@skrr-ai/cli 0.1.75 → 0.1.76

package/dist/commands/agents/releases/ci-publish.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
 const github_oidc_1 = require("../../../lib/github-oidc");
+const http_error_1 = require("../../../lib/http-error");
 /**
  * Publish a release from CI using GitHub OIDC trusted publishing (OSK-12311).
  *
@@ -84,6 +85,21 @@ class AgentsReleasesCiPublish extends base_command_1.BaseCommand {
             });
         }
         catch (err) {
+            const body = (0, http_error_1.httpBodyOf)(err);
+            if ((0, http_error_1.httpStatusOf)(err) === 401 && body?.code === 'CI_OIDC_TOKEN_INVALID') {
+                const reason = typeof body.error === 'string' ? body.error : 'OIDC token was rejected';
+                const requestId = err instanceof Error ? err.requestId : undefined;
+                this.failWithCliError({
+                    message: `${reason}. Request a fresh GitHub Actions OIDC token with ` +
+                        '`permissions: id-token: write` and the expected audience.',
+                    code: 'CI_OIDC_TOKEN_INVALID',
+                    status: 401,
+                    exit: 2,
+                    retryable: false,
+                    details: body,
+                    requestId: typeof requestId === 'string' ? requestId : undefined,
+                });
+            }
             this.handleApiError(err);
         }
         if (flags.json) {

package/dist/commands/store/install.js

@@ -6,12 +6,12 @@ const base_command_1 = require("../../base-command");
 const prompt_1 = require("../../lib/prompt");
 /**
  * One line per placement, said the same way the web install rail says it: the
- * difference is whether a stranger's instructions get this computer's shell,
- * files and browser.
+ * difference is whether a stranger's instructions may reach a connected
+ * machine in the buyer's account. The model loop stays on Agent Worker.
  */
 const PLACEMENT_NOTE = {
-    cloud: "It runs in the cloud, so its tools do not reach this computer. You can change that in the agent's Runtime settings.",
-    local: 'It may use tools on your own computer (shell, files, browser) whenever your daemon is connected.',
+    cloud: "It runs in the cloud, so its tools cannot reach your connected machines. You can change that in the agent's Runtime settings.",
+    local: 'It still runs in the cloud. Its tools may use the shell, files and browser on an available connected machine in your account, selected when the agent runs.',
 };
 class StoreInstall extends base_command_1.BaseCommand {
     static description = 'Install a published agent — you get your own copy of it. A paid agent shows its price and refund terms and asks you to confirm first.';
@@ -44,8 +44,8 @@ class StoreInstall extends base_command_1.BaseCommand {
             description: 'Confirm a paid purchase without prompting. The price and refund terms are still printed.',
         }),
         'run-on': core_1.Flags.string({
-            description: 'Where the copy runs. cloud (the default) keeps its tools off this computer; ' +
-                'local lets it use your shell, files and browser when your daemon is connected',
+            description: 'Where its tools may run. cloud (the default) keeps tools off connected machines; ' +
+                'local lets tools use an available connected machine in your account, selected at run time. The agent runs in the cloud either way',
             options: [...data_provider_1.STORE_INSTALL_EXECUTION_PLACEMENTS],
         }),
         'share-outcomes': core_1.Flags.boolean({