@skrr-ai/cli 0.1.79 → 0.1.81

package/dist/lib/agentic-stream.js

@@ -26,6 +26,7 @@ const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const config_1 = require("./config");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
+const dpop_auth_1 = require("./dpop-auth");
 /**
  * Why a question was dismissed when no terminal exists to ask it on. It is the
  * REASON for a dismissal, never an answer: it travels as the value of the
@@ -709,12 +710,13 @@ class AgenticStreamClient {
             : undefined;
         this.socket = (0, socket_io_client_1.io)(wsURL, {
             path: '/ws/agentic',
-            auth: {
+            // OSK-12020 — a DPoP-bound token proves possession on every handshake.
+            auth: (0, dpop_auth_1.socketAuthWithDpop)({
                 token: this.options.token,
                 ...(0, data_provider_1.getClientIdentityAuth)(),
                 clientPlatform: 'cli',
                 clientOs: process.platform === 'darwin' ? 'macos' : process.platform,
-            },
+            }, wsURL),
             extraHeaders,
             transports: ['websocket'],
             reconnection: true,
@@ -948,12 +950,19 @@ class AgenticStreamClient {
                     if (this.closed || this.settled || generation !== this.replayGeneration)
                         return;
                     this.replayFailures = 0;
-                    this.receiveSessionOutput({ type: 'session.output', sessionId: this.options.sessionId, source: 'replay', envelopes: result.envelopes });
+                    this.receiveSessionOutput({
+                        type: 'session.output',
+                        sessionId: this.options.sessionId,
+                        source: 'replay',
+                        envelopes: result.envelopes,
+                    });
                     // The canonical endpoint explicitly identifies retention gaps. Only
                     // then may later frames pass with the existing honest gap notice.
                     if (result.gap) {
                         // A retention gap proves only this page, never a later live frame.
-                        const pageSeqs = result.envelopes.map((e) => Number(e?.__seq)).filter(Number.isSafeInteger);
+                        const pageSeqs = result.envelopes
+                            .map((e) => Number(e?.__seq))
+                            .filter(Number.isSafeInteger);
                         if (pageSeqs.length)
                             this.flushPendingEnvelopes(true, Math.max(...pageSeqs));
                         this.flushPendingEnvelopes(false);

package/dist/lib/api-fetch.js

@@ -44,6 +44,7 @@ const node_adapter_1 = require("./node-adapter");
 const refresh_1 = require("./refresh");
 const delegated_cli_1 = require("./delegated-cli");
 const daemonBroker_1 = require("./daemonBroker");
+const dpop_auth_1 = require("./dpop-auth");
 const workspace_header_1 = require("./workspace-header");
 const non_json_response_1 = require("./non-json-response");
 class ApiFetchError extends Error {
@@ -162,7 +163,7 @@ async function apiFetch(pathOrUrl, opts = {}) {
                 (0, node_adapter_1.getAdapterCredentialOverride)() ??
                 (await (0, credential_resolver_1.resolveCredential)());
     }
-    const fetchWithCredential = (credential) => {
+    const fetchWithCredential = async (credential) => {
         const headers = {
             Accept: 'application/json',
             'X-Oversky-Origin': (0, refresh_1.getCliOrigin)(),
@@ -178,10 +179,13 @@ async function apiFetch(pathOrUrl, opts = {}) {
         // key is additive metadata, not a way to re-auth the request.
         for (const [k, v] of Object.entries(callerHeaders)) {
             const lower = k.toLowerCase();
-            if (lower === 'authorization' || lower === 'content-type')
+            if (lower === 'authorization' || lower === 'content-type' || lower === 'dpop')
                 continue;
             headers[k] = v;
         }
+        // OSK-12020 — a fresh proof per attempt for a DPoP-bound hand-off token
+        // (the 401 retry below re-enters here and gets its own). No-op otherwise.
+        Object.assign(headers, await (0, dpop_auth_1.dpopHeadersFor)(credential.token, method, url));
         return fetch(url, {
             method,
             headers: (0, workspace_header_1.withWorkspaceHeader)(headers),

