@skrr-ai/cli 0.1.110 → 0.1.111

package/dist/lib/triggers.js

@@ -42,6 +42,7 @@ exports.onceDueAt = onceDueAt;
 exports.nextRunLabel = nextRunLabel;
 exports.armedLabel = armedLabel;
 exports.degradedMarker = degradedMarker;
+exports.sensorHealthLines = sensorHealthLines;
 exports.renderTriggerList = renderTriggerList;
 exports.formatDuplicateSubscriptionWarning = formatDuplicateSubscriptionWarning;
 exports.armedStateLabel = armedStateLabel;
@@ -1118,8 +1119,48 @@ function armedLabel(trigger) {
  * Marked here so the list says it, not only `triggers show`.
  */
 function degradedMarker(trigger) {
-    const reason = trigger.execution?.sensor?.state?.degradedReason;
-    return reason ? ' (degraded)' : '';
+    const state = trigger.execution?.sensor?.state;
+    // A sensor that stopped ITSELF reads `no` exactly like one its owner turned
+    // off; only the stop reason tells them apart.
+    if (trigger.enabled === false && state?.disabledReason)
+        return ' (stopped)';
+    if (state?.degradedReason)
+        return ' (degraded)';
+    if (state?.retryAfter && Date.parse(state.retryAfter) > Date.now())
+        return ' (backing off)';
+    return '';
+}
+/**
+ * Feed health lines for `triggers show`: whether the sensor stopped itself and
+ * why, whether it is backing off, and when the source was last read. A stop
+ * the engine made used to be a field nothing printed, so a sensor that had
+ * given up looked like one that was switched off.
+ */
+function sensorHealthLines(trigger, now = Date.now()) {
+    const state = trigger.execution?.sensor?.state;
+    if (!state)
+        return [];
+    const lines = [];
+    if (state.disabledReason) {
+        const why = data_provider_1.SENSOR_DISABLED_COPY[state.disabledReason] ?? state.disabledReason;
+        const http = state.lastHttpStatus ? ` (HTTP ${state.lastHttpStatus})` : '';
+        const when = state.disabledAt ? ` at ${state.disabledAt}` : '';
+        if (trigger.enabled === false) {
+            lines.push(`Stopped:  ${state.disabledCode ?? 'observation_failed'}${http}${when} — ${why}; fix the cause, then \`skrr triggers enable ${trigger.id ?? '<id>'}\``);
+        }
+    }
+    if (trigger.enabled !== false && state.retryAfter && Date.parse(state.retryAfter) > now) {
+        lines.push(`Backoff:  next poll after ${state.retryAfter}${state.lastErrorCode ? ` (after ${state.lastErrorCode})` : ''}`);
+    }
+    if (state.lastSuccessAt)
+        lines.push(`Last OK:  ${state.lastSuccessAt}`);
+    // `polls` counts successful reads, so 0 with an attempt on record is "never"
+    // and not a row that predates `lastSuccessAt`.
+    else if (state.lastCheckedAt && !state.polls)
+        lines.push('Last OK:  never (the source has not been read successfully)');
+    if (state.lastChangeAt)
+        lines.push(`Changed:  ${state.lastChangeAt}`);
+    return lines;
 }
 function renderTriggerList(triggers, log) {
     if (triggers.length === 0) {
@@ -1141,12 +1182,18 @@ function renderTriggerList(triggers, log) {
         { key: 'next', header: 'NEXT/LAST', maxWidth: 24 },
         { key: 'label', header: 'LABEL', maxWidth: 32 },
     ], log);
-    const degraded = triggers.filter((t) => degradedMarker(t));
+    const degraded = triggers.filter((t) => degradedMarker(t) === ' (degraded)');
     if (degraded.length > 0) {
         log('');
         log(`${degraded.length} trigger(s) are enabled but degraded — ` +
             'see `Degraded:` in `triggers show <id>`.');
     }
+    const stopped = triggers.filter((t) => degradedMarker(t) === ' (stopped)');
+    if (stopped.length > 0) {
+        log('');
+        log(`${stopped.length} sensor(s) stopped themselves — ` +
+            'see `Stopped:` in `triggers show <id>`; fix the cause, then `triggers enable <id>`.');
+    }
     const unsynced = triggers.filter((t) => armedLabel(t).startsWith('!'));
     if (unsynced.length > 0) {
         log('');
@@ -1282,11 +1329,14 @@ function renderTriggerSummary(trigger, log, options = {}) {
         if (st.itemFailurePolls)
             log(`Items:    failing for ${st.itemFailurePolls} poll(s) in a row`);
     }
+    if (sensor?.state)
+        for (const line of sensorHealthLines(trigger))
+            log(line);
     // The sensor is degraded, not just carrying a line of text: say it first.
     if (sensor?.state?.degradedReason)
         log(`Degraded: ${sensor.state.degradedReason}`);
     if (sensor?.state?.consecutiveErrors)
-        log(`Errors:   ${sensor.state.consecutiveErrors} feed failure(s) in a row (the sensor disables itself if the feed keeps failing)`);
+        log(`Errors:   ${sensor.state.consecutiveErrors} feed failure(s) in a row${sensor.state.lastErrorCode ? `, latest ${sensor.state.lastErrorCode}${sensor.state.lastHttpStatus ? ` (HTTP ${sensor.state.lastHttpStatus})` : ''}` : ''} (the sensor stops itself if the feed keeps failing)`);
     if (sensor?.state?.lastError)
         log(`Problem:  ${sensor.state.lastError}`);
     // An `external_work_task` writes into someone else's system, and which

