@skrr-ai/cli 0.1.79 → 0.1.81

package/dist/lib/daemonRestartWait.js

@@ -0,0 +1,181 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_POLL_MS = exports.SUPERVISED_GRACE_MS = exports.DEFAULT_RESTART_WAIT_MS = exports.STARTING_WINDOW_MS = void 0;
+exports.probeDaemonRestart = probeDaemonRestart;
+exports.awaitRestartedDaemon = awaitRestartedDaemon;
+/**
+ * Bounded wait for a local daemon that is restarting (OSK-13222).
+ *
+ * The CLI's credential on a daemon-brokered machine is redeemed per process
+ * over the daemon's loopback hand-off. A daemon restart opens a window in which
+ * there is nothing to redeem from:
+ *
+ *   - a GRACEFUL restart removes the hand-off descriptor on shutdown and the
+ *     replacement publishes a new one only once it is listening — measured at
+ *     ~14s on a laptop (shutdown 03:11:34 → `listening` 03:11:48), most of it
+ *     harness detection;
+ *   - a CRASH leaves the descriptor naming a pid that has exited until the
+ *     supervisor starts a replacement.
+ *
+ * Every `skrr` process landing in that window used to report "Not signed in.
+ * Run `skrr login` first." and succeed on an immediate retry. This module
+ * decides whether a restart is plausibly in progress and, if so, waits for a
+ * fresh descriptor — bounded, and never when nothing says a daemon is coming
+ * back, so a machine with no daemon pays nothing.
+ *
+ * The signals, cheapest to strongest:
+ *
+ *   - `starting` — the profile's singleton-lock sidecar names a LIVE pid that
+ *     acquired the lock recently. That is a daemon between lock and listen;
+ *     its descriptor is coming. Wait up to the full budget.
+ *   - `supervised` — no live lock holder, but a launchd plist / systemd user
+ *     unit for the profile is installed, so a supervisor is expected to bring
+ *     one up (the ~1.4s between a graceful release and the next acquire, or a
+ *     crash awaiting respawn). Wait a short grace, extended to the full budget
+ *     if a holder appears.
+ *   - `none` — no daemon is coming, or one is running and deliberately not
+ *     serving hand-offs (its lock is old: auth latched, OSK-12807). Do not wait.
+ */
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+/** A lock acquired within this window belongs to a daemon still starting up. */
+exports.STARTING_WINDOW_MS = 60_000;
+/** Total wait once a starting daemon is seen. Startup was measured at ~14s. */
+exports.DEFAULT_RESTART_WAIT_MS = 20_000;
+/** Wait for a supervisor to start a daemon when none holds the lock yet. */
+exports.SUPERVISED_GRACE_MS = 4_000;
+exports.DEFAULT_POLL_MS = 250;
+const PROFILE_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+function pidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        return err.code === 'EPERM';
+    }
+}
+/**
+ * Read the restart signal for `profile` from the daemon's own on-disk state.
+ * Never throws; anything unreadable reads as absent.
+ */
+function probeDaemonRestart(profile, opts = {}) {
+    if (!PROFILE_RE.test(profile))
+        return 'none';
+    const home = opts.homeDir ?? os.homedir();
+    const now = opts.now ?? Date.now();
+    const platform = opts.platform ?? process.platform;
+    try {
+        const infoPath = path.join(home, '.skrr', 'profiles', profile, 'daemon.lock.info.json');
+        const info = JSON.parse(fs.readFileSync(infoPath, 'utf8'));
+        if (typeof info.pid === 'number' && info.pid > 0 && pidAlive(info.pid)) {
+            const startedAt = typeof info.startedAt === 'string' ? Date.parse(info.startedAt) : NaN;
+            // A live holder that started long ago is a running daemon that is not
+            // serving hand-offs on purpose — waiting would only add latency.
