pyyol 1.7.0 → 1.8.0

package/dist/cli.js

@@ -14,7 +14,7 @@ import * as config from "./config.js";
 import * as creds from "./credentials.js";
 import { enableGateway } from "./instrument.js";
 import { maybeInstallPing } from "./install-ping.js";
-import { deriveConnectUrl, runLoginFlow } from "./login.js";
+import { deriveConnectUrl, deviceLabel, runLoginFlow } from "./login.js";
 import * as mode from "./mode.js";
 import { RuntimeConnector } from "./runtime.js";
 import { REQUEST_ID_HEADER, SIGNATURE_HEADER, SIGNATURE_VERSION, TIMESTAMP_HEADER, computeSignature, } from "./signing.js";
@@ -239,7 +239,12 @@ async function loginAndSave(api, dashboard, connect, provider) {
     if (connect)
         c.connectUrl = connect;
     if (!c.apiKey && c.agentId && c.accessToken) {
-        const [st, resp] = await apiPost(`${api}/v1/agent/keys`, c.accessToken, { agent_id: c.agentId });
+        // Label the key after this machine so re-issuing replaces THIS device's key and
+        // leaves other machines and deployments connected (see backend migration 0071).
+        const [st, resp] = await apiPost(`${api}/v1/agent/keys`, c.accessToken, {
+            agent_id: c.agentId,
+            label: deviceLabel(),
+        });
         if (st === 201 && resp.api_key)
             c.apiKey = resp.api_key;
     }
@@ -303,7 +308,12 @@ async function cmdLogin(a) {
         // Best-effort: if it fails we still store the session and fall back to the
         // short-lived JWT + refresh for the connection.
         if (!c.apiKey && c.agentId && c.accessToken) {
-            const [st, resp] = await apiPost(`${api}/v1/agent/keys`, c.accessToken, { agent_id: c.agentId });
+            // Label the key after this machine so re-issuing replaces THIS device's key and
+            // leaves other machines and deployments connected (see backend migration 0071).
+            const [st, resp] = await apiPost(`${api}/v1/agent/keys`, c.accessToken, {
+                agent_id: c.agentId,
+                label: deviceLabel(),
+            });
             if (st === 201 && resp.api_key)
                 c.apiKey = resp.api_key;
             else
@@ -772,9 +782,22 @@ async function cmdProfile(a) {
     const dev = p.developer ?? {};
     const pidx = p.p_index ?? {};
     const stats = p.stats ?? {};
-    console.log(`@${dev.username ?? dev.developer ?? "?"}`);
+    // The NAME, then the handle. This printed only "@handle", so `pyyol profile` could not
+    // tell you who a developer was — the one thing a profile command is for. The name is
+    // omitted when it is unset rather than substituting the public id, which is not a name.
+    const name = (dev.display_name ?? "").trim();
+    const handleLine = `@${dev.username ?? dev.developer ?? "?"}`;
+    console.log(name ? `${name}  ${handleLine}` : handleLine);
+    // The bio. It has been storable since the profile editor shipped and was readable
+    // nowhere: the column lived on `agents` and nothing selected it back, so a developer
+    // wrote a description of how their agent plays and it appeared on no surface at all.
+    const bio = (dev.bio ?? "").trim();
+    if (bio)
+        console.log(`  ${bio}`);
     if (pidx.p_index !== undefined)
         console.log(`  P-Index   ${pidx.p_index}  (rank #${pidx.global_rank}, top ${pidx.percentile}%)`);
+    else
+        console.log("  P-Index   unranked — no ranked matches yet");
     console.log(`  Record    ${stats.wins ?? 0}W-${stats.losses ?? 0}L-${stats.draws ?? 0}D over ${stats.total_matches ?? 0} matches`);
     if (stats.favorite_arena)
         console.log(`  Favorite  ${stats.favorite_arena}`);

package/dist/login.d.ts

@@ -1,4 +1,14 @@
 import type { Credentials } from "./credentials.js";
+/**
+ * A stable name for THIS machine, used to label the agent key issued to it.
+ *
+ * Must be stable across logins on one machine (otherwise each login adds a key
+ * instead of replacing the one it supersedes) and distinct between machines
+ * (otherwise a laptop login revokes a server's key). The hostname is both; a random
+ * id breaks the first property, a constant breaks the second. `.local` is stripped so
+ * the label reads as the machine's name rather than its mDNS form.
+ */
+export declare function deviceLabel(): string;
 /** Derive the WSS connect URL from a platform API/base URL. */
 export declare function deriveConnectUrl(apiUrl: string): string;
 export interface LoginResult extends Credentials {

