@skrr-ai/cli 0.1.94 → 0.1.95

package/dist/commands/instructions/guide.js

@@ -0,0 +1,84 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const node_crypto_1 = require("node:crypto");
+const base_command_1 = require("../../base-command");
+const managed_instruction_guides_json_1 = __importDefault(require("../../generated/managed-instruction-guides.json"));
+const api_fetch_1 = require("../../lib/api-fetch");
+const auth_core_init_1 = require("../../lib/auth-core-init");
+const credential_resolver_1 = require("../../lib/credential-resolver");
+const harness_context_1 = require("../../lib/harness-context");
+const keychain_1 = require("../../lib/keychain");
+// Documentation stays available when a daemon-issued Agent credential is
+// unavailable. Do not run BaseCommand's mandatory credential initialization.
+class InstructionsGuide extends core_1.Command {
+    static baseFlags = base_command_1.BaseCommand.baseFlags;
+    static description = 'Read the detailed task-management guide on demand';
+    static args = {
+        name: core_1.Args.string({
+            description: 'Guide to read',
+            options: ['task-management'],
+            default: 'task-management',
+            ignoreStdin: true,
+        }),
+    };
+    static flags = {
+        json: core_1.Flags.boolean({ description: 'Output the guide and source provenance as JSON' }),
+        offline: core_1.Flags.boolean({
+            description: 'Read the bundled release guide without checking credentials or the server',
+        }),
+    };
+    static examples = [
+        '<%= config.bin %> instructions guide task-management',
+        '<%= config.bin %> instructions guide --json',
+    ];
+    async run() {
+        const { flags } = await this.parse(InstructionsGuide);
+        let guide = managed_instruction_guides_json_1.default['oversky-task-management'];
+        let source = 'bundled';
+        let reason = flags.offline ? 'offline-requested' : 'no-session';
+        if (!flags.offline) {
+            try {
+                (0, keychain_1.setActiveProfile)(flags.profile ?? process.env.OVERSKY_PROFILE ?? '');
+                const autonomous = (0, credential_resolver_1.resolveTrustedAutonomousCredential)();
+                if (!autonomous && !flags.bare && !(0, harness_context_1.isHarnessCliContext)())
+                    await (0, auth_core_init_1.prefetchCliAuth)();
+                const credential = autonomous ??
+                    (await (0, credential_resolver_1.resolveCredential)({
+                        flagToken: flags.token,
+                        bareMode: flags.bare,
+                        allowUnreadableStoredCredential: true,
+                    }));
+                if (credential.token) {
+                    reason = 'server-unavailable';
+                    const response = await (0, api_fetch_1.apiFetch)('/api/instructions/presets/oversky-task-management/guide', { credential, signal: AbortSignal.timeout(3_000) });
+                    if ((0, node_crypto_1.createHash)('sha256').update(response.body).digest('hex') !== response.hash) {
+                        throw new Error('The server guide hash does not match its body.');
+                    }
+                    guide = response;
+                    source = 'server';
+                    reason = undefined;
+                }
+            }
+            catch {
+                // A missing/unreadable auth envelope or delegated daemon cannot make
+                // a read-only local guide unavailable, and must never emit auth JSON.
+                reason ??= 'server-unavailable';
+            }
+        }
+        if (flags.json)
+            this.log(JSON.stringify({
+                ...guide,
+                provenance: { source, fallback: source === 'bundled', ...(reason ? { reason } : {}) },
+            }, null, 2));
+        else {
+            if (source === 'bundled')
+                this.logToStderr(`Using the CLI’s bundled task-management guide (template v${guide.templateVersion}).`);
+            this.log(guide.body);
+        }
+    }
+}
+exports.default = InstructionsGuide;

