@skrr-ai/cli 0.1.49 → 0.1.50

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/sessionPermissionAuthority.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Session permission authority — the ONE rule that decides whether a session's
+ * execution contract governs the run's permissions, shared by the server and
+ * the daemon (OSK-11975 introduced it; it was implemented twice — the server
+ * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
+ * which is exactly how a new contract kind or a new source value would drift
+ * them apart).
+ *
+ * The wire model:
+ *
+ *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
+ *     permissions govern" can never ride INSIDE it. It is a top-level session
+ *     field: `permissionSource`.
+ *   - `'agent'` means the Agent's own configured permission mode, tool policy,
+ *     Grants, session env, MCP servers and machine consent govern the run,
+ *     exactly as for an unattended Task of the same Agent. Today only a
+ *     `commitment` contract may carry it.
+ *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
+ *     still governs permissions — the marker is the version signal, so its
+ *     absence must keep the legacy fence, not silently lift it.
+ *   - `task_delivery` contracts always govern, marker or not.
+ *
+ * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
+ * (`permissionSourceForContract`), so on its own side the predicate reduces to
+ * "a commitment never governs" — `contractGovernsPermissions(c,
+ * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
+ * daemon reads the marker it received, because it cannot distinguish "new
+ * server, agent permissions" from "old server, contract fence" any other way.
+ * Both call the same function; only the input differs.
+ */
+/** The wire vocabulary for `permissionSource`. Top-level session field. */
+export declare const SESSION_PERMISSION_SOURCES: readonly ["agent"];
+export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number];
+/**
+ * The daemon capability that proves a build honours `permissionSource`. The
+ * server announces it in preflight and refuses to dispatch a Commitment Run to
+ * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
+ * the marker never reaches a daemon that would ignore it.
+ */
+export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v2_agent_permissions";
+/**
+ * The minimal contract shape this rule reads. The predicate only ever needs
+ * `kind` — keeping the input structural means this module never imports the
+ * full `CommitmentExecutionContract` type, which lives daemon-side
+ * (`daemon/src/commitment-execution-contract.ts`) and server-side in the
+ * commitment services.
+ */
+export type PermissionContractKind = {
+    kind?: unknown;
+} | null | undefined;
+/**
+ * Untrusted wire input: anything but an exact vocabulary literal reads as
+ * absent. Never widen by coercion — an unrecognized future value must degrade
+ * to "contract governs", the conservative answer.
+ */
+export declare function normalizeSessionPermissionSource(value: unknown): SessionPermissionSource | undefined;
+/**
+ * What the server stamps on the wire for this contract. A `commitment`
+ * contract no longer carries permissions (OSK-11975); every other contract
+ * kind keeps its own authority and stamps nothing.
+ */
+export declare function permissionSourceForContract(contract: PermissionContractKind): SessionPermissionSource | undefined;
+/**
+ * Whether the contract is the run's PERMISSION authority — the single place
+ * this rule lives.
+ *
+ * True for a non-commitment contract regardless of marker, and for a
+ * commitment whose server did not declare agent permissions. False for no
+ * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
+ * which then follows the Agent's own permissions exactly as a Task does while
+ * the contract keeps its non-permission roles (normalized shape, ephemeral
+ * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+ */
+export declare function contractGovernsPermissions(contract: PermissionContractKind, permissionSource: unknown): boolean;
+/**
+ * The contract when it governs permissions, else `undefined` — for the sites
+ * that used `executionContract` as "is this run permission-fenced".
+ */
+export declare function permissionGoverningContract<T extends {
+    kind?: unknown;
+}>(contract: T | null | undefined, permissionSource: unknown): T | undefined;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/sessionPermissionAuthority.js

