@skrr-ai/cli 0.1.45 → 0.1.46

package/dist/lib/task-extras.js

@@ -2,6 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.taskChatApi = exports.taskSelfScheduleApi = exports.taskLookupApi = exports.taskWorkflowApi = void 0;
 exports.taskCompletePath = taskCompletePath;
+exports.taskRunHandover = taskRunHandover;
+exports.taskRunFork = taskRunFork;
+exports.taskRunPromote = taskRunPromote;
+exports.parseExecutionTargetRef = parseExecutionTargetRef;
 /**
  * task-extras.ts — the `/api/tasks` endpoints that have no `dataService.*`
  * wrapper, gathered so every one of them is reachable from `skrr`.
@@ -18,6 +22,7 @@ exports.taskCompletePath = taskCompletePath;
  */
 const data_provider_1 = require("@skrr-ai/data-provider");
 const triggers_1 = require("./triggers");
+const api_fetch_1 = require("./api-fetch");
 const MOUNT = '/api/tasks';
 const base = (id) => `${MOUNT}/${encodeURIComponent(id)}`;
 exports.taskWorkflowApi = {
@@ -78,6 +83,74 @@ exports.taskSelfScheduleApi = {
 function taskCompletePath(taskId) {
     return `${base(taskId)}/complete`;
 }
+/**
+ * `POST /api/tasks/:taskId/runs/:runId/handover` — the B1 admission path
+ * (docs/architecture/execution-handover-impl-contracts.md): mint a new run on a
+ * different agent/target, resumed from the source run's Resume Point.
+ *
+ * `apiFetch` rather than `request.post`: a handover ADMITS a run, so the write
+ * needs the shared `X-Idempotency-Key` stamping apiFetch applies — a retried
+ * request must not double-admit. Kept in the lib so `domain-api-parity` sees
+ * the endpoint — a command that builds its own `/api/tasks/...` string is
+ * invisible to the coverage check.
+ */
+function taskRunHandover(taskId, runId, body) {
+    return (0, api_fetch_1.apiFetch)(`${base(taskId)}/runs/${encodeURIComponent(runId)}/handover`, {
+        method: 'POST',
+        body,
+    });
+}
+/**
+ * `POST /api/tasks/:taskId/runs/:runId/fork` — B8. Admits a SIBLING run from
+ * the same Resume Point, so both attempts are live and neither is canonical
+ * until `promote`. Distinct from handover, which continues the work once.
+ */
+function taskRunFork(taskId, runId, body) {
+    return (0, api_fetch_1.apiFetch)(`${base(taskId)}/runs/${encodeURIComponent(runId)}/fork`, {
+        method: 'POST',
+        body,
+    });
+}
+/**
+ * `POST /api/tasks/:taskId/runs/:runId/promote` — B8. Fixes one branch of a
+ * parallel group as canonical and CANCELS the live losers, which is why it has
+ * a surface of its own rather than riding a flag on fork.
+ */
+function taskRunPromote(taskId, runId, body) {
+    return (0, api_fetch_1.apiFetch)(`${base(taskId)}/runs/${encodeURIComponent(runId)}/promote`, {
+        method: 'POST',
+        body,
+    });
+}
+/** Selectors the platform reserves for its own managed targets. */
+const AGENT_WORKER_SELECTORS = new Set(['agent-worker', '__oversky_worker__']);
+const HOSTED_MACHINE_SELECTORS = new Set(['hosted-machine', '__oversky_hosted_machine__']);
+/**
+ * Turn a `--harness` value into the `executionTargetRef` the API parses.
+ *
+ * The route validates an OBJECT (`{kind, ref?}`); passing the flag through as a
+ * string failed its zod parse, so every `--harness` invocation returned
+ * `400 Invalid request data` — the harness axis, which is half of what handover
+ * is for, was unreachable from the CLI and untested.
+ *
+ * The kind is INFERRED rather than asked for, because an operator naming a
+ * machine should not also have to name its category: the two managed selectors
+ * are reserved words, a `hosted-machine:<sessionId>` form addresses one
+ * session, and everything else is a harness id — which is what the flag is
+ * called.
+ */
+function parseExecutionTargetRef(value) {
+    const trimmed = value.trim();
+    if (AGENT_WORKER_SELECTORS.has(trimmed))
+        return { kind: 'agent-worker' };
+    if (HOSTED_MACHINE_SELECTORS.has(trimmed))
+        return { kind: 'hosted-machine' };
+    const hosted = /^hosted-machine:(.+)$/.exec(trimmed);
+    if (hosted)
+        return { kind: 'hosted-machine', ref: hosted[1] };
+    const harness = /^harness:(.+)$/.exec(trimmed);
+    return { kind: 'harness', ref: harness ? harness[1] : trimmed };
+}
 exports.taskChatApi = {
     transcriptSources: (id, query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${base(id)}/transcript/sources`, query)),
     reindexTranscript: (id) => data_provider_1.request.post(`${base(id)}/transcript/reindex`, {}),