package/dist/commands/instructions/install.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.conflictingTargetOf = conflictingTargetOf;
 exports.describeTargetConflict = describeTargetConflict;
 const core_1 = require("@oclif/core");
+const node_crypto_1 = require("node:crypto");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -107,41 +108,67 @@ class InstructionsInstall extends base_command_1.BaseCommand {
                 exit: 2,
             });
         }
-        let previewBody;
+        const daemonId = await this.resolveDaemon(flags.daemon);
+        const inputs = providers.map((provider) => ({
+            daemonId,
+            bundleId: flags.bundle,
+            provider,
+            scope,
+            mode: flags.mode,
+            projectPath: flags.project,
+            trackingMode: flags.pin ? 'pinned' : 'latest',
+            pinnedVersionId: flags.pin,
+            label: flags.label,
+        }));
+        // Inspect the selected machine before any consent or target write. This is
+        // also required for --yes: unattended consent does not waive readability.
+        let preparedTargets;
         try {
-            const bundle = (await data_provider_1.dataService.getManagedInstructionBundle(flags.bundle)).bundle;
-            if (flags.pin) {
-                const versions = await data_provider_1.dataService.listManagedInstructionVersions(flags.bundle, true);
-                const pinned = versions.versions.find((version) => version.id === flags.pin);
-                if (!pinned || pinned.archivedAt) {
-                    this.error('The requested pinned version is missing or archived', { exit: 2 });
-                }
-                previewBody = pinned.body;
-            }
-            else {
-                if (!bundle.currentVersion)
-                    this.error('The prompt has no current version', { exit: 2 });
-                previewBody = bundle.currentVersion.body;
-            }
+            preparedTargets = await Promise.all(inputs.map((input) => data_provider_1.dataService.prepareManagedInstructionTarget(input)));
         }
         catch (error) {
             this.handleApiError(error);
         }
-        if (providers.includes('codex') && Buffer.byteLength(previewBody, 'utf8') > 30 * 1024) {
-            this.error('Codex managed instruction bodies are limited to 30 KiB; no targets were created', { exit: 2 });
+        for (let index = 0; index < preparedTargets.length; index += 1) {
+            const entry = preparedTargets[index];
+            const provider = providers[index];
+            const placement = entry.providers.find((candidate) => candidate.provider === provider);
+            const preview = entry.previews.find((candidate) => candidate.provider === provider);
+            if (entry.daemonId !== daemonId || entry.readiness !== 'ready') {
+                this.error(entry.message ||
+                    'The selected daemon cannot inspect its instruction files. Update or reconnect it and retry; no targets were created.', { exit: 1 });
+            }
+            if (!placement?.canInstall ||
+                !placement.instructionPath ||
+                placement.loadingStatus === 'shadowed') {
+                this.error(`${(0, harness_provider_input_1.canonicalHarnessInput)(provider)} cannot use this placement: ${placement?.issues.map((issue) => issue.message).join(' ') || placement?.loadingStatus || 'preflight unavailable'}. No targets were created.`, { exit: 1 });
+            }
+            if (!preview || (0, node_crypto_1.createHash)('sha256').update(preview.body).digest('hex') !== preview.hash) {
+                this.error('The instruction preview could not be verified; no targets were created.', {
+                    exit: 1,
+                });
+            }
+            if (!flags.json) {
+                this.log(`${(0, harness_provider_input_1.canonicalHarnessInput)(provider)} on ${daemonId}: ${placement.instructionPath} (${placement.loadingStatus})`);
+                for (const issue of placement.issues)
+                    this.log(`  ${issue.severity}: ${issue.message}`);
+            }
         }
         // The body is shown so the confirmation below is informed. With `--yes`
         // there is no confirmation to inform, and printing a ~9 KB body anyway put
         // the command's actual outcome — often a refusal — a screen of scrollback
         // away (OSK-4631). Say what was authorized, and where to read it.
         if (!flags.json && !flags.yes) {
-            this.log('Exact managed instruction body:');
-            this.log('---');
-            this.log(previewBody);
-            this.log('---');
+            for (let index = 0; index < providers.length; index += 1) {
+                const preview = preparedTargets[index].previews.find((entry) => entry.provider === providers[index]);
+                this.log(`Exact ${(0, harness_provider_input_1.canonicalHarnessInput)(providers[index])} managed instruction body (SHA-256 ${preview.hash}):`);
+                this.log('---');
+                this.log(preview.body);
+                this.log('---');
+            }
         }
         else if (!flags.json) {
-            this.log(`Authorizing ${Buffer.byteLength(previewBody, 'utf8').toLocaleString()} bytes of instruction ` +
+            this.log(`Authorizing ${Buffer.byteLength(preparedTargets[0].version.body, 'utf8').toLocaleString()} bytes of instruction ` +
                 `${flags.bundle}; \`${this.config.bin} instructions show ${flags.bundle}\` prints them.`);
         }
         const teamWarning = scope === 'project' && flags.mode === 'team'
@@ -150,20 +177,17 @@ class InstructionsInstall extends base_command_1.BaseCommand {
         const confirmed = await (0, prompt_1.confirmDestructive)(`Authorize continuous ${providers.join(', ')} reconciliation on this target?${teamWarning}`, flags.yes);
         if (!confirmed)
             return this.log('Aborted.');
-        const daemonId = await this.resolveDaemon(flags.daemon);
         const results = [];
-        for (const provider of providers) {
+        for (let index = 0; index < providers.length; index += 1) {
+            const provider = providers[index];
+            const entry = preparedTargets[index];
             try {
                 results.push(await data_provider_1.dataService.createManagedInstructionTarget({
-                    daemonId,
-                    bundleId: flags.bundle,
-                    provider,
-                    scope,
-                    mode: flags.mode,
-                    projectPath: flags.project,
-                    trackingMode: flags.pin ? 'pinned' : 'latest',
-                    pinnedVersionId: flags.pin,
-                    label: flags.label,
+                    ...inputs[index],
+                    expectedHash: entry.version.hash,
+                    expectedVersionId: entry.version.id,
+                    expectedRenderedHash: entry.previews.find((preview) => preview.provider === provider)
+                        .hash,
                 }));
             }
             catch (error) {

