@skrr-ai/cli 0.1.49 → 0.1.51

package/dist/lib/first-party-harness-broker.js

@@ -259,7 +259,10 @@ async function acquireManagedSession(input = {}, deps = {}) {
                 sessionToken,
                 model: input.model?.trim() || AUTOMATIC_MODEL,
                 localRuntimeId: (deps.localRuntimeId ?? localRuntimeId)(),
-                machineUuid: (deps.machineUuid ?? auth_core_1.ensureMachineDaemonId)(),
+                // The hardware id every Daemon row is keyed on — the same function
+                // the daemon calls — not the minted `~/.skrr/daemon.id` UUIDv7,
+                // so the reservation's attribution joins to this machine (OSK-12063).
+                machineUuid: (deps.machineUuid ?? auth_core_1.getMachineUuid)(),
             }, fetchImpl, acquisition.signal);
         }
         catch (err) {
@@ -999,8 +1002,15 @@ function createManagedEngineHooks(input) {
      * is not reported to the user as a decision about their account (OSK-3961).
      */
     let tearingDown = false;
+    /**
+     * `prepare` answered `{}` with no credential the engine could inherit —
+     * latched, so a post-exit caller can reconnect an opaque engine failure to
+     * the auth cause the fallback line already named (OSK-11949).
+     */
+    let unprovisioned = false;
     return {
         session: () => handle,
+        unprovisionedByok: () => unprovisioned,
         // A live handle means a broker is running and the engine's base URLs point at
         // it, which is exactly when re-admitting an ambient provider key would let the
         // engine bypass the relay (or 401 preferring a stale `x-api-key`). No handle
@@ -1012,6 +1022,7 @@ function createManagedEngineHooks(input) {
             if (skip) {
                 if (skip.announce)
                     log(`Managed inference not used: ${skip.detail}. ${fallbackTail(env)}`);
+                unprovisioned = !(0, first_party_harness_1.hasProviderCredential)(env);
                 return {};
             }
             try {
@@ -1063,6 +1074,7 @@ function createManagedEngineHooks(input) {
                 if (failure.action === 'refuse') {
                     throw new first_party_harness_1.EngineStartRefusedError(failure.code, failure.line);
                 }
+                unprovisioned = !(0, first_party_harness_1.hasProviderCredential)(env);
                 return {};
             }
         },

package/dist/lib/first-party-harness-doctor.js

@@ -42,6 +42,7 @@ const first_party_harness_1 = require("./first-party-harness");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const harness_tiers_1 = require("./harness-tiers");
 const first_party_harness_managed_1 = require("./first-party-harness-managed");
+const first_party_harness_project_trust_1 = require("./first-party-harness-project-trust");
 /**
  * Project-level state dir — the ENGINE's own project marker
  * (`FIRST_PARTY_HARNESS_ENGINE.projectDirectory`). Basename deliberately differs
@@ -490,6 +491,42 @@ function permissionAuthorityCheck(env) {
         detail: 'daemon-managed sessions adjudicate every tool call; no trust tier auto-approves',
     };
 }
+/**
+ * OSK-11958 — whether `skrr code` will load THIS directory's project configuration.
+ *
+ * Reported because the answer changes what the engine can do before any tool
+ * call exists: a project's plugins and custom tools run on load, and its
+ * permission block can loosen what the agent does without asking. Never a
+ * `warn`: an untrusted project with config is the safe default working as
+ * designed, and one with none has nothing to decide.
