@skrr-ai/cli 0.1.78 → 0.1.80

package/dist/lib/daemonRestartWait.js

@@ -0,0 +1,181 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_POLL_MS = exports.SUPERVISED_GRACE_MS = exports.DEFAULT_RESTART_WAIT_MS = exports.STARTING_WINDOW_MS = void 0;
+exports.probeDaemonRestart = probeDaemonRestart;
+exports.awaitRestartedDaemon = awaitRestartedDaemon;
+/**
+ * Bounded wait for a local daemon that is restarting (OSK-13222).
+ *
+ * The CLI's credential on a daemon-brokered machine is redeemed per process
+ * over the daemon's loopback hand-off. A daemon restart opens a window in which
+ * there is nothing to redeem from:
+ *
+ *   - a GRACEFUL restart removes the hand-off descriptor on shutdown and the
+ *     replacement publishes a new one only once it is listening — measured at
+ *     ~14s on a laptop (shutdown 03:11:34 → `listening` 03:11:48), most of it
+ *     harness detection;
+ *   - a CRASH leaves the descriptor naming a pid that has exited until the
+ *     supervisor starts a replacement.
+ *
+ * Every `skrr` process landing in that window used to report "Not signed in.
+ * Run `skrr login` first." and succeed on an immediate retry. This module
+ * decides whether a restart is plausibly in progress and, if so, waits for a
+ * fresh descriptor — bounded, and never when nothing says a daemon is coming
+ * back, so a machine with no daemon pays nothing.
+ *
+ * The signals, cheapest to strongest:
+ *
+ *   - `starting` — the profile's singleton-lock sidecar names a LIVE pid that
+ *     acquired the lock recently. That is a daemon between lock and listen;
+ *     its descriptor is coming. Wait up to the full budget.
+ *   - `supervised` — no live lock holder, but a launchd plist / systemd user
+ *     unit for the profile is installed, so a supervisor is expected to bring
+ *     one up (the ~1.4s between a graceful release and the next acquire, or a
+ *     crash awaiting respawn). Wait a short grace, extended to the full budget
+ *     if a holder appears.
+ *   - `none` — no daemon is coming, or one is running and deliberately not
+ *     serving hand-offs (its lock is old: auth latched, OSK-12807). Do not wait.
+ */
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+/** A lock acquired within this window belongs to a daemon still starting up. */
+exports.STARTING_WINDOW_MS = 60_000;
+/** Total wait once a starting daemon is seen. Startup was measured at ~14s. */
+exports.DEFAULT_RESTART_WAIT_MS = 20_000;
+/** Wait for a supervisor to start a daemon when none holds the lock yet. */
+exports.SUPERVISED_GRACE_MS = 4_000;
+exports.DEFAULT_POLL_MS = 250;
+const PROFILE_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+/**
+ * Read the restart signal for `profile` from the daemon's own on-disk state.
+ * Never throws; anything unreadable reads as absent.
+ */
+function probeDaemonRestart(profile, opts = {}) {
+    if (!PROFILE_RE.test(profile))
+        return 'none';
+    const home = opts.homeDir ?? os.homedir();
+    const now = opts.now ?? Date.now();
+    const platform = opts.platform ?? process.platform;
+    try {
+        const infoPath = path.join(home, '.skrr', 'profiles', profile, 'daemon.lock.info.json');
+        const info = JSON.parse(fs.readFileSync(infoPath, 'utf8'));
+        if (typeof info.pid === 'number' && info.pid > 0 && pidAlive(info.pid)) {
+            const startedAt = typeof info.startedAt === 'string' ? Date.parse(info.startedAt) : NaN;
+            // A live holder that started long ago is a running daemon that is not
+            // serving hand-offs on purpose — waiting would only add latency.
+            if (Number.isFinite(startedAt) && now - startedAt <= exports.STARTING_WINDOW_MS)
+                return 'starting';
+            return 'none';
+        }
+    }
+    catch {
+        /* no sidecar, or unreadable: fall through to the supervisor check */
+    }
+    // Supervisor names mirror daemon/src/profile.ts (`launchdLabelFor`,
+    // `systemdUnitFor`); the CLI does not import daemon code.
+    const units = [];
+    if (platform === 'darwin') {
+        units.push(path.join(home, 'Library', 'LaunchAgents', `ai.skrr.daemon.${profile}.plist`));
+    }
+    else if (platform === 'linux') {
+        units.push(path.join(home, '.config', 'systemd', 'user', `skrrd-${profile}.service`));
+    }
+    for (const unit of units) {
+        try {
+            if (fs.existsSync(unit))
+                return 'supervised';
+        }
+        catch {
+            /* unreadable reads as absent */
+        }
+    }
+    return 'none';
+}
+function envBudget() {
+    const raw = process.env.SKRR_DAEMON_RESTART_WAIT_MS;
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : undefined;
+}
+async function awaitRestartedDaemon(opts) {
+    const maxWaitMs = envBudget() ?? opts.maxWaitMs ?? exports.DEFAULT_RESTART_WAIT_MS;
+    if (maxWaitMs <= 0)
+        return { waited: false, waitedMs: 0, ready: false };
+    const probe = opts.probe ?? ((p) => probeDaemonRestart(p));
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const pollMs = opts.pollMs ?? exports.DEFAULT_POLL_MS;
+    const grace = Math.min(opts.supervisedGraceMs ?? exports.SUPERVISED_GRACE_MS, maxWaitMs);
+    let signal = probe(opts.profile);
+    if (signal === 'none')
+        return { waited: false, waitedMs: 0, ready: false };
+    const start = now();
+    let deadline = start + (signal === 'starting' ? maxWaitMs : grace);
+    const notify = opts.notify ??
+        ((message) => {
+            process.stderr.write(`[skrr] ${message}\n`);
+        });
+    notify(`The skrr background service on this computer is restarting; waiting up to ${Math.round(maxWaitMs / 1000)}s for it to come back.`);
+    for (;;) {
+        if (opts.ready())
+            return { waited: true, waitedMs: now() - start, ready: true };
+        if (now() >= deadline)
+            break;
+        await sleep(pollMs);
+        signal = probe(opts.profile);
+        if (signal === 'starting')
+            deadline = Math.max(deadline, start + maxWaitMs);
+        else if (signal === 'none') {
+            // Nothing is coming back after all — but a descriptor may have landed
+            // between the last check and this probe.
+            if (opts.ready())
+                return { waited: true, waitedMs: now() - start, ready: true };
+            break;
+        }
+    }
+    return { waited: true, waitedMs: now() - start, ready: false };
+}