package/dist/commands/instructions/setup.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../base-command';
+export default class InstructionsSetup extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        daemon: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        provider: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'update-policy': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        yes: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        review: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/instructions/setup.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const auth_core_1 = require("@skrr-ai/auth-core");
+const base_command_1 = require("../../base-command");
+const harness_provider_input_1 = require("../../lib/harness-provider-input");
+const managed_instruction_setup_1 = require("../../lib/managed-instruction-setup");
+class InstructionsSetup extends base_command_1.BaseCommand {
+    static description = 'Review and install removable global instructions for coding agents on this machine.\n\n' +
+        'Verifies the local daemon’s account, server and profile, then asks that daemon to check ' +
+        'its real instruction files. Choose providers separately and choose automatic updates or ' +
+        'a fixed current version. Existing installation decisions are preserved. Pass --daemon ' +
+        'to explicitly choose another connected machine. No files are written by the CLI.';
+    static examples = [
+        '<%= config.bin %> instructions setup',
+        '<%= config.bin %> instructions setup --provider codex --review',
+        '<%= config.bin %> instructions setup --provider claude --update-policy pinned --yes --json',
+        '<%= config.bin %> instructions setup --daemon <id> --provider codex --update-policy latest --yes',
+    ];
+    static flags = {
+        daemon: core_1.Flags.string({
+            description: 'Explicit connected daemon ID; defaults only to a verified daemon on this computer',
+        }),
+        provider: core_1.Flags.string({
+            description: 'Provider to set up or revisit (repeatable); otherwise offers newly detected providers',
+            options: (0, harness_provider_input_1.harnessFlagOptions)(['claude', 'codex', auth_core_1.FIRST_PARTY_HARNESS.provider]),
+            multiple: true,
+        }),
+        'update-policy': core_1.Flags.string({
+            description: 'Track automatic updates, or pin today’s reviewed version',
+            options: ['latest', 'pinned'],
+        }),
+        yes: core_1.Flags.boolean({
+            char: 'y',
+            description: 'Authorize selected providers and update policy without prompting; requires --provider and --update-policy',
+        }),
+        review: core_1.Flags.boolean({
+            description: 'Show exact previews and daemon preflight without installing or changing decisions',
+        }),
+        json: core_1.Flags.boolean({ description: 'Output one JSON result; requires --review or --yes' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(InstructionsSetup);
+        if (flags.json && !flags.review && !flags.yes)
+            this.error('--json requires --review or --yes', { exit: 2 });
+        if (flags.review && flags.yes)
+            this.error('--review cannot be combined with --yes', { exit: 2 });
+        try {
+            const result = await (0, managed_instruction_setup_1.runManagedInstructionSetup)({
+                trigger: 'manual',
+                log: flags.json ? () => { } : (message) => this.log(message),
+                daemonId: flags.daemon,
+                providers: flags.provider
+                    ? (0, harness_provider_input_1.canonicalHarnessInputs)(flags.provider)
+                    : undefined,
+                trackingMode: flags['update-policy'],
+                yes: flags.yes,
+                review: flags.review,
+                json: flags.json,
+            });
+            if (flags.json)
+                this.log(JSON.stringify(result, null, 2));
+            if (result.status === 'unavailable')
+                this.exit(1);
+        }
+        catch (error) {
+            this.handleApiError(error);
+        }
+    }
+}
+exports.default = InstructionsSetup;

