@skrr-ai/cli 0.1.82 → 0.1.84

package/dist/lib/first-party-harness-broker.js

@@ -75,6 +75,13 @@ const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
 const cred_envelope_1 = require("./cred-envelope");
+const dedicated_guest_1 = require("./dedicated-guest");
+const daemonBroker_1 = require("./daemonBroker");
+const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
+const cli_identity_1 = require("./cli-identity");
+const credential_resolver_1 = require("./credential-resolver");
+const harness_context_1 = require("./harness-context");
+const node_adapter_1 = require("./node-adapter");
 const first_party_harness_1 = require("./first-party-harness");
 const first_party_harness_agent_1 = require("./first-party-harness-agent");
 const first_party_harness_managed_1 = require("./first-party-harness-managed");
@@ -162,6 +169,47 @@ class ManagedAcquisitionError extends Error {
     }
 }
 exports.ManagedAcquisitionError = ManagedAcquisitionError;
+async function borrowDedicatedGuestCredential() {
+    if (!(0, dedicated_guest_1.runningOnDedicatedRuntimeGuest)() ||
+        (0, harness_context_1.isHarnessCliContext)() ||
+        (0, credential_resolver_1.resolveTrustedAutonomousCredential)()) {
+        return null;
+    }
+    // `skrr code run` does not extend BaseCommand, so its local credential check
+    // used to stop before the guest's daemon hand-off could be redeemed. Borrow
+    // only the fixed root-owned guest descriptor. No refresh family or credential
+    // is persisted, and apiFetch can re-redeem this DPoP-bound token on a 401.
+    try {
+        const cfg = (0, config_1.loadConfig)();
+        const outcome = await (0, daemonBroker_1.attemptDaemonBrokerLogin)({
+            cliId: (0, cli_identity_1.planLoginCliId)(cfg).cliId,
+            baseURL: cfg.baseURL,
+            bootstrapPathOverride: daemonBroker_1.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR,
+            preferHandoffMode: 'access_token',
+            borrowOnly: true,
+            timeoutMs: 10_000,
+        });
+        if (!outcome.ok) {
+            const description = (0, daemonBrokerRefusal_1.describeBrokerFailure)(outcome);
+            throw new ManagedAcquisitionError(outcome.code ?? 'guest-handoff-unavailable', description
+                ? `${description.headline} ${description.remedy}`
+                : `the Dedicated Runtime could not provide its managed skrr session (${outcome.reason})`);
+        }
+        if (!outcome.brokered)
+            return false;
+        (0, node_adapter_1.setAdapterCredentialOverride)({
+            token: outcome.accessToken,
+            source: 'env-token',
+            kind: (0, auth_core_1.classifyTokenKind)(outcome.accessToken),
+        });
+        return true;
+    }
+    catch (error) {
+        if (error instanceof ManagedAcquisitionError)
+            throw error;
+        return false;
+    }
+}
 /**
  * Acquire a managed session, or throw a typed `ManagedAcquisitionError`.
  *
@@ -183,11 +231,28 @@ async function acquireManagedSession(input = {}, deps = {}) {
     // Checked locally, BEFORE any network. A fresh machine that has never run
     // `skrr login` must fall back to BYOK without a round trip and without a 401 that
     // would drag `apiFetch`'s refresh machinery in behind it.
-    let localCredentialAvailable;
-    if (deps.hasCredential) {
+    let localCredentialAvailable = false;
+    // Match BaseCommand's narrowly scoped retirement path: a stale guest refresh
+    // family must not prevent the live machine descriptor from lending a token.
+    const brokerBeforeStored = !deps.hasCredential &&
+        !(0, config_1.isEnvAuthOverride)() &&
+        !(0, harness_context_1.isHarnessCliContext)() &&
+        !(0, credential_resolver_1.resolveTrustedAutonomousCredential)() &&
+        (0, daemonBroker_1.shouldBrokerBeforeStoredCredential)();
+    if (brokerBeforeStored) {
+        try {
+            const guestHandoff = await (deps.borrowGuestCredential ?? borrowDedicatedGuestCredential)();
+            if (guestHandoff === true)
+                localCredentialAvailable = true;
+        }
+        catch {
+            // A usable stored credential remains the fallback during a hand-off outage.
+        }
+    }
+    if (!localCredentialAvailable && deps.hasCredential) {
         localCredentialAvailable = deps.hasCredential();
     }
-    else {
+    else if (!localCredentialAvailable) {
         (0, cred_envelope_1.consumeEncryptedCredentialReadWhileInactive)();
         localCredentialAvailable = hasLocalCredential();
         if (!localCredentialAvailable && (0, cred_envelope_1.consumeEncryptedCredentialReadWhileInactive)()) {
@@ -195,6 +260,15 @@ async function acquireManagedSession(input = {}, deps = {}) {
             localCredentialAvailable = hasLocalCredential();
         }
     }
+    if (!localCredentialAvailable) {
+        const guestHandoff = await (deps.borrowGuestCredential ?? borrowDedicatedGuestCredential)();
+        if (guestHandoff === true) {
+            localCredentialAvailable = true;
+        }
+        else if (guestHandoff === false) {
+            throw new ManagedAcquisitionError('guest-handoff-unavailable', 'the Dedicated Runtime could not provide its managed skrr session');
+        }
+    }
     if (!localCredentialAvailable) {
         throw new ManagedAcquisitionError('not-signed-in', 'no skrr session on this machine — run `skrr login`');
     }