+            if (Number.isFinite(startedAt) && now - startedAt <= exports.STARTING_WINDOW_MS)
+                return 'starting';
+            return 'none';
+        }
+    }
+    catch {
+        /* no sidecar, or unreadable: fall through to the supervisor check */
+    }
+    // Supervisor names mirror daemon/src/profile.ts (`launchdLabelFor`,
+    // `systemdUnitFor`); the CLI does not import daemon code.
+    const units = [];
+    if (platform === 'darwin') {
+        units.push(path.join(home, 'Library', 'LaunchAgents', `ai.skrr.daemon.${profile}.plist`));
+    }
+    else if (platform === 'linux') {
+        units.push(path.join(home, '.config', 'systemd', 'user', `skrrd-${profile}.service`));
+    }
+    for (const unit of units) {
+        try {
+            if (fs.existsSync(unit))
+                return 'supervised';
+        }
+        catch {
+            /* unreadable reads as absent */
+        }
+    }
+    return 'none';
+}
+function envBudget() {
+    const raw = process.env.SKRR_DAEMON_RESTART_WAIT_MS;
+    if (raw === undefined || raw.trim() === '')
+        return undefined;
+    const n = Number(raw);
+    return Number.isFinite(n) && n >= 0 ? n : undefined;
+}
+async function awaitRestartedDaemon(opts) {
+    const maxWaitMs = envBudget() ?? opts.maxWaitMs ?? exports.DEFAULT_RESTART_WAIT_MS;
+    if (maxWaitMs <= 0)
+        return { waited: false, waitedMs: 0, ready: false };
+    const probe = opts.probe ?? ((p) => probeDaemonRestart(p));
+    const now = opts.now ?? Date.now;
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const pollMs = opts.pollMs ?? exports.DEFAULT_POLL_MS;
+    const grace = Math.min(opts.supervisedGraceMs ?? exports.SUPERVISED_GRACE_MS, maxWaitMs);
+    let signal = probe(opts.profile);
+    if (signal === 'none')
+        return { waited: false, waitedMs: 0, ready: false };
+    const start = now();
+    let deadline = start + (signal === 'starting' ? maxWaitMs : grace);
+    const notify = opts.notify ??
+        ((message) => {
+            process.stderr.write(`[skrr] ${message}\n`);
+        });
+    notify(`The skrr background service on this computer is restarting; waiting up to ${Math.round(maxWaitMs / 1000)}s for it to come back.`);
+    for (;;) {
+        if (opts.ready())
+            return { waited: true, waitedMs: now() - start, ready: true };
+        if (now() >= deadline)
+            break;
+        await sleep(pollMs);
+        signal = probe(opts.profile);
+        if (signal === 'starting')
+            deadline = Math.max(deadline, start + maxWaitMs);
+        else if (signal === 'none') {
+            // Nothing is coming back after all — but a descriptor may have landed
+            // between the last check and this probe.
+            if (opts.ready())
+                return { waited: true, waitedMs: now() - start, ready: true };
+            break;
+        }
+    }
+    return { waited: true, waitedMs: now() - start, ready: false };
+}

package/dist/lib/dedicated-service.js

@@ -26,6 +26,7 @@ const node_path_1 = __importDefault(require("node:path"));
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agentic_stream_1 = require("./agentic-stream");
+const dpop_auth_1 = require("./dpop-auth");
 const format_1 = require("./format");
 /**
  * Declared services on a Dedicated Runtime — the CLI half of
@@ -411,17 +412,20 @@ function specFromFlags(input) {
     }
     return spec;
 }
-function socketOptions(token) {
+function socketOptions(token, wsOrigin) {
     return {
         path: '/ws/agentic',
-        auth: {
+        // OSK-12020 — a DPoP-bound token proves possession on every handshake.
+        auth: (0, dpop_auth_1.socketAuthWithDpop)({
             token,
             // This proves origin only; the normal CLI token retains full execution authority.