+ */
+function projectConfigCheck(cwd, env) {
+    const root = (0, first_party_harness_project_trust_1.findProjectRoot)(cwd);
+    const config = (0, first_party_harness_project_trust_1.findProjectConfig)(cwd, root, env);
+    if (config.length === 0) {
+        return {
+            name: 'project-config',
+            status: 'ok',
+            detail: 'this project ships no agent configuration — nothing to trust',
+        };
+    }
+    const listed = config.map((file) => node_path_1.default.relative(root, file) || '.').join(', ');
+    if ((0, first_party_harness_project_trust_1.isProjectTrusted)(root, env)) {
+        return {
+            name: 'project-config',
+            status: 'ok',
+            detail: `trusted — ${listed} load for \`skrr code\` and \`skrr code run\``,
+            remedy: `Recorded in ${(0, first_party_harness_project_trust_1.trustRecordPath)(env)}; delete this project's entry there to stop trusting it.`,
+        };
+    }
+    return {
+        name: 'project-config',
+        status: 'ok',
+        detail: `not trusted — ${listed} will NOT load (instructions files still do)`,
+        remedy: `Project configuration can run code on this machine and loosen permissions. Pass ` +
+            `${first_party_harness_project_trust_1.TRUST_PROJECT_FLAG} once, or answer "always" when the TUI asks, to load it.`,
+    };
+}
 /**
  * Hosts the engine's WL-2.7 egress policy denies, and the one it still permits.
  *
@@ -759,7 +796,9 @@ function sessionAuthorityCheck(env) {
                 name: 'session-authority',
                 status: 'ok',
                 detail: 'standalone — the engine decides. No daemon permission adjudication, no run fence, no ' +
-                    'scoped platform credential, no durable task context, no worktree isolation. ' +
+                    'scoped platform credential, no durable task context, no worktree isolation. The TUI ' +
+                    'asks before edits, commands and web access unless OPENCODE_PERMISSION or ' + // brand-leak-ok:compat  upstream env var name
+                    '--engine-permissions says otherwise; `skrr code run` keeps the engine config. ' +
                     'Daemon-supervised sessions enter through `skrr code acp`, not through this command.',
                 remedy: 'Intended for local use, and nothing to fix. Worth knowing because it is NOT the same ' +
                     'trust plane as a daemon-dispatched run — and neither plane is an OS-level sandbox ' +
@@ -828,6 +867,7 @@ function runDoctor(cwd = process.cwd(), env = process.env) {
         stateDirCheck(cwd, env),
         compatCheck(cwd, env),
         opencodeCheck(cwd),
+        projectConfigCheck(cwd, env),
         // Before the trust/permission/credential trio, because it frames all three:
         // what a tier grants and who enforces it both depend on which plane you are on.
         sessionAuthorityCheck(env),

package/dist/lib/first-party-harness-managed.d.ts

@@ -122,9 +122,10 @@ export declare const MANAGED_SESSION_ENV = "OVERSKY_MANAGED_SESSION";
  * by `skrr` itself. Keying an AUTHORITY answer on it therefore tells a user with
  * no daemon at all that "a daemon adjudicates every tool call", which is the
  * exact conflation `sessionAuthorityCheck`'s own docstring was written to warn
- * about. It is not a subtle misread: bare `skrr code` never sets
- * `OPENCODE_PERMISSION={"*":"ask"}` (only the daemon's backend does), so the
- * engine consults its own allow-by-default config and nothing is adjudicated.
+ * about. It is not a subtle misread: nothing on this plane routes a tool call
+ * to the daemon. Since OSK-11958 the bare TUI asks the PERSON at the terminal
+ * before edits and commands (`INTERACTIVE_PERMISSION_DEFAULT`), and `skrr code
+ * run` keeps the engine's own config — neither is daemon adjudication.
  *
  * Ordered deliberately: DAEMON IDENTITY FIRST. Only the daemon can set
  * `OVERSKY_AUTONOMOUS_SESSION` or the runtime context a daemon session carries,

package/dist/lib/first-party-harness-project-trust.d.ts

@@ -0,0 +1,125 @@
+/**
+ * `skrr code` on a repository somebody else wrote (OSK-11958).
