@skrr-ai/cli 0.1.113 → 0.1.115

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/computerUse.d.ts

@@ -0,0 +1,228 @@
+/**
+ * Computer Use v1 is a host-to-host protocol, never a model tool schema.
+ * Models see exactly the runtime's js/js_reset surface. In particular, script
+ * contents cannot prove that a call is read-only or supply execution identity.
+ * Kept dependency-free so daemon, API, browser and native clients agree.
+ */
+export declare const COMPUTER_USE_TOOL: "ComputerUse";
+export declare const COMPUTER_USE_PROVIDER: "lcu";
+export declare const COMPUTER_USE_PROTOCOL: "computer_use_mcp_v1";
+export declare const COMPUTER_USE_ROTATE_CREDENTIAL_EVENT: "daemon:computer-use:rotate-credential";
+/** Owner-approved hosted credential upgrade; no bearer secret travels in this request. */
+export interface ComputerUseRotateCredentialRequest {
+    requestId: string;
+    ownerUserId: string;
+    machineUuid: string;
+    leaseId: string;
+    generation: number;
+}
+export declare const COMPUTER_USE_EXECUTION_CAPABILITY: "computer_use";
+export declare const COMPUTER_USE_CLOUD_CONSENT: "computer_use_cloud_agents_v1";
+export declare const COMPUTER_USE_PUBLIC_TOOLS: readonly ["js", "js_reset"];
+export type ComputerUsePublicTool = (typeof COMPUTER_USE_PUBLIC_TOOLS)[number];
+export declare const COMPUTER_USE_OPERATIONS: readonly ["describe", "call", "end_turn", "close", "status", "control_stop"];
+export type ComputerUseOperation = (typeof COMPUTER_USE_OPERATIONS)[number];
+export type ComputerUseSurfaceMode = 'computer' | 'browser' | 'all';
+export type ComputerUseEndReason = 'Stop' | 'Interrupt';
+/** Identity is derived from authenticated execution, never tool arguments. */
+export interface ComputerUseHostContext {
+    principalId: string;
+    machineId: string;
+    sessionId: string;
+    turnId: string;
+    generation: number;
+    toolCallId?: string;
+    agentId?: string;
+    engine?: string;
+    conversationId?: string;
+    contextKey?: string;
+}
+export interface ComputerUseBudgets {
+    activeExecutionMs: number;
+    humanResponseMs: number;
+    totalLifetimeMs: number;
+    cleanupGraceMs: number;
+}
+export declare const COMPUTER_USE_DEFAULT_BUDGETS: Readonly<ComputerUseBudgets>;
+/** Negotiated ceilings; exceeding a limit is an error, never silent clipping. */
+export declare const COMPUTER_USE_LIMITS: Readonly<{
+    maxEnvelopeBytes: number;
+    maxInstructionsBytes: number;
+    maxSchemaBytes: number;
+    maxContentBlocks: 512;
+    maxIdentityChars: 512;
+    maxActiveExecutionMs: 900000;
+    maxHumanResponseMs: 900000;
+    maxTotalLifetimeMs: 1800000;
+    maxCleanupGraceMs: 60000;
+}>;
+/** Preserve upstream fields and schemas, including annotations and extensions. */
+export interface ComputerUseToolDescriptor {
+    name: ComputerUsePublicTool;
+    description?: string;
+    inputSchema: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface ComputerUseMcpContent {
+    type: string;
+    [key: string]: unknown;
+}
+export interface ComputerUseMcpResult {
+    content: ComputerUseMcpContent[];
+    isError?: boolean;
+    structuredContent?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+export interface ComputerUseVersions {
+    lcu: string;
+    adapter?: string;
+    app?: string;
+    runtime?: string;
+    [key: string]: string | undefined;
+}
+export interface ComputerUseRuntimePolicy {
+    replPersistence: 'turn';
+    audioCleanup: 'retire-runtime';
+}
+export interface ComputerUseSurface {
+    protocol: typeof COMPUTER_USE_PROTOCOL;
+    provider: typeof COMPUTER_USE_PROVIDER;
+    instructions: string;
+    tools: ComputerUseToolDescriptor[];
+    versions: ComputerUseVersions;
+    /** Digest of the actual instructions and full descriptors, not a version label. */
+    digest: string;
+    surfaceMode: ComputerUseSurfaceMode;
+    /** Host-observed lifecycle constraints, separate from original runtime instructions. */
+    runtimePolicy?: ComputerUseRuntimePolicy;
+}
+/** Preserve original documentation while explaining the host's narrower lifecycle. */
+export declare function computerUseModelInstructions(surface: ComputerUseSurface): string;
+export declare const COMPUTER_USE_RUNTIME_STATES: readonly ["disabled", "starting", "ready", "executing", "awaiting_approval", "ending_turn", "unavailable", "closed"];
+export type ComputerUseRuntimeState = (typeof COMPUTER_USE_RUNTIME_STATES)[number];
+export interface ComputerUseReadiness {
