@skrr-ai/cli 0.1.79 → 0.1.80

package/dist/base-command.js

@@ -399,7 +399,10 @@ class BaseCommand extends core_1.Command {
                 }
                 else if ((this.brokerRefusal =
                     (0, daemonBrokerRefusal_1.describeBrokerRefusal)(autoResult.outcome, this.config.bin) ??
-                        describeAbsentGuestDaemon(autoResult.outcome, this.config.bin))) {
+                        describeAbsentGuestDaemon(autoResult.outcome, this.config.bin) ??
+                        // A laptop daemon that is down or mid-restart is not the person
+                        // being signed out (OSK-13222).
+                        (0, daemonBrokerRefusal_1.describeLocalDaemonUnavailable)(autoResult.outcome, this.config.bin))) {
                     // Reported by requireAuth(); nothing to print here.
                 }
                 else if (autoResult.outcome.reason === 'rate_limited') {
@@ -760,7 +763,11 @@ class BaseCommand extends core_1.Command {
                 // Same code as the plain case — scripts branch on NOT_SIGNED_IN — with
                 // the daemon's answer in the message and in `details.broker`.
                 this.failWithCliError({
-                    message: `Not signed in. ${refusal.headline}\n→ ${refusal.remedy}`,
+                    // A daemon that is down or restarting holds the person's sign-in; it
+                    // has not been lost, so the sentence must not say it has (OSK-13222).
+                    message: refusal.daemonUnavailable
+                        ? `No credential from the skrr background service. ${refusal.headline}\n→ ${refusal.remedy}`
+                        : `Not signed in. ${refusal.headline}\n→ ${refusal.remedy}`,
                     code: 'NOT_SIGNED_IN',
                     exit: 2,
                     retryable: refusal.transient,

package/dist/commands/inbox/index.js

@@ -8,6 +8,7 @@ const base_command_1 = require("../../base-command");
 const inbox_1 = require("../../lib/inbox");
 const format_1 = require("../../lib/format");
 const agentic_stream_1 = require("../../lib/agentic-stream");
+const dpop_auth_1 = require("../../lib/dpop-auth");
 /**
  * Stop `--follow` on Ctrl-C or SIGTERM, and end with the status a shell
  * reports for that signal (130 / 143).
@@ -241,11 +242,12 @@ class Inbox extends base_command_1.BaseCommand {
         const wsURL = (0, agentic_stream_1.toWebSocketOrigin)(this.cliConfig.baseURL);
         const socket = (0, socket_io_client_1.io)(wsURL, {
             path: '/ws/agentic',
-            auth: {
+            // OSK-12020 — a DPoP-bound token proves possession on every handshake.
+            auth: (0, dpop_auth_1.socketAuthWithDpop)({
                 token: this.resolvedCredential.token,
                 ...(0, data_provider_1.getClientIdentityAuth)(),
                 clientPlatform: 'cli',
-            },
+            }, wsURL),
             extraHeaders: process.env.OVERSKY_WORKSPACE_ID
                 ? { 'X-Workspace-Id': process.env.OVERSKY_WORKSPACE_ID }
                 : undefined,

package/dist/commands/login.d.ts

@@ -12,9 +12,14 @@ import { BaseCommand } from '../base-command';
  * Refresh, rotation, family revoke, and the cross-process auth.lock are
  * all the same substrate the daemon uses (@skrr-ai/auth-core).
  *
- * CI callers should NOT use this command — use
- *   skrr create-token --name <name> --ttl 365
- * and set `OVERSKY_TOKEN=osk_ci_...` in the CI environment.
+ * CI. There is no long-lived token that `skrr` commands accept yet (OSK-13208).
+ * `skrr create-token` mints an `osk_ci_*` token, and that token only
+ * bootstraps a DAEMON (`OVERSKY_TOKEN=osk_ci_... skrrd start`): every `skrr`
+ * command rejects it with 401 (see create-token.ts and base-command.ts). What
+ * works today is a session minted for the machine with
+ * `skrr token mint --for <id>`, restored by the `OVERSKY_REFRESH_TOKEN` path
+ * below — whose refresh token rotates on use — or `OVERSKY_AUTH_HELPER`.
+ * docs/cli/SKRR_AUTH.md ("CI today") states the caveats.
  *
  * L13 — non-interactive restore from a refresh token. When
  * `OVERSKY_REFRESH_TOKEN` is set in the environment, the browser /

