@skrr-ai/cli 0.1.108 → 0.1.109

package/dist/lib/write-target.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expectTargetFlag = void 0;
+exports.formatWriteTarget = formatWriteTarget;
+exports.matchesExpectedTarget = matchesExpectedTarget;
+exports.firstUnmetExpectation = firstUnmetExpectation;
+/**
+ * Which account and which server a bulk write is about to touch.
+ *
+ * `skrr` is increasingly driven by agents, against a platform whose development
+ * and production share one database. A person (or an agent) who has run `skrr
+ * login` once can write 94 tasks to an account and a server they have not looked
+ * at since, and nothing in the command's own output said so — the target was
+ * visible only to someone who thought to run `whoami` first (OSK-S-440 #10).
+ * "I checked once" is not a control; the command that is about to write in bulk
+ * has to say where, and let its caller assert where.
+ *
+ * Pure: the command gathers the facts (a request or two), this decides how to say
+ * them and whether an expectation holds.
+ */
+const core_1 = require("@oclif/core");
+/** `stevedu518@gmail.com on https://skrr.ai (no workspace)` */
+function formatWriteTarget(target) {
+    const who = target.account ?? target.accountId ?? 'an account that could not be read';
+    const where = target.workspace ? `workspace ${target.workspace}` : 'no workspace';
+    return `${who} on ${target.server} (${where})`;
+}
+function hostOf(value) {
+    try {
+        return new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : `https://${value}`).host.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Does one `--expect-target` value describe this target?
+ *
+ *   - contains `@`            -> the account email (case-insensitive)
+ *   - a URL or a host name    -> the server's host (`skrr.ai` matches `https://skrr.ai`)
+ *   - anything else           -> the account id
+ *
+ * One value names one fact; pass the flag twice to pin both account and server.
+ * An unreadable fact never matches: an expectation about an account the command
+ * could not read is not met.
+ */
+function matchesExpectedTarget(target, expected) {
+    const value = expected.trim();
+    if (!value)
+        return false;
+    if (value.includes('@') && !/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
+        return target.account !== null && target.account.toLowerCase() === value.toLowerCase();
+    }
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value) ||
+        value.includes('.') ||
+        value.startsWith('localhost')) {
+        const expectedHost = hostOf(value);
+        return expectedHost !== null && expectedHost === hostOf(target.server);
+    }
+    return target.accountId !== null && target.accountId === value;
+}
+/** The first expectation that does NOT hold, or undefined when all do. */
+function firstUnmetExpectation(target, expected) {
+    return (expected ?? []).find((value) => !matchesExpectedTarget(target, value));
+}
+/** The assertion flag, declared once so every bulk writer spells it the same way. */
+exports.expectTargetFlag = {
+    'expect-target': core_1.Flags.string({
+        description: 'Refuse to write unless the target matches: an account email, a server host (skrr.ai) or an account id. Repeat to pin more than one (account AND server). Checked before anything is created.',
+        multiple: true,
+    }),
+};

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/workspaceIsolationProbeWire.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The workspace-isolation probe wire contract (OSK-15099).
+ *
+ * A Commitment Run is always isolated: the daemon cuts it a private git
+ * worktree from the directory the Run is rooted in, and refuses the Run with
+ * `EXECUTION_ISOLATION_UNAVAILABLE` before any tool when it cannot. Preflight
+ * had no way to read that machine's filesystem, so it reported `ready`,
+ * activation succeeded, and the first Run failed. The daemon now answers the
+ * same question BEFORE a Run, through the same predicate its executor refuses
+ * on, and this module is the one place both ends spell it.
+ *
+ * - The daemon announces {@link WORKSPACE_ISOLATION_PROBE_CAPABILITY}. A daemon
+ *   that does not is never asked, and the server reports the prerequisite as
+ *   UNVERIFIED — never as satisfied (unknown is never ok).
+ * - The server sends {@link WORKSPACE_ISOLATION_PROBE_METHOD} as a control RPC
+ *   with `{ workingDirectory? }`: exactly the directory it would put on the
+ *   Run's request (`agent.workingDirectory || daemon cwd`).
+ * - The daemon answers {@link WorkspaceIsolationProbeAnswer}.
+ *
+ * Pure: no I/O, safe for the browser, the CLI and the API.
+ */
+export declare const WORKSPACE_ISOLATION_PROBE_CAPABILITY: "workspace_isolation_probe_v1";
+export declare const WORKSPACE_ISOLATION_PROBE_METHOD: "daemon:workspace:isolation-probe";
+/**
+ * What an explicit isolation request can be given from a base directory.
+ *
+ *   - `worktree`          — a git repository with a commit: a worktree is cut;
+ *   - `sandbox`           — the daemon's own bare scratch workspace: an empty
+ *                           private sandbox is used instead;
+ *   - `not_a_repository`  — refused: not inside a git repository;
+ *   - `no_initial_commit` — refused: a repository with an unborn HEAD.
+ */
+export declare const WORKTREE_BASE_VERDICTS: readonly ["worktree", "sandbox", "not_a_repository", "no_initial_commit"];
+export type WorktreeBaseVerdict = (typeof WORKTREE_BASE_VERDICTS)[number];
+/** The verdicts on which the daemon refuses an isolated Run before any tool. */
+export declare const REFUSING_WORKTREE_BASE_VERDICTS: ReadonlySet<WorktreeBaseVerdict>;
+export declare function isWorktreeBaseVerdict(value: unknown): value is WorktreeBaseVerdict;
+export interface WorkspaceIsolationProbeRequest {
+    /** Omitted: the daemon resolves its own default, as it would for the Run. */
+    workingDirectory?: string;
+}
+export interface WorkspaceIsolationProbeAnswer {
+    /** The directory a Run asked with this `workingDirectory` would be rooted in. */
+    baseCwd: string;
+    /** Whether a person chose it (agent/task directory or configured default). */
+    chosenExplicitly: boolean;
+    verdict: WorktreeBaseVerdict;
+    /** The refusal sentence the Run would fail with; null when it would be admitted. */
+    remedy: string | null;
+    checkedAt: string;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/workspaceIsolationProbeWire.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * The workspace-isolation probe wire contract (OSK-15099).
+ *
+ * A Commitment Run is always isolated: the daemon cuts it a private git
+ * worktree from the directory the Run is rooted in, and refuses the Run with
+ * `EXECUTION_ISOLATION_UNAVAILABLE` before any tool when it cannot. Preflight
+ * had no way to read that machine's filesystem, so it reported `ready`,
+ * activation succeeded, and the first Run failed. The daemon now answers the
+ * same question BEFORE a Run, through the same predicate its executor refuses
+ * on, and this module is the one place both ends spell it.
+ *
+ * - The daemon announces {@link WORKSPACE_ISOLATION_PROBE_CAPABILITY}. A daemon
+ *   that does not is never asked, and the server reports the prerequisite as
+ *   UNVERIFIED — never as satisfied (unknown is never ok).
+ * - The server sends {@link WORKSPACE_ISOLATION_PROBE_METHOD} as a control RPC
+ *   with `{ workingDirectory? }`: exactly the directory it would put on the
+ *   Run's request (`agent.workingDirectory || daemon cwd`).
+ * - The daemon answers {@link WorkspaceIsolationProbeAnswer}.
+ *
+ * Pure: no I/O, safe for the browser, the CLI and the API.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFUSING_WORKTREE_BASE_VERDICTS = exports.WORKTREE_BASE_VERDICTS = exports.WORKSPACE_ISOLATION_PROBE_METHOD = exports.WORKSPACE_ISOLATION_PROBE_CAPABILITY = void 0;
+exports.isWorktreeBaseVerdict = isWorktreeBaseVerdict;
+exports.WORKSPACE_ISOLATION_PROBE_CAPABILITY = 'workspace_isolation_probe_v1';
+exports.WORKSPACE_ISOLATION_PROBE_METHOD = 'daemon:workspace:isolation-probe';
+/**
+ * What an explicit isolation request can be given from a base directory.
+ *
+ *   - `worktree`          — a git repository with a commit: a worktree is cut;
+ *   - `sandbox`           — the daemon's own bare scratch workspace: an empty
+ *                           private sandbox is used instead;
+ *   - `not_a_repository`  — refused: not inside a git repository;
+ *   - `no_initial_commit` — refused: a repository with an unborn HEAD.
+ */
+exports.WORKTREE_BASE_VERDICTS = Object.freeze([
+    'worktree',
+    'sandbox',
+    'not_a_repository',
+    'no_initial_commit',
+]);
+/** The verdicts on which the daemon refuses an isolated Run before any tool. */
+exports.REFUSING_WORKTREE_BASE_VERDICTS = new Set([
+    'not_a_repository',
+    'no_initial_commit',
+]);
+function isWorktreeBaseVerdict(value) {
+    return typeof value === 'string' && exports.WORKTREE_BASE_VERDICTS.includes(value);
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/workspaceIsolationProbeWire.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The workspace-isolation probe wire contract (OSK-15099).
+ *
+ * A Commitment Run is always isolated: the daemon cuts it a private git
+ * worktree from the directory the Run is rooted in, and refuses the Run with
+ * `EXECUTION_ISOLATION_UNAVAILABLE` before any tool when it cannot. Preflight
+ * had no way to read that machine's filesystem, so it reported `ready`,
+ * activation succeeded, and the first Run failed. The daemon now answers the
+ * same question BEFORE a Run, through the same predicate its executor refuses
+ * on, and this module is the one place both ends spell it.
+ *
+ * - The daemon announces {@link WORKSPACE_ISOLATION_PROBE_CAPABILITY}. A daemon
+ *   that does not is never asked, and the server reports the prerequisite as
+ *   UNVERIFIED — never as satisfied (unknown is never ok).
+ * - The server sends {@link WORKSPACE_ISOLATION_PROBE_METHOD} as a control RPC
+ *   with `{ workingDirectory? }`: exactly the directory it would put on the
+ *   Run's request (`agent.workingDirectory || daemon cwd`).
+ * - The daemon answers {@link WorkspaceIsolationProbeAnswer}.
+ *
+ * Pure: no I/O, safe for the browser, the CLI and the API.
+ */
+export declare const WORKSPACE_ISOLATION_PROBE_CAPABILITY: "workspace_isolation_probe_v1";
+export declare const WORKSPACE_ISOLATION_PROBE_METHOD: "daemon:workspace:isolation-probe";
+/**
+ * What an explicit isolation request can be given from a base directory.
+ *
+ *   - `worktree`          — a git repository with a commit: a worktree is cut;
+ *   - `sandbox`           — the daemon's own bare scratch workspace: an empty
+ *                           private sandbox is used instead;
+ *   - `not_a_repository`  — refused: not inside a git repository;
+ *   - `no_initial_commit` — refused: a repository with an unborn HEAD.
+ */
+export declare const WORKTREE_BASE_VERDICTS: readonly ["worktree", "sandbox", "not_a_repository", "no_initial_commit"];
+export type WorktreeBaseVerdict = (typeof WORKTREE_BASE_VERDICTS)[number];
+/** The verdicts on which the daemon refuses an isolated Run before any tool. */
+export declare const REFUSING_WORKTREE_BASE_VERDICTS: ReadonlySet<WorktreeBaseVerdict>;
+export declare function isWorktreeBaseVerdict(value: unknown): value is WorktreeBaseVerdict;
+export interface WorkspaceIsolationProbeRequest {
+    /** Omitted: the daemon resolves its own default, as it would for the Run. */
+    workingDirectory?: string;
+}
+export interface WorkspaceIsolationProbeAnswer {
+    /** The directory a Run asked with this `workingDirectory` would be rooted in. */
+    baseCwd: string;
+    /** Whether a person chose it (agent/task directory or configured default). */
+    chosenExplicitly: boolean;
+    verdict: WorktreeBaseVerdict;
+    /** The refusal sentence the Run would fail with; null when it would be admitted. */
+    remedy: string | null;
+    checkedAt: string;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/workspaceIsolationProbeWire.js

@@ -0,0 +1,46 @@
+/**
+ * The workspace-isolation probe wire contract (OSK-15099).
+ *
+ * A Commitment Run is always isolated: the daemon cuts it a private git
+ * worktree from the directory the Run is rooted in, and refuses the Run with
+ * `EXECUTION_ISOLATION_UNAVAILABLE` before any tool when it cannot. Preflight
+ * had no way to read that machine's filesystem, so it reported `ready`,
+ * activation succeeded, and the first Run failed. The daemon now answers the
+ * same question BEFORE a Run, through the same predicate its executor refuses
+ * on, and this module is the one place both ends spell it.
+ *
+ * - The daemon announces {@link WORKSPACE_ISOLATION_PROBE_CAPABILITY}. A daemon
+ *   that does not is never asked, and the server reports the prerequisite as
+ *   UNVERIFIED — never as satisfied (unknown is never ok).
+ * - The server sends {@link WORKSPACE_ISOLATION_PROBE_METHOD} as a control RPC
+ *   with `{ workingDirectory? }`: exactly the directory it would put on the
+ *   Run's request (`agent.workingDirectory || daemon cwd`).
+ * - The daemon answers {@link WorkspaceIsolationProbeAnswer}.
+ *
+ * Pure: no I/O, safe for the browser, the CLI and the API.
+ */
+export const WORKSPACE_ISOLATION_PROBE_CAPABILITY = 'workspace_isolation_probe_v1';
+export const WORKSPACE_ISOLATION_PROBE_METHOD = 'daemon:workspace:isolation-probe';
+/**
+ * What an explicit isolation request can be given from a base directory.
+ *
+ *   - `worktree`          — a git repository with a commit: a worktree is cut;
+ *   - `sandbox`           — the daemon's own bare scratch workspace: an empty
+ *                           private sandbox is used instead;
+ *   - `not_a_repository`  — refused: not inside a git repository;
+ *   - `no_initial_commit` — refused: a repository with an unborn HEAD.
+ */
+export const WORKTREE_BASE_VERDICTS = Object.freeze([
+    'worktree',
+    'sandbox',
+    'not_a_repository',
+    'no_initial_commit',
+]);
+/** The verdicts on which the daemon refuses an isolated Run before any tool. */
+export const REFUSING_WORKTREE_BASE_VERDICTS = new Set([
+    'not_a_repository',
+    'no_initial_commit',
+]);
+export function isWorktreeBaseVerdict(value) {
+    return typeof value === 'string' && WORKTREE_BASE_VERDICTS.includes(value);
+}

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.25",
+  "version": "0.4.26",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {
@@ -144,6 +144,16 @@
         "default": "./dist/cjs/dedicatedRuntimeWakeWire.js"
       }
     },
+    "./workspace-isolation-probe-wire": {
+      "import": {
+        "types": "./dist/esm/workspaceIsolationProbeWire.d.ts",
+        "default": "./dist/esm/workspaceIsolationProbeWire.js"
+      },
+      "require": {
+        "types": "./dist/cjs/workspaceIsolationProbeWire.d.ts",
+        "default": "./dist/cjs/workspaceIsolationProbeWire.js"
+      }
+    },
     "./commitment-execution-contract": {
       "import": {
         "types": "./dist/esm/commitmentExecutionContract.d.ts",