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarness.d.ts

@@ -313,6 +313,13 @@ declare const ENGINE_ENV_SUFFIXES: Readonly<{
     allowUpstreamEgress: "ALLOW_UPSTREAM_EGRESS";
     compatOpencode: "COMPAT_OPENCODE";
     noCompatPrompts: "NO_COMPAT_PROMPTS";
+    /**
+     * Advisory input-token budget for a managed session, set by the daemon from
+     * the server-issued `requestEnvelope.maxInputTokens` so the engine's
+     * auto-compaction can trigger before the relay refuses the request. The
+     * engine must treat it as a hint: enforcement stays server-side.
+     */
+    maxInputTokens: "MAX_INPUT_TOKENS";
 }>;
 export type FirstPartyHarnessEngineEnvKey = keyof typeof ENGINE_ENV_SUFFIXES;
 /**
@@ -350,7 +357,7 @@ export declare const FIRST_PARTY_HARNESS_ENGINE: Readonly<{
      * `readFirstPartyHarnessEngineEnv` to read one the way the engine does and
      * `firstPartyHarnessEngineEnvEntries` to set one every engine build honours.
      */
-    env: Readonly<Record<"appName" | "serverPassword" | "serverUsername" | "home" | "config" | "scriptName" | "allowUpstreamEgress" | "compatOpencode" | "noCompatPrompts", string>>;
+    env: Readonly<Record<"appName" | "serverPassword" | "serverUsername" | "home" | "config" | "scriptName" | "allowUpstreamEgress" | "compatOpencode" | "noCompatPrompts" | "maxInputTokens", string>>;
 }>;
 /**
  * Every name the engine reads for one purpose, current namespace first — the

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarness.js

@@ -450,6 +450,13 @@ const ENGINE_ENV_SUFFIXES = Object.freeze({
     allowUpstreamEgress: 'ALLOW_UPSTREAM_EGRESS',
     compatOpencode: 'COMPAT_OPENCODE',
     noCompatPrompts: 'NO_COMPAT_PROMPTS',
+    /**
+     * Advisory input-token budget for a managed session, set by the daemon from
+     * the server-issued `requestEnvelope.maxInputTokens` so the engine's
+     * auto-compaction can trigger before the relay refuses the request. The
+     * engine must treat it as a hint: enforcement stays server-side.
+     */
+    maxInputTokens: 'MAX_INPUT_TOKENS',
 });
 function engineEnvName(appName, key) {
     return `${appName.toUpperCase().replace(/-/g, '_')}_${ENGINE_ENV_SUFFIXES[key]}`;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessHome.js

