@skrr-ai/cli 0.1.108 → 0.1.110

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/workspaceIsolationProbeWire.js

@@ -0,0 +1,50 @@
+"use strict";
+/**
+ * The workspace-isolation probe wire contract (OSK-15099).
+ *
+ * A Commitment Run is always isolated: the daemon cuts it a private git
+ * worktree from the directory the Run is rooted in, and refuses the Run with
+ * `EXECUTION_ISOLATION_UNAVAILABLE` before any tool when it cannot. Preflight
+ * had no way to read that machine's filesystem, so it reported `ready`,
+ * activation succeeded, and the first Run failed. The daemon now answers the
+ * same question BEFORE a Run, through the same predicate its executor refuses
+ * on, and this module is the one place both ends spell it.
+ *
+ * - The daemon announces {@link WORKSPACE_ISOLATION_PROBE_CAPABILITY}. A daemon
+ *   that does not is never asked, and the server reports the prerequisite as
+ *   UNVERIFIED — never as satisfied (unknown is never ok).
+ * - The server sends {@link WORKSPACE_ISOLATION_PROBE_METHOD} as a control RPC
+ *   with `{ workingDirectory? }`: exactly the directory it would put on the
+ *   Run's request (`agent.workingDirectory || daemon cwd`).
+ * - The daemon answers {@link WorkspaceIsolationProbeAnswer}.
+ *
+ * Pure: no I/O, safe for the browser, the CLI and the API.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFUSING_WORKTREE_BASE_VERDICTS = exports.WORKTREE_BASE_VERDICTS = exports.WORKSPACE_ISOLATION_PROBE_METHOD = exports.WORKSPACE_ISOLATION_PROBE_CAPABILITY = void 0;
+exports.isWorktreeBaseVerdict = isWorktreeBaseVerdict;
+exports.WORKSPACE_ISOLATION_PROBE_CAPABILITY = 'workspace_isolation_probe_v1';
+exports.WORKSPACE_ISOLATION_PROBE_METHOD = 'daemon:workspace:isolation-probe';
+/**
+ * What an explicit isolation request can be given from a base directory.
+ *
+ *   - `worktree`          — a git repository with a commit: a worktree is cut;
+ *   - `sandbox`           — the daemon's own bare scratch workspace: an empty
+ *                           private sandbox is used instead;
+ *   - `not_a_repository`  — refused: not inside a git repository;
+ *   - `no_initial_commit` — refused: a repository with an unborn HEAD.
+ */
+exports.WORKTREE_BASE_VERDICTS = Object.freeze([
+    'worktree',
+    'sandbox',
+    'not_a_repository',
+    'no_initial_commit',
+]);
+/** The verdicts on which the daemon refuses an isolated Run before any tool. */
+exports.REFUSING_WORKTREE_BASE_VERDICTS = new Set([
+    'not_a_repository',
+    'no_initial_commit',
+]);
+function isWorktreeBaseVerdict(value) {
+    return typeof value === 'string' && exports.WORKTREE_BASE_VERDICTS.includes(value);
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -30,7 +30,7 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
-export { getMachineUuid, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
+export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -125,7 +125,7 @@ __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest,
 // Hardware machine identity sent as `machineUuid` (IOPlatformUUID /
 // machine-id / MachineGuid). ONE implementation for daemon and CLI —
 // OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
-export { getMachineUuid, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
+export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 // Stable per-machine UUIDv7 identity persisted at <configDir>/daemon.id.
 // NOT a `machineUuid` — see machineUuid.ts.
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/machineUuid.d.ts

@@ -56,5 +56,65 @@ export declare function getMachineUuidProfile(): string | null;
  * profile that already held credentials; see the block above.
  */
 export declare function getMachineUuid(): string;
+/**
+ * The `machineUuid` a process running as `profile` sends, WITHOUT changing which
+ * profile this process runs as.
+ *
+ * The CLI needs the answer for the profile it is about to hand a credential to,
+ * and asks the daemon binary what IT will send (`accept-handoff --print-id`).