package/dist/lib/usage-discovery.d.ts

@@ -29,6 +29,10 @@ export declare const USAGE_OVERVIEW_TOKEN_BUDGET = 240;
  * grouping changes, and `skrr usage <folded>` resolves to the host page, which
  * names the folded topic in an `Includes:` line so it stays reachable.
  * `proposals` is the unified proposal inbox, so it reads as part of `inbox`.
+ * `apps` (author, install and approve an Agent App) is the packaged form of a widget: `skrr apps check` extends
+ * `skrr widgets check`, and the app runs in the same frame. Its own overview line took the first read from 240 to 241
+ * tokens, and this file's rule for that is to fold into a domain that already has the concept, not to raise the bound.
+ * `skrr usage apps` still resolves, to the `widgets` pages, which name it in `Includes:`.
  */
 export declare const USAGE_DOMAIN_FOLDS: Readonly<Record<string, string>>;
 export declare const USAGE_DOMAIN_TOKEN_BUDGET = 500;

package/dist/lib/usage-discovery.js

@@ -40,8 +40,15 @@ exports.USAGE_OVERVIEW_TOKEN_BUDGET = 240;
  * grouping changes, and `skrr usage <folded>` resolves to the host page, which
  * names the folded topic in an `Includes:` line so it stays reachable.
  * `proposals` is the unified proposal inbox, so it reads as part of `inbox`.
+ * `apps` (author, install and approve an Agent App) is the packaged form of a widget: `skrr apps check` extends
+ * `skrr widgets check`, and the app runs in the same frame. Its own overview line took the first read from 240 to 241
+ * tokens, and this file's rule for that is to fold into a domain that already has the concept, not to raise the bound.
+ * `skrr usage apps` still resolves, to the `widgets` pages, which name it in `Includes:`.
  */
-exports.USAGE_DOMAIN_FOLDS = { proposals: 'inbox' };
+exports.USAGE_DOMAIN_FOLDS = {
+    proposals: 'inbox',
+    apps: 'widgets',
+};
 exports.USAGE_DOMAIN_TOKEN_BUDGET = 500;
 const GENERIC_FLAGS = new Set(['bare', 'help', 'json', 'token', 'workspace']);
 /**
@@ -98,13 +105,13 @@ function buildUsageReference(manifest, domainInput, options = {}) {
     const bin = options.bin ?? 'skrr';
     const entries = groupEntries(manifest).get(domain) ?? [];
     const commands = entries.map((entry) => usageCommand(entry, bin));
-    const pages = paginate(commands, domain, bin);
+    const includes = foldedTopics(manifest, domain);
+    const pages = paginate(commands, domain, bin, includes);
     const requested = options.page ?? 1;
     const index = requested - 1;
     if (!Number.isInteger(requested) || index < 0 || index >= pages.length)
         return undefined;
     const data = pages[index];
-    const includes = foldedTopics(manifest, domain);
     const draft = {
         object: 'sky_usage_reference',
         generatedFrom: 'oclif.manifest.json',
@@ -229,7 +236,7 @@ function compact(value, maxCharacters) {
         return normalized;
     return `${normalized.slice(0, Math.max(0, maxCharacters - 1)).trimEnd()}…`;
 }
-function paginate(commands, domain, bin) {
+function paginate(commands, domain, bin, includes) {
     const pages = [];
     let page = [];
     for (const command of commands) {
@@ -241,6 +248,9 @@ function paginate(commands, domain, bin) {
             object: 'sky_usage_reference',
             generatedFrom: 'oclif.manifest.json',
             domain,
+            // the `Includes:` line is part of every page's header, so it is part of what a page is measured against: a
+            // folded domain's pages were measured one line short, and a page could land one token over its budget
+            ...(includes.length > 0 ? { includes } : {}),
             tokenBudget: exports.USAGE_DOMAIN_TOKEN_BUDGET,
             estimatedTokens: 0,
             page: 999,

