@skrr-ai/cli 0.1.8

package/dist/lib/message-intent.js

@@ -0,0 +1,287 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageIntentCliError = exports.COMMUNICATION_KIND_INPUTS = exports.LEGACY_COMMUNICATION_KIND_ALIASES = exports.COMMUNICATION_KINDS = exports.CANONICAL_DESTINATION_KINDS = void 0;
+exports.normalizeCommunicationKindInput = normalizeCommunicationKindInput;
+exports.readAgentSessionMessageContext = readAgentSessionMessageContext;
+exports.resolveMessageCommandSessionContext = resolveMessageCommandSessionContext;
+exports.sessionCredential = sessionCredential;
+exports.submitSessionMessageIntent = submitSessionMessageIntent;
+exports.canonicalAppOwnerDmRequest = canonicalAppOwnerDmRequest;
+exports.canonicalSlackChannelRequest = canonicalSlackChannelRequest;
+exports.canonicalSlackOwnerDmRequest = canonicalSlackOwnerDmRequest;
+exports.rejectAutonomousSlackTarget = rejectAutonomousSlackTarget;
+const auth_core_1 = require("@skrr-ai/auth-core");
+const api_fetch_1 = require("./api-fetch");
+const daemonBroker_1 = require("./daemonBroker");
+const runtime_context_1 = require("./runtime-context");
+const DAEMON_MESSAGE_INTENT_TIMEOUT_MS = 10_000;
+exports.CANONICAL_DESTINATION_KINDS = [
+    'app_owner_dm',
+    'slack_owner_dm',
+    'slack_channel',
+];
+/**
+ * The durable, user-facing taxonomy for deliberate Agent Updates. Keep this
+ * aligned with `Communication/communicationMetadata.js`: CLI callers may
+ * still submit the legacy inputs below, but every new message is normalized
+ * onto one of these values before it reaches the API.
+ */
+exports.COMMUNICATION_KINDS = [
+    'milestone',
+    'status',
+    'decision',
+    'blocker',
+    'result',
+];
+/** Inputs retained only so existing scripts and managed instructions do not break. */
+exports.LEGACY_COMMUNICATION_KIND_ALIASES = {
+    progress: 'status',
+    question: 'decision',
+};
+exports.COMMUNICATION_KIND_INPUTS = [
+    ...exports.COMMUNICATION_KINDS,
+    ...Object.keys(exports.LEGACY_COMMUNICATION_KIND_ALIASES),
+];
+function normalizeCommunicationKindInput(value) {
+    const normalized = value.trim().toLowerCase();
+    const aliased = exports.LEGACY_COMMUNICATION_KIND_ALIASES[normalized];
+    if (aliased)
+        return aliased;
+    return exports.COMMUNICATION_KINDS.includes(normalized)
+        ? normalized
+        : undefined;
+}
+/**
+ * Session presence is proved by the session credential, not by caller-shaped
+ * metadata such as `source.kind` or `OVERSKY_SESSION_ID` alone.  This keeps a
+ * human CLI process from opting into the autonomous path by setting an env
+ * label, while still allowing the legacy commands to discover the daemon
+ * session route.
+ */
+function readAgentSessionMessageContext(env = process.env) {
+    const token = env.OVERSKY_SESSION_TOKEN?.trim();
+    if (!token)
+        return null;
+    const runtime = (0, runtime_context_1.readRuntimeContext)(env);
+    return {
+        token,
+        sessionId: runtime.session.id,
+    };
+}
+/**
+ * Select the principal for a message-producing CLI command before that
+ * command is allowed to consult normal CLI auth or resolve any cloud data.
+ *
+ * `OVERSKY_AUTONOMOUS_SESSION=1` is stamped only by the trusted daemon
+ * session environment. Once present it is a one-way trust boundary: missing
+ * session credentials, or a missing broker after broker routing was
+ * explicitly advertised, must stop the command rather than letting a
+ * keychain/file/OVERSKY_TOKEN credential silently turn the autonomous action
+ * into a human API call. A restricted session credential may still use the
+ * direct online session endpoint when broker routing is disabled.