package/dist/lib/dedicated-lease-command.js

@@ -129,6 +129,7 @@ class DedicatedLeaseCommand extends base_command_1.BaseCommand {
                 ...(flags.cwd ? { cwd: flags.cwd } : {}),
                 ...(initialCommand ? { initialCommand } : {}),
                 persistent,
+                resumeExistingSupported: capabilities.includes('persistent_terminal_resume_v1'),
                 ...(sessionName ? { sessionName } : {}),
                 leaseId,
                 input: process.stdin,

package/dist/lib/dedicated-service.js

@@ -26,6 +26,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agentic_stream_1 = require("./agentic-stream");
+const dpop_auth_1 = require("./dpop-auth");
 const format_1 = require("./format");
 /**
  * Declared services on a Dedicated Runtime — the CLI half of
@@ -411,17 +412,20 @@ function specFromFlags(input) {
     }
     return spec;
 }
-function socketOptions(token) {
+function socketOptions(token, wsOrigin) {
     return {
         path: '/ws/agentic',
-        auth: {
+        // OSK-12020 — a DPoP-bound token proves possession on every handshake.
+        auth: (0, dpop_auth_1.socketAuthWithDpop)({
             token,
             // This proves origin only; the normal CLI token retains full execution authority.
-            ...(process.env.OVERSKY_SESSION_TOKEN ? { executionOriginToken: process.env.OVERSKY_SESSION_TOKEN } : {}),
+            ...(process.env.OVERSKY_SESSION_TOKEN
+                ? { executionOriginToken: process.env.OVERSKY_SESSION_TOKEN }
+                : {}),
             ...(0, data_provider_1.getClientIdentityAuth)(),
             clientPlatform: 'cli',
             clientOs: process.platform === 'darwin' ? 'macos' : process.platform,
-        },
+        }, wsOrigin),
         transports: ['websocket'],
         reconnection: false,
     };
@@ -442,7 +446,8 @@ class DedicatedServiceChannel {
     constructor(options) {
         this.options = options;
         const connect = options.connect ?? socket_io_client_1.io;
-        this.socket = connect((0, agentic_stream_1.toWebSocketOrigin)(options.baseURL), socketOptions(options.token));
+        const wsOrigin = (0, agentic_stream_1.toWebSocketOrigin)(options.baseURL);
+        this.socket = connect(wsOrigin, socketOptions(options.token, wsOrigin));
         // An ack resolves a request only when it arrives on THAT request's own
         // ack event — a requestId echoed back on the wrong family is not an
         // answer, however well-formed it looks.