package/dist/lib/widgetApps.d.ts

@@ -0,0 +1,10 @@
+import type { AppProjectionLoss } from '@skrr-ai/data-provider';
+import type { AppsRefusal } from './apps';
+/** Is this refusal code one of the projection's own (a widget that cannot be an app)? */
+export declare function isProjectionRefusal(code: unknown): code is string;
+/** The machine code `skrr` exits under for one of the projection's refusals. */
+export declare function projectionRefusalCode(code: string): string;
+/** One line saying what the app does not carry, for a loss the projection reported. */
+export declare function describeProjectionLoss(loss: AppProjectionLoss): string;
+/** The words for a widget that cannot be saved as an app, from what the server said. */
+export declare function describeWidgetAppRefusal(refusal: AppsRefusal): string;

package/dist/lib/widgetApps.js

@@ -0,0 +1,47 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isProjectionRefusal = isProjectionRefusal;
+exports.projectionRefusalCode = projectionRefusalCode;
+exports.describeProjectionLoss = describeProjectionLoss;
+exports.describeWidgetAppRefusal = describeWidgetAppRefusal;
+/**
+ * `skrr widgets save-as-app`: the words a terminal needs around the call (decision D1, task p1-13).
+ *
+ * It builds no URL: the call is `dataService.saveAgentWidgetAsApp`, which is also what keeps this command
+ * reachable for `domain-api-parity.spec.ts`. The VOCABULARY is the contract's (`APP_PROJECTION_*`,
+ * `@skrr-ai/data-provider`): a reason arrives as a code and is turned into a sentence here, never declared
+ * a second time.
+ */
+const data_provider_1 = require("@skrr-ai/data-provider");
+const LOSS_REASONS = new Set(data_provider_1.APP_PROJECTION_LOSS_REASONS);
+const REFUSALS = new Set(data_provider_1.APP_PROJECTION_REFUSALS);
+/** Is this refusal code one of the projection's own (a widget that cannot be an app)? */
+function isProjectionRefusal(code) {
+    return typeof code === 'string' && REFUSALS.has(code);
+}
+/** The machine code `skrr` exits under for one of the projection's refusals. */
+function projectionRefusalCode(code) {
+    return `WIDGET_${code.toUpperCase()}`;
+}
+const LOSS_WORDS = {
+    truncated: (loss) => `${loss.field} was cut to fit the app manifest${loss.detail ? ` (it was ${loss.detail} characters)` : ''}.`,
+    forced_private: (loss) => `${loss.field}${loss.detail ? ` "${loss.detail}"` : ''} is not carried: an app draft is private to you.`,
+    not_carried: (loss) => `${loss.field}${loss.detail ? ` (${loss.detail})` : ''} stays with the widget: an app has no such setting.`,
+    never_honoured: (loss) => `${loss.field} was a switch nothing ever read, so the app does not promise it. If the app needs data, declare capabilities.store or capabilities.query in app.json.`,
+    network_not_carried: (loss) => `${loss.field}${loss.detail ? ` (${loss.detail})` : ''} is not carried: an app's frame has no network of its own. Declare capabilities.http.origins in app.json; whoever installs the app grants it.`,
+};
+/** One line saying what the app does not carry, for a loss the projection reported. */
+function describeProjectionLoss(loss) {
+    if (!LOSS_REASONS.has(loss.reason)) {
+        return `${loss.field}: not carried (${loss.reason})`;
+    }
+    return LOSS_WORDS[loss.reason](loss);
+}
+/** The words for a widget that cannot be saved as an app, from what the server said. */
+function describeWidgetAppRefusal(refusal) {
+    const lines = [refusal.message || refusal.error || 'refused'];
+    if (refusal.error === 'unsupported_type') {
+        lines.push('A react or mermaid widget keeps working as a widget. To make it an app, write it as html (`skrr apps create`, then `skrr apps file write`).');
+    }
+    return lines.join('\n');
+}