package/dist/commands/login.js

@@ -27,9 +27,14 @@ const prompt_1 = require("../lib/prompt");
  * Refresh, rotation, family revoke, and the cross-process auth.lock are
  * all the same substrate the daemon uses (@skrr-ai/auth-core).
  *
- * CI callers should NOT use this command — use
- *   skrr create-token --name <name> --ttl 365
- * and set `OVERSKY_TOKEN=osk_ci_...` in the CI environment.
+ * CI. There is no long-lived token that `skrr` commands accept yet (OSK-13208).
+ * `skrr create-token` mints an `osk_ci_*` token, and that token only
+ * bootstraps a DAEMON (`OVERSKY_TOKEN=osk_ci_... skrrd start`): every `skrr`
+ * command rejects it with 401 (see create-token.ts and base-command.ts). What
+ * works today is a session minted for the machine with
+ * `skrr token mint --for <id>`, restored by the `OVERSKY_REFRESH_TOKEN` path
+ * below — whose refresh token rotates on use — or `OVERSKY_AUTH_HELPER`.
+ * docs/cli/SKRR_AUTH.md ("CI today") states the caveats.
  *
  * L13 — non-interactive restore from a refresh token. When
  * `OVERSKY_REFRESH_TOKEN` is set in the environment, the browser /
@@ -60,7 +65,12 @@ class Login extends base_command_1.BaseCommand {
         'Set OVERSKY_SKIP_DAEMON_BROKER=1 to skip step 1 (--device-code skips it too). After signing ' +
         'in, skrr also signs the background service in, and on an interactive first login on a ' +
         'computer without it, offers to install it. Set SKRR_SKIP_DAEMON_HANDOFF=1 to skip that ' +
-        'optional setup; it does not skip step 1.';
+        'optional setup; it does not skip step 1.\n\n' +
+        'With no person to approve a sign-in (CI, a provisioning script): mint a session for that ' +
+        'machine with `skrr token mint --for <id>` and run this command there with ' +
+        'OVERSKY_REFRESH_TOKEN and OVERSKY_CLI_ID set. The refresh token rotates when used, so one ' +
+        'minted session serves one machine. Tokens from `skrr create-token` only bring up a ' +
+        'background service (`skrrd`); skrr commands reject them.';
     static examples = [
         '<%= config.bin %> login',
         '<%= config.bin %> login --env prod',

package/dist/commands/spaces/workflows/events.js

@@ -4,6 +4,7 @@ exports.workflowEventStreamHeaders = workflowEventStreamHeaders;
 const core_1 = require("@oclif/core");
 const base_command_1 = require("../../../base-command");
 const workspace_header_1 = require("../../../lib/workspace-header");
+const dpop_auth_1 = require("../../../lib/dpop-auth");
 function workflowEventStreamHeaders(token, env = process.env) {
     return (0, workspace_header_1.withWorkspaceHeader)({
         Accept: 'text/event-stream',
@@ -31,8 +32,14 @@ class SpacesWorkflowsEvents extends base_command_1.BaseCommand {
             this.error('--after must be an ISO-8601 timestamp', { exit: 2 });
         }
         const path = `/api/spaces/${encodeURIComponent(args.spaceId)}/workflows/runs/${encodeURIComponent(args.runId)}/events/stream${flags.after ? `?after=${encodeURIComponent(flags.after)}` : ''}`;
-        const response = await fetch(`${this.cliConfig.baseURL.replace(/\/+$/, '')}${path}`, {
-            headers: workflowEventStreamHeaders(this.resolvedCredential.token),
+        const streamUrl = `${this.cliConfig.baseURL.replace(/\/+$/, '')}${path}`;
+        const token = this.resolvedCredential.token;
+        const response = await fetch(streamUrl, {
+            headers: {
+                ...workflowEventStreamHeaders(token),
+                // OSK-12020 — a DPoP-bound hand-off token proves possession here too.
+                ...(await (0, dpop_auth_1.dpopHeadersFor)(token, 'GET', streamUrl)),
+            },
         });
         if (!response.ok || !response.body) {
             const body = await response.text();

