves today's renewal path.
+        if (_credOverride?.source === 'flag')
+            return false;
+        // The remaining bareMode case (no token at all) wouldn't reach this
         // function — the adapter only retries on 401, which presupposes a
         // request was made with SOME bearer.
         let outcome;

package/dist/lib/prompt.d.ts

@@ -46,6 +46,13 @@ export declare function confirmDestructive(question: string, yesFlag: boolean, f
  * commands can surface the error via `this.handleApiError()` or similar.
  */
 export declare function readJsonValue(source: string | undefined): Promise<unknown>;
+/**
+ * Parse a flag-supplied JSON value. A bare `JSON.parse` throws a SyntaxError
+ * that never names which flag was malformed — `--data '{bad'` reads
+ * "Unexpected token" with no owner. `readJsonValue` already names its file;
+ * this is the same contract for inline flag values (OSK-12753).
+ */
+export declare function parseJsonFlag(value: string, flagName: string): unknown;
 export declare function readJsonBody(source: string | undefined): Promise<Record<string, unknown>>;
 export declare function readStdin(): Promise<string>;
 /**

package/dist/lib/prompt.js

@@ -37,6 +37,7 @@ exports.prompt = prompt;
 exports.confirm = confirm;
 exports.confirmDestructive = confirmDestructive;
 exports.readJsonValue = readJsonValue;
+exports.parseJsonFlag = parseJsonFlag;
 exports.readJsonBody = readJsonBody;
 exports.readStdin = readStdin;
 exports.mergeDefined = mergeDefined;
@@ -152,6 +153,21 @@ async function readJsonValue(source) {
     }
     return parsed;
 }
+/**
+ * Parse a flag-supplied JSON value. A bare `JSON.parse` throws a SyntaxError
+ * that never names which flag was malformed — `--data '{bad'` reads
+ * "Unexpected token" with no owner. `readJsonValue` already names its file;
+ * this is the same contract for inline flag values (OSK-12753).
+ */
+function parseJsonFlag(value, flagName) {
+    try {
+        return JSON.parse(value);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid JSON in ${flagName}: ${msg}`);
+    }
+}
 async function readJsonBody(source) {
     const parsed = await readJsonValue(source);
     if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {

package/dist/lib/task-asset-upload.d.ts

@@ -1,3 +1,4 @@
+import type { WorkResourceKind } from '@skrr-ai/data-provider';
 export type TaskAssetRole = 'input' | 'evidence' | 'deliverable';
 /**
  * What the bytes ARE in the work ledger, for an upload that is the archived
@@ -15,6 +16,10 @@ export type TaskAssetRole = 'input' | 'evidence' | 'deliverable';
  */
 export interface TaskAssetLedgerResource {
     identity: string;
+    /** The cited artifact's coordinate kind — the Resource identity depends on
+     * it (`url:` bytes must land on the `url` Resource, not a parallel `file`
+     * one). Omitted by callers that mean the literal file (OSK-12740). */
+    kind?: WorkResourceKind;
     title?: string;
     expectationIds?: string[];
 }

package/dist/lib/task-asset-upload.js

@@ -212,6 +212,8 @@ function fileFormData(filePath, filename, mimeType, role, ledger) {
         fd.append('role', role);
     if (ledger?.identity) {
         fd.append('identity', ledger.identity);
+        if (ledger.kind)
+            fd.append('kind', ledger.kind);
         if (ledger.title)
             fd.append('title', ledger.title);
         if (ledger.expectationIds?.length) {
@@ -243,6 +245,7 @@ async function genericDirectUpload(p) {
         ...(p.ledger?.identity
             ? {
                 identity: p.ledger.identity,
+                kind: p.ledger.kind,
                 title: p.ledger.title,
                 expectationIds: p.ledger.expectationIds,
             }
@@ -275,6 +278,7 @@ async function sessionDirectUpload(p) {
             ...(p.ledger?.identity
                 ? {
                     identity: p.ledger.identity,
+                    kind: p.ledger.kind,
                     title: p.ledger.title,
                     expectationIds: p.ledger.expectationIds,
                 }

package/dist/lib/task-closure.d.ts

@@ -42,7 +42,9 @@ export type ClosureLike = TaskClosureEvaluation | {
  * gate's own details carried for a while, and they are unusable on their own —
  * the whole point is to be able to act without a second lookup.
  */
-export declare function closureReport(closure: ClosureLike): string[];
+export declare function closureReport(closure: ClosureLike, { closing }?: {
+    closing?: boolean;
+}): string[];
 /**
  * The ways forward when a closed Task refuses a Result (`TASK_REOPEN_REQUIRED`).
  *