+ *
+ * ── What was wrong ──────────────────────────────────────────────────────────
+ *
+ * Bare `skrr code` and `skrr code run` forwarded straight to the engine, which
+ * then read the project's own configuration. Three things in there act on this
+ * machine, and the engine's own content-addressed trust gate (`skrr code trust`)
+ * covers only the first:
+ *
+ *   1. `plugin` / `mcp` keys in a project config file   — gated by the engine;
+ *   2. plugin and tool FILES auto-discovered under the project directory
+ *      (`<dir>/plugin/*.ts`, `<dir>/tool/*.ts`), and a dependency install run in
+ *      that directory                                     — NOT gated, measured
+ *      against the fork's `config.ts` / `plugin.ts` / `tool/registry.ts`;
+ *   3. `permission` and agent definitions, which LOOSEN what the agent may do
+ *      without asking — findLast wins in the engine's ruleset, so a project's
+ *      `"bash": "allow"` beats a default that asks.
+ *
+ * The daemon's managed path has always set `OPENCODE_DISABLE_PROJECT_CONFIG=1`.
+ * The CLI path set nothing. So opening a cloned repository with `skrr code` could
+ * run that repository's code, with no prompt.
+ *
+ * ── What this module decides ────────────────────────────────────────────────
+ *
+ * **Project configuration is off until the person trusts the project.** Trust is
+ * a record per project root (the git top level, else the directory), kept in
+ * `<config root>/code-trusted-projects.json`, or a one-shot `--trust-project`.
+ * The interactive TUI asks once, before it starts, and only when the project
+ * actually ships configuration; a repository with none is never asked about.
+ *
+ * Path-addressed rather than content-addressed on purpose: this is the coarse
+ * "is this my project?" question every editor asks (the engine's own gate stays
+ * content-addressed for the plugin/mcp keys inside a trusted project).
+ *
+ * **Disabling project config must not cost the repository's instructions.** The
+ * engine's switch also stops it reading `AGENTS.md` / `CLAUDE.md` from the
+ * project — text, not code — and a coding agent that ignores the repository's
+ * conventions is its own failure. So an untrusted run passes those files back by
+ * absolute path through `OPENCODE_CONFIG_CONTENT.instructions`, which the engine
+ * reads as plain files. Nothing executable travels that way.
+ *
+ * **The interactive TUI asks before bash, edits, and the web.** A person is at
+ * the terminal and the engine can prompt there, so the default is the one
+ * Claude Code ships: reads and searches run, changes and commands ask
+ * (`INTERACTIVE_PERMISSION_DEFAULT`). The engine answers "always" per session,
+ * so it costs one approval per kind of action, not one per call. `skrr code run`
+ * is headless — the engine auto-REJECTS every ask there — so it keeps the
+ * engine's own permission config; an `ask` default would make `run` unable to
+ * edit anything. A person's own `OPENCODE_PERMISSION` always wins, and
+ * `--engine-permissions` hands the decision back to the engine's config.
+ */
+/** Wrapper flags this module consumes; the engine never sees them. */
+export declare const TRUST_PROJECT_FLAG = "--trust-project";
+export declare const ENGINE_PERMISSIONS_FLAG = "--engine-permissions";
+/**
+ * The interactive default. Explicit keys after `*`, because the engine's ruleset
+ * is last-match-wins and merges this OVER the project's and the user's config:
+ * a key named here beats a looser value for the same key elsewhere.
+ */
+export declare const INTERACTIVE_PERMISSION_DEFAULT: Readonly<Record<string, unknown>>;
+/** The git top level containing `dir`, else `dir` itself. Never spawns git. */
+export declare function findProjectRoot(dir: string): string;
+/**
+ * Project configuration present between `cwd` and the project root — what the
+ * engine would load. Empty means there is nothing to decide about.
+ */
+export declare function findProjectConfig(cwd: string, root?: string, env?: NodeJS.ProcessEnv): string[];
+/**
+ * The project instruction files the engine would have read, by absolute path, so
+ * an untrusted run keeps them. Mirrors the engine: its own project directory's
+ * `AGENTS.md` at every level, plus the first of `AGENTS.md` / `CLAUDE.md` that
+ * exists anywhere between `cwd` and the root, at every level it exists.