package/dist/lib/agentic-stream.js

@@ -26,6 +26,7 @@ const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
+const dpop_auth_1 = require("./dpop-auth");
 /**
  * Why a question was dismissed when no terminal exists to ask it on. It is the
  * REASON for a dismissal, never an answer: it travels as the value of the
@@ -709,12 +710,13 @@ class AgenticStreamClient {
             : undefined;
         this.socket = (0, socket_io_client_1.io)(wsURL, {
             path: '/ws/agentic',
-            auth: {
+            // OSK-12020 — a DPoP-bound token proves possession on every handshake.
+            auth: (0, dpop_auth_1.socketAuthWithDpop)({
                 token: this.options.token,
                 ...(0, data_provider_1.getClientIdentityAuth)(),
                 clientPlatform: 'cli',
                 clientOs: process.platform === 'darwin' ? 'macos' : process.platform,
-            },
+            }, wsURL),
             extraHeaders,
             transports: ['websocket'],
             reconnection: true,
@@ -948,12 +950,19 @@ class AgenticStreamClient {
                     if (this.closed || this.settled || generation !== this.replayGeneration)
                         return;
                     this.replayFailures = 0;
-                    this.receiveSessionOutput({ type: 'session.output', sessionId: this.options.sessionId, source: 'replay', envelopes: result.envelopes });
+                    this.receiveSessionOutput({
+                        type: 'session.output',
+                        sessionId: this.options.sessionId,
+                        source: 'replay',
+                        envelopes: result.envelopes,
+                    });
                     // The canonical endpoint explicitly identifies retention gaps. Only
                     // then may later frames pass with the existing honest gap notice.
                     if (result.gap) {
                         // A retention gap proves only this page, never a later live frame.
-                        const pageSeqs = result.envelopes.map((e) => Number(e?.__seq)).filter(Number.isSafeInteger);
+                        const pageSeqs = result.envelopes
+                            .map((e) => Number(e?.__seq))
+                            .filter(Number.isSafeInteger);
                         if (pageSeqs.length)
                             this.flushPendingEnvelopes(true, Math.max(...pageSeqs));
                         this.flushPendingEnvelopes(false);

package/dist/lib/api-fetch.js

@@ -44,6 +44,7 @@ const node_adapter_1 = require("./node-adapter");
 const refresh_1 = require("./refresh");
 const delegated_cli_1 = require("./delegated-cli");
 const daemonBroker_1 = require("./daemonBroker");
+const dpop_auth_1 = require("./dpop-auth");
 const workspace_header_1 = require("./workspace-header");
 const non_json_response_1 = require("./non-json-response");
 class ApiFetchError extends Error {
@@ -162,7 +163,7 @@ async function apiFetch(pathOrUrl, opts = {}) {
                 (0, node_adapter_1.getAdapterCredentialOverride)() ??
                 (await (0, credential_resolver_1.resolveCredential)());
     }
-    const fetchWithCredential = (credential) => {
+    const fetchWithCredential = async (credential) => {
         const headers = {
             Accept: 'application/json',
             'X-Oversky-Origin': (0, refresh_1.getCliOrigin)(),
@@ -178,10 +179,13 @@ async function apiFetch(pathOrUrl, opts = {}) {
         // key is additive metadata, not a way to re-auth the request.
         for (const [k, v] of Object.entries(callerHeaders)) {
             const lower = k.toLowerCase();
-            if (lower === 'authorization' || lower === 'content-type')
+            if (lower === 'authorization' || lower === 'content-type' || lower === 'dpop')
                 continue;
             headers[k] = v;
         }
+        // OSK-12020 — a fresh proof per attempt for a DPoP-bound hand-off token
+        // (the 401 retry below re-enters here and gets its own). No-op otherwise.
+        Object.assign(headers, await (0, dpop_auth_1.dpopHeadersFor)(credential.token, method, url));
         return fetch(url, {
             method,
             headers: (0, workspace_header_1.withWorkspaceHeader)(headers),