+ * Two programs that compute one identity can only be known to agree by
+ * comparing them, and a daemon that predates per-profile identities does not
+ * agree: it sends the hardware value whatever the profile's
+ * `machine-identity.json` says, so a credential minted for what it reports
+ * registers the profile on the default machine's row (the OSK-13845 failure, now
+ * reached through version skew rather than through the rule). The comparison
+ * needs this: the expected value for the TARGET profile, which is not
+ * necessarily the one this process is running as.
+ *
+ * Decides and persists the profile's identity if nothing has yet — the same
+ * side effect `getMachineUuid()` has, for the same reason.
+ */
+export declare function getMachineUuidForProfile(profile: string | null | undefined): string;
+export type MachineIdentityReason = 
+/** The default profile, which always uses this computer's own identity. */
+'default_profile'
+/** A hosted runtime, whose identity the control plane issued. */
+ | 'hosted_runtime'
+/** A profile that held no credentials when its identity was first decided. */
+ | 'new_profile'
+/** A profile that already held credentials, so it keeps the shared identity. */
+ | 'pre_existing_profile'
+/** Recovered from the copy kept outside the profile after product state was removed. */
+ | 'restored_profile'
+/** The profile's record could not be read (the identity is still the one in use). */
+ | 'unrecorded';
+export interface MachineIdentityDescription {
+    /** The profile this process runs as; null for the default profile. */
+    profile: string | null;
+    /** The value sent to the server as `machineUuid`. */
+    machineUuid: string;
+    /** This computer's own identity. */
+    hardware: string;
+    /**
+     * A non-default profile that registers on the SAME machine row as the default
+     * profile: they share one Daemon row, one device-key pin and one machine page.
+     */
+    sharesDefaultMachine: boolean;
+    reason: MachineIdentityReason;
+    /** The files that made a profile "already hold credentials", when recorded. */
+    evidence: string[];
+    decidedAt: string | null;
+    /** One sentence for a person. Written once, here, so no surface words it differently. */
+    sentence: string;
+}
+/**
+ * Which machine this process registers as, and WHY — the question a person has
+ * when two profiles turn up on one machine page and the logs say nothing.
+ *
+ * A read, not a decision: it reports the identity `getMachineUuid()` settled on
+ * (settling it if nothing has, exactly as any caller would) and the record that
+ * explains it. It never changes what a profile registers as.
+ */
+export declare function describeMachineIdentity(): MachineIdentityDescription;
 /** @internal test seam — forget the cached value so the next call re-probes. */
 export declare function __resetMachineUuidCacheForTest(): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/machineUuid.js

@@ -218,7 +218,7 @@ function readPersistedChoice(file, hardware, profile, requireProfile = false) {
         return null;
     }
 }
-function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
+function persistChoice(dir, file, hardware, machineUuid, reason, profile, evidence) {
     try {
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
         const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
@@ -228,6 +228,12 @@ function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
             machineUuid,
             profile,
             reason,
+            // WHICH file made a profile "already hold credentials". The reason alone
+            // says a profile shares the default's machine row; this says what put it
+            // there, which is the difference between "an older Skrr set it up" and
+            // "its first credential was written before anything chose its identity".
+            // Additive: a reader that predates it ignores the field.
+            ...(evidence && evidence.length > 0 ? { evidence: [...evidence] } : {}),
             decidedAt: new Date().toISOString(),
         };
         fs.writeFileSync(tmp, `${JSON.stringify(body)}\n`, { mode: 0o600 });
@@ -267,7 +273,7 @@ function resolveProfileMachineUuid(profile, hardware) {
             persistChoice(dir, file, hardware, chosen, 'restored_profile', profile);
     }
     if (!chosen) {
-        const preExisting = PRE_EXISTING_PROFILE_EVIDENCE.some((name) => {
+        const evidence = PRE_EXISTING_PROFILE_EVIDENCE.filter((name) => {
             try {
                 return fs.existsSync(path.join(dir, name));
             }
@@ -275,8 +281,9 @@ function resolveProfileMachineUuid(profile, hardware) {
                 return false;
             }
         });
+        const preExisting = evidence.length > 0;
         chosen = preExisting ? hardware : qualifyMachineUuid(hardware, profile);
-        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile);
+        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile, evidence);
     }
     preserveRecoveryChoice(profile, hardware, chosen);
     profileChoiceCache.set(cacheKey, chosen);
@@ -296,14 +303,129 @@ function resolveProfileMachineUuid(profile, hardware) {
  * profile that already held credentials; see the block above.