-            ...(process.env.OVERSKY_SESSION_TOKEN ? { executionOriginToken: process.env.OVERSKY_SESSION_TOKEN } : {}),
+            ...(process.env.OVERSKY_SESSION_TOKEN
+                ? { executionOriginToken: process.env.OVERSKY_SESSION_TOKEN }
+                : {}),
             ...(0, data_provider_1.getClientIdentityAuth)(),
             clientPlatform: 'cli',
             clientOs: process.platform === 'darwin' ? 'macos' : process.platform,
-        },
+        }, wsOrigin),
         transports: ['websocket'],
         reconnection: false,
     };
@@ -442,7 +446,8 @@ class DedicatedServiceChannel {
     constructor(options) {
         this.options = options;
         const connect = options.connect ?? socket_io_client_1.io;
-        this.socket = connect((0, agentic_stream_1.toWebSocketOrigin)(options.baseURL), socketOptions(options.token));
+        const wsOrigin = (0, agentic_stream_1.toWebSocketOrigin)(options.baseURL);
+        this.socket = connect(wsOrigin, socketOptions(options.token, wsOrigin));
         // An ack resolves a request only when it arrives on THAT request's own
         // ack event — a requestId echoed back on the wrong family is not an
         // answer, however well-formed it looks.

package/dist/lib/dedicated-ssh.d.ts

@@ -104,6 +104,10 @@ export declare function installSshConfigBlock(home?: string): {
     changed: boolean;
 };
 export interface SshStartAck {
+    failed?: boolean;
+    closing?: boolean;
+    closed?: boolean;
+    retryable?: boolean;
     channelId?: string;
     ok?: boolean;
     error?: string;
@@ -113,6 +117,9 @@ export interface SshStartAck {
         key: string;
     }[];
     receiverAckV1?: boolean;
+    resumeV2?: boolean;
+    epoch?: string;
+    generation?: number;
 }
 export interface SshProxyOptions {
     baseURL: string;
@@ -123,6 +130,8 @@ export interface SshProxyOptions {
     /** Diagnostics; never stdout — ssh reads stdout as protocol bytes. */
     errorOutput: NodeJS.WritableStream;
     ttlSeconds?: number;
+    getToken?: () => Promise<string>;
+    recoveryMs?: number;
     /** Injected for tests. */
     connect?: (url: string, opts: Parameters<typeof io>[1]) => Socket;
     /** Injected for tests. */

package/dist/lib/dedicated-ssh.js

@@ -22,6 +22,8 @@ const node_path_1 = __importDefault(require("node:path"));
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agentic_stream_1 = require("./agentic-stream");
+const dpop_auth_1 = require("./dpop-auth");
+const ssh_ordered_bytes_1 = require("./ssh-ordered-bytes");
 /**
  * Owner SSH to a Dedicated Runtime — SSH protocol over the admitted relay.
  *
@@ -277,46 +279,103 @@ function describeSshStartRefusal(ack) {
  */
 function runSshProxy(options) {
     const channelId = `ssh-${(0, node_crypto_1.randomUUID)()}`;
+    const resumeProof = (0, node_crypto_1.randomBytes)(32).toString('hex');
     const connect = options.connect ?? socket_io_client_1.io;
     const { input, output, errorOutput } = options;
     const identity = ensureSshIdentity();
     const writeHosts = options.writeKnownHosts ?? writeKnownHosts;
+    const recoveryMs = options.recoveryMs ?? 45_000;
+    const receiver = new ssh_ordered_bytes_1.SshOrderedBytes();
     return new Promise((resolve) => {
         let started = false;
+        let startSent = false;
         let finished = false;
-        const socket = connect((0, agentic_stream_1.toWebSocketOrigin)(options.baseURL), {
+        let online = false;
+        let attached = false;
+        let resumable = false;
+        let generation = null;
+        let epoch = (0, node_crypto_1.randomUUID)();
+        let recoveringSince = null;
+        let inputOffset = 0;
+        let attachmentSeq = 0;
+        let closing = false;
+        let lastKeepaliveAt = 0;
+        let pendingInput = null;
+        const identityAuth = () => ({ ...(0, data_provider_1.getClientIdentityAuth)(), clientPlatform: 'cli',
+            clientOs: process.platform === 'darwin' ? 'macos' : process.platform });
+        const wsOrigin = (0, agentic_stream_1.toWebSocketOrigin)(options.baseURL);
+        const handshakeAuth = (token, callback) => {
+            // Resolve a fresh proof after token renewal on every reconnect. Never
+            // reuse the original handoff token or its single-use DPoP proof.