package/dist/lib/brokered-dpop.d.ts

@@ -0,0 +1,34 @@
+/**
+ * brokered-dpop.ts — this process's DPoP-bound hand-off token, and the proof
+ * fetch for it (OSK-12020).
+ *
+ * Kept apart from `daemonBroker.ts` on purpose: every transport consults it on
+ * every request (`dpop-auth.ts`), so it must stay a leaf with no I/O at import
+ * and no dependency on the broker's own module graph. `daemonBroker` registers
+ * the binding after a redeem whose answer said `tokenType: 'DPoP'`, and clears
+ * it after one that did not.
+ */
+/** Where to ask for proofs. Re-resolved per call so a rotated secret heals. */
+export interface DpopOracleEndpoint {
+    host: string;
+    port: number;
+    secret: string;
+}
+export declare function registerDpopBinding(accessToken: string, resolveEndpoint: () => DpopOracleEndpoint): void;
+export declare function clearDpopBinding(): void;
+/** True when `token` is this process's DPoP-bound hand-off token. */
+export declare function isDpopBoundHandoffToken(token: string | null | undefined): boolean;
+/**
+ * A fresh RFC 9449 proof for one request made with `token`, from the local
+ * daemon that holds the key the token is bound to. Null when `token` is not the
+ * bound one (nothing to prove) or the daemon would not sign — the request then
+ * goes out without a proof and the server's `DPOP_PROOF_REQUIRED` names the
+ * problem, rather than this client inventing a second error for it.
+ *
+ * The token itself is never sent: the daemon gets its SHA-256 (`ath`) and signs
+ * only for hashes of tokens it issued. Proofs are single-use, so this runs per
+ * request and per retry.
+ */
+export declare function brokeredDpopProof(token: string | null | undefined, htm: string, htu: string): Promise<string | null>;
+/** @internal test seam. */
+export declare function __resetDpopBindingForTest(): void;

package/dist/lib/brokered-dpop.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * brokered-dpop.ts — this process's DPoP-bound hand-off token, and the proof
+ * fetch for it (OSK-12020).
+ *
+ * Kept apart from `daemonBroker.ts` on purpose: every transport consults it on
+ * every request (`dpop-auth.ts`), so it must stay a leaf with no I/O at import
+ * and no dependency on the broker's own module graph. `daemonBroker` registers
+ * the binding after a redeem whose answer said `tokenType: 'DPoP'`, and clears
+ * it after one that did not.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerDpopBinding = registerDpopBinding;
+exports.clearDpopBinding = clearDpopBinding;
+exports.isDpopBoundHandoffToken = isDpopBoundHandoffToken;
+exports.brokeredDpopProof = brokeredDpopProof;
+exports.__resetDpopBindingForTest = __resetDpopBindingForTest;
+const node_crypto_1 = require("node:crypto");
+const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
+const cli_handoff_wire_1 = require("@skrr-ai/auth-core/cli-handoff-wire");
+let binding = null;
+/** Bound the proof fetch: it sits in front of every request a bound token makes. */
+const DPOP_PROOF_TIMEOUT_MS = 5_000;
+function registerDpopBinding(accessToken, resolveEndpoint) {
+    binding = { accessToken, resolveEndpoint };
+}
+function clearDpopBinding() {
+    binding = null;
+}
+/** True when `token` is this process's DPoP-bound hand-off token. */
+function isDpopBoundHandoffToken(token) {
+    return Boolean(token && binding && token === binding.accessToken);
+}
+/**
+ * A fresh RFC 9449 proof for one request made with `token`, from the local
+ * daemon that holds the key the token is bound to. Null when `token` is not the
+ * bound one (nothing to prove) or the daemon would not sign — the request then
+ * goes out without a proof and the server's `DPOP_PROOF_REQUIRED` names the
+ * problem, rather than this client inventing a second error for it.
+ *
+ * The token itself is never sent: the daemon gets its SHA-256 (`ath`) and signs
+ * only for hashes of tokens it issued. Proofs are single-use, so this runs per
+ * request and per retry.
+ */
+async function brokeredDpopProof(token, htm, htu) {
+    const state = binding;
+    if (!token || !state || token !== state.accessToken)
+        return null;
+    let endpoint;
+    try {
+        endpoint = state.resolveEndpoint();
+    }
+    catch {
+        return null;
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DPOP_PROOF_TIMEOUT_MS);
+    try {
+        // The descriptor secret is loopback-only: never global `fetch`, which can
+        // route 127.0.0.1 through HTTP_PROXY (OSK-12134).
+        const response = await (0, loopback_http_1.loopbackFetch)(`http://${endpoint.host}:${endpoint.port}${cli_handoff_wire_1.CLI_HANDOFF_DPOP_PROOF_PATH}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${endpoint.secret}`,
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+            },
+            body: JSON.stringify({
+                htm: htm.toUpperCase(),
+                htu,
+                ath: (0, node_crypto_1.createHash)('sha256').update(token, 'utf8').digest('base64url'),
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return null;
+        return (0, cli_handoff_wire_1.parseCliHandoffDpopProofResponse)(await response.json())?.proof ?? null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** @internal test seam. */
+function __resetDpopBindingForTest() {
+    binding = null;
+}

