@skrr-ai/cli 0.1.8 → 0.1.9

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/legacyStatePreflight.js

@@ -51,6 +51,13 @@ export function findLegacyLocalState(home = os.homedir()) {
  * `--force`: the operator's next step is the backup the runbook specifies, and
  * a flag that skips a safety check is the flag everyone learns to paste.
  */
+/**
+ * The pre-rename runtime binary. Named in the refusal above because deregistering
+ * the OLD service is the one step the NEW binary cannot do: `uninstall` resolves
+ * the current profile's label (`ai.skrr.daemon.*`), and the legacy sweep is wired
+ * only into the install path.
+ */
+const LEGACY_BINARY_NAME = 'oversky';
 export function describeLegacyState(report, binaryName) {
     const lines = [];
     lines.push('Found state from the previous product identity on this machine:');
@@ -65,7 +72,17 @@ export function describeLegacyState(report, binaryName) {
     lines.push('Nothing above has been read, copied or removed. Follow the team cutover');
     lines.push('runbook — it takes a backup first — and then run this again:');
     lines.push('');
-    lines.push(`  ${binaryName} uninstall     # stop and deregister the old service`);
+    // The OLD binary, deliberately: it is the one that knows the old service
+    // label. `<current> uninstall` resolves the CURRENT profile's label and would
+    // report success while leaving the pre-rename service registered. Guarded by
+    // "only if" rather than omitted, because this module inspects directories and
+    // has no way to know whether that binary is still on PATH.
+    lines.push(`  ${LEGACY_BINARY_NAME} uninstall     # only if the old runtime is still installed —`);
+    lines.push(`                        # it is the one that knows the old service label`);
     lines.push('  # then remove the directories listed above, per the runbook');
+    lines.push('');
+    lines.push(`Any pre-rename service still registered is swept by \`${binaryName} install\``);
+    lines.push('once those directories are gone, so re-running the install completes the');
+    lines.push('cutover either way.');
     return lines.join('\n');
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/loginLocalhost.js

@@ -341,15 +341,15 @@ function htmlShell(title, accent, headline, body) {
 function successHtml() {
     const headline = `<div class="badge"><svg viewBox="0 0 24 24"><path d="M5 13l4 4L19 7"/></svg></div>
     <h1>Authorized</h1>`;
-    return htmlShell('OverSky — Authorized', '#10b981', headline, 'You can close this tab and return to your terminal.');
+    return htmlShell('skrr — Authorized', '#10b981', headline, 'You can close this tab and return to your terminal.');
 }
 function declinedHtml() {
     const headline = `<div class="badge" style="background:#64748b"><svg viewBox="0 0 24 24"><path d="M6 6l12 12M18 6L6 18"/></svg></div>
     <h1>Authorization declined</h1>`;
-    return htmlShell('OverSky — Authorization declined', '#64748b', headline, 'You can close this tab. Run the CLI command again to retry.');
+    return htmlShell('skrr — Authorization declined', '#64748b', headline, 'You can close this tab. Run the CLI command again to retry.');
 }
 function genericFailureHtml() {
     const headline = `<div class="badge" style="background:#ef4444"><svg viewBox="0 0 24 24"><path d="M12 8v4M12 16h.01M21 12a9 9 0 11-18 0 9 9 0 0118 0z"/></svg></div>
     <h1>Authorization error</h1>`;
-    return htmlShell('OverSky — Authorization error', '#ef4444', headline, 'Something went wrong. You can close this tab and retry from the terminal.');
+    return htmlShell('skrr — Authorization error', '#ef4444', headline, 'Something went wrong. You can close this tab and retry from the terminal.');
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/messages.js

@@ -14,8 +14,8 @@ const REASON_HUMAN = {
     SESSION_REVOKED: 'Your session was ended (you signed out elsewhere or your password changed).',
     TOKEN_EXPIRED: 'Your access token has expired.',
     TOKEN_INVALID: 'Your saved credentials are no longer valid.',
-    UNKNOWN_401: 'OverSky needs you to sign in again.',
-    UNKNOWN: 'OverSky needs you to sign in again.',
+    UNKNOWN_401: 'skrr needs you to sign in again.',
+    UNKNOWN: 'skrr needs you to sign in again.',
 };
 export function formatReauthMessage(reason) {
     const norm = REASON_HUMAN[reason] || REASON_HUMAN.UNKNOWN;
@@ -24,7 +24,7 @@ export function formatReauthMessage(reason) {
     const cmd = isHeadless ? `${bin} login --device` : `${bin} login`;
     return [
         '',
-        'OverSky cannot connect — re-authentication required.',
+        'skrr cannot connect — re-authentication required.',
         `  Reason: ${norm}`,
         '',
         `  To continue, run:  ${cmd}`,