  */
 export function getMachineUuid() {
+    return getMachineUuidForProfile(activeMachineProfile);
+}
+/**
+ * The `machineUuid` a process running as `profile` sends, WITHOUT changing which
+ * profile this process runs as.
+ *
+ * The CLI needs the answer for the profile it is about to hand a credential to,
+ * and asks the daemon binary what IT will send (`accept-handoff --print-id`).
+ * Two programs that compute one identity can only be known to agree by
+ * comparing them, and a daemon that predates per-profile identities does not
+ * agree: it sends the hardware value whatever the profile's
+ * `machine-identity.json` says, so a credential minted for what it reports
+ * registers the profile on the default machine's row (the OSK-13845 failure, now
+ * reached through version skew rather than through the rule). The comparison
+ * needs this: the expected value for the TARGET profile, which is not
+ * necessarily the one this process is running as.
+ *
+ * Decides and persists the profile's identity if nothing has yet — the same
+ * side effect `getMachineUuid()` has, for the same reason.
+ */
+export function getMachineUuidForProfile(profile) {
     const hardware = getHardwareMachineUuid();
     // A hosted runtime's identity is ISSUED and fenced by the control plane.
     if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID'))
         return hardware;
-    const profile = activeMachineProfile;
-    if (!profile || profile === DEFAULT_PROFILE_NAME)
+    const name = typeof profile === 'string' ? profile.trim() : '';
+    if (!name || name === DEFAULT_PROFILE_NAME)
         return hardware;
-    return resolveProfileMachineUuid(profile, hardware);
+    return resolveProfileMachineUuid(name, hardware);
+}
+function readRecordedChoice(profile) {
+    try {
+        const file = path.join(resolveConfigRoot(), 'profiles', profile, MACHINE_IDENTITY_FILENAME);
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        const reason = parsed.reason === 'new_profile' ||
+            parsed.reason === 'pre_existing_profile' ||
+            parsed.reason === 'restored_profile'
+            ? parsed.reason
+            : null;
+        return {
+            reason,
+            evidence: Array.isArray(parsed.evidence)
+                ? parsed.evidence.filter((e) => typeof e === 'string')
+                : [],
+            decidedAt: typeof parsed.decidedAt === 'string' ? parsed.decidedAt : null,
+        };
+    }
+    catch {
+        return { reason: null, evidence: [], decidedAt: null };
+    }
+}
+/**
+ * Which machine this process registers as, and WHY — the question a person has
+ * when two profiles turn up on one machine page and the logs say nothing.
+ *
+ * A read, not a decision: it reports the identity `getMachineUuid()` settled on
+ * (settling it if nothing has, exactly as any caller would) and the record that
+ * explains it. It never changes what a profile registers as.