+            const auth = (0, dpop_auth_1.socketAuthWithDpop)({ token, ...identityAuth() }, wsOrigin);
+            if (typeof auth === 'function')
+                auth(callback);
+            else
+                callback(auth);
+        };
+        const socket = connect(wsOrigin, {
             path: '/ws/agentic',
-            auth: {
-                token: options.token,
-                ...(0, data_provider_1.getClientIdentityAuth)(),
-                clientPlatform: 'cli',
-                clientOs: process.platform === 'darwin' ? 'macos' : process.platform,
-            },
-            transports: ['websocket'],
-            // A reconnect cannot resume a channel whose admission line the daemon
-            // revoked on socket death — say it ended and let ssh retry fresh.
-            reconnection: false,
+            auth: options.getToken ? (callback) => {
+                void options.getToken().then((token) => handshakeAuth(token, callback), () => {
+                    finish(1, 'Could not renew SSH authentication. Restore skrr login and connect again.');
+                });
+            } : (0, dpop_auth_1.socketAuthWithDpop)({ token: options.token, ...identityAuth() }, wsOrigin),
+            transports: ['websocket'], reconnection: true,
+            reconnectionDelay: 1000, reconnectionDelayMax: 2000,
         });
-        const startTimer = setTimeout(() => {
-            finish(1, 'The machine did not answer the SSH channel in time. Its daemon may be busy or offline.');
-        }, exports.SSH_START_TIMEOUT_MS);
-        const onInput = (chunk) => {
+        const startTimer = setTimeout(() => finish(1, 'The machine did not answer the SSH channel in time. Its daemon may be busy or offline.'), exports.SSH_START_TIMEOUT_MS);
+        function sendPendingInput() {
+            if (closing || !online || !attached || !pendingInput || finished)
+                return;
+            socket.emit('dedicated:ssh:data', { channelId, data: pendingInput.bytes.toString('base64'),
+                resumeV2: true, epoch, generation, offset: pendingInput.offset });
+        }
+        function pumpInput() {
+            if (closing || !started || !resumable || !online || !attached || pendingInput || finished)
+                return;
+            // Explicit reads bound retained input even if ssh writes a large buffer.
+            const available = input.readableLength;
+            if (!available)
+                return;
+            const bytes = input.read(Math.min(16 * 1024, available));
+            if (!bytes?.length)
+                return;
+            pendingInput = { bytes: Buffer.from(bytes), offset: inputOffset, firstSentAt: Date.now() };
+            sendPendingInput();
+        }
+        const onLegacyInput = (chunk) => {
+            if (!online || finished)
+                return;
             const bytes = typeof chunk === 'string' ? Buffer.from(chunk, 'utf8') : chunk;
             socket.emit('dedicated:ssh:data', { channelId, data: bytes.toString('base64') });
         };
-        function cleanup() {
-            clearTimeout(startTimer);
-            input.off('data', onInput);
-            input.off('end', onInputEnded);
-            input.off('close', onInputEnded);
-            output.off('error', onOutputError);
-            input.pause();
+        function sendResume() {
+            if (online && started && resumable && !attached && !finished) {
+                socket.emit('dedicated:ssh:resume', { leaseId: options.leaseId, channelId, resumeProof, epoch, generation, attachmentSeq });
+            }
+        }
+        function keepalive() {
+            if (started && resumable && attached && online && !finished && Date.now() - lastKeepaliveAt >= 10_000) {
+                lastKeepaliveAt = Date.now();
+                socket.emit('dedicated:ssh:keepalive', { channelId, epoch });
+            }
         }
-        // The ssh client exiting is visible ONLY as stdin EOF and an EPIPE on
-        // stdout — sshd cannot tell the ProxyCommand died until its socket sees
-        // the stop or the transport drops. Listen for both so the channel, and
-        // the daemon's key admission, end when ssh does instead of at idle
-        // timeout.
