@skrr-ai/cli 0.1.76 → 0.1.78

package/dist/commands/machines/dedicated/cp.js

@@ -26,6 +26,8 @@ class DedicatedMachinesCp extends base_command_1.BaseCommand {
             'machine is created.',
         'As with cp and scp, a destination that ends in / or is an existing directory receives the file ' +
             'under its source name.',
+        'Files marked executable keep owner execute permission on the copy. Other permissions use ' +
+            'destination defaults; source special permission bits are not copied.',
         'Neither side is left half-written: the file is staged beside its destination and renamed into ' +
             'place at the end. A file that changes while it is copied is refused, not spliced. Ctrl-C removes ' +
             'the partial copy and exits 130 (143 for SIGTERM, 129 when the terminal closes). Progress is ' +

package/dist/commands/store/publishers/cancel.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base-command';
+export default class StorePublishersCancel extends BaseCommand {
+    static description: string;
+    static args: {
+        approvalId: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/store/publishers/cancel.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const data_provider_1 = require("@skrr-ai/data-provider");
+const base_command_1 = require("../../../base-command");
+class StorePublishersCancel extends base_command_1.BaseCommand {
+    static description = 'Withdraw your own pending org publish approval request';
+    static args = { approvalId: core_1.Args.string({ required: true, ignoreStdin: true }) };
+    static flags = { json: core_1.Flags.boolean({ description: 'Output JSON' }) };
+    async run() {
+        this.requireAuth();
+        const { args } = await this.parse(StorePublishersCancel);
+        const result = await data_provider_1.dataService.cancelStoreOrgPublishApproval(args.approvalId);
+        this.log(JSON.stringify(result, null, 2));
+    }
+}
+exports.default = StorePublishersCancel;

package/dist/lib/dedicated-copy.js

@@ -12,6 +12,7 @@ const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const promises_1 = require("node:fs/promises");
 const node_path_1 = require("node:path");
+const dedicated_file_retry_1 = require("./dedicated-file-retry");
 const dedicated_machines_1 = require("./dedicated-machines");
 /**
  * A refusal the CLI makes itself, with the code the server uses for the same
@@ -212,15 +213,15 @@ async function uploadFile(localPath, leaseId, remotePath, scope, io) {
             if (!final && bytesRead === 0) {
                 throw changedWhileCopying(localPath, 'here');
             }
-            const result = await writeChunk(leaseId, {
+            const result = await (0, dedicated_file_retry_1.withFileAdmissionRetry)(() => writeChunk(leaseId, {
                 path: remotePath,
                 transferId,
                 offset,
                 dataBase64: buffer.subarray(0, bytesRead).toString('base64'),
                 // A file that GREW is caught here: the machine refuses to commit
                 // when what it staged is not the size declared at the start.
-                ...(final ? { final: true, totalSize: info.size } : {}),
-            }, scope);
+                ...(final ? { final: true, totalSize: info.size, executable: (info.mode & 0o111) !== 0 } : {}),
+            }, scope), signal);
             offset += bytesRead;
             onProgress?.(offset, info.size);
             if (final) {
@@ -275,20 +276,27 @@ async function downloadFromDedicatedRuntime(leaseId, remotePath, localPath, scop
     let offset = 0;
     let size = -1;
     let mtimeMs = -1;
+    let executable;
     try {
         for (;;) {
             throwIfCancelled(signal);
             // Nothing on the machine needs undoing, so an in-flight read is abandoned
             // at once rather than waited out.
-            const chunk = await readChunk(leaseId, { path: remotePath, offset, length: chunkBytes }, scope, signal);
+            const chunk = await (0, dedicated_file_retry_1.withFileAdmissionRetry)(() => readChunk(leaseId, { path: remotePath, offset, length: chunkBytes }, scope, signal), signal);
             if (size === -1) {
                 size = chunk.size;
                 mtimeMs = chunk.mtimeMs;
+                executable = chunk.executable;
             }
-            else if (chunk.size !== size || chunk.mtimeMs !== mtimeMs) {
+            else if (chunk.size !== size || chunk.mtimeMs !== mtimeMs ||
+                (typeof chunk.executable === 'boolean' && typeof executable === 'boolean' &&
+                    chunk.executable !== executable)) {
                 // Chunks from two versions of a file splice into one that never existed.
                 throw changedWhileCopying(remotePath, 'on the machine');
             }
+            // Older API replicas omit this additive metadata during a rollout.
+            if (typeof chunk.executable === 'boolean')
+                executable = chunk.executable;
             const bytes = Buffer.from(chunk.dataBase64, 'base64');
             if (bytes.byteLength !== chunk.bytesRead) {
                 throw new DedicatedCopyError('DEDICATED_RUNTIME_FILE_TRANSFER_FAILED', 'A chunk arrived damaged; nothing was written to the destination.');
@@ -303,6 +311,11 @@ async function downloadFromDedicatedRuntime(leaseId, remotePath, localPath, scop
                 throw changedWhileCopying(remotePath, 'on the machine');
             }
         }
+        // Set only the owner execute bit on the pinned staging inode. Other
+        // permissions keep destination defaults; source special bits never travel.
+        if (executable === true) {
+            await handle.chmod(((await handle.stat()).mode & 0o777) | 0o100);
+        }
         await handle.close();
         closed = true;
         await (0, promises_1.rename)(temporary, target);