package/dist/lib/daemonBroker.d.ts

@@ -39,6 +39,7 @@
 import { type CliHandoffDescriptor, type CliHandoffTokenResponse } from '@skrr-ai/auth-core/cli-handoff-wire';
 import { type AuthBackend } from './auth-storage';
 import { type CliConfig } from './config';
+import { type AwaitRestartedDaemonOptions } from './daemonRestartWait';
 /**
  * Wire-shape of the bootstrap file — the shared declaration in
  * `@skrr-ai/auth-core/cli-handoff-wire` (`CliHandoffDescriptor`), which the
@@ -173,6 +174,23 @@ export interface DaemonBrokerFailure {
      * the repair for a refusal is the machine, never a login.
      */
     dedicatedGuest?: boolean;
+    /**
+     * For `no_bootstrap`: what the descriptor file on disk actually was, when
+     * one existed. `dead_pid` is a daemon that crashed or is mid-restart and left
+     * its hand-off behind; `unreadable` / `invalid` a file that could not be
+     * used. Absent when no candidate file existed at all (OSK-13222).
+     */
+    descriptorState?: 'dead_pid' | 'unreadable' | 'invalid';
+    /** The pid the descriptor named (a dead one, for `dead_pid`). */
+    descriptorPid?: number;
+    /** The loopback port the descriptor named — for `network`, the refused one. */
+    descriptorPort?: number;
+    /**
+     * How long the CLI waited for a restarting daemon before giving up. Set only
+     * when it waited: the local service was starting or is supervised, so a
+     * restart was the likely state (OSK-13222).
+     */
+    restartWaitedMs?: number;
 }
 export type DaemonBrokerOutcome = (DaemonBrokerResult & {
     ok: true;
@@ -215,7 +233,12 @@ export interface DaemonBrokerOptions {
      *   - `'access_token'` — broker mode: redeem a short-lived access token
      *     and hold it in memory only. Used by `maybeAutoBroker`: nothing
      *     credential-shaped lands on disk and each `skrr` process re-redeems
-     *     over loopback.
+     *     over loopback. When the descriptor advertises `access_token`, the
+     *     token route is the ONLY door for this caller: a failed redeem is
+     *     reported, never retried as a durable mint (OSK-12018). The automatic
+     *     path must not mint and persist a refresh family the human never asked
+     *     for — a durable login is the human's to hold, and only an explicit
+     *     `skrr login` takes it.
      *   - `'refresh_family'` (default) — the legacy durable mint. Used by
      *     explicit `skrr login`: a human login still writes a real,
      *     user-owned refresh family. A descriptor that advertises ONLY
@@ -223,6 +246,12 @@ export interface DaemonBrokerOptions {
      *     regardless — its secret cannot mint a family at all.
      */
     preferHandoffMode?: 'access_token' | 'refresh_family';
+    /**
+     * Overrides for the bounded wait on a restarting local daemon (OSK-13222):
+     * budgets, the clock and the supervisor probe. Tests use it; production
+     * leaves it unset.
+     */
+    restartWait?: Omit<AwaitRestartedDaemonOptions, 'profile' | 'ready'>;
 }
 /**
  * Compute the bootstrap file path. Exported for tests so they can assert
@@ -257,6 +286,17 @@ export declare function resolveBootstrapCandidatePaths(profile?: string): string