+ */
+export declare function findProjectInstructions(cwd: string, root?: string): string[];
+export declare function trustRecordPath(env?: NodeJS.ProcessEnv): string;
+export declare function isProjectTrusted(root: string, env?: NodeJS.ProcessEnv): boolean;
+export declare function trustProject(root: string, env?: NodeJS.ProcessEnv): string;
+export declare function takeProjectPolicyFlags(passthrough: readonly string[]): {
+    trustProject: boolean;
+    enginePermissions: boolean;
+    engineArgv: string[];
+};
+export type TrustAnswer = 'once' | 'always' | 'no';
+export interface ProjectPolicyInput {
+    /** Where the engine will run — the TUI's positional project dir, or the cwd. */
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    /** `tui` asks and applies the interactive permission default; `headless` does neither. */
+    mode: 'tui' | 'headless';
+    trustProject: boolean;
+    enginePermissions: boolean;
+    /** Present only when a person can answer (both stdin and stderr are TTYs). */
+    ask?: (question: {
+        root: string;
+        config: string[];
+    }) => Promise<TrustAnswer>;
+}
+export interface ProjectPolicy {
+    /** Env the engine receives, layered over the sanitized parent. */
+    env: Record<string, string>;
+    /** Lines for stderr — what was withheld and how to change it. */
+    notices: string[];
+    projectConfig: 'loaded' | 'disabled' | 'none';
+}
+export declare function resolveProjectPolicy(input: ProjectPolicyInput): Promise<ProjectPolicy>;
+/**
+ * Where the TUI will run, or null when the argv names an engine subcommand.
+ *
+ * The engine takes its subcommand FIRST (`skrr code trust --show`), and its TUI
+ * takes an optional project directory in that same position. So: nothing, a flag,
+ * or an existing directory first means the TUI; any other word is a subcommand,
+ * forwarded untouched — `trust` in particular must see the project config it
+ * exists to approve.
+ */
+export declare function tuiProjectDir(engineArgv: readonly string[], cwd: string): string | null;
+/**
+ * The in-terminal question, or undefined when nobody can answer it. Asked on
+ * stderr so a redirected stdout stays clean; anything but y/a is "no", including
+ * an empty line and a closed stdin.
+ */
+export declare function ttyTrustAsker(streams?: {
+    input: NodeJS.ReadStream;
+    output: NodeJS.WriteStream;
+}): ProjectPolicyInput['ask'];

package/dist/lib/first-party-harness-project-trust.js

@@ -0,0 +1,364 @@
+"use strict";
+/**
+ * `skrr code` on a repository somebody else wrote (OSK-11958).
+ *
+ * ── What was wrong ──────────────────────────────────────────────────────────
+ *
+ * Bare `skrr code` and `skrr code run` forwarded straight to the engine, which
+ * then read the project's own configuration. Three things in there act on this
+ * machine, and the engine's own content-addressed trust gate (`skrr code trust`)
+ * covers only the first:
+ *
+ *   1. `plugin` / `mcp` keys in a project config file   — gated by the engine;
+ *   2. plugin and tool FILES auto-discovered under the project directory
+ *      (`<dir>/plugin/*.ts`, `<dir>/tool/*.ts`), and a dependency install run in
+ *      that directory                                     — NOT gated, measured
+ *      against the fork's `config.ts` / `plugin.ts` / `tool/registry.ts`;
+ *   3. `permission` and agent definitions, which LOOSEN what the agent may do
+ *      without asking — findLast wins in the engine's ruleset, so a project's
+ *      `"bash": "allow"` beats a default that asks.
+ *
+ * The daemon's managed path has always set `OPENCODE_DISABLE_PROJECT_CONFIG=1`.
+ * The CLI path set nothing. So opening a cloned repository with `skrr code` could
+ * run that repository's code, with no prompt.
+ *
+ * ── What this module decides ────────────────────────────────────────────────
+ *
+ * **Project configuration is off until the person trusts the project.** Trust is
+ * a record per project root (the git top level, else the directory), kept in
+ * `<config root>/code-trusted-projects.json`, or a one-shot `--trust-project`.
+ * The interactive TUI asks once, before it starts, and only when the project
+ * actually ships configuration; a repository with none is never asked about.