@@ -64,6 +64,13 @@ const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
 function olderSpellings() {
     return (0, firstPartyHarness_js_1.firstPartyHarnessArtifactSpellings)().filter((spelling) => spelling !== firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider);
 }
+/**
+ * Entries rescued from a legacy home when the canonical one already exists as a
+ * shell. `bin` is what managed resolution needs; `skills` is the user's own
+ * data. Deliberately a short, named list rather than "everything": a merge this
+ * module cannot enumerate (there is no readdir here) would be guessing.
+ */
+const STRANDED_HOME_ENTRIES = ['bin', 'skills'];
 /** Suffix of the rollback copy the installer keeps beside the binary. */
 exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = '.previous';
 /**
@@ -186,6 +193,44 @@ function migrateFirstPartyHarnessHome(options = {}) {
             break;
         }
     }
+    else if (isRealDirectory(fs.lstat(canonicalHome))) {
+        // 1b. The canonical home EXISTS, so the rename above is impossible — but it
+        // may be a shell rather than the real home. A managed write that reaches
+        // `<root>/<appName>` before this migration runs creates the directory, and
+        // from then on step 1 skips forever and the legacy home keeps the binary.
+        // Observed on a real machine: `<root>/<appName>` holding a 2-byte `{}`
+        // config written hours after `<root>/<legacy appName>/bin` received the
+        // signed 107MB engine, which left managed resolution pointing at a bin
+        // directory that did not exist and every managed session with no engine to
+        // spawn.
+        //
+        // A rename cannot merge two directories, and this module has no readdir, so
+        // this moves the two entries that carry weight and nothing else: `bin`,
+        // which is what resolution needs, and `skills`, which is user data. An
+        // entry already present at the canonical home is never touched — the shell
+        // may be empty, but it is not automatically wrong.
+        for (const legacyAppName of firstPartyHarness_js_1.FIRST_PARTY_HARNESS_ENGINE.legacyAppNames) {
+            const aliasHome = node_path_1.default.join(root, legacyAppName);
+            if (!isRealDirectory(fs.lstat(aliasHome)))
+                continue;
+            for (const entry of STRANDED_HOME_ENTRIES) {
+                const from = node_path_1.default.join(aliasHome, entry);
+                const to = node_path_1.default.join(canonicalHome, entry);
+                if (!isRealDirectory(fs.lstat(from)))
+                    continue;
+                if (fs.lstat(to) !== null)
+                    continue;
+                try {
+                    fs.rename(from, to);
+                    moved.push(`${from} -> ${to}`);
+                }
+                catch (err) {
+                    errors.push(`could not move ${from} to ${to}: ${describe(err)}`);
+                }
+            }
+            break;
+        }
+    }
     // 2. The binary and its companions — follow the provider — inside the home.
     const binDir = node_path_1.default.join(canonicalHome, 'bin');
     if (!isRealDirectory(fs.lstat(binDir))) {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessSkillLayout.d.ts

@@ -0,0 +1,65 @@
+/**
+ * OSK-10409 — which harnesses resolve the `.claude/skills/<name>/SKILL.md`
+ * layout, shared by the server and the daemon.
+ *
+ * ── Why this lives in auth-core ────────────────────────────────────────────
+ *
+ * The same reason `harnessTrust.ts` does: it is a DECLARED per-harness fact
+ * that several processes have to agree on, and the cost of them disagreeing is
+ * silent. It is not auth, and it does not pretend to be — auth-core is where
+ * this repo already keeps the small tables that a harness's identity answers.
+ *
+ * ── What the fact IS ───────────────────────────────────────────────────────
+ *
+ * The daemon materializes a session's skills at
+ * `<root>/.claude/skills/<name>/SKILL.md` and hands `<root>` to the harness —
+ * `--add-dir` for the Claude CLI, ACP `additionalDirectories` for Devin. A
+ * harness on this list READS that layout: it enumerates the tree, surfaces the
+ * manifest line, and resolves the body from disk. A harness that is not on it
+ * ignores the tree entirely, so nothing laid there ever reaches its model.
+ *
+ * It is a capability with EVIDENCE, never a brand check. The gate this replaced
+ * read `provider !== 'claude'` on the stated premise that every other harness
+ * ignores the layout, and the premise was false for Devin (OSK-10264): the
+ * daemon lays the same tree, passes it on `additionalDirectories`, and Devin
+ * loads it — measured live on 3000.10.31. Add a harness here only with the same
+ * kind of evidence, that its sessions actually surface a skill laid out this
+ * way. A harness that ignores the layout gains nothing and pays for the wire.
+ *
+ * ── Three readers, in three directions ─────────────────────────────────────
+ *
+ *  1. The server's PUSH gate (`buildDaemonServerSkills`): a harness on this
+ *     list is one a pushed skill should be sent to.
+ *  2. The server's INVOKED-BODY gate (`buildInvokedSkillsPrompt`, OSK-10361):
+ *     a harness on this list must NOT also have the body pasted into its
+ *     prompt — it already has it from the tree, and on ACP the paste lands in
+ *     the transcript at full skill size on every invoked turn.
+ *  3. The daemon's SHADOWING protection (`skill-shadowing.ts`, OSK-10044): a
+ *     harness on this list resolves `/<name>` from its own `.claude/skills`
+ *     roots, so a picked skill can be shadowed there by a same-named one — and
+ *     the daemon is the only place that collision can be seen. That gate spelled
+ *     `claude` and so never reached Devin, which the server-side paste was
+ *     accidentally masking until (2) stopped pasting.
+ *
+ * Reader 3 is why the table moved out of the API: the daemon cannot require an
+ * api-side module, and a second copy of a table whose whole value is that every
+ * reader agrees is worse than no table at all.
+ */
+/**
+ * Harness provider → the evidence that its sessions load the layout.
+ *
+ * The reason string is part of the entry, not decoration: an entry added
+ * without one is an entry nobody can audit later.
+ */
+export declare const HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT: ReadonlyMap<string, string>;
+/**
+ * Whether this harness resolves a skill from the `.claude/skills` tree the
+ * daemon materializes, so the body reaches it without being pasted anywhere.
+ *
+ * An absent provider is NOT a native resolver. "We do not know what this is"
+ * must never mean "it reads the layout" — that direction withholds the body
+ * from a harness that needed it, which is a turn that looks like the skill ran.
+ */
+export declare function harnessLoadsClaudeSkillsLayout(provider: string | null | undefined): boolean;
+/** The stated evidence for a harness on the list, or `null` when it is not. */
+export declare function claudeSkillsLayoutEvidence(provider: string | null | undefined): string | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessSkillLayout.js