package/dist/lib/harness-context.js

@@ -48,8 +48,4 @@ class HarnessCredentialPersistRefused extends Error {
 }
 exports.HarnessCredentialPersistRefused = HarnessCredentialPersistRefused;
 /** The commands a harness-context process may not run (they own the stored session). */
-exports.HARNESS_REFUSED_AUTH_COMMANDS = new Set([
-    'login',
-    'logout',
-    'pair',
-]);
+exports.HARNESS_REFUSED_AUTH_COMMANDS = new Set(['login', 'logout']);

package/dist/lib/store-acquisition.d.ts

@@ -9,3 +9,5 @@ import type { StoreAcquisitionRequest } from '@skrr-ai/data-provider';
  * terminal and the card cannot describe one request two ways.
  */
 export declare function describeAcquisitionRequestLines(request: StoreAcquisitionRequest): string[];
+/** One request as one line, for `skrr store acquisitions list`. */
+export declare function describeAcquisitionRequestRow(request: StoreAcquisitionRequest): string;

package/dist/lib/store-acquisition.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.describeAcquisitionRequestLines = describeAcquisitionRequestLines;
+exports.describeAcquisitionRequestRow = describeAcquisitionRequestRow;
 const data_provider_1 = require("@skrr-ai/data-provider");
 /**
  * A purchase an agent asked to make, as the lines a terminal shows (OSK-12240).
@@ -17,7 +18,7 @@ function describeAcquisitionRequestLines(request) {
     const kind = request.entityType === 'skill' ? 'skill' : 'agent';
     const status = (0, data_provider_1.describeStoreAcquisitionStatus)(request.status);
     const lines = [
-        `${name}${version} (a paid ${kind})`,
+        `${name}${version} (${request.price > 0 ? 'a paid' : 'a free'} ${kind})`,
         `  Status:       ${status.label}${status.detail ? ` — ${status.detail}` : ''}`,
         `  Price:        ${(0, data_provider_1.formatStoreAcquisitionPrice)(request.price)} ${request.currency}`,
         `  Refunds:      ${(0, data_provider_1.describeStoreAcquisitionRefundTerms)(request.refundTerms)}`,
@@ -36,5 +37,21 @@ function describeAcquisitionRequestLines(request) {
     if (request.expiresAt) {
         lines.push(`  Expires:      ${request.expiresAt}`);
     }
+    const hold = (0, data_provider_1.describeStoreAcquisitionHold)(request);
+    if (hold) {
+        lines.push(`  Workspace:    ${hold}`);
+        const storeRequestId = request.policyHold?.storeInstallRequestId;
+        if (storeRequestId &&
+            request.workspaceId &&
+            request.policyHold?.storeInstallRequestStatus !== 'approved') {
+            lines.push(`  Owner step:   skrr store governance requests ${request.workspaceId} --approve ${storeRequestId}`);
+        }
+    }
     return lines;
 }
+/** One request as one line, for `skrr store acquisitions list`. */
+function describeAcquisitionRequestRow(request) {
+    const name = request.listingName || request.entityId;
+    const held = request.holdReason === 'workspace_policy' ? '  [held: workspace policy]' : '';
+    return `${request.id}  ${request.status}  ${(0, data_provider_1.formatStoreAcquisitionPrice)(request.price)}  ${name}${held}`;
+}