package/dist/lib/auth-core-init.d.ts

@@ -36,6 +36,12 @@ export declare function plainCredentialEnvelopeWarning(args: readonly unknown[])
  * own when a local daemon can hand a credential over.
  */
 export declare const CREDENTIAL_KEY_CHANGED_NOTICE: string;
+/**
+ * The one line an unreadable device key prints when no credential-key change
+ * explains it. The CLI never enrolls or requires a device key (OSK-12063), so
+ * this degrades a proof, not access — say exactly that.
+ */
+export declare const DEVICE_KEY_RECOVERY_REQUIRED_NOTICE: string;
 export declare function createCredentialEnvelopeWarningPresenter(): (args: readonly unknown[]) => string | null;
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;

package/dist/lib/auth-core-init.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CliCredentialInitializationError = exports.CREDENTIAL_KEY_CHANGED_NOTICE = void 0;
+exports.CliCredentialInitializationError = exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = exports.CREDENTIAL_KEY_CHANGED_NOTICE = void 0;
 exports.plainCredentialEnvelopeWarning = plainCredentialEnvelopeWarning;
 exports.createCredentialEnvelopeWarningPresenter = createCredentialEnvelopeWarningPresenter;
 exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
@@ -108,6 +108,20 @@ exports.CREDENTIAL_KEY_CHANGED_NOTICE = "note: this machine's credential key cha
  */
 /** auth-core's device-identity warning for a private key it could not open. */
 const DEVICE_KEY_DECRYPT_FAILED = '[deviceIdentity] private_key_decrypt_failed';
+/**
+ * auth-core's device-identity warning for a stored key it will NOT replace on
+ * ordinary boot (`b5e683280b`): minting a new key here would make the next
+ * refresh sign with a key the server never pinned. Only an explicit login with
+ * `recoverUnreadable` replaces it.
+ */
+const DEVICE_KEY_RECOVERY_REQUIRED = '[deviceIdentity] recovery_required';
+/**
+ * The one line an unreadable device key prints when no credential-key change
+ * explains it. The CLI never enrolls or requires a device key (OSK-12063), so
+ * this degrades a proof, not access — say exactly that.
+ */
+exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = "warning: this machine's stored device key could not be read, so skrr sends requests " +
+    'without a device proof until the local daemon signs in again. (DEBUG=1 shows the underlying error.)';
 function createCredentialEnvelopeWarningPresenter() {
     let keyChanged = false;
     return (args) => {
@@ -133,12 +147,20 @@ function createCredentialEnvelopeWarningPresenter() {
         if (keyChanged && event === 'cred_envelope.read.decrypt_failed')
             return '';
         // The device private key is one of those values: auth-core's device
-        // identity loads it next, cannot open it, and mints a new keypair. It
-        // logs that through its own `[deviceIdentity]` prefix, which reached the
-        // terminal as a raw `[auth-core warn]` line right under the notice. The
-        // notice covers it; without a key change it is a real fault and prints.
-        if (keyChanged && message === DEVICE_KEY_DECRYPT_FAILED)
+        // identity loads it next and cannot open it. Since `b5e683280b` it does
+        // NOT mint a replacement on ordinary boot — it parks in
+        // `recovery_required` until an explicit login recovers it. Both warnings
+        // come through the `[deviceIdentity]` prefix and reached the terminal as
+        // raw `[auth-core warn]` lines right under the notice, which already says
+        // the old key is gone and what replaces it.
+        if (keyChanged &&
+            (message === DEVICE_KEY_DECRYPT_FAILED || message === DEVICE_KEY_RECOVERY_REQUIRED)) {
             return '';
+        }
+        // Without a key change an unreadable device key is a real fault: one
+        // plain line instead of an object dump.
+        if (message === DEVICE_KEY_RECOVERY_REQUIRED)
+            return exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE;
         return plainCredentialEnvelopeWarning(args);
     };
 }