+ *
+ * Path-addressed rather than content-addressed on purpose: this is the coarse
+ * "is this my project?" question every editor asks (the engine's own gate stays
+ * content-addressed for the plugin/mcp keys inside a trusted project).
+ *
+ * **Disabling project config must not cost the repository's instructions.** The
+ * engine's switch also stops it reading `AGENTS.md` / `CLAUDE.md` from the
+ * project — text, not code — and a coding agent that ignores the repository's
+ * conventions is its own failure. So an untrusted run passes those files back by
+ * absolute path through `OPENCODE_CONFIG_CONTENT.instructions`, which the engine
+ * reads as plain files. Nothing executable travels that way.
+ *
+ * **The interactive TUI asks before bash, edits, and the web.** A person is at
+ * the terminal and the engine can prompt there, so the default is the one
+ * Claude Code ships: reads and searches run, changes and commands ask
+ * (`INTERACTIVE_PERMISSION_DEFAULT`). The engine answers "always" per session,
+ * so it costs one approval per kind of action, not one per call. `skrr code run`
+ * is headless — the engine auto-REJECTS every ask there — so it keeps the
+ * engine's own permission config; an `ask` default would make `run` unable to
+ * edit anything. A person's own `OPENCODE_PERMISSION` always wins, and
+ * `--engine-permissions` hands the decision back to the engine's config.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERACTIVE_PERMISSION_DEFAULT = exports.ENGINE_PERMISSIONS_FLAG = exports.TRUST_PROJECT_FLAG = void 0;
+exports.findProjectRoot = findProjectRoot;
+exports.findProjectConfig = findProjectConfig;
+exports.findProjectInstructions = findProjectInstructions;
+exports.trustRecordPath = trustRecordPath;
+exports.isProjectTrusted = isProjectTrusted;
+exports.trustProject = trustProject;
+exports.takeProjectPolicyFlags = takeProjectPolicyFlags;
+exports.resolveProjectPolicy = resolveProjectPolicy;
+exports.tuiProjectDir = tuiProjectDir;
+exports.ttyTrustAsker = ttyTrustAsker;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_readline_1 = __importDefault(require("node:readline"));
+const auth_core_1 = require("@skrr-ai/auth-core");
+/** Wrapper flags this module consumes; the engine never sees them. */
+exports.TRUST_PROJECT_FLAG = '--trust-project';
+exports.ENGINE_PERMISSIONS_FLAG = '--engine-permissions';
+// The upstream engine's variable names, which the fork still reads.
+const DISABLE_PROJECT_CONFIG_ENV = 'OPENCODE_DISABLE_PROJECT_CONFIG'; // brand-leak-ok:compat  upstream env var name
+const PERMISSION_ENV = 'OPENCODE_PERMISSION'; // brand-leak-ok:compat  upstream env var name
+const CONFIG_CONTENT_ENV = 'OPENCODE_CONFIG_CONTENT'; // brand-leak-ok:compat  upstream env var name
+/**
+ * The upstream project namespace, which the engine reads ONLY when its
+ * compatibility switch is on — otherwise a repository with an upstream config
+ * directory would be asked about a file the engine never opens.
+ */
+const UPSTREAM_APP_NAME = 'opencode'; // brand-leak-ok:compat  upstream project dir / config basename
+function upstreamCompatOn(env) {
+    const value = (0, auth_core_1.readFirstPartyHarnessEngineEnv)(env, 'compatOpencode').value?.trim().toLowerCase();
+    return value === '1' || value === 'true';
+}
+/**
+ * The interactive default. Explicit keys after `*`, because the engine's ruleset
+ * is last-match-wins and merges this OVER the project's and the user's config:
+ * a key named here beats a looser value for the same key elsewhere.