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/runtime.d.ts

@@ -49,9 +49,13 @@ export interface AuthCoreConfig {
      * per-profile and silently killed the `legacyDaemonUuids()` fold safety net
      * (it scanned `<profileDir>/profiles/*`, which never exists). See OSK-1478.
      *
-     * Default: falls back to `configDir()` when unset. The CLI's `configDir` is
-     * already the machine root (`~/.skrr`), so it needs no wiring; the daemon
-     * wires this explicitly to its root `CONFIG_DIR` in `auth/configure.ts`.
+     * Default: falls back to `configDir()` when unset. BOTH callers now wire it
+     * explicitly — the daemon to its root `CONFIG_DIR` in `auth/configure.ts`,
+     * and the CLI in `auth-core-init.ts`. The CLI's used to need no wiring
+     * because its `configDir` was unconditionally the machine root; that stopped
+     * being true when `configDir` became profile-aware, and an unwired default
+     * would have drifted `cliId` per profile — which the server rejects, because
+     * it binds that value into the JWT `did` claim.
      */
     machineConfigDir?: () => string;
     /** Logger used by all stateful helpers. */

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/skyCodeChannels.d.ts

@@ -0,0 +1,96 @@
+/**
+ * skrr Code update channels — the vocabulary, in the ONE place both readers resolve.
+ *
+ * It lived in `daemon/src/sky-code/channels.ts`, whose only importer was the
+ * daemon's own installer. That was fine while the daemon was the only thing that
+ * needed it, and it stopped being fine the moment a user could be told to go
+ * looking: `skrr code`'s not-installed message promised that `skrr code doctor`
+ * would name "which channel this machine follows and whether that channel has a
+ * published release", and the CLI had no access to any of it — so the sentence
+ * described a diagnosis nobody had written (dogfood OSK-274).
+ *
+ * A MIRROR in the CLI was the obvious alternative and is the wrong answer here,
+ * with precedent: OSK-3894 shipped exactly that for the harness trust tiers and
+ * OSK-3897 removed it, because a mirror proves two copies agree rather than
+ * proving there is one copy. `harnessTrust.ts` moved into this package for that
+ * reason, the daemon re-exports it, and a static check keeps the daemon from
+ * quietly redeclaring. This follows that road rather than reopening the one it
+ * replaced.
+ *
+ * Only the VOCABULARY moves — channel names, the env var, the default, and the
+ * URL shape. The installer, the signature verification and the promotion
+ * machinery stay in the daemon, which is the only process that performs them.
+ */
+/** Channels in promotion order. Index order IS the promotion order. */
+export declare const SKY_CODE_CHANNELS: readonly ["internal", "canary", "beta", "stable"];
+export type SkyCodeChannel = (typeof SKY_CODE_CHANNELS)[number];
+/**
+ * The channel a build without an explicit setting follows.
+ *
+ * `stable`, and never inferred from anything else. A default that drifted with
+ * the build (say, dev builds silently on `canary`) would mean a user's update
+ * path depended on how their binary happened to be produced.
+ */
+export declare const DEFAULT_SKY_CODE_CHANNEL: SkyCodeChannel;
+/** Env var selecting the channel. Explicit opt-in; never set implicitly. */
+export declare const SKY_CODE_CHANNEL_ENV = "OVERSKY_SKY_CODE_CHANNEL";
+/** Manifest filename, under a channel prefix or an immutable release prefix. */
+export declare const SKY_CODE_MANIFEST_FILE = "sky-code-version.json";
+export declare function isSkyCodeChannel(value: unknown): value is SkyCodeChannel;
+/**
+ * The channel this process should follow.
+ *
+ * An unrecognised value falls back to the default rather than throwing. A
+ * typo'd channel must not brick updates altogether — that turns a harmless
+ * mistake into an un-updatable machine, which is the failure the updater exists
+ * to prevent. The caller is handed `invalid` so it can say so out loud.
+ */
+export declare function resolveSkyCodeChannel(env?: NodeJS.ProcessEnv): {
+    channel: SkyCodeChannel;
+    invalid?: string;
+};
+/**
+ * Where a channel's signed manifest lives.
+ *
+ * `stable` is NOT special-cased to `latest/`. Two paths that must always agree
+ * is a pair that eventually will not, and the one that disagrees silently is
+ * the one serving production. `latest/` remains for the daemon feed and for
+ * anything already pointing at it; skrr Code channel clients read
+ * `channels/<name>/` uniformly.
+ */
+export declare function skyCodeChannelPrefix(channel: SkyCodeChannel): string;
+/**
+ * Manifest URL for a channel, or for a pinned version.
+ *
+ * A pinned version wins over the channel and reads its immutable per-release
+ * copy: pinning means "this exact build", and a channel pointer that moved
+ * underneath would make the pin a suggestion.
+ *
+ * Builds only MANIFEST urls, never artifact ones. `buildManifestMessage` signs
+ * version, minimum, forceUpdate and the per-platform sha256s; `buildArtifactMessage`
+ * signs the artifact URL. Neither signs a channel — so artifact URLs stay
+ * channel-independent and promotion is a COPY OF AN ALREADY-SIGNED OBJECT that
+ * never needs the release key. Put the channel in the artifact URL instead and
+ * every promotion becomes a re-signing ceremony, which decides whether the
+ * ed25519 key has to be reachable from routine automation. A helper here that
+ * adjusted artifact urls would silently reintroduce exactly that coupling.
+ */
+export declare function resolveChannelManifestUrl(input: {
+    base: string;
+    manifestFilename: string;
+    channel: SkyCodeChannel;
+    pinnedVersion?: string | null;
+}): string;
+/** Default public feed. Mirrors the daemon's `updates.oversky.ai/daemon` prefix. */
+export declare const DEFAULT_SKY_CODE_FEED_BASE = "https://updates.oversky.ai/sky-code";
+/**
+ * Feed override, read at call time rather than module load so a test or an
+ * operator can repoint it without re-importing.
+ *
+ * Explicit-only: a production user must never be silently enrolled onto a
+ * different feed. Selecting a feed changes WHICH signed manifest is read, never
+ * WHETHER the signature is checked — every artifact is verified against the
+ * pinned keys regardless of where it came from.
+ */
+export declare const SKY_CODE_FEED_BASE_ENV = "OVERSKY_SKY_CODE_UPDATE_FEED_BASE";
+export declare function skyCodeFeedBase(env?: NodeJS.ProcessEnv): string;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/skyCodeChannels.js

