@skrr-ai/cli 0.1.75 → 0.1.77

package/dist/commands/agents/releases/ci-publish.js

@@ -4,6 +4,7 @@ const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../../base-command");
 const github_oidc_1 = require("../../../lib/github-oidc");
+const http_error_1 = require("../../../lib/http-error");
 /**
  * Publish a release from CI using GitHub OIDC trusted publishing (OSK-12311).
  *
@@ -84,6 +85,21 @@ class AgentsReleasesCiPublish extends base_command_1.BaseCommand {
             });
         }
         catch (err) {
+            const body = (0, http_error_1.httpBodyOf)(err);
+            if ((0, http_error_1.httpStatusOf)(err) === 401 && body?.code === 'CI_OIDC_TOKEN_INVALID') {
+                const reason = typeof body.error === 'string' ? body.error : 'OIDC token was rejected';
+                const requestId = err instanceof Error ? err.requestId : undefined;
+                this.failWithCliError({
+                    message: `${reason}. Request a fresh GitHub Actions OIDC token with ` +
+                        '`permissions: id-token: write` and the expected audience.',
+                    code: 'CI_OIDC_TOKEN_INVALID',
+                    status: 401,
+                    exit: 2,
+                    retryable: false,
+                    details: body,
+                    requestId: typeof requestId === 'string' ? requestId : undefined,
+                });
+            }
             this.handleApiError(err);
         }
         if (flags.json) {

package/dist/commands/store/install.js

@@ -6,12 +6,12 @@ const base_command_1 = require("../../base-command");
 const prompt_1 = require("../../lib/prompt");
 /**
  * One line per placement, said the same way the web install rail says it: the
- * difference is whether a stranger's instructions get this computer's shell,
- * files and browser.
+ * difference is whether a stranger's instructions may reach a connected
+ * machine in the buyer's account. The model loop stays on Agent Worker.
  */
 const PLACEMENT_NOTE = {
-    cloud: "It runs in the cloud, so its tools do not reach this computer. You can change that in the agent's Runtime settings.",
-    local: 'It may use tools on your own computer (shell, files, browser) whenever your daemon is connected.',
+    cloud: "It runs in the cloud, so its tools cannot reach your connected machines. You can change that in the agent's Runtime settings.",
+    local: 'It still runs in the cloud. Its tools may use the shell, files and browser on an available connected machine in your account, selected when the agent runs.',
 };
 class StoreInstall extends base_command_1.BaseCommand {
     static description = 'Install a published agent — you get your own copy of it. A paid agent shows its price and refund terms and asks you to confirm first.';
@@ -44,8 +44,8 @@ class StoreInstall extends base_command_1.BaseCommand {
             description: 'Confirm a paid purchase without prompting. The price and refund terms are still printed.',
         }),
         'run-on': core_1.Flags.string({
-            description: 'Where the copy runs. cloud (the default) keeps its tools off this computer; ' +
-                'local lets it use your shell, files and browser when your daemon is connected',
+            description: 'Where its tools may run. cloud (the default) keeps tools off connected machines; ' +
+                'local lets tools use an available connected machine in your account, selected at run time. The agent runs in the cloud either way',
             options: [...data_provider_1.STORE_INSTALL_EXECUTION_PLACEMENTS],
         }),
         'share-outcomes': core_1.Flags.boolean({

package/dist/commands/store/publishers/cancel.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base-command';
+export default class StorePublishersCancel extends BaseCommand {
+    static description: string;
+    static args: {
+        approvalId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/publishers/cancel.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+class StorePublishersCancel extends base_command_1.BaseCommand {
+    static description = 'Withdraw your own pending org publish approval request';
+    static args = { approvalId: core_1.Args.string({ required: true, ignoreStdin: true }) };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args } = await this.parse(StorePublishersCancel);
+        const result = await data_provider_1.dataService.cancelStoreOrgPublishApproval(args.approvalId);
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StorePublishersCancel;