+ */
+export function describeMachineIdentity() {
+    const hardware = getHardwareMachineUuid();
+    const machineUuid = getMachineUuid();
+    const active = activeMachineProfile;
+    const profile = active && active !== DEFAULT_PROFILE_NAME ? active : null;
+    const base = { profile, machineUuid, hardware };
+    if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID')) {
+        return {
+            ...base,
+            sharesDefaultMachine: false,
+            reason: 'hosted_runtime',
+            evidence: [],
+            decidedAt: null,
+            sentence: 'This runtime is hosted; its machine identity was issued by the control plane.',
+        };
+    }
+    if (!profile) {
+        return {
+            ...base,
+            sharesDefaultMachine: false,
+            reason: 'default_profile',
+            evidence: [],
+            decidedAt: null,
+            sentence: "The default profile uses this computer's own machine identity.",
+        };
+    }
+    const recorded = readRecordedChoice(profile);
+    const sharesDefaultMachine = machineUuid === hardware;
+    const reason = recorded.reason ?? 'unrecorded';
+    const decided = recorded.decidedAt ? ` (decided ${recorded.decidedAt})` : '';
+    const held = recorded.evidence.length > 0 ? ` (${recorded.evidence.join(', ')})` : '';
+    let sentence;
+    if (reason === 'new_profile') {
+        sentence =
+            `Profile '${profile}' has its own machine identity: it held no credentials when that ` +
+                `identity was first chosen${decided}.`;
+    }
+    else if (reason === 'pre_existing_profile') {
+        sentence =
+            `Profile '${profile}' shares this computer's default machine identity: it already held ` +
+                `credentials${held} when its identity was first chosen${decided}, and the server ties ` +
+                'those credentials to that identity, so changing it would sign the profile out.';
+    }
+    else if (reason === 'restored_profile') {
+        sentence = sharesDefaultMachine
+            ? `Profile '${profile}' shares this computer's default machine identity, restored from the ` +
+                `copy kept outside the profile after its state was removed${decided}.`
+            : `Profile '${profile}' has its own machine identity, restored from the copy kept outside ` +
+                `the profile after its state was removed${decided}.`;
+    }
+    else {
+        sentence = sharesDefaultMachine
+            ? `Profile '${profile}' uses this computer's default machine identity; the record of why ` +
+                'could not be read.'
+            : `Profile '${profile}' has its own machine identity; the record of why could not be read.`;
+    }
+    return {
+        ...base,
+        sharesDefaultMachine,
+        reason,
+        evidence: recorded.evidence,
+        decidedAt: recorded.decidedAt,
+        sentence,
+    };
 }
 /** @internal test seam — forget the cached value so the next call re-probes. */
 export function __resetMachineUuidCacheForTest() {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/workspaceIsolationProbeWire.d.ts

@@ -0,0 +1,51 @@
+/**
+ * The workspace-isolation probe wire contract (OSK-15099).
+ *
+ * A Commitment Run is always isolated: the daemon cuts it a private git
+ * worktree from the directory the Run is rooted in, and refuses the Run with
+ * `EXECUTION_ISOLATION_UNAVAILABLE` before any tool when it cannot. Preflight
+ * had no way to read that machine's filesystem, so it reported `ready`,
+ * activation succeeded, and the first Run failed. The daemon now answers the
+ * same question BEFORE a Run, through the same predicate its executor refuses
+ * on, and this module is the one place both ends spell it.
+ *
+ * - The daemon announces {@link WORKSPACE_ISOLATION_PROBE_CAPABILITY}. A daemon
+ *   that does not is never asked, and the server reports the prerequisite as
+ *   UNVERIFIED — never as satisfied (unknown is never ok).
+ * - The server sends {@link WORKSPACE_ISOLATION_PROBE_METHOD} as a control RPC
+ *   with `{ workingDirectory? }`: exactly the directory it would put on the
+ *   Run's request (`agent.workingDirectory || daemon cwd`).
+ * - The daemon answers {@link WorkspaceIsolationProbeAnswer}.
+ *
+ * Pure: no I/O, safe for the browser, the CLI and the API.
+ */
+export declare const WORKSPACE_ISOLATION_PROBE_CAPABILITY: "workspace_isolation_probe_v1";
+export declare const WORKSPACE_ISOLATION_PROBE_METHOD: "daemon:workspace:isolation-probe";
+/**
+ * What an explicit isolation request can be given from a base directory.
+ *
+ *   - `worktree`          — a git repository with a commit: a worktree is cut;
+ *   - `sandbox`           — the daemon's own bare scratch workspace: an empty
+ *                           private sandbox is used instead;
+ *   - `not_a_repository`  — refused: not inside a git repository;
+ *   - `no_initial_commit` — refused: a repository with an unborn HEAD.