+    provider: typeof COMPUTER_USE_PROVIDER;
+    protocol: typeof COMPUTER_USE_PROTOCOL;
+    state: ComputerUseRuntimeState;
+    available: boolean;
+    enabled: boolean;
+    cloudAgentsAllowed: boolean;
+    reason?: string;
+    versions?: ComputerUseVersions;
+    surfaceDigest?: string;
+    /** Capability readiness is independent of whether a person granted consent. */
+    browserReady?: boolean;
+    audioReady?: boolean;
+}
+export interface ComputerUseStatus extends ComputerUseReadiness {
+    controller?: Pick<ComputerUseHostContext, 'sessionId' | 'turnId' | 'generation' | 'agentId' | 'conversationId'>;
+    pendingApprovalId?: string;
+    cleanupConfirmed?: boolean;
+}
+export type ComputerUseInput = {
+    operation: 'describe';
+    surfaceMode?: ComputerUseSurfaceMode;
+} | {
+    operation: 'call';
+    tool: ComputerUsePublicTool;
+    arguments: Record<string, unknown>;
+    surfaceDigest?: string;
+    budgets?: Partial<ComputerUseBudgets>;
+} | {
+    operation: 'end_turn';
+    reason: ComputerUseEndReason;
+} | {
+    operation: 'close';
+    reason?: string;
+} | {
+    operation: 'status';
+} | {
+    operation: 'control_stop';
+    reason?: string;
+};
+export type ComputerUseRequest = ComputerUseInput & {
+    protocol: typeof COMPUTER_USE_PROTOCOL;
+    provider: typeof COMPUTER_USE_PROVIDER;
+    context: ComputerUseHostContext;
+};
+export interface ComputerUseCleanupResult {
+    /** True only after the runtime confirms execution can no longer produce input. */
+    cleanupConfirmed: boolean;
+    closed: boolean;
+    generation: number;
+}
+export type ComputerUseResponse = {
+    operation: 'describe';
+    surface: ComputerUseSurface;
+} | {
+    operation: 'call';
+    mcpResult: ComputerUseMcpResult;
+} | {
+    operation: 'status';
+    status: ComputerUseStatus;
+} | {
+    operation: 'end_turn' | 'close' | 'control_stop';
+    cleanup: ComputerUseCleanupResult;
+};
+export declare const COMPUTER_USE_ELICITATION_CHOICES: readonly ["once", "session", "always", "decline"];
+export type ComputerUseElicitationChoice = (typeof COMPUTER_USE_ELICITATION_CHOICES)[number];
+export interface ComputerUseElicitationOption {
+    value: ComputerUseElicitationChoice;
+    label: string;
+    description?: string;
+}
+/** This is a dedicated permission request, not AskUserQuestion or sticky tool approval. */
+export interface ComputerUseElicitationRequest {
+    kind: 'computer_use_runtime';
+    requestId: string;
+    context: ComputerUseHostContext & {
+        toolCallId: string;
+    };
+    message: string;
+    resource?: Record<string, unknown>;
+    options: ComputerUseElicitationOption[];
+    expiresAt: number;
+}
+export interface ComputerUseElicitationResponse {
+    requestId: string;
+    context: ComputerUseHostContext & {
+        toolCallId: string;
+    };
+    choice: ComputerUseElicitationChoice;
+}
+export declare class ComputerUseContractError extends Error {
+    readonly code: string;
+    constructor(code: string, message: string);
+}
+/** Validate the hosted rotation envelope before changing runtime admission. */
+export declare function assertComputerUseRotateCredentialRequest(value: unknown): asserts value is ComputerUseRotateCredentialRequest;
+export declare function assertComputerUseHostContext(value: unknown): asserts value is ComputerUseHostContext;
+export declare function computerUseBudgets(value?: unknown): ComputerUseBudgets;
+export declare function assertComputerUseInput(value: unknown): asserts value is ComputerUseInput;
+export declare function assertComputerUseRequest(value: unknown): asserts value is ComputerUseRequest;
+export declare function assertComputerUseSurface(value: unknown): asserts value is ComputerUseSurface;
+/** Validate the envelope without rewriting blocks or discarding upstream extensions. */
+export declare function assertComputerUseMcpResult(value: unknown): asserts value is ComputerUseMcpResult;
+/** Compare full execution identity; a matching conversation alone never grants access. */
+export declare function sameComputerUseContext(left: ComputerUseHostContext, right: ComputerUseHostContext): boolean;
+export declare function assertComputerUseElicitationRequest(value: unknown): asserts value is ComputerUseElicitationRequest;
+export declare function assertComputerUseElicitationResponse(value: unknown): asserts value is ComputerUseElicitationResponse;
+/** A human answer can only satisfy this exact pending request and offered scope.