+ */
+function resolveMessageCommandSessionContext({ env = process.env, requireHumanAuth, bootstrapPathOverride, }) {
+    const context = readAgentSessionMessageContext(env);
+    if (env.OVERSKY_AUTONOMOUS_SESSION !== '1') {
+        if (!context)
+            requireHumanAuth();
+        return context;
+    }
+    if (!context) {
+        throw new MessageIntentCliError('AUTONOMOUS_SESSION_CREDENTIAL_MISSING', 'This autonomous Agent process has no usable OVERSKY_SESSION_TOKEN; refusing to use ambient CLI credentials.');
+    }
+    if (!context.sessionId) {
+        throw new MessageIntentCliError('AUTONOMOUS_SESSION_CONTEXT_MISSING', 'This autonomous Agent process has no usable OVERSKY_SESSION_ID; refusing to use ambient CLI credentials.');
+    }
+    if (daemonMessageIntentRequired(env)) {
+        // Check availability before command parsing can reach agent resolution or
+        // any data-provider/API call. Submission validates the bootstrap again so
+        // a daemon exit between this check and the send also fails closed.
+        const bootstrap = (0, daemonBroker_1.findLiveDaemonBootstrap)({
+            profile: env.OVERSKY_PROFILE?.trim() || 'default',
+            bootstrapPathOverride,
+        });
+        if (!bootstrap?.host || !bootstrap.port || !bootstrap.secret) {
+            throw new MessageIntentCliError('DAEMON_MESSAGE_INTENT_UNAVAILABLE', 'This autonomous Agent process requires the local daemon message broker, but no live daemon bootstrap was found.');
+        }
+    }
+    // Broker flag 0 is the connected online case. It remains a restricted
+    // session-token request and is safe to send directly; apiFetch receives an
+    // explicit sessionCredential and therefore cannot adopt ambient human auth.
+    return context;
+}
+function sessionCredential(token) {
+    return {
+        token,
+        // `env-token` is the closest existing source category and, importantly,
+        // prevents the normal CLI refresh/keychain path from adopting a human
+        // credential after a session-token failure.
+        source: 'env-token',
+        kind: (0, auth_core_1.classifyTokenKind)(token),
+    };
+}
+class MessageIntentCliError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'MessageIntentCliError';
+        this.code = code;
+    }
+}
+exports.MessageIntentCliError = MessageIntentCliError;
+function daemonMessageIntentRequired(env) {
+    return env.OVERSKY_OFFLINE_MESSAGE_SUBMIT_VIA_DAEMON === '1';
+}
+async function submitDaemonLoopbackMessageIntent({ context, request, env, bootstrapPathOverride, timeoutMs, fetchImpl, }) {
+    const bootstrap = (0, daemonBroker_1.findLiveDaemonBootstrap)({
+        profile: env.OVERSKY_PROFILE?.trim() || 'default',
+        bootstrapPathOverride,
+    });
+    if (!bootstrap?.host || !bootstrap.port || !bootstrap.secret) {
+        throw new MessageIntentCliError('DAEMON_MESSAGE_INTENT_UNAVAILABLE', 'This Agent session requires the local daemon message broker, but no live daemon bootstrap was found.');
+    }
+    const controller = new AbortController();
+    const deadlineMs = timeoutMs ?? DAEMON_MESSAGE_INTENT_TIMEOUT_MS;
+    const timeoutError = () => new MessageIntentCliError('DAEMON_MESSAGE_INTENT_TIMEOUT', `The local daemon message broker did not respond within ${deadlineMs}ms.`);
+    let timer;
+    const deadline = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(timeoutError());
+        }, deadlineMs);
+    });
+    try {
+        const response = await Promise.race([
+            (fetchImpl || globalThis.fetch)(`http://${bootstrap.host}:${bootstrap.port}/v1/agent/message-intents`, {
+                method: 'POST',
+                headers: {
+                    Authorization: `Bearer ${bootstrap.secret}`,
+                    'Content-Type': 'application/json',
+                    Accept: 'application/json',
+                },
+                body: JSON.stringify({
+                    sessionId: context.sessionId,
+                    sessionToken: context.token,
+                    request,
+                }),
+                signal: controller.signal,
+            }),
+            deadline,
+        ]);
+        let body = null;
+        try {
+            body = (await Promise.race([
+                response.json(),
+                deadline,
+            ]));
+        }
+        catch (error) {
+            if (error instanceof MessageIntentCliError ||
+                controller.signal.aborted ||
+                (error instanceof Error && error.name === 'AbortError')) {
+                throw error instanceof MessageIntentCliError ? error : timeoutError();
+            }
+            body = null;
+        }
+        if (!response.ok || body?.ok !== true) {
+            const code = typeof body?.reason === 'string' && body.reason
+                ? body.reason
+                : `DAEMON_MESSAGE_INTENT_HTTP_${response.status}`;
+            throw new MessageIntentCliError(code, `The local daemon message broker rejected the Agent message (${code}).`);
+        }
+        return body;
+    }
+    catch (error) {
+        if (error instanceof MessageIntentCliError)
+            throw error;
+        const timedOut = controller.signal.aborted || (error instanceof Error && error.name === 'AbortError');
+        throw timedOut
+            ? timeoutError()
+            : new MessageIntentCliError('DAEMON_MESSAGE_INTENT_UNAVAILABLE', 'The local daemon message broker could not be reached.');
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function submitSessionMessageIntent({ context, request, env = process.env, bootstrapPathOverride, timeoutMs, fetchImpl, }) {
+    if (!context.sessionId) {
+        throw new MessageIntentCliError('SESSION_CONTEXT_MISSING', 'An Agent session message requires OVERSKY_SESSION_ID alongside OVERSKY_SESSION_TOKEN.');
+    }
+    // A daemon-owned autonomous session must submit through the authenticated
+    // loopback broker. Falling back to the cloud here would bypass the
+    // server-issued offline grant and make network failure skip the durable WAL.
