@skrr-ai/cli 0.1.115 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/githubPushRefusal.js

@@ -1,49 +1,67 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.GITHUB_WORKFLOW_PERMISSION_REQUIRED = void 0;
-exports.isWorkflowPath = isWorkflowPath;
-exports.classifyGitHubPushRefusal = classifyGitHubPushRefusal;
-/** GitHub push diagnostics must never escape this parser as raw stderr. */
-exports.GITHUB_WORKFLOW_PERMISSION_REQUIRED = 'github_workflow_permission_required';
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var githubPushRefusal_exports = {};
+__export(githubPushRefusal_exports, {
+  GITHUB_WORKFLOW_PERMISSION_REQUIRED: () => GITHUB_WORKFLOW_PERMISSION_REQUIRED,
+  classifyGitHubPushRefusal: () => classifyGitHubPushRefusal,
+  isWorkflowPath: () => isWorkflowPath
+});
+module.exports = __toCommonJS(githubPushRefusal_exports);
+const GITHUB_WORKFLOW_PERMISSION_REQUIRED = "github_workflow_permission_required";
 function workflowPath(value) {
-    if (typeof value !== 'string' || value.length > 240)
-        return null;
-    const path = value.replaceAll('\\', '/');
-    if (!/^\.github\/workflows\/[A-Za-z0-9_. /-]+$/.test(path))
-        return null;
-    const parts = path.split('/');
-    if (parts.some((part) => !part.trim() || part !== part.trim() || part === '.' || part === '..'))
-        return null;
-    return path;
+  if (typeof value !== "string" || value.length > 240)
+    return null;
+  const path = value.replaceAll("\\", "/");
+  if (!/^\.github\/workflows\/[A-Za-z0-9_. /-]+$/.test(path))
+    return null;
+  const parts = path.split("/");
+  if (parts.some((part) => !part.trim() || part !== part.trim() || part === "." || part === ".."))
+    return null;
+  return path;
 }
 function isWorkflowPath(value) {
-    return workflowPath(value) !== null;
+  return workflowPath(value) !== null;
 }
 function classifyGitHubPushRefusal(text) {
-    if (typeof text !== 'string')
-        return null;
-    // Bound parsing work. Git prints the rejection LAST, after any amount of
-    // progress output, so keep the tail; truncated diagnostics keep the generic refusal.
-    const input = text.slice(-64 * 1024);
-    const pattern = /refusing to allow (?:a|an) (GitHub App|OAuth App|Personal Access Token) to create or update workflow [`'"]([^`'"\r\n]+)[`'"] without [`'"]workflows?[`'"] (?:permission|scope)/gi;
-    const paths = [];
-    let tokenKind = 'unknown';
-    for (const match of input.matchAll(pattern)) {
-        const path = workflowPath(match[2]);
-        if (!path)
-            continue;
-        if (tokenKind === 'unknown') {
-            tokenKind =
-                match[1].toLowerCase() === 'github app'
-                    ? 'github_app'
-                    : match[1].toLowerCase() === 'oauth app'
-                        ? 'oauth_app'
-                        : 'personal_access_token';
-        }
-        if (!paths.includes(path))
-            paths.push(path);
-        if (paths.length === 10)
-            break;
+  if (typeof text !== "string")
+    return null;
+  const input = text.slice(-64 * 1024);
+  const pattern = /refusing to allow (?:a|an) (GitHub App|OAuth App|Personal Access Token) to create or update workflow [`'"]([^`'"\r\n]+)[`'"] without [`'"]workflows?[`'"] (?:permission|scope)/gi;
+  const paths = [];
+  let tokenKind = "unknown";
+  for (const match of input.matchAll(pattern)) {
+    const path = workflowPath(match[2]);
+    if (!path)
+      continue;
+    if (tokenKind === "unknown") {
+      tokenKind = match[1].toLowerCase() === "github app" ? "github_app" : match[1].toLowerCase() === "oauth app" ? "oauth_app" : "personal_access_token";
     }
-    return paths.length ? { code: exports.GITHUB_WORKFLOW_PERMISSION_REQUIRED, tokenKind, paths } : null;
+    if (!paths.includes(path))
+      paths.push(path);
+    if (paths.length === 10)
+      break;
+  }
+  return paths.length ? { code: GITHUB_WORKFLOW_PERMISSION_REQUIRED, tokenKind, paths } : null;
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GITHUB_WORKFLOW_PERMISSION_REQUIRED,
+  classifyGitHubPushRefusal,
+  isWorkflowPath
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessPermissionControls.js

@@ -1,62 +1,69 @@
 "use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.parseHarnessPermissionControls = parseHarnessPermissionControls;
-const PLAN = ['harness', 'reported-actions', 'unsupported', 'unknown'];
-const APPROVAL = ['harness', 'reported-actions', 'none', 'unknown'];
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var harnessPermissionControls_exports = {};
+__export(harnessPermissionControls_exports, {
+  parseHarnessPermissionControls: () => parseHarnessPermissionControls
+});
+module.exports = __toCommonJS(harnessPermissionControls_exports);
+const PLAN = ["harness", "reported-actions", "unsupported", "unknown"];
+const APPROVAL = ["harness", "reported-actions", "none", "unknown"];
 const FILESYSTEM = [
-    'harness-sandbox',
-    'tool-path-guards',
-    'reported-actions',
-    'not-restricted-by-daemon',
-    'unknown',
+  "harness-sandbox",
+  "tool-path-guards",
+  "reported-actions",
+  "not-restricted-by-daemon",
+  "unknown"
 ];
-const TOOL_ENFORCEMENT = ['harness', 'negotiated', 'unsupported', 'unknown'];
-/**
- * Presence/registration metadata is untrusted input. Copy only the v1 enum
- * vocabulary: unknown future claims and malformed profiles yield no report,
- * rather than a green badge. Additive fields are stripped for compatibility.