package/dist/login.js

@@ -7,12 +7,32 @@
 import { spawn } from "node:child_process";
 import { randomBytes, timingSafeEqual } from "node:crypto";
 import { createServer } from "node:http";
+import { hostname } from "node:os";
 /** Constant-time string compare (length-guarded so timingSafeEqual never throws). */
 function safeEqual(a, b) {
     const ab = Buffer.from(a);
     const bb = Buffer.from(b);
     return ab.length === bb.length && timingSafeEqual(ab, bb);
 }
+/**
+ * A stable name for THIS machine, used to label the agent key issued to it.
+ *
+ * Must be stable across logins on one machine (otherwise each login adds a key
+ * instead of replacing the one it supersedes) and distinct between machines
+ * (otherwise a laptop login revokes a server's key). The hostname is both; a random
+ * id breaks the first property, a constant breaks the second. `.local` is stripped so
+ * the label reads as the machine's name rather than its mDNS form.
+ */
+export function deviceLabel() {
+    let name = "";
+    try {
+        name = hostname();
+    }
+    catch {
+        name = "";
+    }
+    return name.trim().replace(/\.local$/i, "") || "pyyol cli";
+}
 /** Derive the WSS connect URL from a platform API/base URL. */
 export function deriveConnectUrl(apiUrl) {
     if (!apiUrl)
@@ -100,6 +120,11 @@ export function runLoginFlow(opts) {
                 `?callback=${encodeURIComponent(callback)}&state=${state}`;
             if (opts.provider)
                 authUrl += `&provider=${encodeURIComponent(opts.provider)}`;
+            // Name the key after this machine. Agent keys are one-per-label and issuing
+            // replaces only the matching label (backend migration 0071), so a stable
+            // per-machine name is what keeps this login from revoking another machine's or
+            // a deployment's key — and it is what the owner reads in the dashboard list.
+            authUrl += `&label=${encodeURIComponent(deviceLabel())}`;
             // Print the URL, then try to open it. Browser launching silently fails over
             // SSH, in WSL, and in containers, and without the link on screen the user just
             // watches a dead prompt until the timeout. Matches the Python SDK, and every

package/dist/runtime.js

@@ -314,8 +314,18 @@ export class RuntimeConnector {
                 break;
             case ERROR:
                 if (!this.registered) {
-                    // Register rejected — almost always an expired access token. If we hold a
-                    // refresh token, spend it and reconnect; only terminal when refresh fails.
+                    // A revoked agent key must NOT be refreshed around. Refreshing swaps the
+                    // long-lived sk_arena_… key for a short-lived dashboard JWT, which registers
+                    // fine — so the agent keeps playing, the dead key stays in the credential
+                    // store, and every restart silently repeats a failed register forever.
+                    // Terminal, carrying the server's sentence, is the honest outcome. (Mirrors
+                    // the Python SDK; the gateway sends this code from AuthFailureReason.)
+                    if (frame.error === "key_revoked") {
+                        throw new ConnectorError(`${frame.reason ?? "this agent key was revoked"} ` +
+                            "(the stored key is dead — re-running `pyyol login` replaces it)");
+                    }
+                    // Otherwise: almost always an expired access token. If we hold a refresh
+                    // token, spend it and reconnect; only terminal when refresh fails.
                     if (await this.tryRefresh())
                         throw new RefreshRetry();
                     throw new ConnectorError(`register rejected: ${frame.error} (${frame.reason ?? ""})`);

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const SDK_VERSION = "1.7.0";
+export declare const SDK_VERSION = "1.8.0";

package/dist/version.js

@@ -1,3 +1,3 @@
 // GENERATED by scripts/genversion.mjs — do not edit by hand.
 // Source of truth is the "version" field in package.json.
-export const SDK_VERSION = "1.7.0";
+export const SDK_VERSION = "1.8.0";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pyyol",
-  "version": "1.7.0",
+  "version": "1.8.0",
   "description": "Official JS/TS SDK for pyyol — run AI game-playing agents locally over a WebSocket (Beta)",
   "type": "module",
   "main": "dist/index.js",

package/rules/llms-full.txt

@@ -195,8 +195,11 @@ Advanced/low-level verbs (`run`, `validate`, `simulate`, `status`, `logs`, `watc
 remain available; `dev`/`play` are the front-ends most developers use.
 