+ * This matcher is not authentication: the caller must verify the human responder.
+ */
+export declare function acceptsComputerUseElicitationResponse(request: ComputerUseElicitationRequest, response: ComputerUseElicitationResponse, now?: number): boolean;
+export type ComputerUseModelProjectionOptions = {
+    audio: 'inline';
+} | {
+    audio: 'artifact-reference';
+    principalId: string;
+    sessionId: string;
+    consumer?: string;
+};
+/**
+ * Consumer capability projection, never a rewrite of the canonical daemon
+ * result. Some model hosts accept MCP AudioContent but silently omit its bytes.
+ * Those hosts receive explicit references to already-persisted owned audio.
+ * This function never uploads, transcribes, invents a path or grants access.
+ */
+export declare function projectComputerUseResultForModel(result: ComputerUseMcpResult, options: ComputerUseModelProjectionOptions): ComputerUseMcpResult;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/computerUse.js

@@ -0,0 +1,375 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ComputerUseContractError = exports.COMPUTER_USE_ELICITATION_CHOICES = exports.COMPUTER_USE_RUNTIME_STATES = exports.COMPUTER_USE_LIMITS = exports.COMPUTER_USE_DEFAULT_BUDGETS = exports.COMPUTER_USE_OPERATIONS = exports.COMPUTER_USE_PUBLIC_TOOLS = exports.COMPUTER_USE_CLOUD_CONSENT = exports.COMPUTER_USE_EXECUTION_CAPABILITY = exports.COMPUTER_USE_ROTATE_CREDENTIAL_EVENT = exports.COMPUTER_USE_PROTOCOL = exports.COMPUTER_USE_PROVIDER = exports.COMPUTER_USE_TOOL = void 0;
+exports.computerUseModelInstructions = computerUseModelInstructions;
+exports.assertComputerUseRotateCredentialRequest = assertComputerUseRotateCredentialRequest;
+exports.assertComputerUseHostContext = assertComputerUseHostContext;
+exports.computerUseBudgets = computerUseBudgets;
+exports.assertComputerUseInput = assertComputerUseInput;
+exports.assertComputerUseRequest = assertComputerUseRequest;
+exports.assertComputerUseSurface = assertComputerUseSurface;
+exports.assertComputerUseMcpResult = assertComputerUseMcpResult;
+exports.sameComputerUseContext = sameComputerUseContext;
+exports.assertComputerUseElicitationRequest = assertComputerUseElicitationRequest;
+exports.assertComputerUseElicitationResponse = assertComputerUseElicitationResponse;
+exports.acceptsComputerUseElicitationResponse = acceptsComputerUseElicitationResponse;
+exports.projectComputerUseResultForModel = projectComputerUseResultForModel;
+/**
+ * Computer Use v1 is a host-to-host protocol, never a model tool schema.
+ * Models see exactly the runtime's js/js_reset surface. In particular, script
+ * contents cannot prove that a call is read-only or supply execution identity.
+ * Kept dependency-free so daemon, API, browser and native clients agree.