+        const ticker = setInterval(() => {
+            if (finished)
+                return;
+            const now = Date.now();
+            if ((recoveringSince !== null && now - recoveringSince >= recoveryMs) ||
+                (pendingInput && now - pendingInput.firstSentAt >= recoveryMs)) {
+                finish(1, 'SSH connection recovery timed out; connect again.');
+                return;
+            }
+            if (!online && started && resumable && socket.active === false)
+                socket.connect();
+            sendResume();
+            sendPendingInput();
+            keepalive();
+        }, 2000);
+        ticker.unref?.();
         const onInputEnded = () => finish(0);
         const onOutputError = () => finish(1);
         input.once('end', onInputEnded);
@@ -326,25 +385,44 @@ function runSshProxy(options) {
             if (finished)
                 return;
             finished = true;
-            cleanup();
+            clearTimeout(startTimer);
+            clearInterval(ticker);
+            input.off('data', onLegacyInput);
+            input.off('readable', pumpInput);
+            input.off('end', onInputEnded);
+            input.off('close', onInputEnded);
+            output.off('error', onOutputError);
+            input.pause();
+            pendingInput = null;
             if (notice)
                 errorOutput.write(`${notice}\n`);
-            if (started)
-                socket.emit('dedicated:ssh:stop', { channelId });
+            // Never queue an offline stop that might arrive after another attachment.
+            if (started && online)
+                socket.emit('dedicated:ssh:stop', { channelId, ...(resumable ? { epoch } : {}) });
             socket.disconnect();
             resolve(code);
         }
-        socket.on('connect_error', (err) => {
-            finish(1, `Could not connect to skrr: ${err.message}`);
+        socket.on('connect_error', (error) => {
+            if (finished || (started && resumable))
+                return;
+            finish(1, `Could not connect to skrr: ${error.message}`);
         });
         socket.on('connect', () => {
-            socket.emit('dedicated:ssh:start', {
-                leaseId: options.leaseId,
-                channelId,
-                keyType: identity.keyType,
-                keyBlob: identity.keyBlob,
-                receiverAckV1: true,
-            });
+            if (finished)
+                return;
+            online = true;
+            if (started) {
+                sendResume();
+                return;
+            }
+            if (startSent) {
+                finish(1, 'SSH admission was interrupted before confirmation; connect again.');
+                return;
+            }
+            startSent = true;
+            socket.emit('dedicated:ssh:start', { leaseId: options.leaseId, channelId,
+                keyType: identity.keyType, keyBlob: identity.keyBlob, receiverAckV1: true,
+                resumeV2: true, resumeProof, epoch });
         });
         socket.on('dedicated:ssh:start:ack', (ack) => {
             if (!ack || ack.channelId !== channelId || started || finished)
@@ -353,48 +431,142 @@ function runSshProxy(options) {
                 finish(1, describeSshStartRefusal(ack));
                 return;
             }
+            if (ack.resumeV2 === true) {
+                if (ack.epoch !== epoch || !Number.isSafeInteger(ack.generation) || Number(ack.generation) < 1 ||
+                    (generation !== null && generation !== ack.generation)) {
+                    finish(1, 'Invalid SSH stream admission.');
+                    return;
+                }
+                resumable = true;
+                generation = ack.generation;
+            }
             started = true;
+            attached = true;
             clearTimeout(startTimer);
-            // The instance's keys, attested by the channel — write them before the
-            // first protocol byte flows so ssh's host-key check reads the new file.