package/dist/lib/dedicated-ssh.js

@@ -22,6 +22,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agentic_stream_1 = require("./agentic-stream");
+const dpop_auth_1 = require("./dpop-auth");
 /**
  * Owner SSH to a Dedicated Runtime — SSH protocol over the admitted relay.
  *
@@ -284,14 +285,16 @@ function runSshProxy(options) {
     return new Promise((resolve) => {
         let started = false;
         let finished = false;
-        const socket = connect((0, agentic_stream_1.toWebSocketOrigin)(options.baseURL), {
+        const wsOrigin = (0, agentic_stream_1.toWebSocketOrigin)(options.baseURL);
+        const socket = connect(wsOrigin, {
             path: '/ws/agentic',
-            auth: {
+            // OSK-12020 — a DPoP-bound token proves possession on every handshake.
+            auth: (0, dpop_auth_1.socketAuthWithDpop)({
                 token: options.token,
                 ...(0, data_provider_1.getClientIdentityAuth)(),
                 clientPlatform: 'cli',
                 clientOs: process.platform === 'darwin' ? 'macos' : process.platform,
-            },
+            }, wsOrigin),
             transports: ['websocket'],
             // A reconnect cannot resume a channel whose admission line the daemon
             // revoked on socket death — say it ended and let ssh retry fresh.

package/dist/lib/dedicated-terminal.d.ts

@@ -27,6 +27,7 @@ export interface TerminalOutputFrame {
     encoding?: 'utf8' | 'base64';
     exitCode?: number | null;
     signal?: string | null;
+    code?: string;
 }
 export interface TerminalStartAck {
     sessionId?: string;
@@ -66,6 +67,8 @@ export interface DedicatedTerminalOptions {
      * capability before asking.
      */
     persistent?: boolean;
+    /** Capability-gated recovery can attach only an existing named shell. */
+    resumeExistingSupported?: boolean;
     /**
      * The session suffix (`skrr-term-<name>`). The same name re-attaches the
      * same session; omitted under `persistent`, the machine names the session