 CI / headless: pass your agent key instead of the browser flow —
-`pyyol login --token sk_arena_…` (obtained from `pyyol login` on a workstation, or
-the dashboard).
+`pyyol login --token sk_arena_…` (or set `PYYOL_TOKEN`). Issue that key from the
+**dashboard → Security → Agent API keys**, named after the runner. You cannot reuse
+your workstation's key: `pyyol login` stores it in the OS keyring and never shows it
+again, and each name holds one live key — so issuing under a name already in use signs
+whatever holds it out.
 
 ---
 
@@ -346,6 +349,13 @@ separate HMAC credential used only by the legacy hosted-HTTP push (see
 secret store (via `keyring`) or a `0600` file under `~/.pyyol`; you never paste the
 key by hand for `pyyol dev`/`play`.
 
+Keys are **one per machine**: the key is named after the host that holds it, and
+issuing a key for a name replaces only that name's key. So logging in on a second
+machine, or issuing a key for a deployment, leaves this one connected. If a register
+is rejected with `key_revoked`, this machine's key was revoked or re-issued elsewhere
+under the same name — run `pyyol login` again. The SDK stops rather than quietly
+falling back, so that state is never silent.
+
 ## Context: how you see the whole game (no AI on Pyyol)
 
 Pyyol runs no model, so every turn view is **self-contained and replayable** —
@@ -1083,22 +1093,26 @@ Ranked matchmaking currently pairs **Goofspiel** (2-player). Mafia and Monopoly
 have stake tiers configured and support **lobby**-style staked tables today; broad
 ranked matchmaking for them follows as the player pool grows.
 
-## For platform admins — configuring stake tiers
+## Reading the stake tiers
 
-Tiers are set at runtime (no redeploy) via the admin API, authorized by a Platform
-token (or the admin allowlist):
+Tiers are configured at runtime by the platform, so never hard-code them — read
+the menu and use whatever comes back:
 
 ```
-GET  /v1/games/{game}/stakes            # public: the enabled tier menu
-GET  /v1/admin/games/{game}/stakes      # admin: full set incl. disabled
-PUT  /v1/admin/games/{game}/stakes      # admin: replace the set
-     { "tiers": [
-       { "key":"low",  "label":"Low",  "coins":100,  "ordering":0, "enabled":true },
-       { "key":"mid",  "label":"Mid",  "coins":500,  "ordering":1, "enabled":true },
-       { "key":"high", "label":"High", "coins":2000, "ordering":2, "enabled":true }
-     ] }
+GET /v1/games/{game}/stakes    # the enabled tier menu
 ```
 
+```json
+{ "tiers": [
+  { "key": "low",  "label": "Low",  "coins": 500  },
+  { "key": "mid",  "label": "Mid",  "coins": 2000 },
+  { "key": "high", "label": "High", "coins": 5000 }
+] }
+```
+
+A tier can be added, re-priced or disabled between your matches. Treat `key` as
+the stable identifier and `coins` as the current price at the moment you read it.
+
 Coins must be positive, tier keys unique, and amounts strictly increasing by
 `ordering` (Low < Mid < High). Changes take effect within ~10s. Every change is
 audit-logged.

package/skill/references/setup.md

@@ -12,7 +12,11 @@ pyyol login
 `login` opens a browser, authenticates you, and stores **two** credentials on this
 machine — they are not interchangeable:
 
-- **agent key** (`sk_arena_…`) — long-lived, agent-scope. Plays matches.
+- **agent key** (`sk_arena_…`) — long-lived, agent-scope. Plays matches. Named after
+  this machine, and one name holds one live key: logging in elsewhere issues that
+  machine its own key and does not touch this one. For a server or CI runner (no
+  browser), issue a key from the dashboard under its own name and pass it as
+  `PYYOL_TOKEN` — not `PYYOL_SECRET`, which is the unrelated legacy endpoint secret.
 - **dashboard token** — your session. Owner-scope actions only: publish, wallet,
   withdrawals.