-            // `host` is what ssh asks about (`%h`), so the pin goes under the alias;
-            // a daemon that reported no keys becomes an honest StrictHostKeyChecking
-            // refusal, never a silent TOFU.
             const host = `${options.leaseId}${exports.SSH_HOST_SUFFIX}`;
-            if (!writeHosts(host, ack.hostKeys)) {
+            if (!writeHosts(host, ack.hostKeys))
                 errorOutput.write('[skrr ssh] warning: the machine reported no host keys; the connection will be refused if none are pinned\n');
+            if (resumable) {
+                input.pause();
+                input.on('readable', pumpInput);
+                keepalive();
+                pumpInput();
+            }
+            else {
+                input.on('data', onLegacyInput);
+                input.resume();
+            }
+        });
+        socket.on('dedicated:ssh:resume:ack', (ack) => {
+            if (!ack || ack.channelId !== channelId || ack.epoch !== epoch || !started || !resumable || finished || attached)
+                return;
+            if (!ack.ok) {
+                if (ack.retryable === true)
+                    return;
+                finish(1, ack.error || 'The existing SSH channel cannot resume.');
+                return;
+            }
+            if (ack.resumeV2 !== true || ack.generation !== generation) {
+                finish(1, 'Invalid SSH resume admission.');
+                return;
+            }
+            if (ack.closed === true) {
+                finish(ack.failed === true ? 1 : 0);
+                return;
+            }
+            closing = ack.closing === true;
+            attached = true;
+            recoveringSince = null;
+            lastKeepaliveAt = 0;
+            keepalive();
+            sendPendingInput();
+            pumpInput();
+        });
+        socket.on('dedicated:ssh:input:ack', (ack) => {
+            if (finished || !resumable || !pendingInput || !attached || ack?.channelId !== channelId ||
+                ack.epoch !== epoch || ack.generation !== generation || ack.offset !== pendingInput.offset)
+                return;
+            if (!ack.ok) {
+                finish(1, ack.error || 'The SSH input stream was refused.');
+                return;
+            }
+            if (ack.nextOffset !== pendingInput.offset + pendingInput.bytes.length) {
+                finish(1, 'Invalid SSH input acknowledgment.');
+                return;
             }
-            input.resume();
-            input.on('data', onInput);
+            inputOffset = ack.nextOffset;
+            pendingInput = null;
+            pumpInput();
         });
-        socket.on('dedicated:ssh:data', (frame, receipt) => {
-            if (!frame || frame.channelId !== channelId || finished)
+        socket.on('dedicated:ssh:data', async (frame, receipt) => {
+            if (!frame || frame.channelId !== channelId || finished || typeof frame.data !== 'string' || !frame.data.length)
                 return;
-            if (typeof frame.data === 'string' && frame.data.length > 0) {
+            try {
                 const bytes = Buffer.from(frame.data, 'base64');
-                if (typeof receipt === 'function') {
-                    // A frame can precede start-ack (sshd's banner). The owned channel
-                    // already advertised support; confirm only when stdout flushed.