package/dist/lib/brokered-dpop.d.ts

@@ -0,0 +1,34 @@
+/**
+ * brokered-dpop.ts — this process's DPoP-bound hand-off token, and the proof
+ * fetch for it (OSK-12020).
+ *
+ * Kept apart from `daemonBroker.ts` on purpose: every transport consults it on
+ * every request (`dpop-auth.ts`), so it must stay a leaf with no I/O at import
+ * and no dependency on the broker's own module graph. `daemonBroker` registers
+ * the binding after a redeem whose answer said `tokenType: 'DPoP'`, and clears
+ * it after one that did not.
+ */
+/** Where to ask for proofs. Re-resolved per call so a rotated secret heals. */
+export interface DpopOracleEndpoint {
+    host: string;
+    port: number;
+    secret: string;
+}
+export declare function registerDpopBinding(accessToken: string, resolveEndpoint: () => DpopOracleEndpoint): void;
+export declare function clearDpopBinding(): void;
+/** True when `token` is this process's DPoP-bound hand-off token. */
+export declare function isDpopBoundHandoffToken(token: string | null | undefined): boolean;
+/**
+ * A fresh RFC 9449 proof for one request made with `token`, from the local
+ * daemon that holds the key the token is bound to. Null when `token` is not the
+ * bound one (nothing to prove) or the daemon would not sign — the request then
+ * goes out without a proof and the server's `DPOP_PROOF_REQUIRED` names the
+ * problem, rather than this client inventing a second error for it.
+ *
+ * The token itself is never sent: the daemon gets its SHA-256 (`ath`) and signs
+ * only for hashes of tokens it issued. Proofs are single-use, so this runs per
+ * request and per retry.
+ */
+export declare function brokeredDpopProof(token: string | null | undefined, htm: string, htu: string): Promise<string | null>;
+/** @internal test seam. */
+export declare function __resetDpopBindingForTest(): void;

package/dist/lib/brokered-dpop.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * brokered-dpop.ts — this process's DPoP-bound hand-off token, and the proof
+ * fetch for it (OSK-12020).
+ *
+ * Kept apart from `daemonBroker.ts` on purpose: every transport consults it on
+ * every request (`dpop-auth.ts`), so it must stay a leaf with no I/O at import
+ * and no dependency on the broker's own module graph. `daemonBroker` registers
+ * the binding after a redeem whose answer said `tokenType: 'DPoP'`, and clears
+ * it after one that did not.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.registerDpopBinding = registerDpopBinding;
+exports.clearDpopBinding = clearDpopBinding;
+exports.isDpopBoundHandoffToken = isDpopBoundHandoffToken;
+exports.brokeredDpopProof = brokeredDpopProof;
+exports.__resetDpopBindingForTest = __resetDpopBindingForTest;
+const node_crypto_1 = require("node:crypto");
+const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
+const cli_handoff_wire_1 = require("@skrr-ai/auth-core/cli-handoff-wire");
+let binding = null;
+/** Bound the proof fetch: it sits in front of every request a bound token makes. */
+const DPOP_PROOF_TIMEOUT_MS = 5_000;
+function registerDpopBinding(accessToken, resolveEndpoint) {
+    binding = { accessToken, resolveEndpoint };
+}
+function clearDpopBinding() {
+    binding = null;
+}
+/** True when `token` is this process's DPoP-bound hand-off token. */
+function isDpopBoundHandoffToken(token) {
+    return Boolean(token && binding && token === binding.accessToken);
+}
+/**
+ * A fresh RFC 9449 proof for one request made with `token`, from the local
+ * daemon that holds the key the token is bound to. Null when `token` is not the
+ * bound one (nothing to prove) or the daemon would not sign — the request then
+ * goes out without a proof and the server's `DPOP_PROOF_REQUIRED` names the
+ * problem, rather than this client inventing a second error for it.
+ *
+ * The token itself is never sent: the daemon gets its SHA-256 (`ath`) and signs
+ * only for hashes of tokens it issued. Proofs are single-use, so this runs per
+ * request and per retry.
+ */
+async function brokeredDpopProof(token, htm, htu) {
+    const state = binding;
+    if (!token || !state || token !== state.accessToken)
+        return null;
+    let endpoint;
+    try {
+        endpoint = state.resolveEndpoint();
+    }
+    catch {
+        return null;
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), DPOP_PROOF_TIMEOUT_MS);
+    try {
+        // The descriptor secret is loopback-only: never global `fetch`, which can
+        // route 127.0.0.1 through HTTP_PROXY (OSK-12134).
+        const response = await (0, loopback_http_1.loopbackFetch)(`http://${endpoint.host}:${endpoint.port}${cli_handoff_wire_1.CLI_HANDOFF_DPOP_PROOF_PATH}`, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${endpoint.secret}`,
+                'Content-Type': 'application/json',
+                Accept: 'application/json',
+            },
+            body: JSON.stringify({
+                htm: htm.toUpperCase(),
+                htu,
+                ath: (0, node_crypto_1.createHash)('sha256').update(token, 'utf8').digest('base64url'),
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok)
+            return null;
+        return (0, cli_handoff_wire_1.parseCliHandoffDpopProofResponse)(await response.json())?.proof ?? null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/** @internal test seam. */
+function __resetDpopBindingForTest() {
+    binding = null;
+}