package/dist/lib/store-moderation.d.ts

@@ -0,0 +1,95 @@
+/**
+ * `/api/store/moderation/reports` — a Store curator's report queue and its
+ * dispositions (OSK-12597).
+ *
+ * Only the `store_curation` surface (the TRUST role) may use these; the server
+ * refuses everyone else, a system ADMIN with no functional role included. A
+ * curator may not disposition a report on a listing they published, or whose
+ * publisher shares a workspace with them (STORE_CURATION_CONFLICT_OF_INTEREST).
+ *
+ * Every route is written out at its own call site rather than composed from a
+ * builder, like the rest of the Store CLI: the parity checker reads the
+ * LITERAL at the call site.
+ */
+/** The disposition vocabulary, mirroring STORE_REPORT_DISPOSITIONS on the server. */
+export declare const STORE_REPORT_DISPOSITIONS: readonly ["dismiss", "warn", "delist", "ban"];
+export type StoreReportDisposition = (typeof STORE_REPORT_DISPOSITIONS)[number];
+/** What each disposition does, in the words a curator decides by. */
+export declare const STORE_REPORT_DISPOSITION_EFFECTS: Record<StoreReportDisposition, string>;
+/** A ban one curator requested, waiting for a different one to confirm. */
+export type StoreReportBanRequest = {
+    requestId: string;
+    requestedBy: string;
+    requestedAt?: string;
+    /** Withheld (absent) on a listing the reading curator is conflicted on. */
+    note?: string | null;
+};
+/** One open report as a curator reads it. Never the reporter's identity. */
+export type CuratorStoreReport = {
+    reportId: string;
+    agentId: string;
+    reason: string;
+    /** Withheld (null) on a listing the curator is conflicted on. */
+    description: string | null;
+    status: string;
+    moderationAction: string | null;
+    releaseId: string | null;
+    versionLabel: string | null;
+    createdAt?: string;
+    reviewedAt?: string | null;
+    /** A ban waiting for a second curator, or null. */
+    banRequest?: StoreReportBanRequest | null;
+    /** Why this curator may not disposition it, or null. */
+    conflict: string | null;
+};
+export type CuratorStoreReportQueue = {
+    reports: CuratorStoreReport[];
+    total: number;
+    limit: number;
+    skip: number;
+};
+export type StoreReportDispositionResult = {
+    disposition: {
+        reportId: string;
+        agentId: string;
+        action: StoreReportDisposition;
+        replayed: boolean;
+        reportStatus: string;
+        listingState?: string;
+        reportsClosed?: number;
+        publisherNotified: boolean;
+        /** True when a ban was recorded and now waits for a second curator. */
+        pendingConfirmation?: boolean;
+        banRequest?: StoreReportBanRequest | null;
+        requestedBy?: string;
+        confirmedBy?: string;
+    };
+};
+export type StoreReportBanWithdrawalResult = {
+    withdrawal: {
+        reportId: string;
+        agentId: string;
+        withdrawn: boolean;
+        replayed: boolean;
+        withdrawnRequest?: StoreReportBanRequest;
+    };
+};
+/** `GET /moderation/reports` — every report still waiting, oldest first. */
+export declare function listCuratorStoreReports(params?: {
+    agentId?: string;
+    limit?: number;
+    skip?: number;
+}): Promise<CuratorStoreReportQueue>;
+/** `POST /moderation/reports/:reportId/disposition` */
+export declare function dispositionStoreReport(reportId: string, body: {
+    action: StoreReportDisposition;
+    note: string;
+}): Promise<StoreReportDispositionResult>;
+/** `POST /moderation/reports/:reportId/ban-request/confirm` — the second curator. */
+export declare function confirmStoreReportBan(reportId: string, body: {
+    note: string;
+}): Promise<StoreReportDispositionResult>;
+/** `DELETE /moderation/reports/:reportId/ban-request` — withdraw a waiting ban. */
+export declare function withdrawStoreReportBan(reportId: string, body?: {
+    note?: string;
+}): Promise<StoreReportBanWithdrawalResult>;