package/dist/lib/widgetStaticScan.js

@@ -454,7 +454,10 @@ const JS_RULES = [
         severity: 'warn',
         code: 'host-access',
         message: 'top. or parent. as a bare name: if this is the browsing context, it is cross-origin and throws; ignore if it is your own variable.',
-        fix: 'Use window.skrr (requestPrompt, openLink, navigate) to talk to the app.',
+        // This pattern matches a local variable called `top` as readily as the browsing context, so the fix has to be
+        // right for BOTH: rename the variable, or (if the page that hosts the frame was meant) use the bridge. A fix that
+        // spoke only of `window.skrr` read as nonsense beside a harmless `const top = el` (experiment Y2).
+        fix: 'If top (or parent) is your own variable, rename it and this finding goes away. If you meant the page that hosts the frame, the sandbox does not allow that: use window.skrr (requestPrompt, openLink, navigate) to talk to the app.',
     },
     {
         pattern: /\b(?:window|self|globalThis)\s*\.\s*open\s*\(/g,
@@ -502,8 +505,27 @@ const STRING_ARGUMENT_RULES = [
         fix: 'Use inline SVG, canvas, or a data: URI.',
     },
 ];
+/** Broker calls send a capability message; they never use the frame's network API. */
+function brokerFetchOffsets(code) {
+    const offsets = new Set();
+    const calls = /\b(?:window\s*\.\s*)?skrr\s*\.\s*app\s*\.\s*(?:http|service)\s*\.\s*fetch\s*\(/g;
+    for (const match of code.matchAll(calls)) {
+        const start = match.index ?? 0;
+        if (start > 0 && isIdentChar(code[start - 1]))
+            continue;
+        // `other . skrr.app.http.fetch` is another object's property, not the host SDK.
+        let before = start - 1;
+        while (before >= 0 && /\s/.test(code[before]))
+            before -= 1;
+        if (before >= 0 && code[before] === '.')
+            continue;
+        offsets.add(start + match[0].lastIndexOf('fetch'));
+    }
+    return offsets;
+}
 function scanJsInto(source, baseLine, out) {
     const { code, commentless, literals } = lexJs(source);
+    const brokerFetches = brokerFetchOffsets(code);
     const starts = lineStarts(source);
     const lineOf = (index) => baseLine + lineAt(starts, index) - 1;
     const codeLines = code.split('\n');
@@ -513,6 +535,8 @@ function scanJsInto(source, baseLine, out) {
     // string, a template's text or a regular expression is not a call.
     for (const rule of JS_RULES) {
         for (const match of code.matchAll(rule.pattern)) {
+            if (rule.code === 'network-api' && brokerFetches.has(match.index ?? 0))
+                continue;
             out.add(rule.severity, rule.code, lineOf(match.index ?? 0), rule.message, rule.fix);
         }
     }

package/dist/lib/workspaces.d.ts

@@ -46,12 +46,12 @@ export interface WorkspaceStewardshipReport extends WorkspaceGrantReport {
     }> | null;
 }
 export declare function getWorkspaceStewardship(workspaceId: string, memberUserId: string): Promise<WorkspaceStewardshipReport>;
-/** One current member of a workspace, as `GET /api/workspaces/:id/members` returns it. */
 /**
  * One current member as `skrr workspaces members` shows it, in its table and in
  * `--json` alike (OSK-16472). Only these fields: the endpoint's raw row also carries
  * the membership `_id`, monthly usage counters the web billing tab reads, and the
- * user's avatar, none of which a members listing promises.
+ * user's avatar, none of which a default members listing promises. Image transport
+ * may be explicitly expanded with --include-images; usage and storage metadata never are.
  */
 export interface WorkspaceMemberRow {
     userId: string;
@@ -59,6 +59,8 @@ export interface WorkspaceMemberRow {
     email: string | null;
     role: string | null;
     joinedAt: string | null;
+    /** Present only when image transport was explicitly requested. */
+    avatar?: string;
 }
 interface RawWorkspaceMember {
     userId?: unknown;
@@ -68,11 +70,16 @@ interface RawWorkspaceMember {
         name?: unknown;
         username?: unknown;
         email?: unknown;
+        avatar?: unknown;
     } | null;
 }
 /** The ONE projection of a raw members row; nothing else of it reaches output. */
-export declare function toWorkspaceMemberRow(raw: RawWorkspaceMember): WorkspaceMemberRow;
-export declare function listWorkspaceMembers(workspaceId: string): Promise<WorkspaceMemberRow[]>;
+export declare function toWorkspaceMemberRow(raw: RawWorkspaceMember, options?: {
+    includeImages?: boolean;
+}): WorkspaceMemberRow;
+export declare function listWorkspaceMembers(workspaceId: string, options?: {
+    includeImages?: boolean;
+}): Promise<WorkspaceMemberRow[]>;
 /** A user id as the stewardship route takes it: a 24-hex ObjectId. */
 export declare const USER_ID_PATTERN: RegExp;
 export declare class MemberReferenceError extends Error {