package/dist/lib/credential-resolver.d.ts

@@ -5,7 +5,7 @@
  * CLI-appropriate backends. The resolver walks the published chain:
  *
  *   1. flag         — --token <jwt> (debugging; BaseCommand parses)
- *   2. env-token    — OVERSKY_TOKEN (CI / static; kind='ci' detected)
+ *   2. env-token    — OVERSKY_TOKEN, then SKRR_TOKEN (CI / static; kind 'ci' or 'pat' detected)
  *   3. auth-helper  — OVERSKY_AUTH_HELPER script output
  *   4. fd-handoff   — N/A for CLI (skipped; no parent fd)
  *   5. keychain     — ai.skrr.cli.<profile>

package/dist/lib/credential-resolver.js

@@ -12,7 +12,7 @@ exports.formatCredentialSource = formatCredentialSource;
  * CLI-appropriate backends. The resolver walks the published chain:
  *
  *   1. flag         — --token <jwt> (debugging; BaseCommand parses)
- *   2. env-token    — OVERSKY_TOKEN (CI / static; kind='ci' detected)
+ *   2. env-token    — OVERSKY_TOKEN, then SKRR_TOKEN (CI / static; kind 'ci' or 'pat' detected)
  *   3. auth-helper  — OVERSKY_AUTH_HELPER script output
  *   4. fd-handoff   — N/A for CLI (skipped; no parent fd)
  *   5. keychain     — ai.skrr.cli.<profile>
@@ -78,6 +78,9 @@ async function resolveCredential(opts = {}) {
         flagToken: opts.flagToken,
         bareMode,
         storeMode,
+        // SKRR_TOKEN is the name the CI recipe uses (OSK-13208); OVERSKY_TOKEN still
+        // wins when both are set, as in the config overlay (config.ts).
+        envTokenNames: ['OVERSKY_TOKEN', 'SKRR_TOKEN'],
         // CLI never has an interactive slot — users run `skrr login` explicitly.
         isHeadless: () => true,
         // Stored credentials are only usable against the origin that issued
@@ -160,7 +163,10 @@ function formatCredentialSource(source) {
         case 'flag':
             return 'CLI --token flag';
         case 'env-token':
-            return 'OVERSKY_TOKEN';
+            // Name the variable that actually supplied it (OVERSKY_TOKEN wins).
+            return !process.env.OVERSKY_TOKEN?.trim() && process.env.SKRR_TOKEN?.trim()
+                ? 'SKRR_TOKEN'
+                : 'OVERSKY_TOKEN';
         case 'auth-helper':
             return 'OVERSKY_AUTH_HELPER';
         case 'fd-handoff':