@@ -0,0 +1,99 @@
+"use strict";
+/**
+ * OSK-10409 — which harnesses resolve the `.claude/skills/<name>/SKILL.md`
+ * layout, shared by the server and the daemon.
+ *
+ * ── Why this lives in auth-core ────────────────────────────────────────────
+ *
+ * The same reason `harnessTrust.ts` does: it is a DECLARED per-harness fact
+ * that several processes have to agree on, and the cost of them disagreeing is
+ * silent. It is not auth, and it does not pretend to be — auth-core is where
+ * this repo already keeps the small tables that a harness's identity answers.
+ *
+ * ── What the fact IS ───────────────────────────────────────────────────────
+ *
+ * The daemon materializes a session's skills at
+ * `<root>/.claude/skills/<name>/SKILL.md` and hands `<root>` to the harness —
+ * `--add-dir` for the Claude CLI, ACP `additionalDirectories` for Devin. A
+ * harness on this list READS that layout: it enumerates the tree, surfaces the
+ * manifest line, and resolves the body from disk. A harness that is not on it
+ * ignores the tree entirely, so nothing laid there ever reaches its model.
+ *
+ * It is a capability with EVIDENCE, never a brand check. The gate this replaced
+ * read `provider !== 'claude'` on the stated premise that every other harness
+ * ignores the layout, and the premise was false for Devin (OSK-10264): the
+ * daemon lays the same tree, passes it on `additionalDirectories`, and Devin
+ * loads it — measured live on 3000.10.31. Add a harness here only with the same
+ * kind of evidence, that its sessions actually surface a skill laid out this
+ * way. A harness that ignores the layout gains nothing and pays for the wire.
+ *
+ * ── Three readers, in three directions ─────────────────────────────────────
+ *
+ *  1. The server's PUSH gate (`buildDaemonServerSkills`): a harness on this
+ *     list is one a pushed skill should be sent to.
+ *  2. The server's INVOKED-BODY gate (`buildInvokedSkillsPrompt`, OSK-10361):
+ *     a harness on this list must NOT also have the body pasted into its
+ *     prompt — it already has it from the tree, and on ACP the paste lands in
+ *     the transcript at full skill size on every invoked turn.
+ *  3. The daemon's SHADOWING protection (`skill-shadowing.ts`, OSK-10044): a
+ *     harness on this list resolves `/<name>` from its own `.claude/skills`
+ *     roots, so a picked skill can be shadowed there by a same-named one — and
+ *     the daemon is the only place that collision can be seen. That gate spelled
+ *     `claude` and so never reached Devin, which the server-side paste was
+ *     accidentally masking until (2) stopped pasting.
+ *
+ * Reader 3 is why the table moved out of the API: the daemon cannot require an
+ * api-side module, and a second copy of a table whose whole value is that every
+ * reader agrees is worse than no table at all.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = void 0;
+exports.harnessLoadsClaudeSkillsLayout = harnessLoadsClaudeSkillsLayout;
+exports.claudeSkillsLayoutEvidence = claudeSkillsLayoutEvidence;
+const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
+/**
+ * Harness provider → the evidence that its sessions load the layout.
+ *
+ * The reason string is part of the entry, not decoration: an entry added
+ * without one is an entry nobody can audit later.
+ */
+exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = new Map([
+    ['claude', 'Claude Code reads .claude/skills natively from --add-dir'],
+    [
+        'devin',
+        'Devin imports the Claude convention from additionalDirectories ' +
+            '(read_config_from.claude, on by default) — verified live on 3000.10.31',
+    ],
+]);
+/**
+ * Canonicalise the way every reader of this table must.
+ *
+ * The provider is lower-cased and trimmed, then passed through
+ * `canonicalHarnessProvider` so an accepted alias of the first-party harness
+ * resolves to the same decision as its canonical slug rather than falling
+ * through to "not a native resolver". Callers with a RICHER normalizer (the API
+ * has `normalizeSessionProvider`, which also folds `claude-code`) apply theirs
+ * first; this is the floor, not a replacement.
+ */
+function canonicalize(provider) {
+    return String((0, firstPartyHarness_js_1.canonicalHarnessProvider)(provider.trim().toLowerCase()));
+}
+/**
+ * Whether this harness resolves a skill from the `.claude/skills` tree the
+ * daemon materializes, so the body reaches it without being pasted anywhere.
+ *
+ * An absent provider is NOT a native resolver. "We do not know what this is"
+ * must never mean "it reads the layout" — that direction withholds the body
+ * from a harness that needed it, which is a turn that looks like the skill ran.
+ */
+function harnessLoadsClaudeSkillsLayout(provider) {
+    if (!provider || typeof provider !== 'string')
+        return false;
+    return exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT.has(canonicalize(provider));
+}
+/** The stated evidence for a harness on the list, or `null` when it is not. */
+function claudeSkillsLayoutEvidence(provider) {
+    if (!provider || typeof provider !== 'string')
+        return null;
+    return exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT.get(canonicalize(provider)) ?? null;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -32,6 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
+export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
 export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -25,8 +25,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
 exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = void 0;
-exports.consolidateProfileState = void 0;
+exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -295,6 +295,14 @@ Object.defineProperty(exports, "HARNESS_TIERS", { enumerable: true, get: functio
 Object.defineProperty(exports, "getHarnessTier", { enumerable: true, get: function () { return harnessTrust_js_1.getHarnessTier; } });
 Object.defineProperty(exports, "credentialPolicyForTier", { enumerable: true, get: function () { return harnessTrust_js_1.credentialPolicyForTier; } });
 Object.defineProperty(exports, "tierPermitsConfiguredAutoMode", { enumerable: true, get: function () { return harnessTrust_js_1.tierPermitsConfiguredAutoMode; } });
+// OSK-10409 — which harnesses resolve the `.claude/skills` layout the daemon
+// materializes. One declared table with per-harness evidence, read by the
+// server's two skill gates and by the daemon's shadowing protection. See
+// harnessSkillLayout.ts for why a second copy would be worse than none.
+var harnessSkillLayout_js_1 = require("./harnessSkillLayout.js");
+Object.defineProperty(exports, "HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT", { enumerable: true, get: function () { return harnessSkillLayout_js_1.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT; } });
+Object.defineProperty(exports, "claudeSkillsLayoutEvidence", { enumerable: true, get: function () { return harnessSkillLayout_js_1.claudeSkillsLayoutEvidence; } });
+Object.defineProperty(exports, "harnessLoadsClaudeSkillsLayout", { enumerable: true, get: function () { return harnessSkillLayout_js_1.harnessLoadsClaudeSkillsLayout; } });
 // OSK-3892 — spawn-env sanitization, shared by the daemon (which has stripped
 // its own credentials before every harness spawn all along) and the CLI (which
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.d.ts