-                    output.write(bytes, (error) => {
-                        receipt({ channelId, ok: !error && !finished });
-                        if (error)
-                            finish(1, 'Could not write SSH output.');
-                    });
+                if (frame.resumeV2 === true) {
+                    if (frame.epoch !== epoch)
+                        return;
+                    if (!Number.isSafeInteger(frame.generation) || Number(frame.generation) < 1 ||
+                        (generation !== null && frame.generation !== generation) || bytes.toString('base64') !== frame.data) {
+                        throw new Error('invalid SSH output frame');
+                    }
+                    generation ??= frame.generation;
+                    const nextOffset = await receiver.receive(frame.offset, bytes, (value) => new Promise((done, reject) => output.write(value, (error) => error ? reject(error) : done())));
+                    receipt?.({ channelId, ok: !finished, epoch: frame.epoch, nextOffset });
                 }
                 else {
-                    output.write(bytes);
+                    if (resumable)
+                        throw new Error('unsequenced output on resumable SSH stream');
+                    if (typeof receipt === 'function') {
+                        output.write(bytes, (error) => {
+                            receipt({ channelId, ok: !error && !finished });
+                            if (error)
+                                finish(1, 'Could not write SSH output.');
+                        });
+                    }
+                    else
+                        output.write(bytes);
                 }
             }
+            catch {
+                receipt?.({ channelId, ok: false, epoch: frame.epoch });
+                finish(1, 'Could not preserve the SSH output stream.');
+            }
         });
-        socket.on('dedicated:ssh:closed', (frame) => {
-            if (!frame || frame.channelId !== channelId)
+        socket.on('dedicated:ssh:closed', (frame, receipt) => {
+            if (!frame || frame.channelId !== channelId || (frame.epoch && frame.epoch !== epoch))
                 return;
-            finish(0, frame.reason ? `[ssh channel closed: ${frame.reason}]` : undefined);
+            receipt?.({ channelId, epoch: frame.epoch, ok: true });
+            finish(frame.failed === true ? 1 : 0, frame.reason ? `[ssh channel closed: ${frame.reason}]` : undefined);
+        });
+        function beginRecovery() {
+            if (finished || !attached)
+                return;
+            attached = false;
+            input.pause();
+            epoch = (0, node_crypto_1.randomUUID)();
+            attachmentSeq++;
+            if (recoveringSince === null) {
+                recoveringSince = Date.now();
+                errorOutput.write('[skrr ssh] connection interrupted; restoring the existing SSH stream\n');
+            }
+        }
+        socket.on('dedicated:ssh:lost', (frame) => {
+            if (frame?.channelId !== channelId || frame.epoch !== epoch || !resumable || finished)
+                return;
+            beginRecovery();
+            sendResume();
         });
         socket.on('disconnect', () => {
             if (finished)
                 return;
-            finish(started ? 1 : 1, '[lost the connection to skrr; the SSH channel has ended]');
+            online = false;
+            input.pause();
+            if (!started || !resumable) {
+                finish(1, '[lost the connection to skrr; the SSH channel has ended]');
+                return;
+            }
+            beginRecovery();
         });
     });
 }

package/dist/lib/dedicated-terminal.js

@@ -9,6 +9,7 @@ const node_crypto_1 = require("node:crypto");
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agentic_stream_1 = require("./agentic-stream");
+const dpop_auth_1 = require("./dpop-auth");
 /**
  * A real pseudo-terminal on a Dedicated Runtime, from a local terminal.
  *
@@ -100,14 +101,16 @@ function runDedicatedTerminal(options) {
         let retryTimer;
         let recoveryTimer;
         let connected = false;
-        const socket = connect((0, agentic_stream_1.toWebSocketOrigin)(options.baseURL), {
+        const wsOrigin = (0, agentic_stream_1.toWebSocketOrigin)(options.baseURL);
+        const socket = connect(wsOrigin, {
             path: '/ws/agentic',
-            auth: {
+            // OSK-12020 — a DPoP-bound token proves possession on every handshake.
+            auth: (0, dpop_auth_1.socketAuthWithDpop)({
                 token: options.token,
                 ...(0, data_provider_1.getClientIdentityAuth)(),
                 clientPlatform: 'cli',
                 clientOs: process.platform === 'darwin' ? 'macos' : process.platform,
-            },
+            }, wsOrigin),
             transports: ['websocket'],
             // A bare PTY cannot be resumed: the relay forgets the session with the
             // socket, and silently opening a NEW shell would drop the user into a