@skrr-ai/cli 0.1.45 → 0.1.46

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/harnessSkillLayout.js

@@ -0,0 +1,94 @@
+/**
+ * OSK-10409 — which harnesses resolve the `.claude/skills/<name>/SKILL.md`
+ * layout, shared by the server and the daemon.
+ *
+ * ── Why this lives in auth-core ────────────────────────────────────────────
+ *
+ * The same reason `harnessTrust.ts` does: it is a DECLARED per-harness fact
+ * that several processes have to agree on, and the cost of them disagreeing is
+ * silent. It is not auth, and it does not pretend to be — auth-core is where
+ * this repo already keeps the small tables that a harness's identity answers.
+ *
+ * ── What the fact IS ───────────────────────────────────────────────────────
+ *
+ * The daemon materializes a session's skills at
+ * `<root>/.claude/skills/<name>/SKILL.md` and hands `<root>` to the harness —
+ * `--add-dir` for the Claude CLI, ACP `additionalDirectories` for Devin. A
+ * harness on this list READS that layout: it enumerates the tree, surfaces the
+ * manifest line, and resolves the body from disk. A harness that is not on it
+ * ignores the tree entirely, so nothing laid there ever reaches its model.
+ *
+ * It is a capability with EVIDENCE, never a brand check. The gate this replaced
+ * read `provider !== 'claude'` on the stated premise that every other harness
+ * ignores the layout, and the premise was false for Devin (OSK-10264): the
+ * daemon lays the same tree, passes it on `additionalDirectories`, and Devin
+ * loads it — measured live on 3000.10.31. Add a harness here only with the same
+ * kind of evidence, that its sessions actually surface a skill laid out this
+ * way. A harness that ignores the layout gains nothing and pays for the wire.
+ *
+ * ── Three readers, in three directions ─────────────────────────────────────
+ *
+ *  1. The server's PUSH gate (`buildDaemonServerSkills`): a harness on this
+ *     list is one a pushed skill should be sent to.
+ *  2. The server's INVOKED-BODY gate (`buildInvokedSkillsPrompt`, OSK-10361):
+ *     a harness on this list must NOT also have the body pasted into its
+ *     prompt — it already has it from the tree, and on ACP the paste lands in
+ *     the transcript at full skill size on every invoked turn.
+ *  3. The daemon's SHADOWING protection (`skill-shadowing.ts`, OSK-10044): a
+ *     harness on this list resolves `/<name>` from its own `.claude/skills`
+ *     roots, so a picked skill can be shadowed there by a same-named one — and
+ *     the daemon is the only place that collision can be seen. That gate spelled
+ *     `claude` and so never reached Devin, which the server-side paste was
+ *     accidentally masking until (2) stopped pasting.
+ *
+ * Reader 3 is why the table moved out of the API: the daemon cannot require an
+ * api-side module, and a second copy of a table whose whole value is that every
+ * reader agrees is worse than no table at all.
+ */
+import { canonicalHarnessProvider } from './firstPartyHarness.js';
+/**
+ * Harness provider → the evidence that its sessions load the layout.
+ *
+ * The reason string is part of the entry, not decoration: an entry added
+ * without one is an entry nobody can audit later.
+ */
+export const HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = new Map([
+    ['claude', 'Claude Code reads .claude/skills natively from --add-dir'],
+    [
+        'devin',
+        'Devin imports the Claude convention from additionalDirectories ' +
+            '(read_config_from.claude, on by default) — verified live on 3000.10.31',
+    ],
+]);
+/**
+ * Canonicalise the way every reader of this table must.
+ *
+ * The provider is lower-cased and trimmed, then passed through
+ * `canonicalHarnessProvider` so an accepted alias of the first-party harness
+ * resolves to the same decision as its canonical slug rather than falling
+ * through to "not a native resolver". Callers with a RICHER normalizer (the API
+ * has `normalizeSessionProvider`, which also folds `claude-code`) apply theirs
+ * first; this is the floor, not a replacement.
+ */
+function canonicalize(provider) {
+    return String(canonicalHarnessProvider(provider.trim().toLowerCase()));
+}
+/**
+ * Whether this harness resolves a skill from the `.claude/skills` tree the
+ * daemon materializes, so the body reaches it without being pasted anywhere.
+ *
+ * An absent provider is NOT a native resolver. "We do not know what this is"
+ * must never mean "it reads the layout" — that direction withholds the body
+ * from a harness that needed it, which is a turn that looks like the skill ran.
+ */
+export function harnessLoadsClaudeSkillsLayout(provider) {
+    if (!provider || typeof provider !== 'string')
+        return false;
+    return HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT.has(canonicalize(provider));
+}
+/** The stated evidence for a harness on the list, or `null` when it is not. */
+export function claudeSkillsLayoutEvidence(provider) {
+    if (!provider || typeof provider !== 'string')
+        return null;
+    return HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT.get(canonicalize(provider)) ?? null;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -32,6 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
+export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
 export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -130,6 +130,11 @@ export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NON
 // in the daemon on purpose: a tier is a published fact, provenance is evidence
 // about bytes on disk that only the spawning process can gather.
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, } from './harnessTrust.js';
+// OSK-10409 — which harnesses resolve the `.claude/skills` layout the daemon
+// materializes. One declared table with per-harness evidence, read by the
+// server's two skill gates and by the daemon's shadowing protection. See
+// harnessSkillLayout.ts for why a second copy would be worse than none.
+export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
 // OSK-3892 — spawn-env sanitization, shared by the daemon (which has stripped
 // its own credentials before every harness spawn all along) and the CLI (which
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {
@@ -33,6 +33,16 @@
         "types": "./dist/cjs/firstPartyHarness.d.ts",
         "default": "./dist/cjs/firstPartyHarness.js"
       }
+    },
+    "./harness-skill-layout": {
+      "import": {
+        "types": "./dist/esm/harnessSkillLayout.d.ts",
+        "default": "./dist/esm/harnessSkillLayout.js"
+      },
+      "require": {
+        "types": "./dist/cjs/harnessSkillLayout.d.ts",
+        "default": "./dist/cjs/harnessSkillLayout.js"
+      }
     }
   },
   "dependencies": {