package/dist/lib/dedicated-terminal.js

@@ -9,6 +9,7 @@ const node_crypto_1 = require("node:crypto");
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agentic_stream_1 = require("./agentic-stream");
+const dpop_auth_1 = require("./dpop-auth");
 /**
  * A real pseudo-terminal on a Dedicated Runtime, from a local terminal.
  *
@@ -67,6 +68,9 @@ function describeTerminalStartRefusal(ack) {
     if (code === 'DEDICATED_RUNTIME_GENERATION_STALE') {
         return 'The machine was replaced since its daemon registered. Wait a minute and try again.';
     }
+    if (code === 'persistent-session-missing') {
+        return 'The original terminal no longer exists. Start a new terminal explicitly; no replacement shell was opened.';
+    }
     if (code === 'not_found' || code === 'offline') {
         return 'The machine’s daemon is not connected. Wait for it to come online and try again.';
     }
@@ -94,14 +98,19 @@ function runDedicatedTerminal(options) {
         let sessionReady = false;
         let reattaching = false;
         let persistentName = options.sessionName;
-        const socket = connect((0, agentic_stream_1.toWebSocketOrigin)(options.baseURL), {
+        let retryTimer;
+        let recoveryTimer;
+        let connected = false;
+        const wsOrigin = (0, agentic_stream_1.toWebSocketOrigin)(options.baseURL);
+        const socket = connect(wsOrigin, {
             path: '/ws/agentic',
-            auth: {
+            // OSK-12020 — a DPoP-bound token proves possession on every handshake.
+            auth: (0, dpop_auth_1.socketAuthWithDpop)({
                 token: options.token,
                 ...(0, data_provider_1.getClientIdentityAuth)(),
                 clientPlatform: 'cli',
                 clientOs: process.platform === 'darwin' ? 'macos' : process.platform,
-            },
+            }, wsOrigin),
             transports: ['websocket'],
             // A bare PTY cannot be resumed: the relay forgets the session with the
             // socket, and silently opening a NEW shell would drop the user into a
@@ -170,6 +179,10 @@ function runDedicatedTerminal(options) {
         const onSigterm = () => finish(143, true);
         const onSighup = () => finish(129, true);
         const onStartTimeout = () => {
+            if (reattaching) {
+                scheduleRetry();
+                return;
+            }
             fail(new DedicatedTerminalError('The machine did not answer the terminal start in time. Its daemon may be busy or offline.', 'TERMINAL_START_TIMEOUT'));
         };
         let startTimer = setTimeout(onStartTimeout, exports.TERMINAL_START_TIMEOUT_MS);
@@ -190,6 +203,8 @@ function runDedicatedTerminal(options) {
                 return;
             finished = true;
             clearTimeout(startTimer);
+            clearTimeout(retryTimer);
+            clearTimeout(recoveryTimer);
             pending?.close();
             restoreTty();
             detachReconnectFailed();
@@ -203,6 +218,8 @@ function runDedicatedTerminal(options) {
                 return;
             finished = true;
             clearTimeout(startTimer);
+            clearTimeout(retryTimer);
+            clearTimeout(recoveryTimer);
             pending?.close();
             restoreTty();
             detachReconnectFailed();
@@ -212,15 +229,19 @@ function runDedicatedTerminal(options) {
         socket.on('connect_error', (err) => {
             // A failed retry while reattaching is not fatal — the attempt countdown
             // keeps running and `reconnect_failed` ends it if they all miss.
-            if (persistent && reattaching)
+            if (persistent && reattaching && !err.data?.code)
                 return;
             fail(new DedicatedTerminalError(`Could not connect to skrr: ${err.message}`, err.data?.code || 'TERMINAL_CONNECT_FAILED'));
         });
-        socket.on('connect', () => {
-            if (finished)
+        function sendStart() {
+            if (finished || !connected)
                 return;
+            // Clear the previous relay entry too; never replay bytes sent before loss.
+            if (sessionId)
+                socket.emit(events.stop, { sessionId });
             sessionId = (0, node_crypto_1.randomUUID)();
             clearTimeout(startTimer);
+            clearTimeout(retryTimer);
             startTimer = setTimeout(onStartTimeout, exports.TERMINAL_START_TIMEOUT_MS);
             startTimer.unref();
             socket.emit(events.start, {
@@ -228,13 +249,44 @@ function runDedicatedTerminal(options) {
                 sessionId,
                 ...(options.cwd ? { cwd: options.cwd } : {}),
                 ...(persistent ? { persistent: true } : {}),