@@ -313,6 +313,13 @@ declare const ENGINE_ENV_SUFFIXES: Readonly<{
     allowUpstreamEgress: "ALLOW_UPSTREAM_EGRESS";
     compatOpencode: "COMPAT_OPENCODE";
     noCompatPrompts: "NO_COMPAT_PROMPTS";
+    /**
+     * Advisory input-token budget for a managed session, set by the daemon from
+     * the server-issued `requestEnvelope.maxInputTokens` so the engine's
+     * auto-compaction can trigger before the relay refuses the request. The
+     * engine must treat it as a hint: enforcement stays server-side.
+     */
+    maxInputTokens: "MAX_INPUT_TOKENS";
 }>;
 export type FirstPartyHarnessEngineEnvKey = keyof typeof ENGINE_ENV_SUFFIXES;
 /**
@@ -350,7 +357,7 @@ export declare const FIRST_PARTY_HARNESS_ENGINE: Readonly<{
      * `readFirstPartyHarnessEngineEnv` to read one the way the engine does and
      * `firstPartyHarnessEngineEnvEntries` to set one every engine build honours.
      */
-    env: Readonly<Record<"appName" | "serverPassword" | "serverUsername" | "home" | "config" | "scriptName" | "allowUpstreamEgress" | "compatOpencode" | "noCompatPrompts", string>>;
+    env: Readonly<Record<"appName" | "serverPassword" | "serverUsername" | "home" | "config" | "scriptName" | "allowUpstreamEgress" | "compatOpencode" | "noCompatPrompts" | "maxInputTokens", string>>;
 }>;
 /**
  * Every name the engine reads for one purpose, current namespace first — the