package/dist/commands/integrations/execute.js

@@ -33,7 +33,7 @@ class IntegrationsExecute extends base_command_1.BaseCommand {
             description: 'Agent ID (falls back to OVERSKY_AGENT_ID, then primary agent)',
         }),
         'request-id': core_1.Flags.string({
-            description: 'Idempotency key — reuse to safely retry side-effecting tools (auto-generated if omitted)',
+            description: 'Reuse only for the same tool, arguments and connection. A pending or unknown outcome requires reconciliation before another write (auto-generated if omitted)',
         }),
         json: core_1.Flags.boolean({
             description: 'Output full response as JSON (recommended for daemon use)',

package/dist/commands/login.d.ts

@@ -12,14 +12,13 @@ import { BaseCommand } from '../base-command';
  * Refresh, rotation, family revoke, and the cross-process auth.lock are
  * all the same substrate the daemon uses (@skrr-ai/auth-core).
  *
- * CI. There is no long-lived token that `skrr` commands accept yet (OSK-13208).
- * `skrr create-token` mints an `osk_ci_*` token, and that token only
- * bootstraps a DAEMON (`OVERSKY_TOKEN=osk_ci_... skrrd start`): every `skrr`
- * command rejects it with 401 (see create-token.ts and base-command.ts). What
- * works today is a session minted for the machine with
+ * CI. `skrr tokens create` mints an expiring, revocable personal access token
+ * (`osk_pat_*`) for SKRR_TOKEN. It does not rotate and is distinct from a
+ * per-machine SESSION minted with
  * `skrr token mint --for <id>`, restored by the `OVERSKY_REFRESH_TOKEN` path
  * below — whose refresh token rotates on use — or `OVERSKY_AUTH_HELPER`.
- * docs/cli/SKRR_AUTH.md ("CI today") states the caveats.
+ * docs/cli/SKRR_AUTH.md states credential precedence and revocation scopes.
+ * Legacy `skrr create-token` credentials only bootstrap a daemon.
  *
  * L13 — non-interactive restore from a refresh token. When
  * `OVERSKY_REFRESH_TOKEN` is set in the environment, the browser /