package/dist/lib/dedicated-file-retry.d.ts

@@ -0,0 +1,4 @@
+/** Only admission refusals prove the pending file request never reached the daemon. */
+export declare function isFileAdmissionReconnect(error: unknown): boolean;
+/** Retry the same pending chunk, never an ambiguous transport failure or lost commit reply. */
+export declare function withFileAdmissionRetry<T>(request: () => Promise<T>, signal?: AbortSignal): Promise<T>;

package/dist/lib/dedicated-file-retry.js

@@ -0,0 +1,45 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isFileAdmissionReconnect = isFileAdmissionReconnect;
+exports.withFileAdmissionRetry = withFileAdmissionRetry;
+const promises_1 = require("node:timers/promises");
+const api_fetch_1 = require("./api-fetch");
+const RECONNECT_BACKOFF_MS = [500, 1000, 2000, 2000];
+/** Only admission refusals prove the pending file request never reached the daemon. */
+function isFileAdmissionReconnect(error) {
+    if (!(error instanceof api_fetch_1.ApiFetchError) ||
+        error.status !== 503 ||
+        error.code !== 'DEDICATED_RUNTIME_NOT_ASSIGNABLE')
+        return false;
+    try {
+        const body = JSON.parse(error.body ?? 'null');
+        return (body !== null &&
+            typeof body === 'object' &&
+            !Array.isArray(body) &&
+            body.code === 'DEDICATED_RUNTIME_NOT_ASSIGNABLE' &&
+            body.retryable === true);
+    }
+    catch {
+        return false;
+    }
+}
+/** Retry the same pending chunk, never an ambiguous transport failure or lost commit reply. */
+async function withFileAdmissionRetry(request, signal) {
+    for (let attempt = 0;; attempt += 1) {
+        if (signal?.aborted)
+            throw signal.reason ?? new Error('Copy cancelled');
+        try {
+            return await request();
+        }
+        catch (error) {
+            if (attempt >= RECONNECT_BACKOFF_MS.length || !isFileAdmissionReconnect(error))
+                throw error;
+            try {
+                await (0, promises_1.setTimeout)(RECONNECT_BACKOFF_MS[attempt], undefined, { signal });
+            }
+            catch (waitError) {
+                throw signal?.aborted ? (signal.reason ?? waitError) : waitError;
+            }
+        }
+    }
+}

package/dist/lib/dedicated-machines.d.ts

@@ -466,6 +466,7 @@ export interface DedicatedFileChunk {
     path: string;
     size: number;
     mtimeMs: number;
+    executable?: boolean;
     offset: number;
     bytesRead: number;
     dataBase64: string;
@@ -491,6 +492,7 @@ export declare function writeDedicatedRuntimeFileChunk(leaseId: string, input: {
     final?: boolean;
     abort?: boolean;
     totalSize?: number;
+    executable?: boolean;
 }, scope?: DedicatedRuntimeScope): Promise<DedicatedFileWriteResult>;
 export type DedicatedCopyPlan = {
     direction: 'upload';

package/dist/lib/dedicated-ssh.d.ts

@@ -112,6 +112,7 @@ export interface SshStartAck {
         type: string;
         key: string;
     }[];
+    receiverAckV1?: boolean;
 }
 export interface SshProxyOptions {
     baseURL: string;

package/dist/lib/dedicated-ssh.js

@@ -343,6 +343,7 @@ function runSshProxy(options) {
                 channelId,
                 keyType: identity.keyType,
                 keyBlob: identity.keyBlob,
+                receiverAckV1: true,
             });
         });
         socket.on('dedicated:ssh:start:ack', (ack) => {
@@ -366,11 +367,23 @@ function runSshProxy(options) {
             input.resume();
             input.on('data', onInput);
         });
-        socket.on('dedicated:ssh:data', (frame) => {
+        socket.on('dedicated:ssh:data', (frame, receipt) => {
             if (!frame || frame.channelId !== channelId || finished)
                 return;
             if (typeof frame.data === 'string' && frame.data.length > 0) {
-                output.write(Buffer.from(frame.data, 'base64'));
+                const bytes = Buffer.from(frame.data, 'base64');
+                if (typeof receipt === 'function') {
+                    // A frame can precede start-ack (sshd's banner). The owned channel
+                    // already advertised support; confirm only when stdout flushed.
+                    output.write(bytes, (error) => {
+                        receipt({ channelId, ok: !error && !finished });
+                        if (error)
+                            finish(1, 'Could not write SSH output.');
+                    });
+                }
+                else {
+                    output.write(bytes);
+                }
             }
         });
         socket.on('dedicated:ssh:closed', (frame) => {

package/dist/node_modules/@skrr-ai/data-provider/index.js

@@ -42881,6 +42881,10 @@ var gR = Object.freeze({ __proto__: null, acceptAgentIntuition: function(e2, t2,
   return oR.post((function(e3, t3) {
     return "".concat(ia(e3, t3), "/cancel");
   })(e2, t2), {});
+}, cancelStoreOrgPublishApproval: function(e2) {
+  return oR.delete((function(e3) {
+    return "".concat(er(), "/publishers/approvals/").concat(encodeURIComponent(e3));
+  })(e2));
 }, cancelSubscription: function(e2) {
   return oR.post("".concat(Lr(), "/cancel"), e2);
 }, cancelTaskAssetUpload: function(e2) {