package/dist/lib/dedicated-copy.js

@@ -12,6 +12,7 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = require("node:path");
+const dedicated_file_retry_1 = require("./dedicated-file-retry");
 const dedicated_machines_1 = require("./dedicated-machines");
 /**
  * A refusal the CLI makes itself, with the code the server uses for the same
@@ -212,7 +213,7 @@ async function uploadFile(localPath, leaseId, remotePath, scope, io) {
             if (!final && bytesRead === 0) {
                 throw changedWhileCopying(localPath, 'here');
             }
-            const result = await writeChunk(leaseId, {
+            const result = await (0, dedicated_file_retry_1.withFileAdmissionRetry)(() => writeChunk(leaseId, {
                 path: remotePath,
                 transferId,
                 offset,
@@ -220,7 +221,7 @@ async function uploadFile(localPath, leaseId, remotePath, scope, io) {
                 // A file that GREW is caught here: the machine refuses to commit
                 // when what it staged is not the size declared at the start.
                 ...(final ? { final: true, totalSize: info.size } : {}),
-            }, scope);
+            }, scope), signal);
             offset += bytesRead;
             onProgress?.(offset, info.size);
             if (final) {
@@ -280,7 +281,7 @@ async function downloadFromDedicatedRuntime(leaseId, remotePath, localPath, scop
             throwIfCancelled(signal);
             // Nothing on the machine needs undoing, so an in-flight read is abandoned
             // at once rather than waited out.
-            const chunk = await readChunk(leaseId, { path: remotePath, offset, length: chunkBytes }, scope, signal);
+            const chunk = await (0, dedicated_file_retry_1.withFileAdmissionRetry)(() => readChunk(leaseId, { path: remotePath, offset, length: chunkBytes }, scope, signal), signal);
             if (size === -1) {
                 size = chunk.size;
                 mtimeMs = chunk.mtimeMs;

package/dist/lib/dedicated-file-retry.d.ts

@@ -0,0 +1,4 @@
+/** Only admission refusals prove the pending file request never reached the daemon. */
+export declare function isFileAdmissionReconnect(error: unknown): boolean;
+/** Retry the same pending chunk, never an ambiguous transport failure or lost commit reply. */
+export declare function withFileAdmissionRetry<T>(request: () => Promise<T>, signal?: AbortSignal): Promise<T>;

package/dist/lib/dedicated-file-retry.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isFileAdmissionReconnect = isFileAdmissionReconnect;
+exports.withFileAdmissionRetry = withFileAdmissionRetry;
+const promises_1 = require("node:timers/promises");
+const api_fetch_1 = require("./api-fetch");
+const RECONNECT_BACKOFF_MS = [500, 1000, 2000, 2000];
+/** Only admission refusals prove the pending file request never reached the daemon. */
+function isFileAdmissionReconnect(error) {
+    if (!(error instanceof api_fetch_1.ApiFetchError) ||
+        error.status !== 503 ||
+        error.code !== 'DEDICATED_RUNTIME_NOT_ASSIGNABLE')
+        return false;
+    try {
+        const body = JSON.parse(error.body ?? 'null');
+        return (body !== null &&
+            typeof body === 'object' &&
+            !Array.isArray(body) &&
+            body.code === 'DEDICATED_RUNTIME_NOT_ASSIGNABLE' &&
+            body.retryable === true);
+    }
+    catch {
+        return false;
+    }
+}
+/** Retry the same pending chunk, never an ambiguous transport failure or lost commit reply. */
+async function withFileAdmissionRetry(request, signal) {
+    for (let attempt = 0;; attempt += 1) {
+        if (signal?.aborted)
+            throw signal.reason ?? new Error('Copy cancelled');
+        try {
+            return await request();
+        }
+        catch (error) {
+            if (attempt >= RECONNECT_BACKOFF_MS.length || !isFileAdmissionReconnect(error))
+                throw error;
+            try {
+                await (0, promises_1.setTimeout)(RECONNECT_BACKOFF_MS[attempt], undefined, { signal });
+            }
+            catch (waitError) {
+                throw signal?.aborted ? (signal.reason ?? waitError) : waitError;
+            }
+        }
+    }
+}

package/dist/node_modules/@skrr-ai/data-provider/index.js

@@ -42881,6 +42881,10 @@ var gR = Object.freeze({ __proto__: null, acceptAgentIntuition: function(e2, t2,
   return oR.post((function(e3, t3) {
     return "".concat(ia(e3, t3), "/cancel");
   })(e2, t2), {});
+}, cancelStoreOrgPublishApproval: function(e2) {
+  return oR.delete((function(e3) {
+    return "".concat(er(), "/publishers/approvals/").concat(encodeURIComponent(e3));
+  })(e2));
 }, cancelSubscription: function(e2) {
   return oR.post("".concat(Lr(), "/cancel"), e2);
 }, cancelTaskAssetUpload: function(e2) {