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.js

@@ -415,6 +415,13 @@ const ENGINE_ENV_SUFFIXES = Object.freeze({
     allowUpstreamEgress: 'ALLOW_UPSTREAM_EGRESS',
     compatOpencode: 'COMPAT_OPENCODE',
     noCompatPrompts: 'NO_COMPAT_PROMPTS',
+    /**
+     * Advisory input-token budget for a managed session, set by the daemon from
+     * the server-issued `requestEnvelope.maxInputTokens` so the engine's
+     * auto-compaction can trigger before the relay refuses the request. The
+     * engine must treat it as a hint: enforcement stays server-side.
+     */
+    maxInputTokens: 'MAX_INPUT_TOKENS',
 });
 function engineEnvName(appName, key) {
     return `${appName.toUpperCase().replace(/-/g, '_')}_${ENGINE_ENV_SUFFIXES[key]}`;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarnessHome.js

@@ -53,6 +53,13 @@ import { FIRST_PARTY_HARNESS, FIRST_PARTY_HARNESS_ENGINE, firstPartyHarnessArtif
 function olderSpellings() {
     return firstPartyHarnessArtifactSpellings().filter((spelling) => spelling !== FIRST_PARTY_HARNESS.provider);
 }
+/**
+ * Entries rescued from a legacy home when the canonical one already exists as a
+ * shell. `bin` is what managed resolution needs; `skills` is the user's own
+ * data. Deliberately a short, named list rather than "everything": a merge this
+ * module cannot enumerate (there is no readdir here) would be guessing.
+ */
+const STRANDED_HOME_ENTRIES = ['bin', 'skills'];
 /** Suffix of the rollback copy the installer keeps beside the binary. */
 export const FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = '.previous';
 /**
@@ -175,6 +182,44 @@ export function migrateFirstPartyHarnessHome(options = {}) {
             break;
         }
     }
+    else if (isRealDirectory(fs.lstat(canonicalHome))) {
+        // 1b. The canonical home EXISTS, so the rename above is impossible — but it
+        // may be a shell rather than the real home. A managed write that reaches
+        // `<root>/<appName>` before this migration runs creates the directory, and
+        // from then on step 1 skips forever and the legacy home keeps the binary.
+        // Observed on a real machine: `<root>/<appName>` holding a 2-byte `{}`
+        // config written hours after `<root>/<legacy appName>/bin` received the
+        // signed 107MB engine, which left managed resolution pointing at a bin
+        // directory that did not exist and every managed session with no engine to
+        // spawn.
+        //
+        // A rename cannot merge two directories, and this module has no readdir, so
+        // this moves the two entries that carry weight and nothing else: `bin`,
+        // which is what resolution needs, and `skills`, which is user data. An
+        // entry already present at the canonical home is never touched — the shell
+        // may be empty, but it is not automatically wrong.
+        for (const legacyAppName of FIRST_PARTY_HARNESS_ENGINE.legacyAppNames) {
+            const aliasHome = path.join(root, legacyAppName);
+            if (!isRealDirectory(fs.lstat(aliasHome)))
+                continue;
+            for (const entry of STRANDED_HOME_ENTRIES) {
+                const from = path.join(aliasHome, entry);
+                const to = path.join(canonicalHome, entry);
+                if (!isRealDirectory(fs.lstat(from)))
+                    continue;
+                if (fs.lstat(to) !== null)
+                    continue;
+                try {
+                    fs.rename(from, to);
+                    moved.push(`${from} -> ${to}`);
+                }
+                catch (err) {
+                    errors.push(`could not move ${from} to ${to}: ${describe(err)}`);
+                }
+            }
+            break;
+        }
+    }
     // 2. The binary and its companions — follow the provider — inside the home.
     const binDir = path.join(canonicalHome, 'bin');
     if (!isRealDirectory(fs.lstat(binDir))) {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/harnessSkillLayout.d.ts