package/dist/lib/task-closure.js

@@ -38,7 +38,7 @@ const SHORT_BLOCKER = data_provider_1.CLOSURE_BLOCKER_PHRASE;
  * gate's own details carried for a while, and they are unusable on their own —
  * the whole point is to be able to act without a second lookup.
  */
-function closureReport(closure) {
+function closureReport(closure, { closing = true } = {}) {
     if (!closure)
         return ['Closure state: not reported by this call.'];
     if (isUnavailable(closure)) {
@@ -98,9 +98,19 @@ function closureReport(closure) {
      */
     const reviewRequired = closure.blockers.some((b) => b.code === 'TASK_RESULT_REVIEW_REQUIRED');
     lines.push('');
-    lines.push(reviewRequired
-        ? 'Only an accepted independent Review — or the Task owner closing directly — settles this. The rest is recorded on resolution.closure.'
-        : 'If this Task is closed anyway, all of the above is recorded on resolution.closure — closing over it settles nothing.');
+    // `result submit` does not close anything — "if closed anyway" there read
+    // as though the submit itself had tried to close and been stamped
+    // (OSK-12757). Distinguish the non-closing report from the close one.
+    if (closing) {
+        lines.push(reviewRequired
+            ? 'Only an accepted independent Review — or the Task owner closing directly — settles this. The rest is recorded on resolution.closure.'
+            : 'If this Task is closed anyway, all of the above is recorded on resolution.closure — closing over it settles nothing.');
+    }
+    else {
+        lines.push(reviewRequired
+            ? 'Only an accepted independent Review — or the Task owner closing directly — settles this. The rest is recorded on resolution.closure at close.'
+            : 'These stay outstanding — closing the Task later records them on resolution.closure.');
+    }
     return lines;
 }
 /**

package/dist/node_modules/@skrr-ai/data-provider/index.js

@@ -42759,6 +42759,10 @@ var gR = Object.freeze({ __proto__: null, acceptAgentIntuition: function(e2, t2,
   return oR.post((function(e3) {
     return "".concat(Rc(e3), "/approve-pr");
   })(e2), {});
+}, approveStoreArtifactAdmission: function(e2, t2) {
+  return oR.post((function(e3) {
+    return "".concat(er(), "/admissions/artifacts/").concat(encodeURIComponent(e3), "/approve");
+  })(e2), t2 ? { note: t2 } : {});
 }, approveStoreListingAdmission: dR, approveStoreReleaseAdmission: lR, approveWorkflowMerge: function(e2) {
   return oR.post((function(e3) {
     return "".concat(jr(), "/").concat(encodeURIComponent(e3), "/workflow/approve-merge");
@@ -43194,10 +43198,10 @@ var gR = Object.freeze({ __proto__: null, acceptAgentIntuition: function(e2, t2,
   var t2 = e2.taskId, n2 = e2.data;
   return oR.post(ka(t2), n2);
 }, createTaskAttachmentUploadIntent: function(e2) {
-  var t2 = e2.taskId, n2 = e2.filename, o2 = e2.mimeType, r2 = e2.sizeBytes, a2 = e2.sha256, i2 = e2.role, s2 = e2.commentId, c2 = e2.identity, l2 = e2.title, u2 = e2.expectationIds, d2 = e2.transport;
+  var t2 = e2.taskId, n2 = e2.filename, o2 = e2.mimeType, r2 = e2.sizeBytes, a2 = e2.sha256, i2 = e2.role, s2 = e2.commentId, c2 = e2.identity, l2 = e2.kind, u2 = e2.title, d2 = e2.expectationIds, p2 = e2.transport;
   return oR.post((function(e3) {
     return "".concat(jr(), "/").concat(encodeURIComponent(e3), "/attachments/upload-intent");
-  })(t2), S(S(S(S(S(S({ filename: n2, mimeType: o2, sizeBytes: r2, sha256: a2 }, i2 ? { role: i2 } : {}), s2 ? { commentId: s2 } : {}), c2 ? { identity: c2 } : {}), c2 && l2 ? { title: l2 } : {}), c2 && (null == u2 ? void 0 : u2.length) ? { expectationIds: u2 } : {}), d2 ? { transport: d2 } : {}));
+  })(t2), S(S(S(S(S(S(S({ filename: n2, mimeType: o2, sizeBytes: r2, sha256: a2 }, i2 ? { role: i2 } : {}), s2 ? { commentId: s2 } : {}), c2 ? { identity: c2 } : {}), c2 && l2 ? { kind: l2 } : {}), c2 && u2 ? { title: u2 } : {}), c2 && (null == d2 ? void 0 : d2.length) ? { expectationIds: d2 } : {}), p2 ? { transport: p2 } : {}));
 }, createTaskFollowUp: function(e2) {
   var t2 = e2.taskId, n2 = e2.data;
   return oR.post((function(e3) {
@@ -46040,6 +46044,10 @@ var gR = Object.freeze({ __proto__: null, acceptAgentIntuition: function(e2, t2,
   return oR.post((function(e3) {
     return "".concat(jr(), "/").concat(encodeURIComponent(e3), "/workflow-findings");
   })(e2), t2);
+}, refuseStoreArtifactAdmission: function(e2, t2) {
+  return oR.post((function(e3) {
+    return "".concat(er(), "/admissions/artifacts/").concat(encodeURIComponent(e3), "/refuse");
+  })(e2), { note: t2 });
 }, refuseStoreListingAdmission: pR, refuseStoreReleaseAdmission: uR, regenerateBackupCodes: function() {
   return oR.post("".concat(en, "/api/auth/2fa/backup/regenerate"));
 }, register: function(e2) {