+ */
+exports.INTERACTIVE_PERMISSION_DEFAULT = Object.freeze({
+    '*': 'ask',
+    read: { '*': 'allow', '*.env': 'ask', '*.env.*': 'ask', '*.env.example': 'allow' },
+    glob: 'allow',
+    grep: 'allow',
+    list: 'allow',
+    lsp: 'allow',
+    todowrite: 'allow',
+    question: 'allow',
+    skill: 'allow',
+    task: 'allow',
+    edit: 'ask',
+    bash: 'ask',
+    webfetch: 'ask',
+    websearch: 'ask',
+    external_directory: 'ask',
+});
+/** Every project-config location the engine reads, current namespace first. */
+function projectConfigNames(env) {
+    const upstream = upstreamCompatOn(env) ? [UPSTREAM_APP_NAME] : [];
+    const appNames = [
+        auth_core_1.FIRST_PARTY_HARNESS_ENGINE.appName,
+        ...auth_core_1.FIRST_PARTY_HARNESS_ENGINE.legacyAppNames,
+        ...upstream,
+    ];
+    return {
+        dirs: [
+            auth_core_1.FIRST_PARTY_HARNESS_ENGINE.projectDirectory,
+            ...auth_core_1.FIRST_PARTY_HARNESS_ENGINE.legacyProjectDirectories,
+            ...upstream.map((name) => `.${name}`),
+        ],
+        files: appNames.flatMap((name) => [`${name}.json`, `${name}.jsonc`]),
+    };
+}
+/** The git top level containing `dir`, else `dir` itself. Never spawns git. */
+function findProjectRoot(dir) {
+    let current = node_path_1.default.resolve(dir);
+    for (;;) {
+        if (node_fs_1.default.existsSync(node_path_1.default.join(current, '.git')))
+            return current;
+        const parent = node_path_1.default.dirname(current);
+        if (parent === current)
+            return node_path_1.default.resolve(dir);
+        current = parent;
+    }
+}
+/** The directories from `start` up to and including `root`. */
+function ancestry(start, root) {
+    const out = [];
+    let current = node_path_1.default.resolve(start);
+    const stop = node_path_1.default.resolve(root);
+    for (;;) {
+        out.push(current);
+        if (current === stop)
+            break;
+        const parent = node_path_1.default.dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return out;
+}
+/**
+ * Project configuration present between `cwd` and the project root — what the
+ * engine would load. Empty means there is nothing to decide about.
+ */
+function findProjectConfig(cwd, root = findProjectRoot(cwd), env = process.env) {
+    const { dirs, files } = projectConfigNames(env);
+    const found = [];
+    for (const dir of ancestry(cwd, root)) {
+        for (const name of [...dirs, ...files]) {
+            const candidate = node_path_1.default.join(dir, name);
+            if (node_fs_1.default.existsSync(candidate))
+                found.push(candidate);
+        }
+    }
+    return found;
+}
+/**
+ * The project instruction files the engine would have read, by absolute path, so
+ * an untrusted run keeps them. Mirrors the engine: its own project directory's
+ * `AGENTS.md` at every level, plus the first of `AGENTS.md` / `CLAUDE.md` that
+ * exists anywhere between `cwd` and the root, at every level it exists.
+ */
+function findProjectInstructions(cwd, root = findProjectRoot(cwd)) {
+    const levels = ancestry(cwd, root);
+    const own = [
+        auth_core_1.FIRST_PARTY_HARNESS_ENGINE.projectDirectory,
+        ...auth_core_1.FIRST_PARTY_HARNESS_ENGINE.legacyProjectDirectories,
+    ];
+    const found = [];
+    for (const dir of levels) {
+        // Current project directory first; a legacy one only where it is absent.