+ */
+exports.COMPUTER_USE_TOOL = 'ComputerUse';
+exports.COMPUTER_USE_PROVIDER = 'lcu';
+exports.COMPUTER_USE_PROTOCOL = 'computer_use_mcp_v1';
+exports.COMPUTER_USE_ROTATE_CREDENTIAL_EVENT = 'daemon:computer-use:rotate-credential';
+exports.COMPUTER_USE_EXECUTION_CAPABILITY = 'computer_use';
+exports.COMPUTER_USE_CLOUD_CONSENT = 'computer_use_cloud_agents_v1';
+exports.COMPUTER_USE_PUBLIC_TOOLS = ['js', 'js_reset'];
+exports.COMPUTER_USE_OPERATIONS = ['describe', 'call', 'end_turn', 'close', 'status', 'control_stop'];
+exports.COMPUTER_USE_DEFAULT_BUDGETS = Object.freeze({
+    activeExecutionMs: 120_000,
+    humanResponseMs: 300_000,
+    totalLifetimeMs: 900_000,
+    cleanupGraceMs: 10_000,
+});
+/** Negotiated ceilings; exceeding a limit is an error, never silent clipping. */
+exports.COMPUTER_USE_LIMITS = Object.freeze({
+    maxEnvelopeBytes: 32 * 1024 * 1024,
+    maxInstructionsBytes: 1024 * 1024,
+    maxSchemaBytes: 1024 * 1024,
+    maxContentBlocks: 512,
+    maxIdentityChars: 512,
+    maxActiveExecutionMs: 900_000,
+    maxHumanResponseMs: 900_000,
+    maxTotalLifetimeMs: 1_800_000,
+    maxCleanupGraceMs: 60_000,
+});
+/** Preserve original documentation while explaining the host's narrower lifecycle. */
+function computerUseModelInstructions(surface) {
+    assertComputerUseSurface(surface);
+    if (!surface.runtimePolicy)
+        return surface.instructions;
+    return surface.instructions + '\n\nOverSky host policy\n' +
+        'Audio cleanup retires the complete runtime after js_reset and at the end of each host turn. ' +
+        'JavaScript variables and application handles persist only within the current turn. ' +
+        'Initialize fresh handles in the next turn; do not reuse handles from an earlier runtime.';
+}
+exports.COMPUTER_USE_RUNTIME_STATES = [
+    'disabled', 'starting', 'ready', 'executing', 'awaiting_approval',
+    'ending_turn', 'unavailable', 'closed',
+];
+exports.COMPUTER_USE_ELICITATION_CHOICES = ['once', 'session', 'always', 'decline'];
+class ComputerUseContractError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'ComputerUseContractError';
+    }
+}
+exports.ComputerUseContractError = ComputerUseContractError;
+function fail(message) {
+    throw new ComputerUseContractError('invalid_computer_use_contract', message);
+}
+function record(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function exactKeys(value, keys, name) {
+    if (Object.keys(value).some((key) => !keys.includes(key)))
+        fail(`Unsupported ${name} field`);
+}
+function identifier(value, name) {
+    if (typeof value !== 'string' || value.trim().length === 0 || value.length > exports.COMPUTER_USE_LIMITS.maxIdentityChars)
+        fail(`Invalid ${name}`);
+}
+/** Reject non-JSON data before transport, including lossy NaN/undefined values. */
+function jsonSize(value) {
+    const seen = new Set();
+    const visit = (item) => {
+        if (item === null || typeof item === 'string' || typeof item === 'boolean')
+            return;
+        if (typeof item === 'number' && Number.isFinite(item))
+            return;
+        if (typeof item !== 'object' || !item || seen.has(item))
+            fail('Expected acyclic JSON data');
+        if (!Array.isArray(item) && Object.getPrototypeOf(item) !== Object.prototype && Object.getPrototypeOf(item) !== null)
+            fail('Expected plain JSON object');
+        seen.add(item);
+        for (const child of Array.isArray(item) ? item : Object.values(item))
+            visit(child);
+        seen.delete(item);
+    };
+    visit(value);
+    return new TextEncoder().encode(JSON.stringify(value)).byteLength;
+}
+function boundedJson(value, max, name) {
+    if (jsonSize(value) > max)
+        fail(`${name} exceeds negotiated byte limit`);
+}
+/** Validate the hosted rotation envelope before changing runtime admission. */
+function assertComputerUseRotateCredentialRequest(value) {
+    if (!record(value))
+        fail('Expected credential rotation request');
+    const ids = ['requestId', 'ownerUserId', 'machineUuid', 'leaseId'];
+    exactKeys(value, [...ids, 'generation'], 'credential rotation');
+    for (const key of ids) {
+        identifier(value[key], key);
+        if (value[key].length > 160)
+            fail(`Invalid ${key}`);
+    }
+    if (!Number.isSafeInteger(value.generation) || value.generation < 1)
+        fail('Invalid hosted desktop generation');
+}
+function assertComputerUseHostContext(value) {
+    if (!record(value))
+        fail('Expected host context');
+    const required = ['principalId', 'machineId', 'sessionId', 'turnId'];
+    const optional = ['toolCallId', 'agentId', 'engine', 'conversationId', 'contextKey'];
+    exactKeys(value, [...required, ...optional, 'generation'], 'host context');
+    for (const key of required)
+        identifier(value[key], key);
+    for (const key of optional)
+        if (value[key] !== undefined)
+            identifier(value[key], key);
+    if (!Number.isSafeInteger(value.generation) || value.generation < 0)
+        fail('Invalid generation');
+}
+function computerUseBudgets(value = {}) {
+    if (!record(value))
+        fail('Expected execution budgets');
+    const ceilings = {
+        activeExecutionMs: exports.COMPUTER_USE_LIMITS.maxActiveExecutionMs,
+        humanResponseMs: exports.COMPUTER_USE_LIMITS.maxHumanResponseMs,
+        totalLifetimeMs: exports.COMPUTER_USE_LIMITS.maxTotalLifetimeMs,
+        cleanupGraceMs: exports.COMPUTER_USE_LIMITS.maxCleanupGraceMs,
+    };
+    exactKeys(value, Object.keys(ceilings), 'budget');
+    const result = { ...exports.COMPUTER_USE_DEFAULT_BUDGETS };
+    for (const key of Object.keys(ceilings)) {
+        if (value[key] === undefined)
+            continue;
+        if (!Number.isSafeInteger(value[key]) || value[key] <= 0 || value[key] > ceilings[key])
+            fail(`Invalid ${key}`);
+        result[key] = value[key];
+    }
+    if (result.totalLifetimeMs < result.activeExecutionMs || result.totalLifetimeMs < result.cleanupGraceMs)
+        fail('Total lifetime is shorter than execution or cleanup budget');
+    return result;
+}
+function assertComputerUseInput(value) {
+    if (!record(value))
+        fail('Expected Computer Use operation');
+    switch (value.operation) {
+        case 'describe':
+            exactKeys(value, ['operation', 'surfaceMode'], 'describe');
+            if (value.surfaceMode !== undefined && !['computer', 'browser', 'all'].includes(value.surfaceMode))
+                fail('Unsupported surface mode');
+            break;
+        case 'call':
+            exactKeys(value, ['operation', 'tool', 'arguments', 'surfaceDigest', 'budgets'], 'call');
+            if (!exports.COMPUTER_USE_PUBLIC_TOOLS.includes(value.tool))
+                fail('Unsupported public tool');
+            if (!record(value.arguments))
+                fail('Expected original tool arguments');
+            if (value.surfaceDigest !== undefined)
+                identifier(value.surfaceDigest, 'surfaceDigest');
+            if (value.budgets !== undefined)
+                computerUseBudgets(value.budgets);
+            break;
+        case 'end_turn':
+            exactKeys(value, ['operation', 'reason'], 'end_turn');
+            if (value.reason !== 'Stop' && value.reason !== 'Interrupt')
+                fail('Unsupported end reason');
+            break;
+        case 'close':
+        case 'control_stop':
+            exactKeys(value, ['operation', 'reason'], value.operation);
+            if (value.reason !== undefined)
+                identifier(value.reason, 'reason');
+            break;
+        case 'status':
+            exactKeys(value, ['operation'], 'status');
+            break;
+        default: fail('Unsupported Computer Use operation');
+    }
+    boundedJson(value, exports.COMPUTER_USE_LIMITS.maxEnvelopeBytes, 'Request');
+}
+function assertComputerUseRequest(value) {
+    if (!record(value) || value.protocol !== exports.COMPUTER_USE_PROTOCOL || value.provider !== exports.COMPUTER_USE_PROVIDER)
+        fail('Unsupported Computer Use protocol/provider');
+    assertComputerUseHostContext(value.context);
+    const { protocol: _protocol, provider: _provider, context, ...input } = value;
+    assertComputerUseInput(input);
+    if (input.operation === 'call' && !context.toolCallId)
+        fail('Calls require exact host toolCallId');
+    boundedJson(value, exports.COMPUTER_USE_LIMITS.maxEnvelopeBytes, 'Request');
+}
+function assertComputerUseSurface(value) {
+    if (!record(value) || value.protocol !== exports.COMPUTER_USE_PROTOCOL || value.provider !== exports.COMPUTER_USE_PROVIDER)
+        fail('Unsupported Computer Use surface');
+    if (typeof value.instructions !== 'string')
+        fail('Expected original runtime instructions');
+    if (new TextEncoder().encode(value.instructions).byteLength > exports.COMPUTER_USE_LIMITS.maxInstructionsBytes)
+        fail('Instructions exceed negotiated byte limit');
+    identifier(value.digest, 'surface digest');
+    if (!['computer', 'browser', 'all'].includes(value.surfaceMode))
+        fail('Unsupported surface mode');
+    if (value.runtimePolicy !== undefined) {
+        if (!record(value.runtimePolicy))
+            fail('Invalid host runtime policy');
+        exactKeys(value.runtimePolicy, ['replPersistence', 'audioCleanup'], 'host runtime policy');
+        if (value.runtimePolicy.replPersistence !== 'turn' || value.runtimePolicy.audioCleanup !== 'retire-runtime')
+            fail('Unsupported host runtime policy');
+    }
+    if (!record(value.versions) || typeof value.versions.lcu !== 'string' || !value.versions.lcu)
+        fail('Missing LCU version');
+    if (Object.values(value.versions).some((v) => typeof v !== 'string'))
+        fail('Invalid runtime version');
+    if (!Array.isArray(value.tools) || value.tools.length !== 2)
+        fail('Expected js and js_reset descriptors');
+    const names = new Set();
+    for (const tool of value.tools) {
+        if (!record(tool) || !exports.COMPUTER_USE_PUBLIC_TOOLS.includes(tool.name) || !record(tool.inputSchema))
+            fail('Invalid original tool descriptor');
+        if (tool.description !== undefined && typeof tool.description !== 'string')
+            fail('Invalid tool description');
+        if (names.has(tool.name))
+            fail('Duplicate public tool');
+        names.add(tool.name);
+        boundedJson(tool, exports.COMPUTER_USE_LIMITS.maxSchemaBytes, 'Tool descriptor');
+    }
+    boundedJson(value, exports.COMPUTER_USE_LIMITS.maxEnvelopeBytes, 'Surface');
+}
+/** Validate the envelope without rewriting blocks or discarding upstream extensions. */
+function assertComputerUseMcpResult(value) {
+    if (!record(value) || !Array.isArray(value.content) || value.content.length > exports.COMPUTER_USE_LIMITS.maxContentBlocks)
+        fail('Invalid MCP result content');
+    if (value.isError !== undefined && typeof value.isError !== 'boolean')
+        fail('Invalid MCP isError');
+    if (value.structuredContent !== undefined && !record(value.structuredContent))
+        fail('Invalid MCP structuredContent');
+    for (const block of value.content) {
+        if (!record(block) || typeof block.type !== 'string' || !block.type)
+            fail('Invalid MCP content block');
+        if (block.type === 'text' && typeof block.text !== 'string')
+            fail('Invalid MCP text block');
+        if (block.type === 'image' && (typeof block.data !== 'string' || typeof block.mimeType !== 'string'))
+            fail('Invalid MCP image block');
+    }
+    boundedJson(value, exports.COMPUTER_USE_LIMITS.maxEnvelopeBytes, 'MCP result');
+}
+/** Compare full execution identity; a matching conversation alone never grants access. */
+function sameComputerUseContext(left, right) {
+    return ['principalId', 'machineId', 'sessionId', 'turnId', 'generation', 'agentId', 'engine', 'conversationId', 'contextKey']
+        .every((key) => left[key] === right[key]);
+}
+function assertComputerUseElicitationRequest(value) {
+    if (!record(value) || value.kind !== 'computer_use_runtime')
+        fail('Expected runtime elicitation');
+    exactKeys(value, ['kind', 'requestId', 'context', 'message', 'resource', 'options', 'expiresAt'], 'elicitation request');
+    identifier(value.requestId, 'requestId');
+    assertComputerUseHostContext(value.context);
+    identifier(value.context.toolCallId, 'toolCallId');
+    if (typeof value.message !== 'string' || !value.message)
+        fail('Missing runtime elicitation message');
+    if (value.resource !== undefined && !record(value.resource))
+        fail('Invalid runtime resource');
+    if (!Number.isSafeInteger(value.expiresAt) || value.expiresAt <= 0)
+        fail('Invalid runtime elicitation expiry');
+    if (!Array.isArray(value.options) || value.options.length === 0 || value.options.length > exports.COMPUTER_USE_ELICITATION_CHOICES.length)
+        fail('Invalid runtime choices');
+    const choices = new Set();
+    for (const option of value.options) {
+        if (!record(option))
+            fail('Invalid runtime option');
+        exactKeys(option, ['value', 'label', 'description'], 'elicitation option');
+        if (!exports.COMPUTER_USE_ELICITATION_CHOICES.includes(option.value) || choices.has(option.value))
+            fail('Unsupported or duplicate runtime choice');
+        if (typeof option.label !== 'string' || !option.label || (option.description !== undefined && typeof option.description !== 'string'))
+            fail('Invalid runtime choice label');
+        choices.add(option.value);
+    }
+    boundedJson(value, exports.COMPUTER_USE_LIMITS.maxEnvelopeBytes, 'Runtime elicitation');
+}
+function assertComputerUseElicitationResponse(value) {
+    if (!record(value))
+        fail('Expected runtime elicitation response');
+    exactKeys(value, ['requestId', 'context', 'choice'], 'elicitation response');
+    identifier(value.requestId, 'requestId');
+    assertComputerUseHostContext(value.context);
+    identifier(value.context.toolCallId, 'toolCallId');
+    if (!exports.COMPUTER_USE_ELICITATION_CHOICES.includes(value.choice))
+        fail('Unsupported runtime choice');
+    boundedJson(value, exports.COMPUTER_USE_LIMITS.maxEnvelopeBytes, 'Runtime elicitation response');
+}
+/** A human answer can only satisfy this exact pending request and offered scope.
+ * This matcher is not authentication: the caller must verify the human responder.
+ */
+function acceptsComputerUseElicitationResponse(request, response, now = Date.now()) {
+    try {
+        assertComputerUseElicitationRequest(request);
+        assertComputerUseElicitationResponse(response);
+    }
+    catch {
+        return false;
+    }
+    return request.kind === 'computer_use_runtime' && request.requestId === response.requestId &&
+        Number.isFinite(request.expiresAt) && now < request.expiresAt &&
+        sameComputerUseContext(request.context, response.context) &&
+        typeof request.context.toolCallId === 'string' && request.context.toolCallId === response.context.toolCallId &&
+        exports.COMPUTER_USE_ELICITATION_CHOICES.includes(response.choice) &&
+        request.options.some((option) => option.value === response.choice);
+}
+/**
+ * Consumer capability projection, never a rewrite of the canonical daemon
+ * result. Some model hosts accept MCP AudioContent but silently omit its bytes.
+ * Those hosts receive explicit references to already-persisted owned audio.
+ * This function never uploads, transcribes, invents a path or grants access.
+ */
+function projectComputerUseResultForModel(result, options) {
+    assertComputerUseMcpResult(result);
+    if (!options || !['inline', 'artifact-reference'].includes(options.audio))
+        fail('Unsupported Computer Use model audio capability');
+    const audioCount = result.content.filter((block) => block.type === 'audio').length;
+    if (options.audio === 'inline' || audioCount === 0)
+        return result;
+    identifier(options.principalId, 'audio artifact owner');
+    identifier(options.sessionId, 'audio artifact session');
+    if (options.consumer !== undefined)
+        identifier(options.consumer, 'audio consumer');
+    const metadata = record(result._meta) ? result._meta : {};
+    const candidates = metadata['skrr.ai/computer-use-artifacts'];
+    const references = Array.isArray(candidates)
+        ? candidates.filter((item) => record(item) && typeof item.mimeType === 'string' && item.mimeType.startsWith('audio/'))
+        : [];
+    if (references.length < audioCount || references.some((item) => !record(item) || typeof item.fileId !== 'string' || !/^[A-Za-z0-9_-]{1,512}$/.test(item.fileId) ||
+        item.reference !== `file:${item.fileId}` || item.ownerUserId !== options.principalId ||
+        item.sessionId !== options.sessionId || !Number.isSafeInteger(item.bytes) || item.bytes <= 0 ||
+        typeof item.sha256 !== 'string' || !/^[a-f0-9]{64}$/.test(item.sha256) ||
+        typeof item.mimeType !== 'string' || item.mimeType.length > 256 || !/^audio\/[A-Za-z0-9.+-]+(?:;[ -~]*)?$/.test(item.mimeType))) {
+        throw new ComputerUseContractError('computer_use_audio_artifact_required', 'This model cannot receive inline audio. Every audio block requires an existing owned file artifact for this exact session.');
+    }
+    const notice = [
+        'Audio is available as owned file artifacts. This model receives references instead of inline audio and has not listened to the recording.',
+        ...references.map((item) => `${item.reference} (${item.mimeType}; ${item.bytes} bytes; sha256 ${item.sha256})`),
+    ].join('\n');
+    let inserted = false;
+    const content = result.content.flatMap((block) => {
+        if (block.type !== 'audio')
+            return [block];
+        if (inserted)
+            return [];
+        inserted = true;
+        return [{ type: 'text', text: notice }];
+    });
+    const projected = { ...result, content, _meta: { ...metadata,
+            'skrr.ai/computer-use-model-projection': {
+                audio: 'artifact-reference', audioBlocks: audioCount,
+                ...(options.consumer ? { consumer: options.consumer } : {}),
+            },
+        } };
+    assertComputerUseMcpResult(projected);
+    return projected;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonScopes.d.ts

@@ -52,16 +52,19 @@ export declare const SCOPES: Readonly<{
     readonly TOOLS_FS_WRITE: "daemon:tools:fs:write";
     readonly BROWSER_CDP: "daemon:browser:cdp";
     readonly NATIVE_UI_CONTROL: "daemon:native-ui:control";
+    readonly COMPUTER_USE_CONTROL: "daemon:computer-use:control";
     readonly SESSION_REPLAY: "daemon:session:replay";
     readonly OFFLINE_QUEUE: "daemon:offline-queue";
 }>;
 export type DaemonScope = (typeof SCOPES)[keyof typeof SCOPES];
 /**
- * The seven daemon scopes in canonical order. Frozen so consumers can
+ * All daemon scopes in canonical order. Login defaults are a separate opt-in policy. Frozen so consumers can
  * pass it directly to OAuth `scope` parameters without defensive
  * copies.
  */
 export declare const ALL_DAEMON_SCOPES: readonly DaemonScope[];
+/** Login defaults retain the existing surface; script control is explicit opt-in. */
+export declare const DEFAULT_DAEMON_SCOPES: readonly DaemonScope[];
 /**
  * Set form of `ALL_DAEMON_SCOPES` for O(1) membership checks.
  */

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonScopes.js

@@ -30,7 +30,7 @@
  * never rename in place.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OAUTH_CLI_SCOPE = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
+exports.OAUTH_CLI_SCOPE = exports.VALID_DAEMON_SCOPE_SET = exports.DEFAULT_DAEMON_SCOPES = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.isDaemonScope = isDaemonScope;
 /**
  * The canonical daemon scope vocabulary. Seven strings, append-only.
@@ -56,11 +56,12 @@ exports.SCOPES = Object.freeze({
     TOOLS_FS_WRITE: 'daemon:tools:fs:write',
     BROWSER_CDP: 'daemon:browser:cdp',
     NATIVE_UI_CONTROL: 'daemon:native-ui:control',
+    COMPUTER_USE_CONTROL: 'daemon:computer-use:control',
     SESSION_REPLAY: 'daemon:session:replay',
     OFFLINE_QUEUE: 'daemon:offline-queue',
 });
 /**
- * The seven daemon scopes in canonical order. Frozen so consumers can
+ * All daemon scopes in canonical order. Login defaults are a separate opt-in policy. Frozen so consumers can
  * pass it directly to OAuth `scope` parameters without defensive
  * copies.
  */
@@ -70,9 +71,12 @@ exports.ALL_DAEMON_SCOPES = Object.freeze([
     exports.SCOPES.TOOLS_FS_WRITE,
     exports.SCOPES.BROWSER_CDP,
     exports.SCOPES.NATIVE_UI_CONTROL,
+    exports.SCOPES.COMPUTER_USE_CONTROL,
     exports.SCOPES.SESSION_REPLAY,
     exports.SCOPES.OFFLINE_QUEUE,
 ]);
+/** Login defaults retain the existing surface; script control is explicit opt-in. */
+exports.DEFAULT_DAEMON_SCOPES = Object.freeze(exports.ALL_DAEMON_SCOPES.filter((scope) => scope !== exports.SCOPES.COMPUTER_USE_CONTROL));
 /**
  * Set form of `ALL_DAEMON_SCOPES` for O(1) membership checks.
  */