  * user configures can point the broker somewhere else.
  */
 export declare const DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR = "/run/skrr-dedicated-runtime/cli-handoff/descriptor.json";
+/**
+ * A Hosted Machine's workload hand-off descriptor, published only on a box
+ * booted under the identity split (OSK-11981, OSK-12019), where the daemon runs
+ * as `oversky-daemon` and its island file is unreadable to the workload. Same
+ * format and same broker-only contract as the Dedicated descriptor
+ * (`daemon/src/dedicated-cli-handoff.ts`, `workloadCliHandoffTarget`), in a
+ * DIFFERENT directory so a Hosted Machine is never mistaken for a Dedicated
+ * Runtime guest (`runningOnDedicatedRuntimeGuest` keys on that directory). The
+ * parent is created by the box's launcher as root and owned by the daemon.
+ */
+export declare const HOSTED_MACHINE_CLI_HANDOFF_DESCRIPTOR = "/run/skrr-hosted-machine/cli-handoff/descriptor.json";
 /** Where the cli-handoff broker looks, in order. */
 export declare function resolveCliHandoffCandidatePaths(profile?: string): string[];
 /**
@@ -283,6 +323,32 @@ export declare function findLiveDaemonBootstrap({ profile, bootstrapPathOverride
  * file is malformed, the CLI shouldn't try to repair it).
  */
 export declare function readBootstrap(filePath: string): LocalBootstrap | null;
+/**
+ * Why a descriptor file did or did not yield a usable bootstrap (OSK-13222).
+ *
+ * `readBootstrap` answers null for all of these alike, which is right for a
+ * caller that only wants "is there a daemon to ask", and wrong for the one
+ * that has to explain a failure: a descriptor naming a pid that has exited is
+ * a daemon that crashed or is restarting, not a person who is signed out, and
+ * the two have opposite repairs.
+ */
+export type BootstrapInspection = {
+    state: 'ok';
+    bootstrap: LocalBootstrap;
+} | {
+    state: 'absent';
+} | {
+    state: 'unreadable';
+    detail: string;
+} | {
+    state: 'invalid';
+    detail: string;
+} | {
+    state: 'dead_pid';
+    pid: number;
+    bootstrap: LocalBootstrap;
+};
+export declare function inspectBootstrap(filePath: string): BootstrapInspection;
 /**
  * Try the daemon-as-broker handoff. Returns a tagged outcome so callers
  * can decide between fall-through and surface-to-user without parsing
@@ -431,7 +497,10 @@ export interface MaybeAutoBrokerResult {
  *     'access_token'`. On a descriptor that advertises broker mode the
  *     outcome is `brokered` — an in-memory access token, nothing written;
  *     the caller holds it for this process and the next `skrr` re-redeems.
- *     On a legacy/v1 descriptor the durable mint is persisted to the
+ *     A failed redeem on such a descriptor is returned as the outcome and
+ *     never retried as a durable mint (OSK-12018). Only on a legacy/v1
+ *     descriptor (no `access_token` advertised — the compatibility window
+ *     documented in `brokerThrough`) is the durable mint persisted to the
  *     keychain / cli-auth.json exactly as before.
  *   - May generate a new `cliId` if the config doesn't have one. The
  *     caller MUST persist `updatedConfig` so the next invocation