feat(session-cli): add session subcommands to kernel-cli

Adds ocap session create/list/requests/queue/approve/reject subcommands.
Refactors daemon-client to delegate socket/RPC helpers to kernel-node-runtime,
and extracts session command builder into session.ts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: grypez

packages/kernel-cli/src/app.ts

@@ -22,6 +22,7 @@ import {
   stopRelay,
 } from './commands/relay.ts';
 import { getServer } from './commands/serve.ts';
+import { buildSessionCommands } from './commands/session.ts';
 import { watchDir } from './commands/watch.ts';
 import { defaultConfig } from './config.ts';
 import type { Config } from './config.ts';
@@ -426,6 +427,13 @@ const yargsInstance = yargs(hideBin(process.argv))
     () => {
       // Handled by subcommands.
     },
+  )
+  .command(
+    'session',
+    'Manage authorization sessions',
+    (_yargs) => buildSessionCommands(_yargs),
+    () => {
+      // Handled by subcommands.
+    },
   );
-
 await yargsInstance.help('help').parse();

packages/kernel-cli/src/commands/daemon-client.ts

@@ -1,106 +1,9 @@
-import { readLine, writeLine } from '@metamask/kernel-node-runtime/daemon';
-import type { JsonRpcResponse } from '@metamask/utils';
-import { assertIsJsonRpcResponse } from '@metamask/utils';
-import { randomUUID } from 'node:crypto';
-import { createConnection } from 'node:net';
-import type { Socket } from 'node:net';
-import { join } from 'node:path';
+import {
+  getSocketPath,
+  sendCommand,
+} from '@metamask/kernel-node-runtime/daemon';
 
-import { getOcapHome } from '../ocap-home.ts';
-
-/**
- * Get the default daemon socket path.
- *
- * @returns The socket path.
- */
-export function getSocketPath(): string {
-  return join(getOcapHome(), 'daemon.sock');
-}
-
-/**
- * Connect to a UNIX domain socket.
- *
- * @param socketPath - The socket path to connect to.
- * @returns A connected socket.
- */
-async function connectSocket(socketPath: string): Promise<Socket> {
-  return new Promise((resolve, reject) => {
-    const socket = createConnection(socketPath, () => {
-      socket.removeListener('error', reject);
-      resolve(socket);
-    });
-    socket.on('error', reject);
-  });
-}
-
-/**
- * Options for {@link sendCommand}.
- */
-type SendCommandOptions = {
-  /** The UNIX socket path. */
-  socketPath: string;
-  /** The RPC method name. */
-  method: string;
-  /** Optional method parameters (object or positional array). */
-  params?: Record<string, unknown> | unknown[] | undefined;
-  /** Read timeout in milliseconds (default: no timeout). */
-  timeoutMs?: number | undefined;
-};
-
-/**
- * Send a JSON-RPC request to the daemon over a UNIX socket and return the response.
- *
- * Opens a connection, writes one JSON-RPC request line, reads one JSON-RPC
- * response line, then closes the connection. Retries once after a short delay
- * if the connection is rejected (e.g. due to a probe connection race).
- *
- * @param options - Command options.
- * @param options.socketPath - The UNIX socket path.
- * @param options.method - The RPC method name.
- * @param options.params - Optional method parameters.
- * @param options.timeoutMs - Read timeout in milliseconds (default: no timeout).
- * @returns The parsed JSON-RPC response.
- */
-export async function sendCommand({
-  socketPath,
-  method,
-  params,
-  timeoutMs,
-}: SendCommandOptions): Promise<JsonRpcResponse> {
-  const id = randomUUID();
-  const request = {
-    jsonrpc: '2.0',
-    id,
-    method,
-    ...(params === undefined ? {} : { params }),
-  };
-
-  const attempt = async (): Promise<JsonRpcResponse> => {
-    const socket = await connectSocket(socketPath);
-    try {
-      await writeLine(socket, JSON.stringify(request));
-      const responseLine = await readLine(socket, timeoutMs);
-      const parsed: unknown = JSON.parse(responseLine);
-      assertIsJsonRpcResponse(parsed);
-      return parsed;
-    } finally {
-      socket.destroy();
-    }
-  };
-
-  try {
-    return await attempt();
-  } catch (error: unknown) {
-    // Retry once on connection errors only — the daemon's socket may
-    // still be cleaning up a previous connection.
-    const code = (error as NodeJS.ErrnoException | undefined)?.code;
-    if (code !== 'ECONNREFUSED' && code !== 'ECONNRESET') {
-      throw error;
-    }
-    await new Promise((resolve) => setTimeout(resolve, 100));
-    return attempt();
-  }
-}
+export { getSocketPath, sendCommand };
 
 /**
  * Check whether the daemon is running by sending a lightweight `getStatus`