+        const hit = own.map((d) => node_path_1.default.join(dir, d, 'AGENTS.md')).find((f) => node_fs_1.default.existsSync(f));
+        if (hit)
+            found.push(hit);
+    }
+    for (const family of ['AGENTS.md', 'CLAUDE.md']) {
+        const matches = levels.map((dir) => node_path_1.default.join(dir, family)).filter((f) => node_fs_1.default.existsSync(f));
+        if (matches.length > 0) {
+            found.push(...matches);
+            break;
+        }
+    }
+    return found;
+}
+function trustRecordPath(env = process.env) {
+    return node_path_1.default.join((0, auth_core_1.resolveConfigRoot)(env), 'code-trusted-projects.json');
+}
+function realRoot(root) {
+    try {
+        return node_fs_1.default.realpathSync(root);
+    }
+    catch {
+        return node_path_1.default.resolve(root);
+    }
+}
+function readTrustFile(file) {
+    try {
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(file, 'utf8'));
+        if (parsed && parsed.version === 1 && parsed.projects && typeof parsed.projects === 'object') {
+            return { version: 1, projects: parsed.projects };
+        }
+    }
+    catch {
+        /* absent or unreadable: nothing is trusted, which is the safe reading */
+    }
+    return { version: 1, projects: {} };
+}
+function isProjectTrusted(root, env = process.env) {
+    return Boolean(readTrustFile(trustRecordPath(env)).projects[realRoot(root)]);
+}
+function trustProject(root, env = process.env) {
+    const file = trustRecordPath(env);
+    const record = readTrustFile(file);
+    record.projects[realRoot(root)] = { trustedAt: new Date().toISOString() };
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    node_fs_1.default.writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+    node_fs_1.default.renameSync(tmp, file);
+    return file;
+}
+// ── Flags ──────────────────────────────────────────────────────────────────
+function takeProjectPolicyFlags(passthrough) {
+    let trust = false;
+    let enginePermissions = false;
+    const engineArgv = [];
+    for (const token of passthrough) {
+        if (token === exports.TRUST_PROJECT_FLAG)
+            trust = true;
+        else if (token === exports.ENGINE_PERMISSIONS_FLAG)
+            enginePermissions = true;
+        else
+            engineArgv.push(token);
+    }
+    return { trustProject: trust, enginePermissions, engineArgv };
+}
+function mergeConfigContent(existing, instructions) {
+    let base = {};
+    if (existing && existing.trim() !== '') {
+        try {
+            const parsed = JSON.parse(existing);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                return null;
+            base = parsed;
+        }
+        catch {
+            // The person's own value is not JSON we can extend; leave it exactly as is.
+            return null;
+        }
+    }
+    const prior = Array.isArray(base.instructions) ? base.instructions : [];
+    const merged = [...prior, ...instructions.filter((file) => !prior.includes(file))];
+    return JSON.stringify({ ...base, instructions: merged });
+}
+function relativeList(root, files) {
+    return files.map((file) => node_path_1.default.relative(root, file) || '.').join(', ');
+}
+async function resolveProjectPolicy(input) {
+    const env = {};
+    const notices = [];
+    if (input.mode === 'tui' && !input.enginePermissions && !input.env[PERMISSION_ENV]) {
+        env[PERMISSION_ENV] = JSON.stringify(exports.INTERACTIVE_PERMISSION_DEFAULT);
+    }
+    const root = findProjectRoot(input.cwd);
+    const config = findProjectConfig(input.cwd, root, input.env);
+    if (config.length === 0)
+        return { env, notices, projectConfig: 'none' };
+    let trusted = input.trustProject || isProjectTrusted(root, input.env);
+    if (!trusted && input.mode === 'tui' && input.ask) {
+        const answer = await input.ask({ root, config });
+        if (answer === 'always') {
+            const file = trustProject(root, input.env);
+            notices.push(`Trusted ${root} for skrr code (recorded in ${file}).`);
+        }
+        trusted = answer !== 'no';
+    }
+    if (trusted)
+        return { env, notices, projectConfig: 'loaded' };
+    env[DISABLE_PROJECT_CONFIG_ENV] = '1';
+    const instructions = findProjectInstructions(input.cwd, root);
+    if (instructions.length > 0) {
+        const content = mergeConfigContent(input.env[CONFIG_CONTENT_ENV], instructions);
+        if (content)
+            env[CONFIG_CONTENT_ENV] = content;
+    }
+    notices.push(`Project configuration in ${root} was not loaded (${relativeList(root, config)}): it can run ` +
+        `code on this machine and change what the agent may do without asking. ` +
+        (instructions.length > 0 ? 'Its instructions files were still read. ' : '') +
+        `To load it, pass ${exports.TRUST_PROJECT_FLAG} once, or answer "always" when \`skrr code\` asks.`);
+    return { env, notices, projectConfig: 'disabled' };
+}
+/**
+ * Where the TUI will run, or null when the argv names an engine subcommand.
