@skrr-ai/cli 0.1.74 → 0.1.76

package/dist/commands/agents/releases/ci-publish.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
 const github_oidc_1 = require("../../../lib/github-oidc");
+const http_error_1 = require("../../../lib/http-error");
 /**
  * Publish a release from CI using GitHub OIDC trusted publishing (OSK-12311).
  *
@@ -84,6 +85,21 @@ class AgentsReleasesCiPublish extends base_command_1.BaseCommand {
             });
         }
         catch (err) {
+            const body = (0, http_error_1.httpBodyOf)(err);
+            if ((0, http_error_1.httpStatusOf)(err) === 401 && body?.code === 'CI_OIDC_TOKEN_INVALID') {
+                const reason = typeof body.error === 'string' ? body.error : 'OIDC token was rejected';
+                const requestId = err instanceof Error ? err.requestId : undefined;
+                this.failWithCliError({
+                    message: `${reason}. Request a fresh GitHub Actions OIDC token with ` +
+                        '`permissions: id-token: write` and the expected audience.',
+                    code: 'CI_OIDC_TOKEN_INVALID',
+                    status: 401,
+                    exit: 2,
+                    retryable: false,
+                    details: body,
+                    requestId: typeof requestId === 'string' ? requestId : undefined,
+                });
+            }
             this.handleApiError(err);
         }
         if (flags.json) {

package/dist/commands/store/advisories/issue.js

@@ -9,7 +9,7 @@ const store_advisories_1 = require("../../../lib/store-advisories");
  * reversible side. Lifting it later takes two (`close`, then `confirm`).
  */
 class StoreAdvisoriesIssue extends base_command_1.BaseCommand {
-    static description = 'Issue a Store advisory against a published release. `revoke` stops every installed copy running it from running unattended. Store curators only.';
+    static description = 'Issue a Store advisory against a published release. `revoke` stops unattended runs; `pause_execution` also stops manual chat. Store curators only.';
     static examples = [
         '<%= config.bin %> store advisories issue agent_abc123 ar_def456 --remedy revoke --summary "Posts connector tokens to a third-party host" --evidence https://example.com/report',
         '<%= config.bin %> store advisories issue agent_abc123 ar_def456 --remedy withdraw --summary "Breaks on the new calendar API"',
@@ -24,7 +24,7 @@ class StoreAdvisoriesIssue extends base_command_1.BaseCommand {
     };
     static flags = {
         remedy: core_1.Flags.string({
-            description: 'notify: tell installers · withdraw: stop new installs and updates · revoke: withdraw, and stop unattended runs of every copy running it',
+            description: 'notify: tell installers · withdraw: stop installs and updates · revoke: also stop unattended runs · pause_execution: also stop manual chat',
             options: [...data_provider_1.STORE_RELEASE_ADVISORY_ISSUABLE_REMEDIES],
             required: true,
         }),

package/dist/commands/store/install.js

@@ -6,12 +6,12 @@ const base_command_1 = require("../../base-command");
 const prompt_1 = require("../../lib/prompt");
 /**
  * One line per placement, said the same way the web install rail says it: the
- * difference is whether a stranger's instructions get this computer's shell,
- * files and browser.
+ * difference is whether a stranger's instructions may reach a connected
+ * machine in the buyer's account. The model loop stays on Agent Worker.
  */
 const PLACEMENT_NOTE = {
-    cloud: "It runs in the cloud, so its tools do not reach this computer. You can change that in the agent's Runtime settings.",
-    local: 'It may use tools on your own computer (shell, files, browser) whenever your daemon is connected.',
+    cloud: "It runs in the cloud, so its tools cannot reach your connected machines. You can change that in the agent's Runtime settings.",
+    local: 'It still runs in the cloud. Its tools may use the shell, files and browser on an available connected machine in your account, selected when the agent runs.',
 };
 class StoreInstall extends base_command_1.BaseCommand {
     static description = 'Install a published agent — you get your own copy of it. A paid agent shows its price and refund terms and asks you to confirm first.';
@@ -44,8 +44,8 @@ class StoreInstall extends base_command_1.BaseCommand {
             description: 'Confirm a paid purchase without prompting. The price and refund terms are still printed.',
         }),
         'run-on': core_1.Flags.string({
-            description: 'Where the copy runs. cloud (the default) keeps its tools off this computer; ' +
-                'local lets it use your shell, files and browser when your daemon is connected',
+            description: 'Where its tools may run. cloud (the default) keeps tools off connected machines; ' +
+                'local lets tools use an available connected machine in your account, selected at run time. The agent runs in the cloud either way',
             options: [...data_provider_1.STORE_INSTALL_EXECUTION_PLACEMENTS],
         }),
         'share-outcomes': core_1.Flags.boolean({