-                // The RESOLVED name, not just the requested one: a `--new` session the
-                // machine named itself comes back in the ack, and a re-attach must
-                // name it — `tmux -A` without `-s` would open a fresh session instead.
+                ...(reattaching ? { resumeExisting: true } : {}),
                 ...(persistentName ? { sessionName: persistentName } : {}),
                 ...(options.leaseId ? { leaseId: options.leaseId } : {}),
                 ...size(),
             });
+        }
+        function scheduleRetry() {
+            clearTimeout(startTimer);
+            clearTimeout(retryTimer);
+            if (finished || !reattaching)
+                return;
+            retryTimer = setTimeout(sendStart, 2_000);
+            retryTimer.unref();
+        }
+        function recover() {
+            if (finished || reattaching)
+                return;
+            started = false;
+            pending?.close(); // The sign-in command is never typed a second time.
+            clearTimeout(startTimer);
+            if (!persistent || !persistentName || !options.resumeExistingSupported) {
+                errorOutput.write(`\r\n[terminal attachment lost; rerun the same command to reattach${persistentName ? ` to '${persistentName}'` : ''}]\r\n`);
+                finish(1, false);
+                return;
+            }
+            reattaching = true;
+            errorOutput.write(`\r\n[lost the terminal attachment — reattaching to session '${persistentName}'…]\r\n`);
+            recoveryTimer = setTimeout(() => {
+                errorOutput.write(`\r\n[could not reattach within 60 seconds; rerun the same command for session '${persistentName}']\r\n`);
+                finish(1, false);
+            }, 60_000);
+            recoveryTimer.unref();
+            if (connected)
+                sendStart();
+        }
+        socket.on('connect', () => {
+            connected = true;
+            sendStart();
         });
         socket.on(events.startAck, (ack) => {
             if (!ack || ack.sessionId !== sessionId || started || finished)
@@ -242,6 +294,12 @@ function runDedicatedTerminal(options) {
             if (ack.daemonId && ack.daemonId !== options.daemonId)
                 return;
             if (!ack.ok) {
+                // Only daemon availability refusals are retryable. Authorization,
+                // generation fencing and a missing original shell end recovery.
+                if (reattaching && (ack.code === 'offline' || ack.code === 'not_found')) {
+                    scheduleRetry();
+                    return;
+                }
                 fail(new DedicatedTerminalError(describeTerminalStartRefusal(ack), ack.code || 'TERMINAL_START_REFUSED'));
                 return;
             }
@@ -249,6 +307,8 @@ function runDedicatedTerminal(options) {
             started = true;
             reattaching = false;
             clearTimeout(startTimer);
+            clearTimeout(retryTimer);
+            clearTimeout(recoveryTimer);
             if (typeof ack.persistentName === 'string' && ack.persistentName) {
                 persistentName = ack.persistentName;
             }
@@ -278,8 +338,13 @@ function runDedicatedTerminal(options) {
                 return;
             if (frame.daemonId && frame.daemonId !== options.daemonId)
                 return;
+            if (frame.code === 'daemon-disconnected' ||
+                (frame.type === 'error' && (frame.code === 'not-found' || frame.code === 'closed'))) {
+                recover();
+                return;
+            }
             if (frame.type === 'exit') {
-                finish(typeof frame.exitCode === 'number' ? frame.exitCode : 0, false);
+                finish(typeof frame.exitCode === 'number' ? frame.exitCode : 1, false);
                 return;
             }
             if (frame.type === 'error' || frame.type === 'info') {
@@ -318,17 +383,11 @@ function runDedicatedTerminal(options) {
             }
         }
         socket.on('disconnect', () => {
+            connected = false;
             if (finished)
                 return;
             if (persistent) {
-                // The tmux session outlives the link — the tmux client's death only
-                // detaches. socket.io retries and the next start re-attaches by name.
-                started = false;
-                if (!reattaching) {
-                    reattaching = true;
-                    const named = persistentName ? ` '${persistentName}'` : '';
-                    errorOutput.write(`\r\n[lost the connection to skrr — reattaching to session${named}…]\r\n`);
-                }
+                recover();
                 return;
             }
             if (!started) {