- */
+const TOOL_ENFORCEMENT = ["harness", "negotiated", "unsupported", "unknown"];
 function parseHarnessPermissionControls(value) {
-    try {
-        if (!value || typeof value !== 'object' || Array.isArray(value))
-            return null;
-        const row = value;
-        const { version, plan, approval, filesystem, organizationToolDenylist, networkEgress, strictToolPolicy, } = row;
-        const strict = strictToolPolicy;
-        if (!strict || typeof strict !== 'object' || Array.isArray(strict))
-            return null;
-        const strictModes = strict.modes;
-        const enforcement = strict.enforcement;
-        if (version !== 1 ||
-            !PLAN.includes(plan) ||
-            !APPROVAL.includes(approval) ||
-            !FILESYSTEM.includes(filesystem) ||
-            !['unsupported', 'unknown'].includes(organizationToolDenylist) ||
-            !['not-restricted-by-daemon', 'unknown'].includes(networkEgress) ||
-            !TOOL_ENFORCEMENT.includes(enforcement) ||
-            !Array.isArray(strictModes) ||
-            strictModes.length > 2 ||
-            !strictModes.every((mode) => mode === 'none' || mode === 'allowlist'))
-            return null;
-        const modes = [...new Set(strictModes)];
-        if (((enforcement === 'unsupported' || enforcement === 'unknown') && modes.length > 0) ||
-            ((enforcement === 'harness' || enforcement === 'negotiated') && modes.length === 0))
-            return null;
-        return Object.freeze({
-            version: 1,
-            plan: plan,
-            approval: approval,
-            filesystem: filesystem,
-            strictToolPolicy: Object.freeze({
-                modes: Object.freeze(modes),
-                enforcement: enforcement,
-            }),
-            organizationToolDenylist: organizationToolDenylist,
-            networkEgress: networkEgress,
-        });
-    }
-    catch {
-        // Malicious accessors/proxies must not break a read surface.
-        return null;
-    }
+  try {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+      return null;
+    const row = value;
+    const { version, plan, approval, filesystem, organizationToolDenylist, networkEgress, strictToolPolicy } = row;
+    const strict = strictToolPolicy;
+    if (!strict || typeof strict !== "object" || Array.isArray(strict))
+      return null;
+    const strictModes = strict.modes;
+    const enforcement = strict.enforcement;
+    if (version !== 1 || !PLAN.includes(plan) || !APPROVAL.includes(approval) || !FILESYSTEM.includes(filesystem) || !["unsupported", "unknown"].includes(organizationToolDenylist) || !["not-restricted-by-daemon", "unknown"].includes(networkEgress) || !TOOL_ENFORCEMENT.includes(enforcement) || !Array.isArray(strictModes) || strictModes.length > 2 || !strictModes.every((mode) => mode === "none" || mode === "allowlist"))
+      return null;
+    const modes = [...new Set(strictModes)];
+    if ((enforcement === "unsupported" || enforcement === "unknown") && modes.length > 0 || (enforcement === "harness" || enforcement === "negotiated") && modes.length === 0)
+      return null;
+    return Object.freeze({
+      version: 1,
+      plan,
+      approval,
+      filesystem,
+      strictToolPolicy: Object.freeze({
+        modes: Object.freeze(modes),
+        enforcement
+      }),
+      organizationToolDenylist,
+      networkEgress
+    });
+  } catch {
+    return null;
+  }
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  parseHarnessPermissionControls
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessSkillLayout.js

@@ -1,99 +1,52 @@
 "use strict";
-/**
- * OSK-10409 — which harnesses resolve the `.claude/skills/<name>/SKILL.md`
- * layout, shared by the server and the daemon.
- *
- * ── Why this lives in auth-core ────────────────────────────────────────────
- *
- * The same reason `harnessTrust.ts` does: it is a DECLARED per-harness fact
- * that several processes have to agree on, and the cost of them disagreeing is
- * silent. It is not auth, and it does not pretend to be — auth-core is where
- * this repo already keeps the small tables that a harness's identity answers.
- *
- * ── What the fact IS ───────────────────────────────────────────────────────
- *
- * The daemon materializes a session's skills at
- * `<root>/.claude/skills/<name>/SKILL.md` and hands `<root>` to the harness —
- * `--add-dir` for the Claude CLI, ACP `additionalDirectories` for Devin. A
- * harness on this list READS that layout: it enumerates the tree, surfaces the
- * manifest line, and resolves the body from disk. A harness that is not on it
- * ignores the tree entirely, so nothing laid there ever reaches its model.
- *
- * It is a capability with EVIDENCE, never a brand check. The gate this replaced
- * read `provider !== 'claude'` on the stated premise that every other harness
- * ignores the layout, and the premise was false for Devin (OSK-10264): the
- * daemon lays the same tree, passes it on `additionalDirectories`, and Devin
- * loads it — measured live on 3000.10.31. Add a harness here only with the same
- * kind of evidence, that its sessions actually surface a skill laid out this
- * way. A harness that ignores the layout gains nothing and pays for the wire.
- *
- * ── Three readers, in three directions ─────────────────────────────────────
- *
- *  1. The server's PUSH gate (`buildDaemonServerSkills`): a harness on this
- *     list is one a pushed skill should be sent to.
- *  2. The server's INVOKED-BODY gate (`buildInvokedSkillsPrompt`, OSK-10361):
- *     a harness on this list must NOT also have the body pasted into its
- *     prompt — it already has it from the tree, and on ACP the paste lands in
- *     the transcript at full skill size on every invoked turn.
- *  3. The daemon's SHADOWING protection (`skill-shadowing.ts`, OSK-10044): a
- *     harness on this list resolves `/<name>` from its own `.claude/skills`
- *     roots, so a picked skill can be shadowed there by a same-named one — and
- *     the daemon is the only place that collision can be seen. That gate spelled
- *     `claude` and so never reached Devin, which the server-side paste was
- *     accidentally masking until (2) stopped pasting.
- *
- * Reader 3 is why the table moved out of the API: the daemon cannot require an
- * api-side module, and a second copy of a table whose whole value is that every
- * reader agrees is worse than no table at all.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = void 0;
-exports.harnessLoadsClaudeSkillsLayout = harnessLoadsClaudeSkillsLayout;
-exports.claudeSkillsLayoutEvidence = claudeSkillsLayoutEvidence;
-const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
-/**
- * Harness provider → the evidence that its sessions load the layout.
- *
- * The reason string is part of the entry, not decoration: an entry added
- * without one is an entry nobody can audit later.
- */
-exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = new Map([
-    ['claude', 'Claude Code reads .claude/skills natively from --add-dir'],
-    [
-        'devin',
-        'Devin imports the Claude convention from additionalDirectories ' +
-            '(read_config_from.claude, on by default) — verified live on 3000.10.31',
-    ],
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var harnessSkillLayout_exports = {};
+__export(harnessSkillLayout_exports, {
+  HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT: () => HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT,
+  claudeSkillsLayoutEvidence: () => claudeSkillsLayoutEvidence,
+  harnessLoadsClaudeSkillsLayout: () => harnessLoadsClaudeSkillsLayout
+});
+module.exports = __toCommonJS(harnessSkillLayout_exports);
+var import_firstPartyHarness = require("./firstPartyHarness.js");
+const HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = /* @__PURE__ */ new Map([
+  ["claude", "Claude Code reads .claude/skills natively from --add-dir"],
+  [
+    "devin",
+    "Devin imports the Claude convention from additionalDirectories (read_config_from.claude, on by default) \u2014 verified live on 3000.10.31"
+  ]
 ]);
-/**
- * Canonicalise the way every reader of this table must.
- *
- * The provider is lower-cased and trimmed, then passed through
- * `canonicalHarnessProvider` so an accepted alias of the first-party harness
- * resolves to the same decision as its canonical slug rather than falling
- * through to "not a native resolver". Callers with a RICHER normalizer (the API
- * has `normalizeSessionProvider`, which also folds `claude-code`) apply theirs
- * first; this is the floor, not a replacement.
- */
 function canonicalize(provider) {
-    return String((0, firstPartyHarness_js_1.canonicalHarnessProvider)(provider.trim().toLowerCase()));
+  return String((0, import_firstPartyHarness.canonicalHarnessProvider)(provider.trim().toLowerCase()));
 }
-/**
- * Whether this harness resolves a skill from the `.claude/skills` tree the
- * daemon materializes, so the body reaches it without being pasted anywhere.
- *
- * An absent provider is NOT a native resolver. "We do not know what this is"
- * must never mean "it reads the layout" — that direction withholds the body
- * from a harness that needed it, which is a turn that looks like the skill ran.
- */
 function harnessLoadsClaudeSkillsLayout(provider) {
-    if (!provider || typeof provider !== 'string')
-        return false;
-    return exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT.has(canonicalize(provider));
+  if (!provider || typeof provider !== "string")
+    return false;
+  return HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT.has(canonicalize(provider));
 }
-/** The stated evidence for a harness on the list, or `null` when it is not. */
 function claudeSkillsLayoutEvidence(provider) {
-    if (!provider || typeof provider !== 'string')
-        return null;
-    return exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT.get(canonicalize(provider)) ?? null;
+  if (!provider || typeof provider !== "string")
+    return null;
+  return HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT.get(canonicalize(provider)) ?? null;
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT,
+  claudeSkillsLayoutEvidence,
+  harnessLoadsClaudeSkillsLayout
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessTrust.js

@@ -1,118 +1,73 @@
 "use strict";
-/**
- * OSK-3897 — harness trust TIERS, shared by the daemon and the CLI.
- *
- * ── Why this lives in auth-core ────────────────────────────────────────────
- *
- * `skrr code doctor` must tell a user what tier their harness is and what that
- * means for credentials and permission prompts. The daemon is the authority for
- * that answer, but the CLI cannot import `daemon/src` — separate packages, and
- * the daemon already depends on the CLI, so the reverse edge would be a cycle.
- *
- * `auth-core` is the one package BOTH already resolve: it is a daemon dependency
- * and it is copied verbatim into the published CLI by
- * `cli/scripts/vendor-monorepo-deps.js`, which keeps its `exports` map intact and
- * preserves a single physical instance. So sharing through here changes nothing
- * in the build or the release pipeline.
- *
- * Before this, the CLI carried a MIRROR of the table with a static test that
- * parsed the daemon's source to catch drift. That guard worked — and it was still
- * only a guard. The regression it existed to catch had already shipped once: the
- * doctor described Tier 2 behaviour for a day after the owner decision of
- * 2026-08-11 moved the first-party harness to Tier 1, and a unit test asserting the stale
- * string made the wrong claim look load-bearing.
- *
- * ── What deliberately did NOT move ────────────────────────────────────────
- *
- * The PROVENANCE half stays in the daemon: `OVERSKY_DISTRIBUTED_HARNESSES`,
- * `PROVENANCE_ELEVATABLE_TIERS`, `ProvenanceEvidence`, `effectiveHarnessTier`,
- * `credentialTierForSpawn`, and the signature verification behind them.
- *
- * That split is the point. A tier is a PUBLISHED FACT — safe for any surface to
- * read and state. Provenance is EVIDENCE ABOUT BYTES ON DISK, which only the
- * process that spawns the binary can gather. Moving it here would let the CLI
- * appear to speak about binary identity it has no way to verify, which is a worse
- * failure than the drift this file fixes: a confident wrong answer beats an
- * honestly stale one for causing harm.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.HARNESS_TIERS = void 0;
-exports.getHarnessTier = getHarnessTier;
-exports.credentialPolicyForTier = credentialPolicyForTier;
-exports.tierPermitsConfiguredAutoMode = tierPermitsConfiguredAutoMode;
-const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
-/**
- * Trust tier by backend name.
- *
- * Tier 1 — first-party / audited. Tier 2 — reviewed open-source community
- * harness. Tier 3 has NO entries on purpose: it is what any name absent from this
- * map resolves to, so adding trust is always a deliberate, reviewable edit and
- * never an omission.
- *
- * The first-party harness is Tier 1 by OWNER DECISION (2026-08-11). The full
- * reasoning, and the measured cost of the Tier 2 posture it replaced, is recorded
- * in `daemon/src/harness-trust.ts` beside the gates that read it — the argument
- * belongs where the enforcement is, not in a shared vocabulary module.
- *
- * It is entered under every ACCEPTED spelling (`firstPartyHarnessSpellings`), not
- * only the canonical one. During a rename a backend name reaches this lookup from
- * a daemon of any version, and an alias that fell through to the Tier 3 default
- * would silently strip the harness of the trust the owner granted it — a failure
- * that looks like a permission prompt storm, not like a rename.
- *
- * A FORMER spelling is deliberately absent. Nothing dispatches under one after
- * contract, and a name that is not accepted must never inherit Tier 1 by being
- * remembered: it falls to the default like any unknown backend.
- */
-exports.HARNESS_TIERS = Object.freeze({
-    // --- Tier 1: vendor first-party / audited ---
-    claude: 1,
-    codex: 1,
-    opencode: 1,
-    'opencode-acp': 1,
-    gemini: 1,
-    'gemini-acp': 1,
-    // Cognition's own CLI (`devin acp`). Vendor first-party like claude/codex —
-    // its credential is Cognition's API key, delivered over the ACP
-    // `authenticate` RPC rather than env (see daemon backends/devin.ts).
-    devin: 1,
-    ...Object.fromEntries((0, firstPartyHarness_js_1.firstPartyHarnessSpellings)().map((spelling) => [spelling, 1])),
-    // --- Tier 2: reviewed open-source community harnesses ---
-    goose: 2,
-    aider: 2,
-    cline: 2,
-    openhands: 2,
-    kimi: 2,
-    hermes: 2,
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var harnessTrust_exports = {};
+__export(harnessTrust_exports, {
+  HARNESS_TIERS: () => HARNESS_TIERS,
+  credentialPolicyForTier: () => credentialPolicyForTier,
+  getHarnessTier: () => getHarnessTier,
+  tierPermitsConfiguredAutoMode: () => tierPermitsConfiguredAutoMode
+});
+module.exports = __toCommonJS(harnessTrust_exports);
+var import_firstPartyHarness = require("./firstPartyHarness.js");
+const HARNESS_TIERS = Object.freeze({
+  // --- Tier 1: vendor first-party / audited ---
+  claude: 1,
+  codex: 1,
+  opencode: 1,
+  "opencode-acp": 1,
+  gemini: 1,
+  "gemini-acp": 1,
+  // Cognition's own CLI (`devin acp`). Vendor first-party like claude/codex —
+  // its credential is Cognition's API key, delivered over the ACP
+  // `authenticate` RPC rather than env (see daemon backends/devin.ts).
+  devin: 1,
+  ...Object.fromEntries((0, import_firstPartyHarness.firstPartyHarnessSpellings)().map((spelling) => [spelling, 1])),
+  // --- Tier 2: reviewed open-source community harnesses ---
+  goose: 2,
+  aider: 2,
+  cline: 2,
+  openhands: 2,
+  kimi: 2,
+  hermes: 2
 });
-/**
- * Resolve the trust tier for a backend name.
- *
- * Returns `3` for any name that is not first-party or reviewed-community —
- * including empty, whitespace-only, and non-string inputs. Unknown == untrusted.
- */
 function getHarnessTier(backendName) {
-    if (!backendName || typeof backendName !== 'string')
-        return 3;
-    const key = backendName.trim();
-    if (!key)
-        return 3;
-    return exports.HARNESS_TIERS[key] ?? 3;
+  if (!backendName || typeof backendName !== "string")
+    return 3;
+  const key = backendName.trim();
+  if (!key)
+    return 3;
+  return HARNESS_TIERS[key] ?? 3;
 }
 function credentialPolicyForTier(tier) {
-    if (tier === 1)
-        return 'direct-or-gateway';
-    if (tier === 2)
-        return 'gateway-only';
-    return 'byo-only';
+  if (tier === 1)
+    return "direct-or-gateway";
+  if (tier === 2)
+    return "gateway-only";
+  return "byo-only";
 }
-/**
- * May an operator-configured `auto` permission mode SURVIVE for this tier?
- *
- * This never approves anything. It answers only whether a mode the operator
- * already chose is kept or downgraded to per-call adjudication — which is the
- * distinction most often lost when someone reads "Tier 1" as "pre-approved".
- */
 function tierPermitsConfiguredAutoMode(tier) {
-    return tier === 1;
+  return tier === 1;
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  HARNESS_TIERS,
+  credentialPolicyForTier,
+  getHarnessTier,
+  tierPermitsConfiguredAutoMode
+});