package/dist/commands/login.js

@@ -6,9 +6,11 @@ const auth_core_1 = require("@skrr-ai/auth-core");
 const base_command_1 = require("../base-command");
 const daemonHandoff_1 = require("../lib/daemonHandoff");
 const daemon_setup_1 = require("../lib/daemon-setup");
+const managed_instruction_setup_1 = require("../lib/managed-instruction-setup");
 const config_1 = require("../lib/config");
 const cli_id_1 = require("../lib/cli-id");
 const keychain_1 = require("../lib/keychain");
+const profile_machine_identity_guard_1 = require("../lib/profile-machine-identity-guard");
 const login_1 = require("../lib/login");
 const device_code_1 = require("../lib/device-code");
 const api_fetch_1 = require("../lib/api-fetch");
@@ -29,14 +31,13 @@ const prompt_1 = require("../lib/prompt");
  * Refresh, rotation, family revoke, and the cross-process auth.lock are
  * all the same substrate the daemon uses (@skrr-ai/auth-core).
  *
- * CI. There is no long-lived token that `skrr` commands accept yet (OSK-13208).
- * `skrr create-token` mints an `osk_ci_*` token, and that token only
- * bootstraps a DAEMON (`OVERSKY_TOKEN=osk_ci_... skrrd start`): every `skrr`
- * command rejects it with 401 (see create-token.ts and base-command.ts). What
- * works today is a session minted for the machine with
+ * CI. `skrr tokens create` mints an expiring, revocable personal access token
+ * (`osk_pat_*`) for SKRR_TOKEN. It does not rotate and is distinct from a
+ * per-machine SESSION minted with
  * `skrr token mint --for <id>`, restored by the `OVERSKY_REFRESH_TOKEN` path
  * below — whose refresh token rotates on use — or `OVERSKY_AUTH_HELPER`.
- * docs/cli/SKRR_AUTH.md ("CI today") states the caveats.
+ * docs/cli/SKRR_AUTH.md states credential precedence and revocation scopes.
+ * Legacy `skrr create-token` credentials only bootstrap a daemon.
  *
  * L13 — non-interactive restore from a refresh token. When
  * `OVERSKY_REFRESH_TOKEN` is set in the environment, the browser /
@@ -60,15 +61,18 @@ class Login extends base_command_1.BaseCommand {
         'If the background service answers but refuses, skrr says why before moving on.\n\n' +
         'What it stores: a refresh session in this profile’s credential store (the macOS Keychain, ' +
         'or ~/.skrr/cli-auth.json elsewhere) that keeps renewing itself. Plain skrr commands on a ' +
-        'computer whose background service is signed in need no login at all: they borrow a ' +
-        'short-lived token from it for each run and store nothing (an older background service ' +
-        'mints them a stored session instead). On a Dedicated Runtime, where the service only ' +
+        'computer whose background service is signed in can adopt a durable CLI session automatically ' +
+        'unless this profile was explicitly signed out. On a Dedicated Runtime, where the service only ' +
         'lends short-lived tokens, nothing is stored.\n\n' +
         'Set OVERSKY_SKIP_DAEMON_BROKER=1 to skip step 1 (--device-code skips it too). After signing ' +
         'in, skrr also signs the background service in, and on an interactive first login on a ' +
         'computer without it, offers to install it. Set SKRR_SKIP_DAEMON_HANDOFF=1 to skip that ' +
-        'optional setup; it does not skip step 1.\n\n' +
-        'With no person to approve a sign-in (CI, a provisioning script): mint a session for that ' +
+        'optional setup; it does not skip step 1. On interactive sign-in, skrr checks managed ' +
+        'instruction setup for coding agents on the verified local daemon. You choose each ' +
+        'provider and its update policy; run `skrr instructions setup` to revisit this later. ' +
+        'Set OVERSKY_DISABLE_INSTRUCTION_OFFER=1 to skip these prompts.\n\n' +
+        'For CI, create an expiring personal access token with `skrr tokens create` and supply it as ' +
+        'SKRR_TOKEN in the secret store; no login is needed. For a persistent machine, mint a session for that ' +
         'machine with `skrr token mint --for <id>` and run this command there with ' +
         'OVERSKY_REFRESH_TOKEN and OVERSKY_CLI_ID set. The refresh token rotates when used, so one ' +
         'minted session serves one machine. Tokens from `skrr create-token` only bring up a ' +
@@ -116,6 +120,11 @@ class Login extends base_command_1.BaseCommand {
     };
     async run() {
         const { flags } = await this.parse(Login);
+        if ((0, profile_machine_identity_guard_1.legacyProfileSharesDefaultMachine)()) {
+            this.error(`Profile '${(0, keychain_1.getActiveProfile)()}' was created before profiles had separate machine identities. ` +
+                "Signing in could replace the default machine's device-key pin. " +
+                'Create a new profile name and sign in there; the existing profile was not changed.', { exit: 78 });
+        }
         if (flags['base-url'] && flags.server && flags['base-url'] !== flags.server) {
             this.error('--base-url and --server were both provided with different values.', { exit: 2 });
         }
@@ -289,6 +298,13 @@ class Login extends base_command_1.BaseCommand {
                     this.log(`The local daemon was not signed in (${handoff.detail}). ` +
                         `Run \`${this.config.bin} daemon login\` to finish.`);
                 }
+                // Authentication above is complete. The common onboarding helper verifies
+                // the daemon's live account/server/profile and handles failures nonfatally.
+                await (0, managed_instruction_setup_1.maybeOfferManagedInstructionSetup)({
+                    trigger: 'login',
+                    log: (line) => this.log(line),
+                    waitForLocalReady: handoff.status === 'delivered',
+                });
             }
             catch (err) {
                 // Ctrl-C while waiting for device-code approval: a person's decision,