package/dist/lib/daemonBroker.d.ts

@@ -1,5 +1,5 @@
 /**
- * daemonBroker.ts — Sky CLI client for the local `oversky` daemon's
+ * daemonBroker.ts — skrr CLI client for the local `skrrd` daemon's
  * cli-handoff endpoint.
  *
  * When the daemon is already authenticated for the user on this machine,
@@ -39,6 +39,7 @@
 import { type CliHandoffDescriptor, type CliHandoffTokenResponse } from '@skrr-ai/auth-core/cli-handoff-wire';
 import { type AuthBackend } from './auth-storage';
 import { type CliConfig } from './config';
+import { type AwaitRestartedDaemonOptions } from './daemonRestartWait';
 /**
  * Wire-shape of the bootstrap file — the shared declaration in
  * `@skrr-ai/auth-core/cli-handoff-wire` (`CliHandoffDescriptor`), which the
@@ -173,6 +174,23 @@ export interface DaemonBrokerFailure {
      * the repair for a refusal is the machine, never a login.
      */
     dedicatedGuest?: boolean;
+    /**
+     * For `no_bootstrap`: what the descriptor file on disk actually was, when
+     * one existed. `dead_pid` is a daemon that crashed or is mid-restart and left
+     * its hand-off behind; `unreadable` / `invalid` a file that could not be
+     * used. Absent when no candidate file existed at all (OSK-13222).
+     */
+    descriptorState?: 'dead_pid' | 'unreadable' | 'invalid';
+    /** The pid the descriptor named (a dead one, for `dead_pid`). */
+    descriptorPid?: number;
+    /** The loopback port the descriptor named — for `network`, the refused one. */
+    descriptorPort?: number;
+    /**
+     * How long the CLI waited for a restarting daemon before giving up. Set only
+     * when it waited: the local service was starting or is supervised, so a
+     * restart was the likely state (OSK-13222).
+     */
+    restartWaitedMs?: number;
 }
 export type DaemonBrokerOutcome = (DaemonBrokerResult & {
     ok: true;
@@ -181,7 +199,7 @@ export interface DaemonBrokerOptions {
     /** Stable per-machine cliId the CLI wants the new refresh row bound to. */
     cliId: string;
     /**
-     * The Sky CLI's currently-configured baseURL (e.g. `https://oversky.ai`).
+     * The skrr CLI's currently-configured baseURL (e.g. `https://skrr.ai`).
      * Two roles:
      *   1. Pre-flight check vs `bootstrap.serverUrl` — when they don't
      *      match, we refuse to call the daemon so we never mint a token
@@ -215,7 +233,12 @@ export interface DaemonBrokerOptions {
      *   - `'access_token'` — broker mode: redeem a short-lived access token
      *     and hold it in memory only. Used by `maybeAutoBroker`: nothing
      *     credential-shaped lands on disk and each `skrr` process re-redeems
-     *     over loopback.
+     *     over loopback. When the descriptor advertises `access_token`, the
+     *     token route is the ONLY door for this caller: a failed redeem is
+     *     reported, never retried as a durable mint (OSK-12018). The automatic
+     *     path must not mint and persist a refresh family the human never asked
+     *     for — a durable login is the human's to hold, and only an explicit
+     *     `skrr login` takes it.
      *   - `'refresh_family'` (default) — the legacy durable mint. Used by
      *     explicit `skrr login`: a human login still writes a real,
      *     user-owned refresh family. A descriptor that advertises ONLY
@@ -223,6 +246,12 @@ export interface DaemonBrokerOptions {
      *     regardless — its secret cannot mint a family at all.
      */
     preferHandoffMode?: 'access_token' | 'refresh_family';
+    /**
+     * Overrides for the bounded wait on a restarting local daemon (OSK-13222):
+     * budgets, the clock and the supervisor probe. Tests use it; production
+     * leaves it unset.
+     */
+    restartWait?: Omit<AwaitRestartedDaemonOptions, 'profile' | 'ready'>;
 }
 /**
  * Compute the bootstrap file path. Exported for tests so they can assert
@@ -257,6 +286,17 @@ export declare function resolveBootstrapCandidatePaths(profile?: string): string