package/dist/lib/dpop-auth.d.ts

@@ -0,0 +1,35 @@
+/**
+ * dpop-auth.ts — attach RFC 9449 proofs for a DPoP-bound hand-off token
+ * (OSK-12020).
+ *
+ * The ONE place a request path asks for a proof, so every transport the CLI
+ * has — `apiFetch`, the data-service node adapter, SSE, and Socket.IO — binds
+ * the same way. For any other credential both helpers are no-ops and the wire
+ * is byte-identical to before.
+ *
+ * The CLI never holds the key. Each proof comes from the local daemon
+ * (`brokeredDpopProof`), which keeps the private half in its own memory; that
+ * is what makes a copied token useless anywhere but on this machine.
+ */
+/** RFC 9449 §4.1. */
+export declare const DPOP_HEADER = "DPoP";
+/** Headers to add to one HTTP request made with `token`; `{}` when unbound. */
+export declare function dpopHeadersFor(token: string | null | undefined, method: string, url: string): Promise<Record<string, string>>;
+/**
+ * The URI a Socket.IO handshake proof commits to: the realtime origin's
+ * http(s) form plus the engine path, no trailing slash — what the server
+ * rebuilds from the handshake request (`reconstructHandshakeHtu`).
+ */
+export declare function socketHandshakeHtu(wsOrigin: string, ioPath?: string): string;
+type SocketAuth = Record<string, unknown>;
+type SocketAuthFn = (cb: (data: SocketAuth) => void) => void;
+/**
+ * Socket.IO `auth` for a handshake made with `auth.token`. Unbound: the object
+ * itself, unchanged. Bound: a FUNCTION, which socket.io-client calls on every
+ * (re)connect — so each handshake presents a fresh, single-use proof instead
+ * of replaying the first one into the server's jti cache.
+ */
+export declare function socketAuthWithDpop(auth: SocketAuth & {
+    token?: string | null;
+}, wsOrigin: string, ioPath?: string): SocketAuth | SocketAuthFn;
+export {};

package/dist/lib/dpop-auth.js

@@ -0,0 +1,57 @@
+"use strict";
+/**
+ * dpop-auth.ts — attach RFC 9449 proofs for a DPoP-bound hand-off token
+ * (OSK-12020).
+ *
+ * The ONE place a request path asks for a proof, so every transport the CLI
+ * has — `apiFetch`, the data-service node adapter, SSE, and Socket.IO — binds
+ * the same way. For any other credential both helpers are no-ops and the wire
+ * is byte-identical to before.
+ *
+ * The CLI never holds the key. Each proof comes from the local daemon
+ * (`brokeredDpopProof`), which keeps the private half in its own memory; that
+ * is what makes a copied token useless anywhere but on this machine.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DPOP_HEADER = void 0;
+exports.dpopHeadersFor = dpopHeadersFor;
+exports.socketHandshakeHtu = socketHandshakeHtu;
+exports.socketAuthWithDpop = socketAuthWithDpop;
+const brokered_dpop_1 = require("./brokered-dpop");
+/** RFC 9449 §4.1. */
+exports.DPOP_HEADER = 'DPoP';
+/** Headers to add to one HTTP request made with `token`; `{}` when unbound. */
+async function dpopHeadersFor(token, method, url) {
+    if (!(0, brokered_dpop_1.isDpopBoundHandoffToken)(token))
+        return {};
+    const proof = await (0, brokered_dpop_1.brokeredDpopProof)(token, method, url);
+    return proof ? { [exports.DPOP_HEADER]: proof } : {};
+}
+/**
+ * The URI a Socket.IO handshake proof commits to: the realtime origin's
+ * http(s) form plus the engine path, no trailing slash — what the server
+ * rebuilds from the handshake request (`reconstructHandshakeHtu`).
+ */
+function socketHandshakeHtu(wsOrigin, ioPath = '/ws/agentic') {
+    const u = new URL(wsOrigin);
+    u.protocol = u.protocol === 'wss:' ? 'https:' : u.protocol === 'ws:' ? 'http:' : u.protocol;
+    u.pathname = ioPath.replace(/\/+$/, '');
+    u.search = '';
+    u.hash = '';
+    return u.toString();
+}
+/**
+ * Socket.IO `auth` for a handshake made with `auth.token`. Unbound: the object
+ * itself, unchanged. Bound: a FUNCTION, which socket.io-client calls on every
+ * (re)connect — so each handshake presents a fresh, single-use proof instead
+ * of replaying the first one into the server's jti cache.
+ */
+function socketAuthWithDpop(auth, wsOrigin, ioPath = '/ws/agentic') {
+    const token = typeof auth.token === 'string' ? auth.token : null;
+    if (!(0, brokered_dpop_1.isDpopBoundHandoffToken)(token))
+        return auth;
+    const htu = socketHandshakeHtu(wsOrigin, ioPath);
+    return (cb) => {
+        void (0, brokered_dpop_1.brokeredDpopProof)(token, 'GET', htu).then((proof) => cb(proof ? { ...auth, dpop: proof } : auth), () => cb(auth));
+    };
+}