@@ -0,0 +1,80 @@
+/**
+ * Session permission authority — the ONE rule that decides whether a session's
+ * execution contract governs the run's permissions, shared by the server and
+ * the daemon (OSK-11975 introduced it; it was implemented twice — the server
+ * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
+ * which is exactly how a new contract kind or a new source value would drift
+ * them apart).
+ *
+ * The wire model:
+ *
+ *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
+ *     permissions govern" can never ride INSIDE it. It is a top-level session
+ *     field: `permissionSource`.
+ *   - `'agent'` means the Agent's own configured permission mode, tool policy,
+ *     Grants, session env, MCP servers and machine consent govern the run,
+ *     exactly as for an unattended Task of the same Agent. Today only a
+ *     `commitment` contract may carry it.
+ *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
+ *     still governs permissions — the marker is the version signal, so its
+ *     absence must keep the legacy fence, not silently lift it.
+ *   - `task_delivery` contracts always govern, marker or not.
+ *
+ * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
+ * (`permissionSourceForContract`), so on its own side the predicate reduces to
+ * "a commitment never governs" — `contractGovernsPermissions(c,
+ * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
+ * daemon reads the marker it received, because it cannot distinguish "new
+ * server, agent permissions" from "old server, contract fence" any other way.
+ * Both call the same function; only the input differs.
+ */
+/** The wire vocabulary for `permissionSource`. Top-level session field. */
+export const SESSION_PERMISSION_SOURCES = ['agent'];
+/**
+ * The daemon capability that proves a build honours `permissionSource`. The
+ * server announces it in preflight and refuses to dispatch a Commitment Run to
+ * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
+ * the marker never reaches a daemon that would ignore it.
+ */
+export const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = 'commitment_execution_contract_v2_agent_permissions';
+/**
+ * Untrusted wire input: anything but an exact vocabulary literal reads as
+ * absent. Never widen by coercion — an unrecognized future value must degrade
+ * to "contract governs", the conservative answer.
+ */
+export function normalizeSessionPermissionSource(value) {
+    return SESSION_PERMISSION_SOURCES.includes(value)
+        ? value
+        : undefined;
+}
+/**
+ * What the server stamps on the wire for this contract. A `commitment`
+ * contract no longer carries permissions (OSK-11975); every other contract
+ * kind keeps its own authority and stamps nothing.
+ */
+export function permissionSourceForContract(contract) {
+    return contract?.kind === 'commitment' ? 'agent' : undefined;
+}
+/**
+ * Whether the contract is the run's PERMISSION authority — the single place
+ * this rule lives.
+ *
+ * True for a non-commitment contract regardless of marker, and for a
+ * commitment whose server did not declare agent permissions. False for no
+ * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
+ * which then follows the Agent's own permissions exactly as a Task does while
+ * the contract keeps its non-permission roles (normalized shape, ephemeral
+ * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+ */
+export function contractGovernsPermissions(contract, permissionSource) {
+    if (!contract)
+        return false;
+    return !(contract.kind === 'commitment' && normalizeSessionPermissionSource(permissionSource) === 'agent');
+}
+/**
+ * The contract when it governs permissions, else `undefined` — for the sites
+ * that used `executionContract` as "is this run permission-fenced".
+ */
+export function permissionGoverningContract(contract, permissionSource) {
+    return contract && contractGovernsPermissions(contract, permissionSource) ? contract : undefined;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/types.d.ts

@@ -62,6 +62,11 @@ export interface TokenPair {
  *   - TOKEN_*         — access-token specific (server pushes 4402 close;
  *                       daemon classifies as TOKEN_INVALID/TOKEN_EXPIRED).
  *   - SESSION_REVOKED — admin/forensic revoke; whole family burned.
+ *   - DEVICE_KEY_MISMATCH — the refresh carried a device proof signed by a key
+ *                       other than the one enrolled on this daemon's row
+ *                       (server code `DEVICE_PROOF_THUMBPRINT_MISMATCH`).
+ *                       The daemon signs every retry with the same key, so
+ *                       retrying can never succeed.
  *   - UNKNOWN_401     — server returned 401 with a code we don't
  *                       recognize. Treated as permanent (better to prompt
  *                       re-auth than to loop forever) but tagged
@@ -74,7 +79,7 @@ export interface TokenPair {
  * Without this, the client `describeAuthFailure` exhaustiveness check
  * was silently broken for the non-REFRESH branches.
  */
-export type PermanentAuthReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'TOKEN_INVALID' | 'TOKEN_EXPIRED' | 'UNKNOWN_401';
+export type PermanentAuthReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'TOKEN_INVALID' | 'TOKEN_EXPIRED' | 'UNKNOWN_401';
 export declare class PermanentAuthFailure extends Error {
     readonly code: PermanentAuthReason;
     constructor(code: PermanentAuthReason, message: string);

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -43,6 +43,46 @@
         "types": "./dist/cjs/harnessSkillLayout.d.ts",
         "default": "./dist/cjs/harnessSkillLayout.js"
       }
+    },
+    "./daemon-tool-approval": {
+      "import": {
+        "types": "./dist/esm/daemonToolApproval.d.ts",
+        "default": "./dist/esm/daemonToolApproval.js"
+      },
+      "require": {
+        "types": "./dist/cjs/daemonToolApproval.d.ts",
+        "default": "./dist/cjs/daemonToolApproval.js"
+      }
+    },
+    "./session-permission-authority": {
+      "import": {
+        "types": "./dist/esm/sessionPermissionAuthority.d.ts",
+        "default": "./dist/esm/sessionPermissionAuthority.js"
+      },
+      "require": {
+        "types": "./dist/cjs/sessionPermissionAuthority.d.ts",
+        "default": "./dist/cjs/sessionPermissionAuthority.js"
+      }
+    },
+    "./credential-session": {
+      "import": {
+        "types": "./dist/esm/credentialSession.d.ts",
+        "default": "./dist/esm/credentialSession.js"
+      },
+      "require": {
+        "types": "./dist/cjs/credentialSession.d.ts",
+        "default": "./dist/cjs/credentialSession.js"
+      }
+    },
+    "./cli-handoff-wire": {
+      "import": {
+        "types": "./dist/esm/cliHandoffWire.d.ts",
+        "default": "./dist/esm/cliHandoffWire.js"
+      },
+      "require": {
+        "types": "./dist/cjs/cliHandoffWire.d.ts",
+        "default": "./dist/cjs/cliHandoffWire.js"
+      }
     }
   },
   "dependencies": {