  * user configures can point the broker somewhere else.
  */
 export declare const DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR = "/run/skrr-dedicated-runtime/cli-handoff/descriptor.json";
+/**
+ * A Hosted Machine's workload hand-off descriptor, published only on a box
+ * booted under the identity split (OSK-11981, OSK-12019), where the daemon runs
+ * as `oversky-daemon` and its island file is unreadable to the workload. Same
+ * format and same broker-only contract as the Dedicated descriptor
+ * (`daemon/src/dedicated-cli-handoff.ts`, `workloadCliHandoffTarget`), in a
+ * DIFFERENT directory so a Hosted Machine is never mistaken for a Dedicated
+ * Runtime guest (`runningOnDedicatedRuntimeGuest` keys on that directory). The
+ * parent is created by the box's launcher as root and owned by the daemon.
+ */
+export declare const HOSTED_MACHINE_CLI_HANDOFF_DESCRIPTOR = "/run/skrr-hosted-machine/cli-handoff/descriptor.json";
 /** Where the cli-handoff broker looks, in order. */
 export declare function resolveCliHandoffCandidatePaths(profile?: string): string[];
 /**
@@ -283,6 +323,32 @@ export declare function findLiveDaemonBootstrap({ profile, bootstrapPathOverride
  * file is malformed, the CLI shouldn't try to repair it).
  */
 export declare function readBootstrap(filePath: string): LocalBootstrap | null;
+/**
+ * Why a descriptor file did or did not yield a usable bootstrap (OSK-13222).
+ *
+ * `readBootstrap` answers null for all of these alike, which is right for a
+ * caller that only wants "is there a daemon to ask", and wrong for the one
+ * that has to explain a failure: a descriptor naming a pid that has exited is
+ * a daemon that crashed or is restarting, not a person who is signed out, and
+ * the two have opposite repairs.
+ */
+export type BootstrapInspection = {
+    state: 'ok';
+    bootstrap: LocalBootstrap;
+} | {
+    state: 'absent';
+} | {
+    state: 'unreadable';
+    detail: string;
+} | {
+    state: 'invalid';
+    detail: string;
+} | {
+    state: 'dead_pid';
+    pid: number;
+    bootstrap: LocalBootstrap;
+};
+export declare function inspectBootstrap(filePath: string): BootstrapInspection;
 /**
  * Try the daemon-as-broker handoff. Returns a tagged outcome so callers
  * can decide between fall-through and surface-to-user without parsing
@@ -395,6 +461,17 @@ export interface MaybeAutoBrokerOptions {
      * everywhere else. Production callers omit it and behave exactly as before.
      */
     bootstrapPathOverride?: string;
+    /**
+     * The profile whose daemon may be borrowed. Defaults to the active profile.
+     *
+     * A silent hand-off must never cross profiles (OSK-13257). The `default`
+     * candidate list falls through to any running daemon, and every daemon is
+     * signed in as whoever started it — so `--profile buyer`, with its own
+     * session refused, used to run as the machine owner after one stderr line.
+     * A named profile now borrows only a daemon started under that same
+     * profile, and otherwise reports NOT_SIGNED_IN for the profile it was given.
+     */
+    profile?: string;
 }
 export interface MaybeAutoBrokerResult {
     /**
@@ -431,7 +508,10 @@ export interface MaybeAutoBrokerResult {
  *     'access_token'`. On a descriptor that advertises broker mode the
  *     outcome is `brokered` — an in-memory access token, nothing written;
  *     the caller holds it for this process and the next `skrr` re-redeems.
- *     On a legacy/v1 descriptor the durable mint is persisted to the
+ *     A failed redeem on such a descriptor is returned as the outcome and
+ *     never retried as a durable mint (OSK-12018). Only on a legacy/v1
+ *     descriptor (no `access_token` advertised — the compatibility window
+ *     documented in `brokerThrough`) is the durable mint persisted to the
  *     keychain / cli-auth.json exactly as before.
  *   - May generate a new `cliId` if the config doesn't have one. The
  *     caller MUST persist `updatedConfig` so the next invocation