@skrr-ai/cli 0.1.82 → 0.1.83

package/dist/lib/daemonBroker.js

@@ -374,6 +374,10 @@ async function attemptDaemonBrokerLogin(opts) {
     const first = await attemptDaemonBrokerLoginOnce(opts);
     if (first.ok || !isRestartShapedFailure(first))
         return first;
+    // The guest descriptor is owned by the runtime supervisor, not this CLI's
+    // local daemon service. Waiting on a laptop launchd restart cannot repair it.
+    if (opts.bootstrapPathOverride === exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR)
+        return first;
     // The local service may be restarting: a graceful restart removes the
     // descriptor and republishes it only once the new daemon is listening
     // (measured ~14s), and a crash leaves it naming a dead pid until launchd

package/dist/lib/first-party-harness-broker.d.ts

@@ -146,6 +146,8 @@ export interface AcquireManagedSessionInput {
 export interface AcquireManagedSessionDeps {
     prefetchAuth?: () => Promise<void>;
     hasCredential?: () => boolean;
+    /** null means this is not a standalone Dedicated guest invocation. */
+    borrowGuestCredential?: () => Promise<boolean | null>;
     /** `signal` is the acquisition-wide deadline; an override that ignores it is unbounded. */
     resolveAgent?: (ref?: string, signal?: AbortSignal) => Promise<FirstPartyHarnessAgent>;
     /** The user-JWT call. Defaults to `apiFetch`. */

package/dist/lib/first-party-harness-broker.js

@@ -75,6 +75,13 @@ const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
 const cred_envelope_1 = require("./cred-envelope");
+const dedicated_guest_1 = require("./dedicated-guest");
+const daemonBroker_1 = require("./daemonBroker");
+const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
+const cli_identity_1 = require("./cli-identity");
+const credential_resolver_1 = require("./credential-resolver");
+const harness_context_1 = require("./harness-context");
+const node_adapter_1 = require("./node-adapter");
 const first_party_harness_1 = require("./first-party-harness");
 const first_party_harness_agent_1 = require("./first-party-harness-agent");
 const first_party_harness_managed_1 = require("./first-party-harness-managed");
@@ -162,6 +169,47 @@ class ManagedAcquisitionError extends Error {
     }
 }
 exports.ManagedAcquisitionError = ManagedAcquisitionError;
+async function borrowDedicatedGuestCredential() {
+    if (!(0, dedicated_guest_1.runningOnDedicatedRuntimeGuest)() ||
+        (0, harness_context_1.isHarnessCliContext)() ||
+        (0, credential_resolver_1.resolveTrustedAutonomousCredential)()) {
+        return null;
+    }
+    // `skrr code run` does not extend BaseCommand, so its local credential check
+    // used to stop before the guest's daemon hand-off could be redeemed. Borrow
+    // only the fixed root-owned guest descriptor. No refresh family or credential
+    // is persisted, and apiFetch can re-redeem this DPoP-bound token on a 401.
+    try {
+        const cfg = (0, config_1.loadConfig)();
+        const outcome = await (0, daemonBroker_1.attemptDaemonBrokerLogin)({
+            cliId: (0, cli_identity_1.planLoginCliId)(cfg).cliId,
+            baseURL: cfg.baseURL,
+            bootstrapPathOverride: daemonBroker_1.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR,
+            preferHandoffMode: 'access_token',
+            borrowOnly: true,
+            timeoutMs: 10_000,
+        });
+        if (!outcome.ok) {
+            const description = (0, daemonBrokerRefusal_1.describeBrokerFailure)(outcome);
+            throw new ManagedAcquisitionError(outcome.code ?? 'guest-handoff-unavailable', description
+                ? `${description.headline} ${description.remedy}`
+                : `the Dedicated Runtime could not provide its managed skrr session (${outcome.reason})`);
+        }
+        if (!outcome.brokered)
+            return false;
+        (0, node_adapter_1.setAdapterCredentialOverride)({
+            token: outcome.accessToken,
+            source: 'env-token',
+            kind: (0, auth_core_1.classifyTokenKind)(outcome.accessToken),
+        });
+        return true;
+    }
+    catch (error) {
+        if (error instanceof ManagedAcquisitionError)
+            throw error;
+        return false;
+    }
+}
 /**
  * Acquire a managed session, or throw a typed `ManagedAcquisitionError`.
  *
@@ -183,11 +231,28 @@ async function acquireManagedSession(input = {}, deps = {}) {
     // Checked locally, BEFORE any network. A fresh machine that has never run
     // `skrr login` must fall back to BYOK without a round trip and without a 401 that
     // would drag `apiFetch`'s refresh machinery in behind it.
-    let localCredentialAvailable;
-    if (deps.hasCredential) {
+    let localCredentialAvailable = false;
+    // Match BaseCommand's narrowly scoped retirement path: a stale guest refresh
+    // family must not prevent the live machine descriptor from lending a token.
+    const brokerBeforeStored = !deps.hasCredential &&
+        !(0, config_1.isEnvAuthOverride)() &&
+        !(0, harness_context_1.isHarnessCliContext)() &&
+        !(0, credential_resolver_1.resolveTrustedAutonomousCredential)() &&
+        (0, daemonBroker_1.shouldBrokerBeforeStoredCredential)();
+    if (brokerBeforeStored) {
+        try {
+            const guestHandoff = await (deps.borrowGuestCredential ?? borrowDedicatedGuestCredential)();
+            if (guestHandoff === true)
+                localCredentialAvailable = true;
+        }
+        catch {
+            // A usable stored credential remains the fallback during a hand-off outage.
+        }
+    }
+    if (!localCredentialAvailable && deps.hasCredential) {
         localCredentialAvailable = deps.hasCredential();
     }
-    else {
+    else if (!localCredentialAvailable) {
         (0, cred_envelope_1.consumeEncryptedCredentialReadWhileInactive)();
         localCredentialAvailable = hasLocalCredential();
         if (!localCredentialAvailable && (0, cred_envelope_1.consumeEncryptedCredentialReadWhileInactive)()) {
@@ -195,6 +260,15 @@ async function acquireManagedSession(input = {}, deps = {}) {
             localCredentialAvailable = hasLocalCredential();
         }
     }
+    if (!localCredentialAvailable) {
+        const guestHandoff = await (deps.borrowGuestCredential ?? borrowDedicatedGuestCredential)();
+        if (guestHandoff === true) {
+            localCredentialAvailable = true;
+        }
+        else if (guestHandoff === false) {
+            throw new ManagedAcquisitionError('guest-handoff-unavailable', 'the Dedicated Runtime could not provide its managed skrr session');
+        }
+    }
     if (!localCredentialAvailable) {
         throw new ManagedAcquisitionError('not-signed-in', 'no skrr session on this machine — run `skrr login`');
     }