+    if (daemonMessageIntentRequired(env)) {
+        return submitDaemonLoopbackMessageIntent({
+            context,
+            request,
+            env,
+            bootstrapPathOverride,
+            timeoutMs,
+            fetchImpl,
+        });
+    }
+    return (0, api_fetch_1.apiFetch)(`/api/agentic/sessions/${encodeURIComponent(context.sessionId)}/message-intents`, {
+        method: 'POST',
+        body: request,
+        // Never let the generic CLI credential resolver replace a session
+        // credential for this autonomous operation.
+        credential: sessionCredential(context.token),
+    });
+}
+function canonicalAppOwnerDmRequest({ agentId, embeds, text, idempotencyKey, taskId, spaceId, goalId, presentation, notificationPolicy, threadRootMessageId, }) {
+    return {
+        protocolVersion: 1,
+        agentId,
+        intentType: 'status_update',
+        destination: { kind: 'app_owner_dm' },
+        content: { text },
+        idempotencyKey,
+        ...(presentation ? { presentation } : {}),
+        ...(notificationPolicy ? { notificationPolicy } : {}),
+        ...(threadRootMessageId ? { threadRootMessageId } : {}),
+        ...(embeds && embeds.length > 0 ? { embeds } : {}),
+        ...(taskId || spaceId || goalId
+            ? {
+                context: {
+                    ...(taskId ? { taskId } : {}),
+                    ...(spaceId ? { spaceId } : {}),
+                    ...(goalId ? { goalId } : {}),
+                },
+            }
+            : {}),
+    };
+}
+function canonicalSlackChannelRequest({ agentId, embeds, channelId, text, threadTs, idempotencyKey, presentation, notificationPolicy, }) {
+    return {
+        protocolVersion: 1,
+        agentId,
+        intentType: 'status_update',
+        destination: {
+            kind: 'slack_channel',
+            channelId,
+            ...(threadTs ? { threadTs } : {}),
+        },
+        content: { text },
+        idempotencyKey,
+        ...(presentation ? { presentation } : {}),
+        ...(notificationPolicy ? { notificationPolicy } : {}),
+        ...(embeds && embeds.length > 0 ? { embeds } : {}),
+    };
+}
+function canonicalSlackOwnerDmRequest({ agentId, embeds, text, idempotencyKey, presentation, notificationPolicy, }) {
+    return {
+        protocolVersion: 1,
+        agentId,
+        intentType: 'status_update',
+        destination: { kind: 'slack_owner_dm' },
+        content: { text },
+        idempotencyKey,
+        ...(presentation ? { presentation } : {}),
+        ...(notificationPolicy ? { notificationPolicy } : {}),
+        ...(embeds && embeds.length > 0 ? { embeds } : {}),
+    };
+}
+function rejectAutonomousSlackTarget(targetType) {
+    throw new MessageIntentCliError('SESSION_SLACK_TARGET_UNSUPPORTED', `Slack target type "${targetType}" cannot be delegated from an Agent session. ` +
+        'Use the canonical owner-DM destination or an authorized Slack channel.');
+}

package/dist/lib/migrate.d.ts

@@ -0,0 +1,21 @@
+import { type AuthBackend } from './auth-storage';
+export interface MigrationResult {
+    migrated: boolean;
+    /**
+     * Backend that accepted the migrated bundle, or the backend that was
+     * already holding it when migration found a newer value present.
