@skrr-ai/cli 0.1.101 → 0.1.102

package/dist/lib/responsibility-controls.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RESPONSIBILITY_CONTROL_SCOPES = void 0;
+exports.controlFromPreview = controlFromPreview;
+exports.renderControl = renderControl;
+exports.renderReadiness = renderReadiness;
+exports.renderProbe = renderProbe;
+/** Scope/version coordinates are intent. The server re-authorizes every read and write. */
+exports.RESPONSIBILITY_CONTROL_SCOPES = [
+    'mute_updates', 'pause_observation', 'cancel_worker', 'cancel_episode', 'cancel_subtree', 'retire',
+];
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+/**
+ * Apply only the saved preview, never a newly fetched version or live target set.
+ * Presentation and authority fields cannot become request fields. The canonical
+ * service validates every attempt pin and rejects stale or enlarged selections.
+ */
+function controlFromPreview(commitmentId, preview, idempotencyKey, reason) {
+    if (preview.schemaVersion !== 1 || preview.commitmentId !== commitmentId) {
+        throw new Error('Use a control preview for this exact Commitment.');
+    }
+    if (preview.available !== true)
+        throw new Error('The reviewed control is unavailable; refresh its preview.');
+    if (!exports.RESPONSIBILITY_CONTROL_SCOPES.some((scope) => scope === preview.scope)) {
+        throw new Error('The preview has an unsupported control scope.');
+    }
+    if (typeof preview.expectedVersion !== 'number' || !Number.isSafeInteger(preview.expectedVersion)
+        || preview.expectedVersion < 1)
+        throw new Error('The preview must pin its Commitment version.');
+    if (!idempotencyKey.trim() || idempotencyKey.length > 200)
+        throw new Error('Use an idempotency key of 1..200 characters.');
+    if (reason !== undefined && reason.length > 1000)
+        throw new Error('The control reason must be at most 1000 characters.');
+    if (!Array.isArray(preview.targetIds) || !Array.isArray(preview.expectedTargets)
+        || preview.targetIds.length > 500 || preview.expectedTargets.length > 500) {
+        throw new Error('The preview must contain a bounded, frozen target set.');
+    }
+    const pinKeys = new Set(['id', 'type', 'generation', 'attempt', 'taskWorkflowGeneration',
+        'workflowPlanGeneration', 'workflowNodeAttempt', 'workflowTaskRunId', 'bindingDigest',
+        'executorAttemptRef', 'taskRunId']);
+    const executorKeys = new Set(['kind', 'runId', 'generation', 'attempt']);
+    const targetIds = preview.targetIds;
+    const pins = preview.expectedTargets;
+    if (targetIds.some((id) => typeof id !== 'string' || !id || id.length > 200)
+        || new Set(targetIds).size !== targetIds.length
+        || pins.some((pin) => !record(pin) || typeof pin.id !== 'string'
+            || typeof pin.generation !== 'number' || !Number.isSafeInteger(pin.generation) || pin.generation < 0
+            || Object.keys(pin).some((key) => !pinKeys.has(key))
+            || (pin.executorAttemptRef != null && (!record(pin.executorAttemptRef)
+                || Object.keys(pin.executorAttemptRef).some((key) => !executorKeys.has(key)))))
+        || pins.length !== targetIds.length
+        || new Set(pins.map((pin) => record(pin) ? pin.id : null)).size !== pins.length
+        || pins.some((pin) => !record(pin) || !targetIds.includes(pin.id))) {
+        throw new Error('Use the exact target identities and generation pins returned by control preview.');
+    }
+    if (String(preview.scope).startsWith('cancel_') && pins.length === 0) {
+        throw new Error('A cancellation preview must identify the exact worker or episode attempts.');
+    }
+    return {
+        scope: preview.scope, expectedVersion: preview.expectedVersion,
+        targetIds, expectedTargets: pins, idempotencyKey,
+        ...(reason !== undefined ? { reason } : {}),
+    };
+}
+function renderControl(value, log) {
+    log(`${value.scope}: ${value.state ?? (value.available === true ? 'available' : 'unavailable')}`);
+    if (value.controlId)
+        log(`Control receipt: ${value.controlId}`);
+    if (value.expectedVersion !== undefined)
+        log(`Commitment version: ${value.expectedVersion}`);
+    if (value.unavailableReason)
+        log(`Reason: ${value.unavailableReason}`);
+    for (const key of ['affected', 'remaining']) {
+        const rows = value[key];
+        if (!Array.isArray(rows))
+            continue;
+        log(`${key === 'affected' ? 'Affected' : 'Remaining'} work: ${rows.length}`);
+        for (const row of rows)
+            if (record(row))
+                log(`  ${row.id}: ${row.status ?? 'unknown'}${row.acknowledgement ? ` (${row.acknowledgement})` : ''}`);
+    }
+    if (Array.isArray(value.warnings))
+        for (const warning of value.warnings)
+            log(String(warning));
+}
+function renderReadiness(value, log) {
+    const activation = value.object === 'commitment_readiness_activation_receipt';
+    log(`${activation ? 'Activation' : 'Readiness'} receipt: ${value.id ?? 'not recorded'}`);
+    if (activation) {
+        log(`Validated version: ${value.validatedVersion ?? 'unknown'}`);
+        log(`Activated version: ${value.activatedVersion ?? 'unknown'}`);
+        if (record(value.materialization))
+            log(`Trigger materialization: ${value.materialization.status ?? 'unknown'}`);
+        log(`Worker observation: ${value.workerObservationConfirmed === true ? 'confirmed' : 'unconfirmed'}`);
+    }
+    if (record(value.preflight))
+        log(`Preflight: ${value.preflight.verdict ?? 'unknown'}`);
+    if (record(value.observation)) {
+        log(`Observation: ${value.observation.status ?? 'unknown'}`);
+        log(`Required source coverage: ${value.observation.requiredCoverageComplete === true ? 'complete' : 'incomplete'}`);
+        log(`Worker observation: ${value.observation.workerObservationConfirmed === true ? 'confirmed' : 'unconfirmed'}`);
+    }
+    if (value.isCurrent !== undefined)
+        log(`Current evidence: ${value.isCurrent === true ? 'yes' : 'no'}`);
+    if (value.validUntil)
+        log(`Evidence valid until: ${value.validUntil}`);
+}
+function renderProbe(value, log) {
+    log(`Source observation: ${value.status ?? 'unknown'}`);
+    log(`Coverage: ${value.coverageComplete === true ? 'complete' : 'incomplete'}`);
+    if (Array.isArray(value.rows))
+        for (const row of value.rows) {
+            if (record(row))
+                log(`  ${row.source ?? row.key ?? 'source'}: ${row.status ?? 'unknown'}${row.reason ? ` (${row.reason})` : ''}`);
+        }
+    log(`Worker observation: ${value.workerObservationConfirmed === true ? 'confirmed' : 'unconfirmed'}`);
+}

package/dist/lib/stewardship-output.js

@@ -9,12 +9,20 @@ function printStewardshipCoverage(report, log) {
         log('Coverage: complete within the bounded sources.');
         return;
     }
-    log('Coverage: incomplete. Unreadable sources do not confirm absence.');
+    const unreadable = report.coverage.sources.some((source) => source.status === 'unavailable' || source.truncated);
+    log(unreadable
+        ? 'Coverage: incomplete. Unreadable sources do not confirm absence.'
+        : 'Coverage: incomplete. Some Grants are not attributed to this workspace and are not listed.');
     for (const source of report.coverage.sources) {
         if (source.status === 'unavailable')
             log(`${source.name}: unavailable`);
         else if (source.truncated)
             log(`${source.name}: truncated at 200 rows`);
+        if (source.unlisted) {
+            // A capped count is a lower bound; say so rather than print 200 as exact.
+            const count = `${source.truncated ? 'at least ' : ''}${source.unlisted}`;
+            log(`${source.name}: ${count} Grant${source.unlisted === 1 && !source.truncated ? '' : 's'} on an Agent or Commitment in this workspace carry no workspace stamp, so they are not listed here. Their owners can see them with \`skrr grants list\`.`);
+        }
     }
 }
 function printWorkspaceGrants(report, log) {
@@ -27,7 +35,10 @@ function printGrantRows(report, log) {
         return;
     }
     if (!report.grants.length) {
-        log('No workspace Grants observed.');
+        const unlisted = report.coverage.sources.some((source) => source.unlisted);
+        log(unlisted
+            ? 'No Grant carries this workspace stamp (see the coverage note above).'
+            : 'No workspace Grants observed.');
         return;
     }
     (0, format_1.renderTable)(report.grants.map((row) => ({

package/dist/lib/workflow-node-control.d.ts

@@ -0,0 +1,10 @@
+import type { WorkflowReviewedCancellationScope } from '@skrr-ai/data-provider';
+/** Freeze the saved canonical selection. This command performs no live reads. */
+export declare function nodeCancellationFromSnapshot(spaceId: string, runId: string, nodeKey: string, snapshot: Record<string, unknown>, reason?: string): {
+    expectedRunGeneration: number;
+    expectedGeneration: number;
+    expectedAttempt: string;
+    expectedTaskRunId: string | null;
+    expectedScopeNode: WorkflowReviewedCancellationScope['nodes'][number];
+    reason?: string;
+};

package/dist/lib/workflow-node-control.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.nodeCancellationFromSnapshot = nodeCancellationFromSnapshot;
+function record(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+function integer(value) {
+    return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0;
+}
+function id(value) {
+    return typeof value === 'string' && value.length > 0 && value.length <= 160;
+}
+/** Freeze the saved canonical selection. This command performs no live reads. */
+function nodeCancellationFromSnapshot(spaceId, runId, nodeKey, snapshot, reason) {
+    if (snapshot.id !== runId || snapshot.spaceId !== spaceId || !integer(snapshot.generation) || !Array.isArray(snapshot.nodes)) {
+        throw new Error('Use a saved canonical run snapshot for this exact Space and workflow run.');
+    }
+    const selected = snapshot.nodes.filter((node) => record(node) && node.nodeKey === nodeKey);
+    const node = selected[0];
+    if (selected.length !== 1 || !record(node) || !id(node.id) || node.workflowRunId !== runId
+        || !integer(node.iteration) || !integer(node.planGeneration) || !id(node.nodeType)) {
+        throw new Error('The saved snapshot must contain one exact node attempt and its generation.');
+    }
+    if (node.taskRunId != null && !id(node.taskRunId))
+        throw new Error('The saved TaskRun pin is invalid.');
+    if (reason !== undefined && reason.length > 500)
+        throw new Error('The cancellation reason must be at most 500 characters.');
+    const expectedScopeNode = {
+        id: node.id, workflowRunId: runId, iteration: node.iteration,
+        planGeneration: node.planGeneration, nodeType: node.nodeType,
+    };
+    for (const key of ['taskId', 'taskRunId', 'autonomousRunId']) {
+        const value = node[key];
+        if (value == null)
+            continue;
+        if (!id(value))
+            throw new Error(`The saved ${key} pin is invalid.`);
+        Object.assign(expectedScopeNode, { [key]: value });
+    }
+    // Explicit physical absence is a boundary. The canonical service refuses
+    // an executor that appears later rather than discovering it during a stop.
+    if (node.sessionId != null && !id(node.sessionId))
+        throw new Error('The saved session pin is invalid.');
+    expectedScopeNode.sessionId = node.sessionId == null ? null : node.sessionId;
+    const executor = (value) => {
+        if (value == null)
+            return null;
+        if (!record(value) || !id(value.kind) || !id(value.runId) || !integer(value.generation) || !integer(value.attempt)) {
+            throw new Error('The saved physical executor attempt is invalid.');
+        }
+        return { kind: value.kind, runId: value.runId, generation: value.generation, attempt: value.attempt };
+    };
+    expectedScopeNode.executorAttemptRef = executor(node.executorAttemptRef);
+    if (node.waitingFor !== undefined) {
+        const waitingFor = node.waitingFor;
+        if (!record(waitingFor))
+            throw new Error('The saved child execution scope is invalid.');
+        const keys = ['kind', 'eventKey', 'workflowRunId', 'index', 'phase', 'round', 'reviewTaskIds', 'reviseTaskId', 'executions'];
+        expectedScopeNode.waitingFor = Object.fromEntries(keys.filter((key) => waitingFor[key] !== undefined)
+            .map((key) => [key, waitingFor[key]]));
+    }
+    if (node.executorPins !== undefined) {
+        if (!Array.isArray(node.executorPins))
+            throw new Error('The saved executor set is invalid.');
+        expectedScopeNode.executorPins = node.executorPins.map((pin) => {
+            if (!record(pin) || !id(pin.taskId) || (pin.runId !== null && !id(pin.runId))
+                || (pin.sessionId != null && !id(pin.sessionId)))
+                throw new Error('The saved executor set is invalid.');
+            return { taskId: pin.taskId, runId: pin.runId, sessionId: pin.sessionId == null ? null : pin.sessionId,
+                executorAttemptRef: executor(pin.executorAttemptRef) };
+        });
+    }
+    return { expectedRunGeneration: snapshot.generation, expectedGeneration: node.planGeneration, expectedAttempt: node.id,
+        expectedTaskRunId: node.taskRunId == null ? null : node.taskRunId, expectedScopeNode,
+        ...(reason !== undefined ? { reason } : {}) };
+}

package/dist/lib/workspaces.d.ts

@@ -4,6 +4,8 @@ export interface StewardshipSource {
     status: 'available' | 'unavailable';
     truncated: boolean;
     code?: string;
+    /** `unattributedGrants` only: Grants in this workspace by Agent or Commitment that carry no workspace stamp and so are not listed. */
+    unlisted?: number;
 }
 export interface StewardshipCoverage {
     complete: boolean;

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.20",
+  "version": "0.4.21",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {