@skrr-ai/cli 0.1.119 → 0.1.121

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/guidedUpdate.js

@@ -0,0 +1,404 @@
+/**
+ * The pure core of a GUIDED update (OSK-19107, Space OSK-S-524, tasks M51 to M53):
+ * hold the machine, wait for it to be quiet, update, verify, and give the machine
+ * back. The Desktop app and a standalone `skrr` install both run it, so what they
+ * decide on, and the words they use for what is in the way, cannot drift apart.
+ *
+ * This file is DECISIONS ONLY. It performs no I/O, reads no clock and holds no
+ * state, so every rule below is a table test. The orchestration (a persisted flow
+ * record, polling, the installer, the supervisor) lives with each caller, because
+ * that is the part that differs between a Desktop that quits mid-flow and a CLI that
+ * runs in the foreground.
+ *
+ * ## Why these rules (each names the failure it prevents)
+ *
+ * - **`prepare` is a probe that briefly refuses admitted work.** While it runs the
+ *   daemon refuses admitted tool calls with an infra-class error, and a tool-proxy Run
+ *   that sees one drops its tools to the Hosted Machine for good. So a guided flow
+ *   calls it ONLY when the server's reading says there is nothing admitted to refuse
+ *   ({@link prepareBasis}), never to find out whether there is.
+ * - **`unknown` is an answer.** A source nobody could read is never zero and never
+ *   ready. {@link noServerVeto} is deliberately strict: every server source must have
+ *   been read, and none may list active or unproven work.
+ * - **A server source can only veto.** Only the daemon's own positively announced
+ *   report grants `ready`; the owner's attestation and the daemon's own `prepare`
+ *   (labelled `no_veto`, D38) are the two other bases, and each is labelled as what
+ *   it is wherever it is shown.
+ * - **Blockers are shown in the words of whoever knows them.** The daemon's blocker
+ *   `reason` and the server's holder `label` are the vocabulary; nothing here
+ *   re-spells them. They are bounded and never a raw path, because a diagnostic can
+ *   carry one.
+ * - **A new PID, an exit code or a cloud connection is not a verified update.**
+ *   {@link verifyReplacement} requires the daemon's own `verified`, from a process
+ *   other than the one that was replaced, for the build that was asked for, and the
+ *   same machine identity afterwards. A different identity is the reinstall case: the
+ *   hold is left in place and shown, never resumed.
+ *
+ * The shapes are STRUCTURAL SUBSETS of `DaemonMaintenanceView` in
+ * `@skrr-ai/data-provider` (`daemonMaintenance.ts`), which is the one vocabulary.
+ * This package cannot import it (it sits below it), so `guidedUpdate.test.ts` reads
+ * that file and fails when a list mirrored here drifts from it.
+ */
+/** The server sources that can only veto. `daemon_report` is the only one that grants. */
+export const GUIDED_SERVER_SOURCES = [
+    'claims',
+    'receipts',
+    'sessions',
+    'runs',
+    'leases',
+    'custody',
+];
+/** The refusals the owner API names, mirrored from `DAEMON_MAINTENANCE_REFUSALS`. */
+export const GUIDED_REFUSALS = [
+    'managed_machine',
+    'no_stable_identity',
+    'not_found',
+    'ambiguous',
+    'generation_conflict',
+    'not_held',
+    'already_held',
+    'attestation_not_applicable',
+    'not_owner',
+    'held_by_other',
+];
+export function isGuidedRefusal(value) {
+    return typeof value === 'string' && GUIDED_REFUSALS.includes(value);
+}
+/** The daemon handoff phases, mirrored from `daemon/src/update/handoff.ts`. */
+export const GUIDED_HANDOFF_PHASES = [
+    'ready',
+    'deferred',
+    'reconnecting',
+    'verified',
+    'failed',
+    'rolled-back',
+];
+/**
+ * Whether the server holds a reading that nothing vetoes, for a daemon that cannot
+ * report (D38). Strict on purpose: a source that is absent from the list, unreadable,
+ * truncated, or that names active or unproven work, is a veto. `daemon_report` must
+ * be `not_announced`: any other answer means the reading is not the
+ * `no_inventory_capability` case this is for.
+ */
+export function noServerVeto(sources) {
+    // `Array.isArray` does not narrow a readonly array, so the list is named explicitly.
+    if (!Array.isArray(sources))
+        return false;
+    const list = sources;
+    for (const name of GUIDED_SERVER_SOURCES) {
+        const source = list.find((s) => s && s.source === name);
+        if (!source || source.read !== 'ok' || source.truncated === true)
+            return false;
+        const holders = Array.isArray(source.holders)
+            ? source.holders
+            : null;
+        if (!holders)
+            return false;
+        if (holders.some((h) => h && (h.class === 'active' || h.class === 'unproven')))
+            return false;
+    }
+    const report = list.find((s) => s && s.source === 'daemon_report');
+    return report !== undefined && report.read === 'not_announced';
+}
+/**
+ * Read the owner API's view for a flow that took `generation`.
+ *
+ * Order matters and is the rule set (each is a test):
+ *  1. No live hold: `not_held`. A different live generation: `generation_changed`.
+ *  2. The fence is not confirmed (`pausing`): nothing below it means anything.
+ *  3. The reading is `ready` (the daemon's own report): `ready` by evidence.
+ *  4. `draining`: work is running. Evidence, never overridden.
+ *  5. `unknown`: ready by attestation if the Journey says the owner vouched for this
+ *     cause; `no_report` if the daemon cannot report and no source vetoes; else
+ *     `unknown`. No reading at all is `unknown (source_unreadable)`, never ready.
+ */
+export function evaluateReadiness(view, expectedGeneration) {
+    const hold = view?.hold;
+    if (!view || !hold || hold.lifecycle !== 'held')
+        return { kind: 'not_held' };
+    if (expectedGeneration !== null && hold.generation !== expectedGeneration) {
+        return { kind: 'generation_changed', currentGeneration: hold.generation };
+    }
+    if (view.journey?.phase === 'pausing')
+        return { kind: 'pausing' };
+    const reading = view.reading;
+    if (!reading)
+        return { kind: 'unknown', cause: 'source_unreadable' };
+    if (reading.state === 'ready')
+        return { kind: 'ready', basis: 'evidence' };
+    if (reading.state === 'draining')
+        return { kind: 'draining' };
+    if (reading.state !== 'unknown')
+        return { kind: 'unknown', cause: 'source_unreadable' };
+    if (view.journey?.phase === 'ready' && view.journey.modifiers?.includes('attested')) {
+        return { kind: 'ready', basis: 'attested' };
+    }
+    if (reading.cause === 'no_inventory_capability' && noServerVeto(reading.sources)) {
+        return { kind: 'no_report' };
+    }
+    return { kind: 'unknown', cause: reading.cause ?? null };
+}
+/**
+ * Whether a guided flow may call the daemon's `prepare`, and on what basis. `null`
+ * means NO: `prepare` is never a way to find out. A legacy daemon never gets one:
+ * it has no endpoint, and its restart is the owner's attested decision, not a probe.
+ */
+export function prepareBasis(readiness, opts) {
+    if (opts.legacy)
+        return null;
+    if (readiness.kind === 'ready')
+        return readiness.basis;
+    if (readiness.kind === 'no_report')
+        return 'no_veto';
+    return null;
+}
+/**
+ * Whether a legacy daemon (no handoff endpoint) may be restarted by the supervisor.
+ * Only on the owner's attestation: the daemon cannot report what it is doing and a
+ * SIGTERM ends its wrappers, so nothing but the owner's word can vouch for it.
+ */
+export function legacyRestartAllowed(readiness) {
+    return readiness.kind === 'ready' && readiness.basis === 'attested';
+}
+export const MAX_OWNER_BLOCKERS = 20;
+const BLOCKER_TEXT_MAX = 200;
+const ID_PATTERN = /^[A-Za-z0-9_-]{1,120}$/;
+// A diagnostic can carry a local path or a URL. Showing one would leak the layout of
+// someone's machine into a notice, so a reason that looks like one is dropped whole.
+const PATHLIKE = /(?:^|[\s("'=])(?:~|\.{1,2})?[\\/](?:[\w.-]+[\\/])+|[A-Za-z]:[\\/]|\\\\|file:\/\/|\/(?:Users|home|var|tmp|private|opt|etc|usr)\//i;
+/** A sentence safe to put in front of the owner, or `undefined` when it is not. */
+export function sanitizeBlockerText(value, max = BLOCKER_TEXT_MAX) {
+    if (typeof value !== 'string')
+        return undefined;
+    const cleaned = Array.from(value, (ch) => {
+        const code = ch.charCodeAt(0);
+        return code < 0x20 || code === 0x7f ? ' ' : ch;
+    })
+        .join('')
+        .replace(/\s+/g, ' ')
+        .trim();
+    if (!cleaned || PATHLIKE.test(cleaned))
+        return undefined;
+    return cleaned.length > max ? `${cleaned.slice(0, max - 1)}…` : cleaned;
+}
+function boundedId(value) {
+    return typeof value === 'string' && ID_PATTERN.test(value) ? value : undefined;
+}
+/**
+ * Everything in the way, from the three places that know: the server's holders
+ * (active and unproven work: `pending_delivery` and `forensic` never block), the
+ * daemon's own refusal from `prepare`, and the work the Desktop app itself hosts and
+ * ends when it quits (`LocalSessionService` processes and agent browser windows,
+ * which the daemon's inventory cannot see).
+ *
+ * A daemon blocker whose id equals a server holder's ref is the same work seen twice:
+ * it is listed once, with the daemon's reason and the server's label. Whether the two
+ * ids are in fact comparable was never established (review §6.2 item 2), so a match
+ * only MERGES the wording and never hides a blocker that has no match.
+ */
+export function describeBlockers(input) {
+    const out = [];
+    const serverByRef = new Map();
+    const serverHolders = [];
+    for (const source of input.view?.reading?.sources ?? []) {
+        for (const holder of source?.holders ?? []) {
+            if (!holder || (holder.class !== 'active' && holder.class !== 'unproven'))
+                continue;
+            serverHolders.push(holder);
+            if (typeof holder.ref === 'string')
+                serverByRef.set(holder.ref, holder);
+        }
+    }
+    const merged = new Set();
+    for (const blocker of input.daemon ?? []) {
+        if (!blocker || typeof blocker.kind !== 'string')
+            continue;
+        const id = boundedId(blocker.id);
+        const holder = blocker.id ? serverByRef.get(blocker.id) : undefined;
+        if (holder)
+            merged.add(holder);
+        const label = holder ? sanitizeBlockerText(holder.label, 120) : undefined;
+        out.push({
+            source: 'daemon',
+            kind: blocker.kind.slice(0, 64),
+            text: sanitizeBlockerText(blocker.reason),
+            ...(label ? { label } : {}),
+            ...(id ? { id } : {}),
+            ...(holder?.since !== undefined ? { since: holder.since } : {}),
+        });
+    }
+    for (const holder of serverHolders) {
+        if (merged.has(holder))
+            continue;
+        const id = boundedId(holder.ref);
+        out.push({
+            source: 'server',
+            kind: String(holder.kind || 'work').slice(0, 64),
+            text: sanitizeBlockerText(holder.label, 120),
+            ...(id ? { id } : {}),
+            ...(holder.since !== undefined ? { since: holder.since } : {}),
+        });
+    }
+    const desktop = input.desktop;
+    if (desktop && desktop.localSessions > 0) {
+        out.push({ source: 'desktop', kind: 'desktop_local_sessions', count: desktop.localSessions });
+    }
+    if (desktop && desktop.agentBrowserWindows > 0) {
+        out.push({
+            source: 'desktop',
+            kind: 'desktop_agent_browser',
+            count: desktop.agentBrowserWindows,
+        });
+    }
+    return out.slice(0, MAX_OWNER_BLOCKERS);
+}
+/**
+ * A string that changes whenever the set of things in the way changes. The "update
+ * now anyway" confirmation carries the one it was shown, and the action is refused
+ * when it no longer matches: a confirmation that names what WAS running is not a
+ * confirmation of what is.
+ */
+export function blockersFingerprint(blockers) {
+    return blockers
+        .map((b) => [b.source, b.kind, b.id ?? '', b.count ?? ''].join('|'))
+        .sort()
+        .join(';');
+}
+/**
+ * The labels the owner is shown, as the server records them in the outcome
+ * (`acknowledged`): each bounded to the server's 160-character limit.
+ */
+export function acknowledgedLabels(blockers, max = 20) {
+    const labels = [];
+    for (const b of blockers) {
+        const detail = b.label ?? b.text;
+        const text = b.count ? `${b.kind} (${b.count})` : detail ? `${b.kind}: ${detail}` : b.kind;
+        labels.push(text.slice(0, 160));
+        if (labels.length >= max)
+            break;
+    }
+    return labels;
+}
+function isHandoffStatus(value) {
+    if (!value || typeof value !== 'object')
+        return false;
+    const v = value;
+    return (v.protocolVersion === 1 &&
+        typeof v.handoffId === 'string' &&
+        typeof v.phase === 'string' &&
+        GUIDED_HANDOFF_PHASES.includes(v.phase) &&
+        typeof v.sourceProcessId === 'string' &&
+        !!v.target &&
+        typeof v.target.sha256 === 'string' &&
+        Array.isArray(v.blockers) &&
+        Array.isArray(v.expectedSessions));
+}
+export function classifyHandoffReply(input) {
+    const { statusCode, body } = input;
+    if (statusCode === null)
+        return { kind: 'unreachable' };
+    if (statusCode === 200) {
+        return isHandoffStatus(body) ? { kind: 'ok', status: body } : { kind: 'unreachable' };
+    }
+    if (statusCode === 404)
+        return { kind: 'absent' };
+    if (statusCode === 401 || statusCode === 403)
+        return { kind: 'unauthorized' };
+    if (statusCode === 400 || statusCode === 409 || statusCode === 413 || statusCode === 405) {
+        const code = body && typeof body === 'object' && typeof body.error === 'string'
+            ? String(body.error).slice(0, 64)
+            : undefined;
+        return { kind: 'refused', ...(code ? { code } : {}) };
+    }
+    return { kind: 'unreachable' };
+}
+/**
+ * Decide whether a committed replacement is complete. All of (1) and (2) must hold
+ * before anything else is asked of the server (3, {@link serverSawNewProcess}), and
+ * nothing here resumes: the verdict only says what was seen.
+ *
+ * An identity that is merely UNREADABLE (the bootstrap is mid-rotation, the machine
+ * payload could not be fetched) is `not_yet`, never a reinstall and never verified.
+ */
+export function verifyReplacement(evidence) {
+    const { handoff, expect, identity } = evidence;
+    if (!handoff)
+        return { kind: 'not_yet', missing: 'daemon_status' };
+    if (handoff.phase === 'failed' || handoff.phase === 'rolled-back') {
+        return {
+            kind: 'failed',
+            phase: handoff.phase,
+            reason: String(handoff.reason || handoff.phase).slice(0, 64),
+            // A failed handoff observed by the SAME process is a replacement that never
+            // happened: the old daemon is still the one running, and a retry is meaningful.
+            sameProcess: handoff.observer?.processId === expect.sourceProcessId,
+        };
+    }
+    if (handoff.phase !== 'verified')
+        return { kind: 'not_yet', missing: 'verified' };
+    const by = handoff.verifiedBy;
+    if (!by ||
+        by.processId === expect.sourceProcessId ||
+        handoff.target.sha256 !== expect.targetSha256 ||
+        (expect.version !== null && by.version !== expect.version)) {
+        return { kind: 'not_yet', missing: 'verified' };
+    }
+    if (identity.bootstrapDaemonId === null || identity.runtimeKeyNow === null) {
+        return { kind: 'not_yet', missing: 'identity_unreadable' };
+    }
+    if (identity.bootstrapDaemonId !== identity.recordedDaemonId) {
+        return { kind: 'reinstall', what: 'daemon_id' };
+    }
+    if (identity.runtimeKeyNow !== identity.recordedRuntimeKey) {
+        return { kind: 'reinstall', what: 'runtime_key' };
+    }
+    return { kind: 'verified' };
+}
+/**
+ * The legacy counterpart: a daemon with no handoff cannot say `verified`, so the copy
+ * claims only what was seen ("restarted on version X"), never "adopted N sessions".
+ * A new process (a different start time and, where known, a different PID), the same
+ * identity, and the version it announces equal to the bundled one.
+ */
+export function verifyLegacyRestart(evidence) {
+    const { before, after, expect } = evidence;
+    if (after.daemonId === null || after.startedAt === null || evidence.runtimeKeyNow === null) {
+        return { kind: 'not_yet', missing: 'identity_unreadable' };
+    }
+    const newProcess = before.startedAt === null
+        ? after.processId !== null && after.processId !== before.processId
+        : after.startedAt > before.startedAt &&
+            (after.processId === null ||
+                before.processId === null ||
+                after.processId !== before.processId);
+    if (!newProcess)
+        return { kind: 'not_yet', missing: 'verified' };
+    if (after.daemonId !== expect.daemonId)
+        return { kind: 'reinstall', what: 'daemon_id' };
+    if (evidence.runtimeKeyNow !== evidence.recordedRuntimeKey) {
+        return { kind: 'reinstall', what: 'runtime_key' };
+    }
+    if (expect.version !== null && after.version !== expect.version) {
+        return { kind: 'not_yet', missing: 'verified' };
+    }
+    return { kind: 'verified' };
+}
+/**
+ * Whether the server independently saw a new process register under the held key
+ * (condition 3). The Journey says `back_held` for ANY process that registered since
+ * the fence, so it can only corroborate THIS replacement when it did not already say
+ * so before the commit. When it did, the answer is `not_independent`: the flow rests
+ * on (1) and (2) and says so.
+ */
+export function serverSawNewProcess(input) {
+    if (input.backHeldAtCommit)
+        return 'not_independent';
+    return input.journeyPhase === 'back_held' ? 'seen' : 'not_yet';
+}
+/** Whether an observed hold is the one this flow took, and still live. */
+export function isOurLiveHold(view, generation) {
+    return (generation !== null &&
+        !!view?.hold &&
+        view.hold.lifecycle === 'held' &&
+        view.hold.generation === generation);
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/independentMachineReservation.d.ts

@@ -0,0 +1,27 @@
+/** The desktop reserves a new profile for every background authorization. */
+export declare const INDEPENDENT_MACHINE_PROFILE_RE: RegExp;
+export declare const INDEPENDENT_MACHINE_RESERVATION_FILE = "independent-machine-attempt.json";
+export interface IndependentMachineReservation {
+    version: 2;
+    profile: string;
+    ownerId: string;
+    origin: string;
+    secretHash: string;
+    encryptedSecret: string;
+    createdAt: string;
+}
+/** Reserve a previously absent profile and persist the encrypted attempt secret.
+ * `encrypt` must use the platform secure store and throw if it is unavailable. */
+export declare function reserveIndependentMachineProfile(options: {
+    root: string;
+    ownerId: string;
+    origin: string;
+    encrypt: (secret: string) => Buffer;
+}): {
+    reservation: IndependentMachineReservation;
+    secret: string;
+};
+/** A saved reservation is a selection hint, never proof of machine ownership. */
+export declare function readIndependentMachineReservation(root: string, profile: string): IndependentMachineReservation | null;
+/** Confirm a one-shot signer is acting on the desktop's reserved attempt. */
+export declare function verifyIndependentMachineReservation(root: string, profile: string, secret: unknown): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/independentMachineReservation.js

@@ -0,0 +1,132 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+/** The desktop reserves a new profile for every background authorization. */
+export const INDEPENDENT_MACHINE_PROFILE_RE = /^desktop-bg-[a-f0-9]{32}$/;
+export const INDEPENDENT_MACHINE_RESERVATION_FILE = 'independent-machine-attempt.json';
+function canonicalOrigin(input) {
+    try {
+        const url = new URL(input);
+        const local = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+        return !url.username && !url.password && url.origin === input &&
+            (url.protocol === 'https:' || (url.protocol === 'http:' && local));
+    }
+    catch {
+        return false;
+    }
+}
+function validSecret(secret) {
+    return typeof secret === 'string' && /^[A-Za-z0-9_-]{43}$/.test(secret) &&
+        Buffer.from(secret, 'base64url').length === 32 &&
+        Buffer.from(secret, 'base64url').toString('base64url') === secret;
+}
+function hashSecret(profile, ownerId, origin, secret) {
+    return crypto.createHash('sha256').update('independent-machine-reservation:v2\0')
+        .update(profile).update('\0').update(ownerId).update('\0').update(origin).update('\0').update(secret).digest();
+}
+function reservationPath(root, profile) {
+    if (!path.isAbsolute(root) || !INDEPENDENT_MACHINE_PROFILE_RE.test(profile)) {
+        throw new Error('Invalid independent machine profile');
+    }
+    return path.join(root, 'profiles', profile, INDEPENDENT_MACHINE_RESERVATION_FILE);
+}
+/** Reserve a previously absent profile and persist the encrypted attempt secret.
+ * `encrypt` must use the platform secure store and throw if it is unavailable. */
+export function reserveIndependentMachineProfile(options) {
+    if (!path.isAbsolute(options.root) || !/^[a-fA-F0-9]{24}$/.test(options.ownerId) ||
+        !canonicalOrigin(options.origin))
+        throw new Error('Invalid background authorization context');
+    const secret = crypto.randomBytes(32).toString('base64url');
+    const encrypted = options.encrypt(secret);
+    if (!Buffer.isBuffer(encrypted) || encrypted.length === 0 || encrypted.length > 4096) {
+        throw new Error('Background authorization secure storage is unavailable');
+    }
+    const profiles = path.join(options.root, 'profiles');
+    const rootExisted = fs.existsSync(options.root);
+    const profilesExisted = fs.existsSync(profiles);
+    fs.mkdirSync(profiles, { recursive: true, mode: 0o700 });
+    for (let i = 0; i < 5; i += 1) {
+        const profile = `desktop-bg-${crypto.randomBytes(16).toString('hex')}`;
+        const dir = path.join(profiles, profile);
+        try {
+            fs.mkdirSync(dir, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code === 'EEXIST')
+                continue;
+            throw error;
+        }
+        const reservation = {
+            version: 2, profile, ownerId: options.ownerId.toLowerCase(), origin: options.origin,
+            secretHash: hashSecret(profile, options.ownerId.toLowerCase(), options.origin, secret).toString('hex'),
+            encryptedSecret: encrypted.toString('base64'),
+            createdAt: new Date().toISOString(),
+        };
+        const file = reservationPath(options.root, profile);
+        const fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+            (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+        try {
+            fs.writeFileSync(fd, `${JSON.stringify(reservation)}\n`, 'utf8');
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        const directories = [dir, profiles, ...(!profilesExisted ? [options.root] : []),
+            ...(!rootExisted ? [path.dirname(options.root)] : [])];
+        for (const directory of directories) {
+            const directoryFd = fs.openSync(directory, 'r');
+            try {
+                fs.fsyncSync(directoryFd);
+            }
+            finally {
+                fs.closeSync(directoryFd);
+            }
+        }
+        // A profile whose reservation cannot be written is never used. Keep any
+        // uncertain directory for recovery rather than deleting other state.
+        return { reservation, secret };
+    }
+    throw new Error('Could not reserve a new background machine profile');
+}
+/** A saved reservation is a selection hint, never proof of machine ownership. */
+export function readIndependentMachineReservation(root, profile) {
+    try {
+        const file = reservationPath(root, profile);
+        const directory = fs.lstatSync(path.dirname(file));
+        if (!directory.isDirectory() || directory.isSymbolicLink())
+            return null;
+        const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+        let raw;
+        try {
+            const stat = fs.fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.size > 8192 || (stat.mode & 0o077) !== 0)
+                return null;
+            raw = fs.readFileSync(fd, 'utf8');
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        const value = JSON.parse(raw);
+        if (value.version !== 2 || value.profile !== profile ||
+            typeof value.ownerId !== 'string' || !/^[a-f0-9]{24}$/.test(value.ownerId) ||
+            typeof value.origin !== 'string' || !canonicalOrigin(value.origin) ||
+            typeof value.secretHash !== 'string' || !/^[a-f0-9]{64}$/.test(value.secretHash) ||
+            typeof value.encryptedSecret !== 'string' || !/^[A-Za-z0-9+/]+={0,2}$/.test(value.encryptedSecret) ||
+            typeof value.createdAt !== 'string' || !Number.isFinite(Date.parse(value.createdAt)))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+/** Confirm a one-shot signer is acting on the desktop's reserved attempt. */
+export function verifyIndependentMachineReservation(root, profile, secret) {
+    if (!validSecret(secret))
+        return false;
+    const saved = readIndependentMachineReservation(root, profile);
+    if (!saved)
+        return false;
+    return crypto.timingSafeEqual(Buffer.from(saved.secretHash, 'hex'), hashSecret(profile, saved.ownerId, saved.origin, secret));
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/independentMachineScopes.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The capabilities explained to a person before a separate background
+ * machine is authorized. This version is an immutable wire contract: adding
+ * access needs a new contract and a new authorization, not an edit to v1.
+ */
+export declare const INDEPENDENT_MACHINE_SCOPE_CONTRACT_V1: "desktop-background-v1";
+export declare const INDEPENDENT_MACHINE_PERMISSIONS_V1: readonly [Readonly<{
+    scope: "daemon:tools:bash";
+    description: "Run terminal commands and local agents";
+}>, Readonly<{
+    scope: "daemon:tools:fs:read";
+    description: "Read files in allowed folders";
+}>, Readonly<{
+    scope: "daemon:tools:fs:write";
+    description: "Create and edit files in allowed folders";
+}>, Readonly<{
+    scope: "daemon:browser:cdp";
+    description: "Control connected browser tabs";
+}>, Readonly<{
+    scope: "daemon:session:replay";
+    description: "Replay results recorded while offline";
+}>, Readonly<{
+    scope: "daemon:offline-queue";
+    description: "Send queued results after reconnecting";
+}>];
+export declare const INDEPENDENT_MACHINE_SCOPES_V1: readonly string[];

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/independentMachineScopes.js

@@ -0,0 +1,15 @@
+/**
+ * The capabilities explained to a person before a separate background
+ * machine is authorized. This version is an immutable wire contract: adding
+ * access needs a new contract and a new authorization, not an edit to v1.
+ */
+export const INDEPENDENT_MACHINE_SCOPE_CONTRACT_V1 = 'desktop-background-v1';
+export const INDEPENDENT_MACHINE_PERMISSIONS_V1 = Object.freeze([
+    Object.freeze({ scope: 'daemon:tools:bash', description: 'Run terminal commands and local agents' }),
+    Object.freeze({ scope: 'daemon:tools:fs:read', description: 'Read files in allowed folders' }),
+    Object.freeze({ scope: 'daemon:tools:fs:write', description: 'Create and edit files in allowed folders' }),
+    Object.freeze({ scope: 'daemon:browser:cdp', description: 'Control connected browser tabs' }),
+    Object.freeze({ scope: 'daemon:session:replay', description: 'Replay results recorded while offline' }),
+    Object.freeze({ scope: 'daemon:offline-queue', description: 'Send queued results after reconnecting' }),
+]);
+export const INDEPENDENT_MACHINE_SCOPES_V1 = Object.freeze(INDEPENDENT_MACHINE_PERMISSIONS_V1.map((permission) => permission.scope));

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -28,7 +28,7 @@ export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as cred
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
-export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
+export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
@@ -50,3 +50,4 @@ export * from './harnessPermissionControls.js';
 export { compareReleaseVersions } from './releaseVersions.js';
 export * from './computerUse.js';
 export * from './desktopWire.js';
+export { INDEPENDENT_MACHINE_PROFILE_RE, INDEPENDENT_MACHINE_RESERVATION_FILE, readIndependentMachineReservation, reserveIndependentMachineProfile, verifyIndependentMachineReservation, type IndependentMachineReservation, } from './independentMachineReservation.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -112,7 +112,7 @@ export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUI
 // Daemon and CLI consume these; the underlying primitives live above.
 export { 
 // credEnvelope bridge
-initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
+initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
 // Test seams — `__`-prefixed so consumers don't import them in
 // production code paths. Re-exported here so CLI/daemon spec files
 // can resolve the wrapped-DEK path against the same module instance.
@@ -186,3 +186,4 @@ export * from './harnessPermissionControls.js';
 export { compareReleaseVersions } from './releaseVersions.js';
 export * from './computerUse.js';
 export * from './desktopWire.js';
+export { INDEPENDENT_MACHINE_PROFILE_RE, INDEPENDENT_MACHINE_RESERVATION_FILE, readIndependentMachineReservation, reserveIndependentMachineProfile, verifyIndependentMachineReservation, } from './independentMachineReservation.js';