package/dist/lib/workspaces.js

@@ -14,6 +14,7 @@ exports.listWorkspaceListing = listWorkspaceListing;
 exports.listWorkspaceAgentAudit = listWorkspaceAgentAudit;
 exports.getWorkspace = getWorkspace;
 exports.matchWorkspace = matchWorkspace;
+const member_output_1 = require("./member-output");
 const api_fetch_1 = require("./api-fetch");
 const triggers_1 = require("./triggers");
 async function getWorkspaceStewardship(workspaceId, memberUserId) {
@@ -21,18 +22,21 @@ async function getWorkspaceStewardship(workspaceId, memberUserId) {
 }
 const text = (value) => (typeof value === 'string' && value ? value : null);
 /** The ONE projection of a raw members row; nothing else of it reaches output. */
-function toWorkspaceMemberRow(raw) {
+function toWorkspaceMemberRow(raw, options = {}) {
     return {
         userId: String(raw.userId ?? ''),
         name: text(raw.user?.name) ?? text(raw.user?.username),
         email: text(raw.user?.email),
         role: text(raw.role),
         joinedAt: text(raw.joinedAt),
+        ...(0, member_output_1.memberAvatar)(raw.user, options.includeImages),
     };
 }
-async function listWorkspaceMembers(workspaceId) {
+async function listWorkspaceMembers(workspaceId, options = {}) {
     const response = await (0, api_fetch_1.apiFetch)(`/api/workspaces/${encodeURIComponent(workspaceId)}/members`);
-    return Array.isArray(response?.data) ? response.data.map(toWorkspaceMemberRow) : [];
+    return Array.isArray(response?.data)
+        ? response.data.map((row) => toWorkspaceMemberRow(row, options))
+        : [];
 }
 /** A user id as the stewardship route takes it: a 24-hex ObjectId. */
 exports.USER_ID_PATTERN = /^[a-f0-9]{24}$/i;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/computerWire.d.ts

@@ -108,6 +108,8 @@ export declare const COMPUTER_EVENTS: {
      * them. Needs `computer_browser_file_chooser_v1`.
      */
     readonly fileChooser: "computer:surface:filechooser";
+    /** Deliberate semantic teaching in the browser controlled by this attachment. */
+    readonly teaching: "computer:surface:teaching";
 };
 /**
  * API ⇄ daemon. The daemon transports (Socket.IO and SSE) carry no
@@ -135,6 +137,7 @@ export declare const DAEMON_COMPUTER_EVENTS: {
     readonly dialog: "daemon:computer:surface:dialog";
     readonly copy: "daemon:computer:surface:copy";
     readonly fileChooser: "daemon:computer:surface:filechooser";
+    readonly teaching: "daemon:computer:surface:teaching";
     /**
      * Pin or unpin the surface an open human-input request names (§8): a pinned
      * surface is not reclaimed by idle or wall-clock expiry. Fire-and-forget,
@@ -244,6 +247,9 @@ export declare const COMPUTER_CAPABILITIES: {
      * them (headless refuses them), so no surface may claim to show one.
      */
     readonly browserPage: "computer_browser_page_v1";
+    readonly browserTeaching: "computer_browser_teaching_v1";
+    /** Separately consented, origin-filtered semantic activity review. */
+    readonly browserActivityReview: "computer_browser_activity_review_v1";
     /** Sharing a person's own surface with an agent session (§5.4). */
     readonly surfaceShare: "computer_surface_share_v1";
     /** Pinning a surface an open human-input request names: `daemon:computer:surface:pin` (§8). */
@@ -1036,7 +1042,7 @@ export declare function computerDeclaredServiceSpec(raw: unknown): {
  * caller can never be handed an address off the machine.
  */
 export declare function computerDeclaredServiceUrl(service: Pick<ComputerDeclaredServiceSpec, 'port'> & Partial<Pick<ComputerDeclaredServiceSpec, 'path' | 'protocol'>>): string;
-export declare const COMPUTER_MACHINE_KINDS: readonly ["dedicated", "personal"];
+export declare const COMPUTER_MACHINE_KINDS: readonly ["dedicated", "personal", "space"];
 export type ComputerMachineKind = (typeof COMPUTER_MACHINE_KINDS)[number];
 /**
  * One picture per machine state; none of them is a spinner without a bound,
@@ -1148,3 +1154,10 @@ export interface ComputerDaemonLogResult {
     /** Lines the redaction rewrote anywhere in the ring (a count, never content). */
     redactedLines: number;
 }
+/** Exact origins only: neither URL paths nor credentials broaden consent. */
+export interface BrowserActivityOriginPolicy {
+    allowOrigins: string[];
+    excludeOrigins: string[];
+}
+export declare function normalizeBrowserActivityOriginPolicy(input: unknown): BrowserActivityOriginPolicy;
+export declare function browserActivityOriginAllowed(policy: BrowserActivityOriginPolicy, url: unknown): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/computerWire.js

@@ -44,6 +44,8 @@ exports.computerDeclaredServiceUrl = computerDeclaredServiceUrl;
 exports.computerPowerPhaseForLeaseState = computerPowerPhaseForLeaseState;
 exports.computerShowsDesktop = computerShowsDesktop;
 exports.computerOffersPowerActions = computerOffersPowerActions;
+exports.normalizeBrowserActivityOriginPolicy = normalizeBrowserActivityOriginPolicy;
+exports.browserActivityOriginAllowed = browserActivityOriginAllowed;
 // ---------------------------------------------------------------------------
 // Events (§7.1)
 // ---------------------------------------------------------------------------
@@ -132,6 +134,8 @@ exports.COMPUTER_EVENTS = {
      * them. Needs `computer_browser_file_chooser_v1`.
      */
     fileChooser: 'computer:surface:filechooser',
+    /** Deliberate semantic teaching in the browser controlled by this attachment. */
+    teaching: 'computer:surface:teaching',
 };
 /**
  * API ⇄ daemon. The daemon transports (Socket.IO and SSE) carry no
@@ -160,6 +164,7 @@ exports.DAEMON_COMPUTER_EVENTS = {
     dialog: 'daemon:computer:surface:dialog',
     copy: 'daemon:computer:surface:copy',
     fileChooser: 'daemon:computer:surface:filechooser',
+    teaching: 'daemon:computer:surface:teaching',
     /**
      * Pin or unpin the surface an open human-input request names (§8): a pinned
      * surface is not reclaimed by idle or wall-clock expiry. Fire-and-forget,
@@ -285,6 +290,9 @@ exports.COMPUTER_CAPABILITIES = {
      * them (headless refuses them), so no surface may claim to show one.
      */
     browserPage: 'computer_browser_page_v1',
+    browserTeaching: 'computer_browser_teaching_v1',
+    /** Separately consented, origin-filtered semantic activity review. */
+    browserActivityReview: 'computer_browser_activity_review_v1',
     /** Sharing a person's own surface with an agent session (§5.4). */
     surfaceShare: 'computer_surface_share_v1',
     /** Pinning a surface an open human-input request names: `daemon:computer:surface:pin` (§8). */
@@ -1132,7 +1140,7 @@ function computerDeclaredServiceUrl(service) {
 // ---------------------------------------------------------------------------
 // Machines and power (§10, §18)
 // ---------------------------------------------------------------------------
-exports.COMPUTER_MACHINE_KINDS = ['dedicated', 'personal'];
+exports.COMPUTER_MACHINE_KINDS = ['dedicated', 'personal', 'space'];
 /**
  * One picture per machine state; none of them is a spinner without a bound,
  * and none collapses two states into the reassuring one.
@@ -1233,7 +1241,7 @@ function computerShowsDesktop(phase) {
 }
 /** Power actions are offered for a Dedicated Runtime only; a personal machine has none (§18). */
 function computerOffersPowerActions(machineKind) {
-    return machineKind === 'dedicated';
+    return machineKind === 'dedicated' || machineKind === 'space';
 }
 // ---------------------------------------------------------------------------
 // The daemon's own log (`computer_daemon_log_v1`)
@@ -1264,3 +1272,40 @@ exports.COMPUTER_DAEMON_LOG_LIMITS = {
     rateMax: 30,
     rateWindowMs: 60 * 1000,
 };
+function normalizeBrowserActivityOriginPolicy(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        throw new Error('Choose exact allowed and excluded web origins');
+    const value = input;
+    if (Object.keys(value).some((key) => !['allowOrigins', 'excludeOrigins'].includes(key)))
+        throw new Error('Unsupported source filter');
+    const origins = (items, required) => {
+        if (!Array.isArray(items) || items.length > 20 || (required && !items.length))
+            throw new Error('Choose from one to twenty allowed origins and up to twenty excluded origins');
+        return [...new Set(items.map((item) => {
+                if (typeof item !== 'string' || item.length > 500)
+                    throw new Error('Use an exact http or https origin without a path, credentials, query or fragment');
+                let url;
+                try {
+                    url = new URL(item);
+                }
+                catch {
+                    throw new Error('Use an exact http or https origin');
+                }
+                if (!['http:', 'https:'].includes(url.protocol) || url.hostname.includes('*') || url.username || url.password || item !== url.origin)
+                    throw new Error('Use an exact http or https origin without a path, credentials, query or fragment');
+                return url.origin;
+            }))].sort();
+    };
+    return { allowOrigins: origins(value.allowOrigins, true), excludeOrigins: origins(value.excludeOrigins, false) };
+}
+function browserActivityOriginAllowed(policy, url) {
+    if (typeof url !== 'string')
+        return false;
+    try {
+        const origin = new URL(url).origin;
+        return ['http:', 'https:'].includes(new URL(url).protocol) && policy.allowOrigins.includes(origin) && !policy.excludeOrigins.includes(origin);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonToolApproval.d.ts

@@ -31,6 +31,11 @@
  * and the daemon spends each approval once: a second delivery of the same
  * attestation inside its window is refused as `replayed`. That ledger lives
  * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
+ *
+ * v2 (OSK-16614, `toolApprovalSignature.ts`) carries the same claims signed by
+ * a platform Ed25519 key and bound to the daemon and session; a daemon that has
+ * pinned the platform's keyset accepts only v2. This module stays the v1
+ * format and the checks both versions share.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 export declare const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = "daemon_tool_attested_approval_v1";
@@ -84,6 +89,14 @@ export interface AttestedToolApproval {
     issuedAt: number;
     expiresAt: number;
 }
+/**
+ * Deterministic serialization for the input digest: objects sort keys
+ * recursively, arrays keep order, non-JSON values normalize the way
+ * `JSON.stringify` would emit them (undefined/functions in objects drop, in
+ * arrays become null). Both runtimes must digest the SAME bytes — the server
+ * mints and the daemon verifies — so this lives here, once.
+ */
+export declare function canonicalApprovalJson(value: unknown): string;
 /** The digest both sides compute over `toolInput`. */
 export declare function canonicalToolInputDigest(toolInput: unknown): string;
 /** Server side: mint the attestation after a person approved THIS call. */
@@ -106,8 +119,24 @@ export declare function mintAttestedToolApproval(args: {
  *  - `replayed`  — this exact approval was already spent on this daemon
  *                  (the ledger is the verifier's caller's, see the daemon's
  *                  `permissions/attestation-ledger.ts`)
+ *
+ * Signed approvals (`tool_approval_signed_v1`, `toolApprovalSignature.ts`):
+ *  - `unsigned`       — a v1 (unsigned) attestation reached a daemon that has
+ *                       pinned the platform's approval keyset: a downgrade
+ *  - `unknown_key`    — signed by a key id the pinned keyset does not hold
+ *  - `signature`      — the signature does not verify over the payload
+ *  - `daemon_binding` — signed for a different daemon or session
+ *  - `unpinned`       — a v2 attestation reached a daemon holding no keyset,
+ *                       so nothing here can verify it
+ *  - `pin_unreadable` — the pinned keyset file exists and cannot be read;
+ *                       nothing is accepted rather than falling back to v1
+ *
+ * All are internal-only for the person: the daemon log line
+ * (`describePermissionRefusalForLog`, `attestation=<reason>`) names them, and
+ * the refusal text a caller reads distinguishes only `absent` from "did not
+ * verify" so a probing caller learns nothing new.
  */
-export type AttestedToolApprovalRefusalReason = 'absent' | 'malformed' | 'binding' | 'expired' | 'window' | 'replayed';
+export type AttestedToolApprovalRefusalReason = 'absent' | 'malformed' | 'binding' | 'expired' | 'window' | 'replayed' | 'unsigned' | 'unknown_key' | 'signature' | 'daemon_binding' | 'unpinned' | 'pin_unreadable';
 export type AttestedToolApprovalVerdict = {
     ok: true;
 } | {
@@ -131,3 +160,22 @@ export declare function verifyAttestedToolApproval(approval: unknown, call: {
     toolInput: unknown;
     now?: number;
 }): AttestedToolApprovalVerdict;
+/**
+ * The checks every attestation version shares once its claims are trusted to
+ * be what the issuer wrote: freshness, the verifier-owned window, and the
+ * binding to this exact call. v1 reaches here after a shape check; v2
+ * (`toolApprovalSignature.ts`) only after its signature verified, so one
+ * implementation decides "expired", "window" and "binding" for both.
+ */
+export declare function verifyAttestedToolApprovalClaims(a: {
+    toolUseId: string;
+    toolName: string;
+    inputSha256: string;
+    issuedAt: number;
+    expiresAt: number;
+}, call: {
+    toolUseId: string;
+    toolName: string;
+    toolInput: unknown;
+    now?: number;
+}): AttestedToolApprovalVerdict;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonToolApproval.js

@@ -2,9 +2,11 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = exports.ATTESTED_TOOL_APPROVAL_TTL_MS = exports.DAEMON_TOOL_CATEGORIES = exports.DAEMON_TOOL_READ_ONLY_CAPABILITY = exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = void 0;
 exports.categoryForDaemonTool = categoryForDaemonTool;
+exports.canonicalApprovalJson = canonicalApprovalJson;
 exports.canonicalToolInputDigest = canonicalToolInputDigest;
 exports.mintAttestedToolApproval = mintAttestedToolApproval;
 exports.verifyAttestedToolApproval = verifyAttestedToolApproval;
+exports.verifyAttestedToolApprovalClaims = verifyAttestedToolApprovalClaims;
 const node_crypto_1 = require("node:crypto");
 /**
  * Server-attested tool approval (OSK-11975 follow-up to the `manual` mode
@@ -39,6 +41,11 @@ const node_crypto_1 = require("node:crypto");
  * and the daemon spends each approval once: a second delivery of the same
  * attestation inside its window is refused as `replayed`. That ledger lives
  * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
+ *
+ * v2 (OSK-16614, `toolApprovalSignature.ts`) carries the same claims signed by
+ * a platform Ed25519 key and bound to the daemon and session; a daemon that has
+ * pinned the platform's keyset accepts only v2. This module stays the v1
+ * format and the checks both versions share.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = 'daemon_tool_attested_approval_v1';
@@ -112,6 +119,9 @@ exports.ATTESTED_TOOL_APPROVAL_TTL_MS = 60 * 1000;
  * arrays become null). Both runtimes must digest the SAME bytes — the server
  * mints and the daemon verifies — so this lives here, once.
  */
+function canonicalApprovalJson(value) {
+    return canonicalJson(value);
+}
 function canonicalJson(value) {
     if (value === null || typeof value !== 'object') {
         if (value === undefined || typeof value === 'function' || typeof value === 'symbol') {
@@ -175,6 +185,22 @@ function verifyAttestedToolApproval(approval, call) {
         typeof a.expiresAt !== 'number') {
         return { ok: false, reason: 'malformed' };
     }
+    return verifyAttestedToolApprovalClaims({
+        toolUseId: a.toolUseId,
+        toolName: a.toolName,
+        inputSha256: a.inputSha256,
+        issuedAt: a.issuedAt,
+        expiresAt: a.expiresAt,
+    }, call);
+}
+/**
+ * The checks every attestation version shares once its claims are trusted to
+ * be what the issuer wrote: freshness, the verifier-owned window, and the
+ * binding to this exact call. v1 reaches here after a shape check; v2
+ * (`toolApprovalSignature.ts`) only after its signature verified, so one
+ * implementation decides "expired", "window" and "binding" for both.
+ */
+function verifyAttestedToolApprovalClaims(a, call) {
     const now = call.now ?? Date.now();
     if (a.expiresAt <= now || a.issuedAt > now + exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS) {
         return { ok: false, reason: 'expired' };