+ */
+export declare const WORKTREE_BASE_VERDICTS: readonly ["worktree", "sandbox", "not_a_repository", "no_initial_commit"];
+export type WorktreeBaseVerdict = (typeof WORKTREE_BASE_VERDICTS)[number];
+/** The verdicts on which the daemon refuses an isolated Run before any tool. */
+export declare const REFUSING_WORKTREE_BASE_VERDICTS: ReadonlySet<WorktreeBaseVerdict>;
+export declare function isWorktreeBaseVerdict(value: unknown): value is WorktreeBaseVerdict;
+export interface WorkspaceIsolationProbeRequest {
+    /** Omitted: the daemon resolves its own default, as it would for the Run. */
+    workingDirectory?: string;
+}
+export interface WorkspaceIsolationProbeAnswer {
+    /** The directory a Run asked with this `workingDirectory` would be rooted in. */
+    baseCwd: string;
+    /** Whether a person chose it (agent/task directory or configured default). */
+    chosenExplicitly: boolean;
+    verdict: WorktreeBaseVerdict;
+    /** The refusal sentence the Run would fail with; null when it would be admitted. */
+    remedy: string | null;
+    checkedAt: string;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/workspaceIsolationProbeWire.js

@@ -0,0 +1,46 @@
+/**
+ * The workspace-isolation probe wire contract (OSK-15099).
+ *
+ * A Commitment Run is always isolated: the daemon cuts it a private git
+ * worktree from the directory the Run is rooted in, and refuses the Run with
+ * `EXECUTION_ISOLATION_UNAVAILABLE` before any tool when it cannot. Preflight
+ * had no way to read that machine's filesystem, so it reported `ready`,
+ * activation succeeded, and the first Run failed. The daemon now answers the
+ * same question BEFORE a Run, through the same predicate its executor refuses
+ * on, and this module is the one place both ends spell it.
+ *
+ * - The daemon announces {@link WORKSPACE_ISOLATION_PROBE_CAPABILITY}. A daemon
+ *   that does not is never asked, and the server reports the prerequisite as
+ *   UNVERIFIED — never as satisfied (unknown is never ok).
+ * - The server sends {@link WORKSPACE_ISOLATION_PROBE_METHOD} as a control RPC
+ *   with `{ workingDirectory? }`: exactly the directory it would put on the
+ *   Run's request (`agent.workingDirectory || daemon cwd`).
+ * - The daemon answers {@link WorkspaceIsolationProbeAnswer}.
+ *
+ * Pure: no I/O, safe for the browser, the CLI and the API.
+ */
+export const WORKSPACE_ISOLATION_PROBE_CAPABILITY = 'workspace_isolation_probe_v1';
+export const WORKSPACE_ISOLATION_PROBE_METHOD = 'daemon:workspace:isolation-probe';
+/**
+ * What an explicit isolation request can be given from a base directory.
+ *
+ *   - `worktree`          — a git repository with a commit: a worktree is cut;
+ *   - `sandbox`           — the daemon's own bare scratch workspace: an empty
+ *                           private sandbox is used instead;
+ *   - `not_a_repository`  — refused: not inside a git repository;
+ *   - `no_initial_commit` — refused: a repository with an unborn HEAD.
+ */
+export const WORKTREE_BASE_VERDICTS = Object.freeze([
+    'worktree',
+    'sandbox',
+    'not_a_repository',
+    'no_initial_commit',
+]);
+/** The verdicts on which the daemon refuses an isolated Run before any tool. */
+export const REFUSING_WORKTREE_BASE_VERDICTS = new Set([
+    'not_a_repository',
+    'no_initial_commit',
+]);
+export function isWorktreeBaseVerdict(value) {
+    return typeof value === 'string' && WORKTREE_BASE_VERDICTS.includes(value);
+}

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.25",
+  "version": "0.4.27",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {
@@ -144,6 +144,16 @@
         "default": "./dist/cjs/dedicatedRuntimeWakeWire.js"
       }
     },
+    "./workspace-isolation-probe-wire": {
+      "import": {
+        "types": "./dist/esm/workspaceIsolationProbeWire.d.ts",
+        "default": "./dist/esm/workspaceIsolationProbeWire.js"
+      },
+      "require": {
+        "types": "./dist/cjs/workspaceIsolationProbeWire.d.ts",
+        "default": "./dist/cjs/workspaceIsolationProbeWire.js"
+      }
+    },
     "./commitment-execution-contract": {
       "import": {
         "types": "./dist/esm/commitmentExecutionContract.d.ts",