+     * `'none'` is reported when migration was a no-op or failed — callers
+     * should not treat it as authoritative storage.
+     */
+    backend?: AuthBackend;
+    /** Non-fatal diagnostic. Populated when a legacy token existed but the
+     *  write failed — the resolver still reads the legacy file in that case. */
+    error?: string;
+}
+/**
+ * Move any legacy `token` / `refreshToken` out of `cli-config.json` into
+ * the keychain/file auth-storage backend.
+ *
+ * Safe to call multiple times per process.
+ */
+export declare function migrateAuthOutOfConfig(): MigrationResult;

package/dist/lib/migrate.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.migrateAuthOutOfConfig = migrateAuthOutOfConfig;
+/**
+ * migrate.ts — one-shot migration of CLI credentials from the legacy
+ * single-file layout to the split metadata/auth-storage layout.
+ *
+ * Before this change, `cli-config.json` stored both non-secret metadata
+ * (`baseURL`, `userId`, `cliId`) AND the secret token pair. That's a
+ * layering violation — the keychain backend is supposed to isolate
+ * secrets from same-UID observers, which `cli-config.json` does not.
+ *
+ * Post-migration:
+ *   - `cli-config.json`: non-secret metadata only (baseURL, userId,
+ *     email, cliId, credentials.*)
+ *   - `cli-auth.json` (file backend) OR Keychain (when available):
+ *     token pair only
+ *
+ * Migration rules (run once at the start of every CLI command via
+ * `BaseCommand.init()`):
+ *   1. If `cli-config.json` contains a `token`, copy `{token, refreshToken?}`
+ *      into the preferred backend (keychain > file).
+ *   2. Strip `token` / `refreshToken` from `cli-config.json` and rewrite.
+ *   3. Leave a breadcrumb field (`migrated.authOutOfConfig: true`) so
+ *      subsequent runs short-circuit the entire migration without a
+ *      keychain probe.
+ *
+ * Idempotent: safe to call on a clean install and on every startup.
+ * Non-fatal: migration failures log at DEBUG and leave the legacy fields
+ * in place; the resolver's file-backend slot still reads them in the
+ * interim.
+ */
+const config_1 = require("./config");
+const auth_storage_1 = require("./auth-storage");
+const BREADCRUMB_KEY = 'authOutOfConfig';
+/**
+ * Move any legacy `token` / `refreshToken` out of `cli-config.json` into
+ * the keychain/file auth-storage backend.
+ *
+ * Safe to call multiple times per process.
+ */
+function migrateAuthOutOfConfig() {
+    const raw = (0, config_1.loadRawConfig)();
+    const migrated = getMigratedMap(raw);
+    const legacyToken = typeof raw.token === 'string' ? raw.token : undefined;
+    const legacyRefreshToken = typeof raw.refreshToken === 'string' ? raw.refreshToken : undefined;
+    const legacyExpiresAt = typeof raw.expiresAt === 'number' ? raw.expiresAt : undefined;
+    const legacyRefreshExpiresAt = typeof raw.refreshExpiresAt === 'number' ? raw.refreshExpiresAt : undefined;
+    // Fast path: breadcrumb says we're done.
+    if (migrated[BREADCRUMB_KEY] === true && !legacyToken && !legacyRefreshToken) {
+        return { migrated: false };
+    }
+    // Nothing to migrate — still set the breadcrumb so we don't probe again.
+    if (!legacyToken && !legacyRefreshToken) {
+        if (migrated[BREADCRUMB_KEY] !== true) {
+            (0, config_1.saveRawConfig)({
+                ...raw,
+                migrated: { ...migrated, [BREADCRUMB_KEY]: true },
+            });
+        }
+        return { migrated: false };
+    }
+    // Legacy tokens present. Before we commit to writing them into the
+    // backend, check whether the backend already has a (presumably newer)
+    // bundle. If it does, just strip the legacy fields — the keychain
+    // value wins because writeToBackend() on login always writes there
+    // first.
+    const existing = (0, auth_storage_1.readFromBackend)();
+    if (existing.bundle && existing.backend !== 'none') {
+        (0, config_1.saveRawConfig)(stripLegacyTokens(raw));
+        return { migrated: true, backend: existing.backend };
+    }
+    if (!legacyToken) {
+        // Refresh without access — bail; log-in flow will re-issue cleanly.
+        (0, config_1.saveRawConfig)(stripLegacyTokens(raw));
+        return { migrated: true, backend: 'none' };
+    }
+    // Write the legacy bundle into the backend, then strip the config.