package/dist/lib/store-moderation.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STORE_REPORT_DISPOSITION_EFFECTS = exports.STORE_REPORT_DISPOSITIONS = void 0;
+exports.listCuratorStoreReports = listCuratorStoreReports;
+exports.dispositionStoreReport = dispositionStoreReport;
+exports.confirmStoreReportBan = confirmStoreReportBan;
+exports.withdrawStoreReportBan = withdrawStoreReportBan;
+const api_fetch_1 = require("./api-fetch");
+const triggers_1 = require("./triggers");
+/**
+ * `/api/store/moderation/reports` — a Store curator's report queue and its
+ * dispositions (OSK-12597).
+ *
+ * Only the `store_curation` surface (the TRUST role) may use these; the server
+ * refuses everyone else, a system ADMIN with no functional role included. A
+ * curator may not disposition a report on a listing they published, or whose
+ * publisher shares a workspace with them (STORE_CURATION_CONFLICT_OF_INTEREST).
+ *
+ * Every route is written out at its own call site rather than composed from a
+ * builder, like the rest of the Store CLI: the parity checker reads the
+ * LITERAL at the call site.
+ */
+/** The disposition vocabulary, mirroring STORE_REPORT_DISPOSITIONS on the server. */
+exports.STORE_REPORT_DISPOSITIONS = ['dismiss', 'warn', 'delist', 'ban'];
+/** What each disposition does, in the words a curator decides by. */
+exports.STORE_REPORT_DISPOSITION_EFFECTS = {
+    dismiss: 'close the report, no action on the listing, publisher not told',
+    warn: 'listing stays up, publisher gets a moderator warning',
+    delist: 'listing suspended until a moderator restores it, publisher told',
+    ban: 'requests a permanent withdrawal; a different curator must confirm it (`store reports confirm-ban`)',
+};
+/** `GET /moderation/reports` — every report still waiting, oldest first. */
+async function listCuratorStoreReports(params = {}) {
+    return (0, api_fetch_1.apiFetch)((0, triggers_1.withQuery)('/api/store/moderation/reports', {
+        agentId: params.agentId,
+        limit: params.limit,
+        skip: params.skip,
+    }));
+}
+/** `POST /moderation/reports/:reportId/disposition` */
+async function dispositionStoreReport(reportId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/store/moderation/reports/${encodeURIComponent(reportId)}/disposition`, { method: 'POST', body });
+}
+/** `POST /moderation/reports/:reportId/ban-request/confirm` — the second curator. */
+async function confirmStoreReportBan(reportId, body) {
+    return (0, api_fetch_1.apiFetch)(`/api/store/moderation/reports/${encodeURIComponent(reportId)}/ban-request/confirm`, { method: 'POST', body });
+}
+/** `DELETE /moderation/reports/:reportId/ban-request` — withdraw a waiting ban. */
+async function withdrawStoreReportBan(reportId, body = {}) {
+    return (0, api_fetch_1.apiFetch)(`/api/store/moderation/reports/${encodeURIComponent(reportId)}/ban-request`, { method: 'DELETE', body });
+}

package/dist/lib/workspaces.d.ts

@@ -61,6 +61,79 @@ export declare function ambientWorkspaceId(env?: NodeJS.ProcessEnv): Promise<str
 export declare function clearAmbientWorkspaceCache(): void;
 /** `listWorkspaces`, keeping the envelope's caller-level fields. */
 export declare function listWorkspaceListing(): Promise<WorkspaceListing>;
+/**
+ * One event of a workspace's third-party (Store) agent audit trail (OSK-12588).
+ * The server builds it from an allow-list; this type is what it sends.
+ */
+export interface WorkspaceAgentAuditEvent {
+    id: string;
+    at: string;
+    kind: string;
+    actor: {
+        kind: 'user' | 'agent' | 'system' | string;
+        userId?: string | null;
+        agentId?: string | null;
+        tool?: string | null;
+        process?: string | null;
+        confirmedBy?: {
+            userId: string | null;
+            at: string | null;
+            acquisitionRequestId: string | null;
+        };
+    };
+    subject: {
+        memberUserId: string | null;
+        fulfillment: string | null;
+        listingId: string | null;
+        listingName: string | null;
+        installedAgentId: string | null;
+        installedAgentName: string | null;
+        teamOrderId: string | null;
+        sourceTeamId: string | null;
+        installedAgentIds: string[] | null;
+    };
+    release: {
+        releaseId: string | null;
+        versionLabel: string | null;
+        releaseNumber: number | null;
+        fromReleaseId: string | null;
+        fromVersionLabel: string | null;
+        direction: 'upgrade' | 'rollback' | 'same' | 'unknown' | null;
+        strategy: string | null;
+        mergeOutcome: string | null;
+    } | null;
+    outcome: Record<string, unknown>;
+    request: {
+        method: string | null;
+        path: string | null;
+        requestId: string | null;
+    };
+    observationScope: unknown;
+}
+export interface WorkspaceAgentAuditPage {
+    workspaceId: string;
+    events: WorkspaceAgentAuditEvent[];
+    hasMore: boolean;
+    nextCursor: string | null;
+    coverage: {
+        source: string;
+        kinds: string[];
+        notRecorded: string[];
+    };
+}
+export interface WorkspaceAgentAuditQuery {
+    kinds?: string[];
+    since?: string;
+    until?: string;
+    limit?: number;
+    cursor?: string;
+}
+/**
+ * `GET /api/workspaces/:workspaceId/audit/agent-lifecycle` — owner/admin only.
+ * The kind vocabulary is the server's; an unknown kind is its 400, not a
+ * second list kept here.
+ */
+export declare function listWorkspaceAgentAudit(workspaceId: string, query?: WorkspaceAgentAuditQuery): Promise<WorkspaceAgentAuditPage>;
 export declare function getWorkspace(workspaceId: string): Promise<WorkspaceRow>;
 /**
  * Resolve what a human typed to a workspace they are actually in.

package/dist/lib/workspaces.js

@@ -5,6 +5,7 @@ exports.listWorkspaces = listWorkspaces;
 exports.ambientWorkspaceId = ambientWorkspaceId;
 exports.clearAmbientWorkspaceCache = clearAmbientWorkspaceCache;
 exports.listWorkspaceListing = listWorkspaceListing;
+exports.listWorkspaceAgentAudit = listWorkspaceAgentAudit;
 exports.getWorkspace = getWorkspace;
 exports.matchWorkspace = matchWorkspace;
 const api_fetch_1 = require("./api-fetch");
@@ -121,6 +122,26 @@ async function listWorkspaceListing() {
     }
     return { rows, defaultWorkspaceId };
 }
+/**
+ * `GET /api/workspaces/:workspaceId/audit/agent-lifecycle` — owner/admin only.
+ * The kind vocabulary is the server's; an unknown kind is its 400, not a
+ * second list kept here.
+ */
+async function listWorkspaceAgentAudit(workspaceId, query = {}) {
+    const params = new URLSearchParams();
+    if (query.kinds?.length)
+        params.set('kind', query.kinds.join(','));
+    if (query.since)
+        params.set('since', query.since);
+    if (query.until)
+        params.set('until', query.until);
+    if (query.limit)
+        params.set('limit', String(query.limit));
+    if (query.cursor)
+        params.set('cursor', query.cursor);
+    const qs = params.toString();
+    return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/audit/agent-lifecycle${qs ? `?${qs}` : ''}`);
+}
 async function getWorkspace(workspaceId) {
     return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}`);
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonPair.js

@@ -43,7 +43,7 @@ exports.generatePairKeyPair = generatePairKeyPair;
  *
  * Lifetime invariant: the ephemeral X25519 secret key NEVER persists. The
  * mobile generates one per pairing, uses it once, and discards. The daemon
- * generates one per `oversky pair` invocation, uses it for the duration
+ * generates one per `skrrd pair` invocation, uses it for the duration
  * of the polling window, and discards on success/failure/abort.
  */
 const tweetnacl_1 = __importDefault(require("tweetnacl"));

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonPair.js

@@ -25,7 +25,7 @@
  *
  * Lifetime invariant: the ephemeral X25519 secret key NEVER persists. The
  * mobile generates one per pairing, uses it once, and discards. The daemon
- * generates one per `oversky pair` invocation, uses it for the duration
+ * generates one per `skrrd pair` invocation, uses it for the duration
  * of the polling window, and discards on success/failure/abort.
  */
 import nacl from 'tweetnacl';