package/dist/lib/login.d.ts

@@ -42,6 +42,12 @@ export interface CliLoginWithRefreshTokenOptions {
  * What a shell with no terminal can do instead (OSK-12117). The refusal used to
  * name only CI tokens, which is not a sign-in: an agent session asking for one
  * could only hand the job to a person typing `! skrr login`.
+ *
+ * It also used to send CI to `skrr create-token` + `OVERSKY_TOKEN=osk_ci_...`.
+ * That token only bootstraps a daemon; every `skrr` command rejects it with 401
+ * (create-token.ts, base-command.ts), so the advice was a dead end (OSK-13209).
+ * The route that works today is a minted machine session — see
+ * docs/cli/SKRR_AUTH.md "CI today" for its caveats.
  */
 export declare const HEADLESS_LOGIN_HINT: string;
 /**

package/dist/lib/login.js

@@ -43,10 +43,18 @@ const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
  * What a shell with no terminal can do instead (OSK-12117). The refusal used to
  * name only CI tokens, which is not a sign-in: an agent session asking for one
  * could only hand the job to a person typing `! skrr login`.
+ *
+ * It also used to send CI to `skrr create-token` + `OVERSKY_TOKEN=osk_ci_...`.
+ * That token only bootstraps a daemon; every `skrr` command rejects it with 401
+ * (create-token.ts, base-command.ts), so the advice was a dead end (OSK-13209).
+ * The route that works today is a minted machine session — see
+ * docs/cli/SKRR_AUTH.md "CI today" for its caveats.
  */
 exports.HEADLESS_LOGIN_HINT = '`skrr login --device-code` works without a terminal: it prints a URL and a code for a ' +
-    'person to approve in any browser, and finishes when they do. For CI, use ' +
-    '`skrr create-token` and set OVERSKY_TOKEN=osk_ci_...';
+    'person to approve in any browser, and finishes when they do. With no person to approve ' +
+    '(CI, a script), mint a session for this machine elsewhere with `skrr token mint --for <id>` ' +
+    'and run `skrr login` here with OVERSKY_REFRESH_TOKEN and OVERSKY_CLI_ID set. ' +
+    '`skrr create-token` tokens are not accepted by skrr commands.';
 /**
  * The line printed when the daemon descriptor this CLI found is for another
  * server (OSK-12117).
@@ -164,8 +172,9 @@ async function cliLogin(opts = {}) {
         // silently fall through to PKCE / device-code below.
         if (brokerResult.reason === 'ci_token_refused') {
             throw new Error('The skrr background service on this computer is bootstrapped from a CI token, which cannot broker an interactive CLI login. ' +
-                'Use `skrr create-token --name <name>` to mint a long-lived CI credential directly, ' +
-                'or run `skrr login` on a machine where the daemon was authenticated interactively.');
+                'Sign this CLI in on its own with `skrr login --device-code`, or with a session minted elsewhere by ' +
+                '`skrr token mint --for <id>` (OVERSKY_REFRESH_TOKEN + OVERSKY_CLI_ID). ' +
+                'A `skrr create-token` token is not accepted by skrr commands.');
         }
         // `base_url_mismatch` is a configuration drift the user can resolve
         // explicitly; print a one-line hint so they're not surprised when

package/dist/lib/node-adapter.js

@@ -12,6 +12,7 @@ const config_1 = require("./config");
 const auth_storage_1 = require("./auth-storage");
 const credential_resolver_1 = require("./credential-resolver");
 const daemonBroker_1 = require("./daemonBroker");
+const dpop_auth_1 = require("./dpop-auth");
 const refresh_1 = require("./refresh");
 const delegated_cli_1 = require("./delegated-cli");
 const workspace_header_1 = require("./workspace-header");
@@ -159,6 +160,9 @@ function createNodeAdapter(opts = {}) {
             }
         }
         const finalUrl = appendQuery(resolveUrl(url), options?.params);
+        // OSK-12020 — a DPoP-bound hand-off token needs a fresh proof per request
+        // (and per retry: proofs are single-use). No-op for every other token.
+        Object.assign(headers, await (0, dpop_auth_1.dpopHeadersFor)(currentCredential().token, method, finalUrl));
         return fetch(finalUrl, { method, headers, body: finalBody });
     }
     /**