+    try {
+        const serverOrigin = typeof raw.baseURL === 'string' ? raw.baseURL : undefined;
+        const backend = (0, auth_storage_1.writeToBackend)({
+            token: legacyToken,
+            ...(legacyExpiresAt !== undefined ? { expiresAt: legacyExpiresAt } : {}),
+            ...(legacyRefreshToken ? { refreshToken: legacyRefreshToken } : {}),
+            ...(legacyRefreshExpiresAt !== undefined ? { refreshExpiresAt: legacyRefreshExpiresAt } : {}),
+            ...(serverOrigin ? { serverOrigin } : {}),
+        });
+        (0, config_1.saveRawConfig)(stripLegacyTokens(raw));
+        return { migrated: true, backend };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (process.env.DEBUG) {
+            console.error(`[cli/migrate] auth-out-of-config failed: ${message}`);
+        }
+        return { migrated: false, error: message };
+    }
+}
+function getMigratedMap(raw) {
+    const m = raw.migrated;
+    if (!m || typeof m !== 'object')
+        return {};
+    const out = {};
+    for (const [k, v] of Object.entries(m)) {
+        if (typeof v === 'boolean')
+            out[k] = v;
+    }
+    return out;
+}
+function stripLegacyTokens(raw) {
+    const next = { ...raw };
+    delete next.token;
+    delete next.refreshToken;
+    delete next.expiresAt;
+    delete next.refreshExpiresAt;
+    next.migrated = { ...getMigratedMap(raw), [BREADCRUMB_KEY]: true };
+    return next;
+}

package/dist/lib/node-adapter.d.ts

@@ -0,0 +1,50 @@
+import type { HttpAdapter } from '@skrr-ai/data-provider';
+import { type ResolvedCredential } from '@skrr-ai/auth-core';
+import './auth-core-init';
+/**
+ * node-adapter.ts — Node-native HttpAdapter for @skrr-ai/data-provider.
+ *
+ * Uses Node 20's global fetch (no axios/undici dependency). Injects the
+ * bearer token resolved by `credential-resolver.ts` on every request,
+ * and transparently handles 401 → refresh → retry except when the
+ * resolved token is a CI token (which doesn't rotate).
+ *
+ * Auth model (post-Phase-H):
+ *   - `BaseCommand.init()` resolves the credential once via the Phase H.1
+ *     precedence chain and calls `setAdapterCredentialOverride()`. The
+ *     adapter reuses that resolution for the process lifetime — a CLI
+ *     command is a single operation and re-walking the chain on every
+ *     HTTP call is both wasteful (keychain = child-process spawn) AND
+ *     wrong (a helper script returning a new token mid-command would
+ *     swap headers between paginated fetches).
+ *   - After a successful refresh, the override is replaced with the
+ *     new access token so subsequent requests in the same process see
+ *     the fresh credential.
+ *   - CI tokens (kind='ci') never refresh. A 401 surfaces directly to
+ *     the caller for operator diagnosis.
+ *
+ * Refresh serialization is delegated to the shared CLI refresh layer,
+ * which uses @skrr-ai/auth-core's auth.lock so the daemon, Electron main,
+ * and CLI never race-rotate against each other.
+ */
+export interface AdapterOptions {
+    /** Called after a successful silent refresh so the caller can react. */
+    onTokenRefresh?: (token: string, refreshToken?: string) => void;
+    /** Called when refresh fails — caller typically prompts re-login. */
+    onAuthFailure?: () => void;
+}
+export declare function setAdapterCredentialOverride(cred: ResolvedCredential): void;
+export declare function clearAdapterCredentialOverride(): void;
+/**
+ * The credential `BaseCommand.init()` resolved for this process, or null.
+ *
+ * Read by `apiFetch` so the two CLI transports share ONE precedence order.
+ * Libraries built on `dataService` reach the override through the adapter, but
+ * `apiFetch`-based ones (runtimes, grants, …) had no default path to it and fell
+ * through to `resolveCredential()` — the KEYCHAIN — which silently discarded
+ * `--token` and `--bare` (dogfood OSK-4691).
+ */
+export declare function getAdapterCredentialOverride(): ResolvedCredential | null;
+export declare function createNodeAdapter(opts?: AdapterOptions): HttpAdapter;
+/** @internal — used by tests to flush the credential override between cases. */
+export declare function __recomputeCredentialForTest(): Promise<void>;