+ *
+ * The engine takes its subcommand FIRST (`skrr code trust --show`), and its TUI
+ * takes an optional project directory in that same position. So: nothing, a flag,
+ * or an existing directory first means the TUI; any other word is a subcommand,
+ * forwarded untouched — `trust` in particular must see the project config it
+ * exists to approve.
+ */
+function tuiProjectDir(engineArgv, cwd) {
+    const first = engineArgv[0];
+    if (first === undefined || first.startsWith('-'))
+        return cwd;
+    const candidate = node_path_1.default.resolve(cwd, first);
+    try {
+        if (node_fs_1.default.statSync(candidate).isDirectory())
+            return candidate;
+    }
+    catch {
+        /* not a directory: a subcommand */
+    }
+    return null;
+}
+/**
+ * The in-terminal question, or undefined when nobody can answer it. Asked on
+ * stderr so a redirected stdout stays clean; anything but y/a is "no", including
+ * an empty line and a closed stdin.
+ */
+function ttyTrustAsker(streams = {
+    input: process.stdin,
+    output: process.stderr,
+}) {
+    if (!streams.input.isTTY || !streams.output.isTTY)
+        return undefined;
+    return ({ root, config }) => new Promise((resolve) => {
+        const rl = node_readline_1.default.createInterface({ input: streams.input, output: streams.output });
+        let settled = false;
+        const finish = (answer) => {
+            if (settled)
+                return;
+            settled = true;
+            rl.close();
+            resolve(answer);
+        };
+        rl.on('close', () => finish('no'));
+        rl.question(`\nThis project ships its own agent configuration: ${relativeList(root, config)}\n` +
+            'Project configuration can run code on this machine (plugins, custom tools, MCP\n' +
+            'servers) and change what the agent may do without asking.\n' +
+            `Load it?  [y] this time   [a] always for ${root}   [N] no  `, (reply) => {
+            const value = reply.trim().toLowerCase();
+            finish(value === 'a' || value === 'always'
+                ? 'always'
+                : value === 'y' || value === 'yes'
+                    ? 'once'
+                    : 'no');
+        });
+    });
+}

package/dist/lib/first-party-harness.d.ts

@@ -264,6 +264,13 @@ export interface EngineSpawnOptions {
      * never spawned, `cleanup` still runs, and the error reaches the caller.
      */
     prepare?: () => Promise<Record<string, string>>;
+    /**
+     * OSK-11958 — the project policy's env (`first-party-harness-project-trust.ts`):
+     * whether the project's own config loads, and the interactive permission
+     * default. Layered over the engine-owned env and UNDER `prepare`'s, so a managed
+     * session's relay values still win.
+     */
+    policyEnv?: Record<string, string>;
     /** Always run, on every exit path. Tear down anything `prepare` created. */
     cleanup?: (outcome: EngineExitOutcome) => Promise<void>;
     /**
@@ -367,9 +374,9 @@ export declare function strippedProviderCredentialNames(env?: NodeJS.ProcessEnv)
  * under that name, rather than rely on inheritance.
  *
  * The layering, in full: sanitized parent → the user's own model credential (BYOK
- * only) → {@link engineOwnedEnv} → `extraEnv`.
+ * only) → {@link engineOwnedEnv} → the project policy (OSK-11958) → `extraEnv`.
  */
-export declare function engineSpawnEnv(env: NodeJS.ProcessEnv, extraEnv: Record<string, string>, mode: 'managed' | 'byok'): NodeJS.ProcessEnv;
+export declare function engineSpawnEnv(env: NodeJS.ProcessEnv, extraEnv: Record<string, string>, mode: 'managed' | 'byok', policyEnv?: Record<string, string>): NodeJS.ProcessEnv;
 /**
  * Settings the platform reads under NEUTRAL names, handed to the engine under the
  * engine's OWN names.