@@ -0,0 +1,107 @@
+/**
+ * skrr Code update channels — the vocabulary, in the ONE place both readers resolve.
+ *
+ * It lived in `daemon/src/sky-code/channels.ts`, whose only importer was the
+ * daemon's own installer. That was fine while the daemon was the only thing that
+ * needed it, and it stopped being fine the moment a user could be told to go
+ * looking: `skrr code`'s not-installed message promised that `skrr code doctor`
+ * would name "which channel this machine follows and whether that channel has a
+ * published release", and the CLI had no access to any of it — so the sentence
+ * described a diagnosis nobody had written (dogfood OSK-274).
+ *
+ * A MIRROR in the CLI was the obvious alternative and is the wrong answer here,
+ * with precedent: OSK-3894 shipped exactly that for the harness trust tiers and
+ * OSK-3897 removed it, because a mirror proves two copies agree rather than
+ * proving there is one copy. `harnessTrust.ts` moved into this package for that
+ * reason, the daemon re-exports it, and a static check keeps the daemon from
+ * quietly redeclaring. This follows that road rather than reopening the one it
+ * replaced.
+ *
+ * Only the VOCABULARY moves — channel names, the env var, the default, and the
+ * URL shape. The installer, the signature verification and the promotion
+ * machinery stay in the daemon, which is the only process that performs them.
+ */
+/** Channels in promotion order. Index order IS the promotion order. */
+export const SKY_CODE_CHANNELS = ['internal', 'canary', 'beta', 'stable'];
+/**
+ * The channel a build without an explicit setting follows.
+ *
+ * `stable`, and never inferred from anything else. A default that drifted with
+ * the build (say, dev builds silently on `canary`) would mean a user's update
+ * path depended on how their binary happened to be produced.
+ */
+export const DEFAULT_SKY_CODE_CHANNEL = 'stable';
+/** Env var selecting the channel. Explicit opt-in; never set implicitly. */
+export const SKY_CODE_CHANNEL_ENV = 'OVERSKY_SKY_CODE_CHANNEL';
+/** Manifest filename, under a channel prefix or an immutable release prefix. */
+export const SKY_CODE_MANIFEST_FILE = 'sky-code-version.json';
+export function isSkyCodeChannel(value) {
+    return typeof value === 'string' && SKY_CODE_CHANNELS.includes(value);
+}
+/**
+ * The channel this process should follow.
+ *
+ * An unrecognised value falls back to the default rather than throwing. A
+ * typo'd channel must not brick updates altogether — that turns a harmless
+ * mistake into an un-updatable machine, which is the failure the updater exists
+ * to prevent. The caller is handed `invalid` so it can say so out loud.
+ */
+export function resolveSkyCodeChannel(env = process.env) {
+    const raw = env[SKY_CODE_CHANNEL_ENV]?.trim();
+    if (!raw)
+        return { channel: DEFAULT_SKY_CODE_CHANNEL };
+    if (isSkyCodeChannel(raw))
+        return { channel: raw };
+    return { channel: DEFAULT_SKY_CODE_CHANNEL, invalid: raw };
+}
+/**
+ * Where a channel's signed manifest lives.
+ *
+ * `stable` is NOT special-cased to `latest/`. Two paths that must always agree
+ * is a pair that eventually will not, and the one that disagrees silently is
+ * the one serving production. `latest/` remains for the daemon feed and for
+ * anything already pointing at it; skrr Code channel clients read
+ * `channels/<name>/` uniformly.
+ */
+export function skyCodeChannelPrefix(channel) {
+    return `channels/${channel}/`;
+}
+/**
+ * Manifest URL for a channel, or for a pinned version.
+ *
+ * A pinned version wins over the channel and reads its immutable per-release
+ * copy: pinning means "this exact build", and a channel pointer that moved
+ * underneath would make the pin a suggestion.
+ *
+ * Builds only MANIFEST urls, never artifact ones. `buildManifestMessage` signs
+ * version, minimum, forceUpdate and the per-platform sha256s; `buildArtifactMessage`
+ * signs the artifact URL. Neither signs a channel — so artifact URLs stay
+ * channel-independent and promotion is a COPY OF AN ALREADY-SIGNED OBJECT that
+ * never needs the release key. Put the channel in the artifact URL instead and
+ * every promotion becomes a re-signing ceremony, which decides whether the
+ * ed25519 key has to be reachable from routine automation. A helper here that
+ * adjusted artifact urls would silently reintroduce exactly that coupling.
+ */
+export function resolveChannelManifestUrl(input) {
+    const base = input.base.replace(/\/+$/, '');
+    if (input.pinnedVersion) {
+        return `${base}/releases/${input.pinnedVersion}/${input.manifestFilename}`;
+    }
+    return `${base}/${skyCodeChannelPrefix(input.channel)}${input.manifestFilename}`;
+}
+/** Default public feed. Mirrors the daemon's `updates.oversky.ai/daemon` prefix. */
+export const DEFAULT_SKY_CODE_FEED_BASE = 'https://updates.oversky.ai/sky-code';
+/**
+ * Feed override, read at call time rather than module load so a test or an
+ * operator can repoint it without re-importing.
+ *
+ * Explicit-only: a production user must never be silently enrolled onto a
+ * different feed. Selecting a feed changes WHICH signed manifest is read, never
+ * WHETHER the signature is checked — every artifact is verified against the
+ * pinned keys regardless of where it came from.
+ */
+export const SKY_CODE_FEED_BASE_ENV = 'OVERSKY_SKY_CODE_UPDATE_FEED_BASE';
+export function skyCodeFeedBase(env = process.env) {
+    const override = (env[SKY_CODE_FEED_BASE_ENV] || '').trim();
+    return (override || DEFAULT_SKY_CODE_FEED_BASE).replace(/\/+$/, '');
+}

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {