@skrr-ai/cli 0.1.108 → 0.1.110

package/dist/lib/workspaces.d.ts

@@ -12,11 +12,8 @@ export interface StewardshipCoverage {
     truncated: boolean;
     sources: StewardshipSource[];
 }
-export type WorkspaceGrantMetadata = Omit<GrantPublic, 'credential' | 'createdAt' | 'updatedAt'> & {
+export type WorkspaceGrantMetadata = Omit<GrantPublic, 'createdAt' | 'updatedAt'> & {
     ownerUserId: string;
-    credential: (NonNullable<GrantPublic['credential']> & {
-        fingerprint?: string;
-    }) | null;
     createdAt?: string;
     updatedAt?: string;
     referencedBy: string[] | null;
@@ -38,6 +35,8 @@ export interface WorkspaceStewardshipReport extends WorkspaceGrantReport {
     membership: {
         status: 'active' | 'absent' | 'unavailable';
         role?: string;
+        /** `false` on `absent`: a removed member and an id that never existed read alike. */
+        canDistinguishRemoved?: boolean;
     };
     commitments: StewardshipCommitmentMetadata[] | null;
     approverSeats: StewardshipCommitmentMetadata[] | null;
@@ -47,6 +46,50 @@ export interface WorkspaceStewardshipReport extends WorkspaceGrantReport {
     }> | null;
 }
 export declare function getWorkspaceStewardship(workspaceId: string, memberUserId: string): Promise<WorkspaceStewardshipReport>;
+/** One current member of a workspace, as `GET /api/workspaces/:id/members` returns it. */
+/**
+ * One current member as `skrr workspaces members` shows it, in its table and in
+ * `--json` alike (OSK-16472). Only these fields: the endpoint's raw row also carries
+ * the membership `_id`, monthly usage counters the web billing tab reads, and the
+ * user's avatar, none of which a members listing promises.
+ */
+export interface WorkspaceMemberRow {
+    userId: string;
+    name: string | null;
+    email: string | null;
+    role: string | null;
+    joinedAt: string | null;
+}
+interface RawWorkspaceMember {
+    userId?: unknown;
+    role?: unknown;
+    joinedAt?: unknown;
+    user?: {
+        name?: unknown;
+        username?: unknown;
+        email?: unknown;
+    } | null;
+}
+/** The ONE projection of a raw members row; nothing else of it reaches output. */
+export declare function toWorkspaceMemberRow(raw: RawWorkspaceMember): WorkspaceMemberRow;
+export declare function listWorkspaceMembers(workspaceId: string): Promise<WorkspaceMemberRow[]>;
+/** A user id as the stewardship route takes it: a 24-hex ObjectId. */
+export declare const USER_ID_PATTERN: RegExp;
+export declare class MemberReferenceError extends Error {
+    constructor(message: string);
+}
+/**
+ * Turn what a person typed into the member's user id (OSK-15356).
+ *
+ * A 24-hex id is passed through untouched: the server answers for it, including
+ * for an id that is not (or is no longer) a member. An email is looked up among
+ * the workspace's CURRENT members, because that is the only directory this
+ * command may read; a former member's email therefore does not resolve, and the
+ * error says so instead of guessing. Anything else is refused here with the
+ * shapes that work, rather than sent to the server for a bare "valid user id
+ * is required".
+ */
+export declare function resolveMemberUserId(workspaceId: string, reference: string, list?: (workspaceId: string) => Promise<WorkspaceMemberRow[]>): Promise<string>;
 export declare function listWorkspaceGrants(workspaceId: string): Promise<WorkspaceGrantReport>;
 /**
  * The workspaces this account belongs to.
@@ -199,3 +242,4 @@ export declare function getWorkspace(workspaceId: string): Promise<WorkspaceRow>
  * session history to the wrong team.
  */
 export declare function matchWorkspace(rows: WorkspaceRow[], ref: string): WorkspaceRow[];
+export {};

package/dist/lib/workspaces.js

@@ -1,6 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MemberReferenceError = exports.USER_ID_PATTERN = void 0;
 exports.getWorkspaceStewardship = getWorkspaceStewardship;
+exports.toWorkspaceMemberRow = toWorkspaceMemberRow;
+exports.listWorkspaceMembers = listWorkspaceMembers;
+exports.resolveMemberUserId = resolveMemberUserId;
 exports.listWorkspaceGrants = listWorkspaceGrants;
 exports.describeUnselectedWorkspace = describeUnselectedWorkspace;
 exports.listWorkspaces = listWorkspaces;
@@ -15,6 +19,57 @@ const triggers_1 = require("./triggers");
 async function getWorkspaceStewardship(workspaceId, memberUserId) {
     return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/stewardship/members/${encodeURIComponent(memberUserId)}`);
 }
+const text = (value) => (typeof value === 'string' && value ? value : null);
+/** The ONE projection of a raw members row; nothing else of it reaches output. */
+function toWorkspaceMemberRow(raw) {
+    return {
+        userId: String(raw.userId ?? ''),
+        name: text(raw.user?.name) ?? text(raw.user?.username),
+        email: text(raw.user?.email),
+        role: text(raw.role),
+        joinedAt: text(raw.joinedAt),
+    };
+}
+async function listWorkspaceMembers(workspaceId) {
+    const response = await (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/members`);
+    return Array.isArray(response?.data) ? response.data.map(toWorkspaceMemberRow) : [];
+}
+/** A user id as the stewardship route takes it: a 24-hex ObjectId. */
+exports.USER_ID_PATTERN = /^[a-f0-9]{24}$/i;
+class MemberReferenceError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'MemberReferenceError';
+    }
+}
+exports.MemberReferenceError = MemberReferenceError;
+/**
+ * Turn what a person typed into the member's user id (OSK-15356).
+ *
+ * A 24-hex id is passed through untouched: the server answers for it, including
+ * for an id that is not (or is no longer) a member. An email is looked up among
+ * the workspace's CURRENT members, because that is the only directory this
+ * command may read; a former member's email therefore does not resolve, and the
+ * error says so instead of guessing. Anything else is refused here with the
+ * shapes that work, rather than sent to the server for a bare "valid user id
+ * is required".
+ */
+async function resolveMemberUserId(workspaceId, reference, list = listWorkspaceMembers) {
+    const value = reference.trim();
+    if (exports.USER_ID_PATTERN.test(value))
+        return value;
+    const listHint = `\`skrr workspaces members ${workspaceId}\` lists current members and their user ids.`;
+    if (!value.includes('@')) {
+        throw new MemberReferenceError(`"${reference}" is not a user id or an email. A user id is 24 hexadecimal characters. ${listHint}`);
+    }
+    const email = value.toLowerCase();
+    const matches = (await list(workspaceId)).filter((member) => member.email?.toLowerCase() === email);
+    if (matches.length === 1)
+        return String(matches[0].userId);
+    throw new MemberReferenceError(matches.length === 0
+        ? `No current member of this workspace has the email ${value}. A former member's email cannot be looked up here; use their user id. ${listHint}`
+        : `More than one member has the email ${value}; use the user id. ${listHint}`);
+}
 async function listWorkspaceGrants(workspaceId) {
     return (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/stewardship/grants`);
 }

package/dist/lib/write-target.d.ts

@@ -0,0 +1,29 @@
+export type WriteTarget = {
+    /** The API origin writes go to, e.g. `https://skrr.ai`. */
+    server: string;
+    /** The signed-in account's email, or null when it could not be read. */
+    account: string | null;
+    accountId: string | null;
+    /** The workspace the request is scoped to, or null for none. */
+    workspace: string | null;
+};
+/** `stevedu518@gmail.com on https://skrr.ai (no workspace)` */
+export declare function formatWriteTarget(target: WriteTarget): string;
+/**
+ * Does one `--expect-target` value describe this target?
+ *
+ *   - contains `@`            -> the account email (case-insensitive)
+ *   - a URL or a host name    -> the server's host (`skrr.ai` matches `https://skrr.ai`)
+ *   - anything else           -> the account id
+ *
+ * One value names one fact; pass the flag twice to pin both account and server.
+ * An unreadable fact never matches: an expectation about an account the command
+ * could not read is not met.
+ */
+export declare function matchesExpectedTarget(target: WriteTarget, expected: string): boolean;
+/** The first expectation that does NOT hold, or undefined when all do. */
+export declare function firstUnmetExpectation(target: WriteTarget, expected: readonly string[] | undefined): string | undefined;
+/** The assertion flag, declared once so every bulk writer spells it the same way. */
+export declare const expectTargetFlag: {
+    'expect-target': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+};

package/dist/lib/write-target.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.expectTargetFlag = void 0;
+exports.formatWriteTarget = formatWriteTarget;
+exports.matchesExpectedTarget = matchesExpectedTarget;
+exports.firstUnmetExpectation = firstUnmetExpectation;
+/**
+ * Which account and which server a bulk write is about to touch.
+ *
+ * `skrr` is increasingly driven by agents, against a platform whose development
+ * and production share one database. A person (or an agent) who has run `skrr
+ * login` once can write 94 tasks to an account and a server they have not looked
+ * at since, and nothing in the command's own output said so — the target was
+ * visible only to someone who thought to run `whoami` first (OSK-S-440 #10).
+ * "I checked once" is not a control; the command that is about to write in bulk
+ * has to say where, and let its caller assert where.
+ *
+ * Pure: the command gathers the facts (a request or two), this decides how to say
+ * them and whether an expectation holds.
+ */
+const core_1 = require("@oclif/core");
+/** `stevedu518@gmail.com on https://skrr.ai (no workspace)` */
+function formatWriteTarget(target) {
+    const who = target.account ?? target.accountId ?? 'an account that could not be read';
+    const where = target.workspace ? `workspace ${target.workspace}` : 'no workspace';
+    return `${who} on ${target.server} (${where})`;
+}
+function hostOf(value) {
+    try {
+        return new URL(/^[a-z][a-z0-9+.-]*:\/\//i.test(value) ? value : `https://${value}`).host.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Does one `--expect-target` value describe this target?
+ *
+ *   - contains `@`            -> the account email (case-insensitive)
+ *   - a URL or a host name    -> the server's host (`skrr.ai` matches `https://skrr.ai`)
+ *   - anything else           -> the account id
+ *
+ * One value names one fact; pass the flag twice to pin both account and server.
+ * An unreadable fact never matches: an expectation about an account the command
+ * could not read is not met.
+ */
+function matchesExpectedTarget(target, expected) {
+    const value = expected.trim();
+    if (!value)
+        return false;
+    if (value.includes('@') && !/^[a-z][a-z0-9+.-]*:\/\//i.test(value)) {
+        return target.account !== null && target.account.toLowerCase() === value.toLowerCase();
+    }
+    if (/^[a-z][a-z0-9+.-]*:\/\//i.test(value) ||
+        value.includes('.') ||
+        value.startsWith('localhost')) {
+        const expectedHost = hostOf(value);
+        return expectedHost !== null && expectedHost === hostOf(target.server);
+    }
+    return target.accountId !== null && target.accountId === value;
+}
+/** The first expectation that does NOT hold, or undefined when all do. */
+function firstUnmetExpectation(target, expected) {
+    return (expected ?? []).find((value) => !matchesExpectedTarget(target, value));
+}
+/** The assertion flag, declared once so every bulk writer spells it the same way. */
+exports.expectTargetFlag = {
+    'expect-target': core_1.Flags.string({
+        description: 'Refuse to write unless the target matches: an account email, a server host (skrr.ai) or an account id. Repeat to pin more than one (account AND server). Checked before anything is created.',
+        multiple: true,
+    }),
+};

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -30,7 +30,7 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
-export { getMachineUuid, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
+export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -24,9 +24,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.isStaticTokenKind = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
-exports.qualifyMachineUuid = exports.getMachineUuidProfile = exports.setMachineUuidProfile = exports.getHardwareMachineUuid = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
-exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.MACHINE_IDENTITY_FILENAME = void 0;
-exports.compareReleaseVersions = exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = void 0;
+exports.setMachineUuidProfile = exports.getHardwareMachineUuid = exports.describeMachineIdentity = exports.getMachineUuidForProfile = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
+exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.MACHINE_IDENTITY_FILENAME = exports.qualifyMachineUuid = exports.getMachineUuidProfile = void 0;
+exports.compareReleaseVersions = exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -284,6 +284,8 @@ Object.defineProperty(exports, "__getDeviceIdentityStateForTest", { enumerable:
 // OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
 var machineUuid_js_1 = require("./machineUuid.js");
 Object.defineProperty(exports, "getMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuid; } });
+Object.defineProperty(exports, "getMachineUuidForProfile", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuidForProfile; } });
+Object.defineProperty(exports, "describeMachineIdentity", { enumerable: true, get: function () { return machineUuid_js_1.describeMachineIdentity; } });
 Object.defineProperty(exports, "getHardwareMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getHardwareMachineUuid; } });
 Object.defineProperty(exports, "setMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.setMachineUuidProfile; } });
 Object.defineProperty(exports, "getMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuidProfile; } });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.d.ts

@@ -56,5 +56,65 @@ export declare function getMachineUuidProfile(): string | null;
  * profile that already held credentials; see the block above.
  */
 export declare function getMachineUuid(): string;
+/**
+ * The `machineUuid` a process running as `profile` sends, WITHOUT changing which
+ * profile this process runs as.
+ *
+ * The CLI needs the answer for the profile it is about to hand a credential to,
+ * and asks the daemon binary what IT will send (`accept-handoff --print-id`).
+ * Two programs that compute one identity can only be known to agree by
+ * comparing them, and a daemon that predates per-profile identities does not
+ * agree: it sends the hardware value whatever the profile's
+ * `machine-identity.json` says, so a credential minted for what it reports
+ * registers the profile on the default machine's row (the OSK-13845 failure, now
+ * reached through version skew rather than through the rule). The comparison
+ * needs this: the expected value for the TARGET profile, which is not
+ * necessarily the one this process is running as.
+ *
+ * Decides and persists the profile's identity if nothing has yet — the same
+ * side effect `getMachineUuid()` has, for the same reason.
+ */
+export declare function getMachineUuidForProfile(profile: string | null | undefined): string;
+export type MachineIdentityReason = 
+/** The default profile, which always uses this computer's own identity. */
+'default_profile'
+/** A hosted runtime, whose identity the control plane issued. */
+ | 'hosted_runtime'
+/** A profile that held no credentials when its identity was first decided. */
+ | 'new_profile'
+/** A profile that already held credentials, so it keeps the shared identity. */
+ | 'pre_existing_profile'
+/** Recovered from the copy kept outside the profile after product state was removed. */
+ | 'restored_profile'
+/** The profile's record could not be read (the identity is still the one in use). */
+ | 'unrecorded';
+export interface MachineIdentityDescription {
+    /** The profile this process runs as; null for the default profile. */
+    profile: string | null;
+    /** The value sent to the server as `machineUuid`. */
+    machineUuid: string;
+    /** This computer's own identity. */
+    hardware: string;
+    /**
+     * A non-default profile that registers on the SAME machine row as the default
+     * profile: they share one Daemon row, one device-key pin and one machine page.
+     */
+    sharesDefaultMachine: boolean;
+    reason: MachineIdentityReason;
+    /** The files that made a profile "already hold credentials", when recorded. */
+    evidence: string[];
+    decidedAt: string | null;
+    /** One sentence for a person. Written once, here, so no surface words it differently. */
+    sentence: string;
+}
+/**
+ * Which machine this process registers as, and WHY — the question a person has
+ * when two profiles turn up on one machine page and the logs say nothing.
+ *
+ * A read, not a decision: it reports the identity `getMachineUuid()` settled on
+ * (settling it if nothing has, exactly as any caller would) and the record that
+ * explains it. It never changes what a profile registers as.
+ */
+export declare function describeMachineIdentity(): MachineIdentityDescription;
 /** @internal test seam — forget the cached value so the next call re-probes. */
 export declare function __resetMachineUuidCacheForTest(): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.js

@@ -10,6 +10,8 @@ exports.qualifyMachineUuid = qualifyMachineUuid;
 exports.setMachineUuidProfile = setMachineUuidProfile;
 exports.getMachineUuidProfile = getMachineUuidProfile;
 exports.getMachineUuid = getMachineUuid;
+exports.getMachineUuidForProfile = getMachineUuidForProfile;
+exports.describeMachineIdentity = describeMachineIdentity;
 exports.__resetMachineUuidCacheForTest = __resetMachineUuidCacheForTest;
 /**
  * machineUuid.ts — the ONE hardware machine identity sent to the server as
@@ -231,7 +233,7 @@ function readPersistedChoice(file, hardware, profile, requireProfile = false) {
         return null;
     }
 }
-function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
+function persistChoice(dir, file, hardware, machineUuid, reason, profile, evidence) {
     try {
         node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
         const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
@@ -241,6 +243,12 @@ function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
             machineUuid,
             profile,
             reason,
+            // WHICH file made a profile "already hold credentials". The reason alone
+            // says a profile shares the default's machine row; this says what put it
+            // there, which is the difference between "an older Skrr set it up" and
+            // "its first credential was written before anything chose its identity".
+            // Additive: a reader that predates it ignores the field.
+            ...(evidence && evidence.length > 0 ? { evidence: [...evidence] } : {}),
             decidedAt: new Date().toISOString(),
         };
         node_fs_1.default.writeFileSync(tmp, `${JSON.stringify(body)}\n`, { mode: 0o600 });
@@ -280,7 +288,7 @@ function resolveProfileMachineUuid(profile, hardware) {
             persistChoice(dir, file, hardware, chosen, 'restored_profile', profile);
     }
     if (!chosen) {
-        const preExisting = PRE_EXISTING_PROFILE_EVIDENCE.some((name) => {
+        const evidence = PRE_EXISTING_PROFILE_EVIDENCE.filter((name) => {
             try {
                 return node_fs_1.default.existsSync(node_path_1.default.join(dir, name));
             }
@@ -288,8 +296,9 @@ function resolveProfileMachineUuid(profile, hardware) {
                 return false;
             }
         });
+        const preExisting = evidence.length > 0;
         chosen = preExisting ? hardware : qualifyMachineUuid(hardware, profile);
-        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile);
+        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile, evidence);
     }
     preserveRecoveryChoice(profile, hardware, chosen);
     profileChoiceCache.set(cacheKey, chosen);
@@ -309,14 +318,129 @@ function resolveProfileMachineUuid(profile, hardware) {
  * profile that already held credentials; see the block above.
  */
 function getMachineUuid() {
+    return getMachineUuidForProfile(activeMachineProfile);
+}
+/**
+ * The `machineUuid` a process running as `profile` sends, WITHOUT changing which
+ * profile this process runs as.
+ *
+ * The CLI needs the answer for the profile it is about to hand a credential to,
+ * and asks the daemon binary what IT will send (`accept-handoff --print-id`).
+ * Two programs that compute one identity can only be known to agree by
+ * comparing them, and a daemon that predates per-profile identities does not
+ * agree: it sends the hardware value whatever the profile's
+ * `machine-identity.json` says, so a credential minted for what it reports
+ * registers the profile on the default machine's row (the OSK-13845 failure, now
+ * reached through version skew rather than through the rule). The comparison
+ * needs this: the expected value for the TARGET profile, which is not
+ * necessarily the one this process is running as.
+ *
+ * Decides and persists the profile's identity if nothing has yet — the same
+ * side effect `getMachineUuid()` has, for the same reason.
+ */
+function getMachineUuidForProfile(profile) {
     const hardware = getHardwareMachineUuid();
     // A hosted runtime's identity is ISSUED and fenced by the control plane.
     if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID'))
         return hardware;
-    const profile = activeMachineProfile;
-    if (!profile || profile === DEFAULT_PROFILE_NAME)
+    const name = typeof profile === 'string' ? profile.trim() : '';
+    if (!name || name === DEFAULT_PROFILE_NAME)
         return hardware;
-    return resolveProfileMachineUuid(profile, hardware);
+    return resolveProfileMachineUuid(name, hardware);
+}
+function readRecordedChoice(profile) {
+    try {
+        const file = node_path_1.default.join((0, configRoot_js_1.resolveConfigRoot)(), 'profiles', profile, exports.MACHINE_IDENTITY_FILENAME);
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(file, 'utf-8'));
+        const reason = parsed.reason === 'new_profile' ||
+            parsed.reason === 'pre_existing_profile' ||
+            parsed.reason === 'restored_profile'
+            ? parsed.reason
+            : null;
+        return {
+            reason,
+            evidence: Array.isArray(parsed.evidence)
+                ? parsed.evidence.filter((e) => typeof e === 'string')
+                : [],
+            decidedAt: typeof parsed.decidedAt === 'string' ? parsed.decidedAt : null,
+        };
+    }
+    catch {
+        return { reason: null, evidence: [], decidedAt: null };
+    }
+}
+/**
+ * Which machine this process registers as, and WHY — the question a person has
+ * when two profiles turn up on one machine page and the logs say nothing.
+ *
+ * A read, not a decision: it reports the identity `getMachineUuid()` settled on
+ * (settling it if nothing has, exactly as any caller would) and the record that
+ * explains it. It never changes what a profile registers as.
+ */
+function describeMachineIdentity() {
+    const hardware = getHardwareMachineUuid();
+    const machineUuid = getMachineUuid();
+    const active = activeMachineProfile;
+    const profile = active && active !== DEFAULT_PROFILE_NAME ? active : null;
+    const base = { profile, machineUuid, hardware };
+    if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID')) {
+        return {
+            ...base,
+            sharesDefaultMachine: false,
+            reason: 'hosted_runtime',
+            evidence: [],
+            decidedAt: null,
+            sentence: 'This runtime is hosted; its machine identity was issued by the control plane.',
+        };
+    }
+    if (!profile) {
+        return {
+            ...base,
+            sharesDefaultMachine: false,
+            reason: 'default_profile',
+            evidence: [],
+            decidedAt: null,
+            sentence: "The default profile uses this computer's own machine identity.",
+        };
+    }
+    const recorded = readRecordedChoice(profile);
+    const sharesDefaultMachine = machineUuid === hardware;
+    const reason = recorded.reason ?? 'unrecorded';
+    const decided = recorded.decidedAt ? ` (decided ${recorded.decidedAt})` : '';
+    const held = recorded.evidence.length > 0 ? ` (${recorded.evidence.join(', ')})` : '';
+    let sentence;
+    if (reason === 'new_profile') {
+        sentence =
+            `Profile '${profile}' has its own machine identity: it held no credentials when that ` +
+                `identity was first chosen${decided}.`;
+    }
+    else if (reason === 'pre_existing_profile') {
+        sentence =
+            `Profile '${profile}' shares this computer's default machine identity: it already held ` +
+                `credentials${held} when its identity was first chosen${decided}, and the server ties ` +
+                'those credentials to that identity, so changing it would sign the profile out.';
+    }
+    else if (reason === 'restored_profile') {
+        sentence = sharesDefaultMachine
+            ? `Profile '${profile}' shares this computer's default machine identity, restored from the ` +
+                `copy kept outside the profile after its state was removed${decided}.`
+            : `Profile '${profile}' has its own machine identity, restored from the copy kept outside ` +
+                `the profile after its state was removed${decided}.`;
+    }
+    else {
+        sentence = sharesDefaultMachine
+            ? `Profile '${profile}' uses this computer's default machine identity; the record of why ` +
+                'could not be read.'
+            : `Profile '${profile}' has its own machine identity; the record of why could not be read.`;
+    }
+    return {
+        ...base,
+        sharesDefaultMachine,
+        reason,
+        evidence: recorded.evidence,
+        decidedAt: recorded.decidedAt,
+        sentence,
+    };
 }
 /** @internal test seam — forget the cached value so the next call re-probes. */
 function __resetMachineUuidCacheForTest() {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/workspaceIsolationProbeWire.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The workspace-isolation probe wire contract (OSK-15099).
+ *
+ * A Commitment Run is always isolated: the daemon cuts it a private git
+ * worktree from the directory the Run is rooted in, and refuses the Run with
+ * `EXECUTION_ISOLATION_UNAVAILABLE` before any tool when it cannot. Preflight
+ * had no way to read that machine's filesystem, so it reported `ready`,
+ * activation succeeded, and the first Run failed. The daemon now answers the
+ * same question BEFORE a Run, through the same predicate its executor refuses
+ * on, and this module is the one place both ends spell it.
+ *
+ * - The daemon announces {@link WORKSPACE_ISOLATION_PROBE_CAPABILITY}. A daemon
+ *   that does not is never asked, and the server reports the prerequisite as
+ *   UNVERIFIED — never as satisfied (unknown is never ok).
+ * - The server sends {@link WORKSPACE_ISOLATION_PROBE_METHOD} as a control RPC
+ *   with `{ workingDirectory? }`: exactly the directory it would put on the
+ *   Run's request (`agent.workingDirectory || daemon cwd`).
+ * - The daemon answers {@link WorkspaceIsolationProbeAnswer}.
+ *
+ * Pure: no I/O, safe for the browser, the CLI and the API.
+ */
+export declare const WORKSPACE_ISOLATION_PROBE_CAPABILITY: "workspace_isolation_probe_v1";
+export declare const WORKSPACE_ISOLATION_PROBE_METHOD: "daemon:workspace:isolation-probe";
+/**
+ * What an explicit isolation request can be given from a base directory.
+ *
+ *   - `worktree`          — a git repository with a commit: a worktree is cut;
+ *   - `sandbox`           — the daemon's own bare scratch workspace: an empty
+ *                           private sandbox is used instead;
+ *   - `not_a_repository`  — refused: not inside a git repository;
+ *   - `no_initial_commit` — refused: a repository with an unborn HEAD.
+ */
+export declare const WORKTREE_BASE_VERDICTS: readonly ["worktree", "sandbox", "not_a_repository", "no_initial_commit"];
+export type WorktreeBaseVerdict = (typeof WORKTREE_BASE_VERDICTS)[number];
+/** The verdicts on which the daemon refuses an isolated Run before any tool. */
+export declare const REFUSING_WORKTREE_BASE_VERDICTS: ReadonlySet<WorktreeBaseVerdict>;
+export declare function isWorktreeBaseVerdict(value: unknown): value is WorktreeBaseVerdict;
+export interface WorkspaceIsolationProbeRequest {
+    /** Omitted: the daemon resolves its own default, as it would for the Run. */
+    workingDirectory?: string;
+}
+export interface WorkspaceIsolationProbeAnswer {
+    /** The directory a Run asked with this `workingDirectory` would be rooted in. */
+    baseCwd: string;
+    /** Whether a person chose it (agent/task directory or configured default). */
+    chosenExplicitly: boolean;
+    verdict: WorktreeBaseVerdict;
+    /** The refusal sentence the Run would fail with; null when it would be admitted. */
+    remedy: string | null;
+    checkedAt: string;
+}