package/dist/commands/logout.js

@@ -68,13 +68,13 @@ function shouldSkipLocalLogout(input) {
  * laptop scenario where the user wants every persistent daemon credential
  * gone immediately, regardless of which machine they're calling from.
  *
- * Architectural note: the L7 server-side has a bulk endpoint
- * (`POST /api/auth/sessions/revoke-all`) but it requires a user-scope JWT.
- * CLI sessions are minted with `scope: 'cli'` (interactive single-machine
- * use), so they cannot directly hit the bulk endpoint — that's by design,
- * preventing a leaked CLI credential from kicking the user out of every
- * other device. We instead iterate `DELETE /api/daemon-resources/:id`
- * which CLI scope CAN hit (per-resource ownership check, not scope check).
+ * This implementation iterates `DELETE /api/daemon-resources/:id` rather
+ * than the broader `POST /api/auth/sessions/revoke-all` endpoint. Its actual
+ * scope is registered daemons plus this CLI family; independent browser/CLI
+ * refresh families and PATs are not swept. The auth endpoint's current
+ * HUMAN_SCOPES includes CLI, so the historical explanation that CLI scope
+ * cannot call it is obsolete. Preserve the disclosed narrower behavior until
+ * a separately reviewed authority/UX migration changes it.
  * N round trips for N daemons; for typical fleet sizes (< 20) this is
  * sub-second. Each per-daemon DELETE produces its own audit row keyed by
  * `'user_initiated_per_device'`, which preserves forensic granularity.

package/dist/commands/security/overview.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../base-command';
+/** A single read of the three owner-only Security Center surfaces. */
+export default class SecurityOverview extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        limit: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}

package/dist/commands/security/overview.js

@@ -0,0 +1,158 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_command_1 = require("../../base-command");
+const api_fetch_1 = require("../../lib/api-fetch");
+function rows(value, name) {
+    if (!Array.isArray(value))
+        throw new Error(`Security overview: invalid ${name} response`);
+    if (value.some((row) => row === null || typeof row !== 'object' || Array.isArray(row))) {
+        throw new Error(`Security overview: invalid ${name} row`);
+    }
+    return value;
+}
+function hasMore(value, name) {
+    if (typeof value !== 'boolean') {
+        throw new Error(`Security overview: invalid ${name} pagination`);
+    }
+    return value;
+}
+function activeTokens(value) {
+    const tokens = rows(value, 'access tokens');
+    // A missing or unfamiliar state must not turn an active credential into a
+    // reassuring "None". Validate the whole list before filtering it.
+    if (tokens.some((row) => typeof row.state !== 'string' || !['active', 'expired', 'revoked'].includes(row.state))) {
+        throw new Error('Security overview: invalid access token state');
+    }
+    return tokens.filter((row) => row.state === 'active');
+}
+function string(value) {
+    return typeof value === 'string' ? value : null;
+}
+/** Explicit allow-lists: the sessions API also returns a full IP address. */
+function safeSession(row) {
+    return {
+        id: string(row.id) ?? '',
+        kind: string(row.kind) ?? 'unknown',
+        device: string(row.device) ?? 'Unknown device',
+        label: string(row.label),
+        daemonId: string(row.daemonId),
+        network: string(row.network),
+        country: string(row.country),
+        createdAt: string(row.createdAt),
+        lastActiveAt: string(row.lastActiveAt),
+        current: row.current === true,
+    };
+}
+function safeActivity(row) {
+    const device = row.device && typeof row.device === 'object' && !Array.isArray(row.device)
+        ? row.device
+        : {};
+    const session = row.session && typeof row.session === 'object' && !Array.isArray(row.session)
+        ? row.session
+        : {};
+    return {
+        id: string(row.id) ?? '',
+        action: string(row.action) ?? 'unknown',
+        outcome: string(row.outcome) ?? 'unknown',
+        method: string(row.method),
+        device: string(device.label),
+        network: string(row.network),
+        country: string(row.country),
+        newDevice: row.newDevice === true,
+        reportedNotMe: row.reportedNotMe === true,
+        createdAt: string(row.createdAt) ?? '',
+        sessionId: string(session.id),
+    };
+}
+function safeToken(row) {
+    return {
+        id: string(row.id) ?? '',
+        name: string(row.name) ?? '',
+        lastFour: string(row.lastFour) ?? '',
+        scopes: Array.isArray(row.scopes)
+            ? row.scopes.filter((v) => typeof v === 'string')
+            : [],
+        expiresAt: string(row.expiresAt),
+        lastUsedAt: string(row.lastUsedAt),
+    };
+}
+/** A single read of the three owner-only Security Center surfaces. */
+class SecurityOverview extends base_command_1.BaseCommand {
+    static description = 'Review active sessions, recent security activity, and access tokens';
+    static examples = [
+        '<%= config.bin %> security overview',
+        '<%= config.bin %> security overview --limit 50 --json',
+    ];
+    static flags = {
+        limit: core_1.Flags.integer({
+            description: 'Sessions and events to show (default 25, maximum 100)',
+            min: 1,
+            max: 100,
+        }),
+        json: core_1.Flags.boolean({ description: 'Output JSON' }),
+    };
+    async run() {
+        this.requireAuth();
+        const { flags } = await this.parse(SecurityOverview);
+        const limit = flags.limit ?? 25;
+        let sessionPage;
+        let activityPage;
+        let tokenPage;
+        try {
+            // All three reads must succeed. A partial response could claim an
+            // account has no sessions or tokens when a Security Center read failed.
+            [sessionPage, activityPage, tokenPage] = await Promise.all([
+                (0, api_fetch_1.apiFetch)(`/api/auth/sessions/refresh?limit=${limit}`, {
+                    credential: this.resolvedCredential,
+                }),
+                (0, api_fetch_1.apiFetch)(`/api/user/security-activity?limit=${limit}`, {
+                    credential: this.resolvedCredential,
+                }),
+                (0, api_fetch_1.apiFetch)('/api/user/access-tokens', {
+                    credential: this.resolvedCredential,
+                }),
+            ]);
+            const sessions = rows(sessionPage?.sessions, 'sessions').map(safeSession);
+            const activity = rows(activityPage?.events, 'activity').map(safeActivity);
+            const accessTokens = activeTokens(tokenPage?.accessTokens).map(safeToken);
+            const overview = {
+                sessions,
+                sessionsHaveMore: hasMore(sessionPage?.hasMore, 'sessions'),
+                activity,
+                activityHasMore: hasMore(activityPage?.hasMore, 'activity'),
+                accessTokens,
+            };
+            if (flags.json) {
+                this.log(JSON.stringify(overview, null, 2));
+                return;
+            }
+            this.log(`Active sessions (${sessions.length}${overview.sessionsHaveMore ? '+' : ''}):`);
+            for (const s of sessions) {
+                this.log(`  ${s.id}  ${s.current ? '[this session] ' : ''}${s.label || s.device}  ${s.kind}  ${s.country || s.network || 'unknown location'}  last active ${s.lastActiveAt || 'unknown'}`);
+            }
+            if (!sessions.length)
+                this.log('  None.');
+            this.log(`Recent security activity (${activity.length}${overview.activityHasMore ? '+' : ''}):`);
+            for (const event of activity) {
+                this.log(`  ${event.createdAt}  ${event.action} (${event.outcome})  ${event.device || 'unknown device'}  ${event.country || event.network || 'unknown location'}${event.newDevice ? '  NEW DEVICE' : ''}${event.reportedNotMe ? '  REPORTED' : ''}  ${event.id}`);
+            }
+            if (!activity.length)
+                this.log('  None.');
+            this.log(`Active access tokens (${accessTokens.length}):`);
+            for (const token of accessTokens) {
+                this.log(`  ${token.id}  ${token.name}  …${token.lastFour}  expires ${token.expiresAt || 'unknown'}`);
+            }
+            if (!accessTokens.length)
+                this.log('  None.');
+            if (overview.sessionsHaveMore || overview.activityHasMore) {
+                this.log('More sessions or events are available in Account settings; increase --limit to see up to 100 here.');
+            }
+            this.log('To review an unfamiliar sign-in and secure your account, open Account settings > Security activity.');
+        }
+        catch (err) {
+            this.handleApiError(err);
+        }
+    }
+}
+exports.default = SecurityOverview;

package/dist/commands/spaces/claim.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base-command';
+export default class SpacesClaim extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        json: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}