@@ -0,0 +1,65 @@
+/**
+ * OSK-10409 — which harnesses resolve the `.claude/skills/<name>/SKILL.md`
+ * layout, shared by the server and the daemon.
+ *
+ * ── Why this lives in auth-core ────────────────────────────────────────────
+ *
+ * The same reason `harnessTrust.ts` does: it is a DECLARED per-harness fact
+ * that several processes have to agree on, and the cost of them disagreeing is
+ * silent. It is not auth, and it does not pretend to be — auth-core is where
+ * this repo already keeps the small tables that a harness's identity answers.
+ *
+ * ── What the fact IS ───────────────────────────────────────────────────────
+ *
+ * The daemon materializes a session's skills at
+ * `<root>/.claude/skills/<name>/SKILL.md` and hands `<root>` to the harness —
+ * `--add-dir` for the Claude CLI, ACP `additionalDirectories` for Devin. A
+ * harness on this list READS that layout: it enumerates the tree, surfaces the
+ * manifest line, and resolves the body from disk. A harness that is not on it
+ * ignores the tree entirely, so nothing laid there ever reaches its model.
+ *
+ * It is a capability with EVIDENCE, never a brand check. The gate this replaced
+ * read `provider !== 'claude'` on the stated premise that every other harness
+ * ignores the layout, and the premise was false for Devin (OSK-10264): the
+ * daemon lays the same tree, passes it on `additionalDirectories`, and Devin
+ * loads it — measured live on 3000.10.31. Add a harness here only with the same
+ * kind of evidence, that its sessions actually surface a skill laid out this
+ * way. A harness that ignores the layout gains nothing and pays for the wire.
+ *
+ * ── Three readers, in three directions ─────────────────────────────────────
+ *
+ *  1. The server's PUSH gate (`buildDaemonServerSkills`): a harness on this
+ *     list is one a pushed skill should be sent to.
+ *  2. The server's INVOKED-BODY gate (`buildInvokedSkillsPrompt`, OSK-10361):
+ *     a harness on this list must NOT also have the body pasted into its
+ *     prompt — it already has it from the tree, and on ACP the paste lands in
+ *     the transcript at full skill size on every invoked turn.
+ *  3. The daemon's SHADOWING protection (`skill-shadowing.ts`, OSK-10044): a
+ *     harness on this list resolves `/<name>` from its own `.claude/skills`
+ *     roots, so a picked skill can be shadowed there by a same-named one — and
+ *     the daemon is the only place that collision can be seen. That gate spelled
+ *     `claude` and so never reached Devin, which the server-side paste was
+ *     accidentally masking until (2) stopped pasting.
+ *
+ * Reader 3 is why the table moved out of the API: the daemon cannot require an
+ * api-side module, and a second copy of a table whose whole value is that every
+ * reader agrees is worse than no table at all.
+ */
+/**
+ * Harness provider → the evidence that its sessions load the layout.
+ *
+ * The reason string is part of the entry, not decoration: an entry added
+ * without one is an entry nobody can audit later.
+ */
+export declare const HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT: ReadonlyMap<string, string>;
+/**
+ * Whether this harness resolves a skill from the `.claude/skills` tree the
+ * daemon materializes, so the body reaches it without being pasted anywhere.
+ *
+ * An absent provider is NOT a native resolver. "We do not know what this is"
+ * must never mean "it reads the layout" — that direction withholds the body
+ * from a harness that needed it, which is a turn that looks like the skill ran.
+ */
+export declare function harnessLoadsClaudeSkillsLayout(provider: string | null | undefined): boolean;
+/** The stated evidence for a harness on the list, or `null` when it is not. */
+export declare function claudeSkillsLayoutEvidence(provider: string | null | undefined): string | null;