@skrr-ai/cli 0.1.88 → 0.1.90

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/computerWire.js

@@ -25,16 +25,18 @@
  * dropped every command event for a release (OSK-13605).
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.COMPUTER_BROWSER_DIALOG_CREDENTIAL_MAX_LENGTH = exports.COMPUTER_BROWSER_DIALOG_PROMPT_MAX_LENGTH = exports.COMPUTER_BROWSER_DIALOG_MESSAGE_MAX_LENGTH = exports.COMPUTER_BROWSER_DIALOG_ANSWERERS = exports.COMPUTER_BROWSER_DIALOG_OUTCOMES = exports.COMPUTER_BROWSER_DIALOG_KINDS = exports.COMPUTER_INPUT_TEXT_MAX_LENGTH = exports.COMPUTER_BROWSER_INPUT_PLATFORMS = exports.COMPUTER_BROWSER_INPUT_TYPES = exports.COMPUTER_TERMINAL_CAVEATS = exports.COMPUTER_TERMINAL_HISTORY_CAUSES = exports.COMPUTER_TERMINAL_LIFETIMES = exports.COMPUTER_TERMINAL_INPUT_TYPES = exports.COMPUTER_TERMINAL_SIGNALS = exports.COMPUTER_DIAGNOSTICS_MAX_STREAMS = exports.COMPUTER_DIAGNOSTICS_INTERVAL_MS = exports.COMPUTER_DIAGNOSTIC_COUNTERS = exports.COMPUTER_FRAME_ACK_TIMEOUT_MS = exports.COMPUTER_FRAME_MAX_BYTES = exports.COMPUTER_BROWSER_VIEWPORT = exports.COMPUTER_SURFACE_END_REASONS = exports.COMPUTER_SURFACE_STATES = exports.COMPUTER_SURFACE_KINDS = exports.COMPUTER_CONTROL_ACTIVITY_CHANGES = exports.COMPUTER_CONTROL_CHANGE_REASONS = exports.COMPUTER_SURFACE_UNPIN_REASONS = exports.COMPUTER_SURFACE_PIN_ACTIONS = exports.COMPUTER_SHARE_MODES = exports.COMPUTER_SHARE_ACTIONS = exports.COMPUTER_CONTROL_ACTIONS = exports.COMPUTER_AGENT_WRITE_WAIT_MS = exports.COMPUTER_RECONNECT_GRACE_MS = exports.COMPUTER_RECLAIM_WARNING_MS = exports.COMPUTER_CONTROL_IDLE_MS = exports.COMPUTER_HANDBACK_NOTE_MAX_LENGTH = exports.COMPUTER_GRANT_TIERS = exports.COMPUTER_OPERATIONS = exports.COMPUTER_ACCESS_LEVELS = exports.COMPUTER_ACTIVITY_ACTOR_KINDS = exports.COMPUTER_ACTOR_KINDS = exports.COMPUTER_LEGACY_REFUSAL_SPELLINGS = exports.COMPUTER_REFUSAL_CODES = exports.COMPUTER_CAPABILITY_VALUES = exports.COMPUTER_CAPABILITIES = exports.COMPUTER_SERVER_EVENT_KEYS = exports.DAEMON_COMPUTER_REPORT_EVENT_KEYS = exports.DAEMON_COMPUTER_EVENT_NAMES = exports.COMPUTER_EVENT_NAMES = exports.DAEMON_COMPUTER_EVENTS = exports.COMPUTER_EVENTS = void 0;
-exports.COMPUTER_DECLARED_SERVICE_PROBLEMS = exports.COMPUTER_DECLARED_SERVICE_NAME_PATTERN = exports.COMPUTER_DECLARED_SERVICE_HOST = exports.COMPUTER_DECLARED_SERVICE_PATH_MAX_LENGTH = exports.COMPUTER_DECLARED_SERVICE_NAME_MAX_LENGTH = exports.COMPUTER_DECLARED_SERVICES_MAX = exports.COMPUTER_DECLARED_SERVICE_PROTOCOLS = exports.COMPUTER_SERVICES_TOOL_ERROR_PREFIX = exports.COMPUTER_SERVICES_TOOL_NAME = exports.COMPUTER_DECLARED_SERVICE_ACTIONS = exports.COMPUTER_COMMAND_OUTPUT_STREAMS = exports.COMPUTER_COMMAND_START_REFUSALS = exports.COMPUTER_COMMAND_UNKNOWN_END_SIGNAL = exports.COMPUTER_COMMAND_NOT_STARTED_SIGNAL = exports.COMPUTER_COMMAND_OUTCOMES = exports.COMPUTER_LIFECYCLE_EVENTS = exports.COMPUTER_COMMAND_PHASES = exports.COMPUTER_ACTIVITY_WITHHELD_PLACEHOLDER = exports.COMPUTER_ACTIVITY_OUTPUT_MAX_LENGTH = exports.COMPUTER_ACTIVITY_SUMMARY_MAX_LENGTH = exports.COMPUTER_ACTIVITY_KINDS = exports.COMPUTER_FILE_CONTENTS_TAG_PATTERN = exports.COMPUTER_FILE_CONTENTS_TAG_MAX_ENTRIES = exports.COMPUTER_FILE_CHANGES = exports.COMPUTER_FILES_CHANGED_MAX_CHANGES = exports.COMPUTER_FILES_WATCH_DEGRADED_REASONS = exports.COMPUTER_FILE_WITHHELD_REASONS = exports.COMPUTER_FILE_TYPES = exports.COMPUTER_FILE_GIT_STATUS_BUDGET_MS = exports.COMPUTER_FILE_SEARCH_MAX_QUERY_LENGTH = exports.COMPUTER_FILE_SEARCH_MAX_BUDGET_MS = exports.COMPUTER_FILE_SEARCH_DEFAULT_BUDGET_MS = exports.COMPUTER_FILE_SEARCH_MAX_LIMIT = exports.COMPUTER_FILE_SEARCH_DEFAULT_LIMIT = exports.COMPUTER_FILE_GIT_MARKS = exports.COMPUTER_FILE_SEARCH_STATES = exports.COMPUTER_FILE_SEARCH_OPERATIONS = exports.COMPUTER_FILE_OPERATIONS = exports.COMPUTER_BROWSER_URL_MAX_LENGTH = exports.COMPUTER_BROWSER_TAB_ACTIONS = exports.COMPUTER_BROWSER_HISTORY_ACTIONS = exports.COMPUTER_BROWSER_COPY_MAX_LENGTH = exports.COMPUTER_TERMINAL_CWD_MAX_LENGTH = exports.COMPUTER_BROWSER_FILE_CHOOSER_PATH_MAX_LENGTH = exports.COMPUTER_BROWSER_FILE_CHOOSER_ACCEPT_MAX_LENGTH = exports.COMPUTER_BROWSER_FILE_CHOOSER_MAX_FILES = exports.COMPUTER_BROWSER_FILE_CHOOSER_OUTCOMES = exports.COMPUTER_BROWSER_FILE_CHOOSER_MODES = exports.COMPUTER_BROWSER_DOWNLOADS_MAX = exports.COMPUTER_BROWSER_DOWNLOAD_STATES = void 0;
-exports.COMPUTER_LEASE_STATE_POWER_PHASE = exports.COMPUTER_START_REFUSALS = exports.COMPUTER_PERSONAL_SIGN_IN_REASONS = exports.COMPUTER_PERSONAL_POWER_PHASES = exports.COMPUTER_POWER_PHASES = exports.COMPUTER_MACHINE_KINDS = void 0;
+exports.COMPUTER_BROWSER_DIALOG_KINDS = exports.COMPUTER_INPUT_TEXT_MAX_LENGTH = exports.COMPUTER_BROWSER_INPUT_PLATFORMS = exports.COMPUTER_BROWSER_VIEWPORT_LIMITS = exports.COMPUTER_BROWSER_INPUT_TYPES = exports.COMPUTER_TERMINAL_CAVEATS = exports.COMPUTER_TERMINAL_HISTORY_CAUSES = exports.COMPUTER_TERMINAL_LIFETIMES = exports.COMPUTER_TERMINAL_INPUT_TYPES = exports.COMPUTER_TERMINAL_SIGNALS = exports.COMPUTER_DIAGNOSTICS_MAX_STREAMS = exports.COMPUTER_DIAGNOSTICS_INTERVAL_MS = exports.COMPUTER_DIAGNOSTIC_COUNTERS = exports.COMPUTER_FRAME_ACK_TIMEOUT_MS = exports.COMPUTER_FRAME_MAX_BYTES = exports.COMPUTER_BROWSER_VIEWPORT = exports.COMPUTER_SURFACE_END_REASONS = exports.COMPUTER_SURFACE_STATES = exports.COMPUTER_SURFACE_KINDS = exports.COMPUTER_CONTROL_ACTIVITY_CHANGES = exports.COMPUTER_CONTROL_CHANGE_REASONS = exports.COMPUTER_SURFACE_UNPIN_REASONS = exports.COMPUTER_SURFACE_PIN_ACTIONS = exports.COMPUTER_SHARE_MODES = exports.COMPUTER_SHARE_ACTIONS = exports.COMPUTER_CONTROL_ACTIONS = exports.COMPUTER_AGENT_WRITE_WAIT_MS = exports.COMPUTER_RECONNECT_GRACE_MS = exports.COMPUTER_RECLAIM_WARNING_MS = exports.COMPUTER_CONTROL_IDLE_MS = exports.COMPUTER_HANDBACK_NOTE_MAX_LENGTH = exports.COMPUTER_GRANT_TIERS = exports.COMPUTER_OPERATIONS = exports.COMPUTER_ACCESS_LEVELS = exports.COMPUTER_ACTOR_ENGINE_MAX_LENGTH = exports.COMPUTER_PLATFORM_ROUTE_SESSION_PREFIXES = exports.COMPUTER_ACTIVITY_ACTOR_KINDS = exports.COMPUTER_ACTOR_KINDS = exports.COMPUTER_REFUSAL_CODES = exports.COMPUTER_CAPABILITY_VALUES = exports.COMPUTER_CAPABILITIES = exports.COMPUTER_MANIFEST_REORDER_WAIT_MS = exports.COMPUTER_RESYNC_TIMEOUT_MS = exports.COMPUTER_API_ANSWERED_EVENT_KEYS = exports.COMPUTER_SERVER_EVENT_KEYS = exports.DAEMON_COMPUTER_REPORT_EVENT_KEYS = exports.DAEMON_COMPUTER_EVENT_NAMES = exports.COMPUTER_EVENT_NAMES = exports.DAEMON_COMPUTER_EVENTS = exports.COMPUTER_EVENTS = void 0;
+exports.COMPUTER_DECLARED_SERVICES_MAX = exports.COMPUTER_DECLARED_SERVICE_PROTOCOLS = exports.COMPUTER_SERVICES_TOOL_ERROR_PREFIX = exports.COMPUTER_SERVICES_TOOL_NAME = exports.COMPUTER_DECLARED_SERVICE_ACTIONS = exports.COMPUTER_COMMAND_OUTPUT_STREAMS = exports.COMPUTER_COMMAND_START_REFUSALS = exports.COMPUTER_COMMAND_UNKNOWN_END_SIGNAL = exports.COMPUTER_COMMAND_NOT_STARTED_SIGNAL = exports.COMPUTER_COMMAND_OUTCOMES = exports.COMPUTER_LIFECYCLE_EVENTS = exports.COMPUTER_COMMAND_PHASES = exports.COMPUTER_ACTIVITY_WITHHELD_PLACEHOLDER = exports.COMPUTER_ACTIVITY_OUTPUT_MAX_LENGTH = exports.COMPUTER_ACTIVITY_SUMMARY_MAX_LENGTH = exports.COMPUTER_ACTIVITY_KINDS = exports.COMPUTER_FILE_CONTENTS_TAG_PATTERN = exports.COMPUTER_FILE_CONTENTS_TAG_MAX_ENTRIES = exports.COMPUTER_FILE_CHANGES = exports.COMPUTER_FILES_CHANGED_MAX_CHANGES = exports.COMPUTER_FILES_WATCH_DEGRADED_REASONS = exports.COMPUTER_FILE_WITHHELD_REASONS = exports.COMPUTER_FILE_TYPES = exports.COMPUTER_FILE_GIT_STATUS_BUDGET_MS = exports.COMPUTER_FILE_SEARCH_MAX_QUERY_LENGTH = exports.COMPUTER_FILE_SEARCH_MAX_BUDGET_MS = exports.COMPUTER_FILE_SEARCH_DEFAULT_BUDGET_MS = exports.COMPUTER_FILE_SEARCH_MAX_LIMIT = exports.COMPUTER_FILE_SEARCH_DEFAULT_LIMIT = exports.COMPUTER_FILE_GIT_MARKS = exports.COMPUTER_FILE_SEARCH_STATES = exports.COMPUTER_FILE_SEARCH_OPERATIONS = exports.COMPUTER_FILE_OPERATIONS = exports.COMPUTER_BROWSER_URL_MAX_LENGTH = exports.COMPUTER_BROWSER_TAB_ACTIONS = exports.COMPUTER_BROWSER_HISTORY_ACTIONS = exports.COMPUTER_BROWSER_COPY_MAX_LENGTH = exports.COMPUTER_TERMINAL_CWD_MAX_LENGTH = exports.COMPUTER_BROWSER_FILE_CHOOSER_PATH_MAX_LENGTH = exports.COMPUTER_BROWSER_FILE_CHOOSER_ACCEPT_MAX_LENGTH = exports.COMPUTER_BROWSER_FILE_CHOOSER_MAX_FILES = exports.COMPUTER_BROWSER_FILE_CHOOSER_OUTCOMES = exports.COMPUTER_BROWSER_FILE_CHOOSER_MODES = exports.COMPUTER_BROWSER_DOWNLOADS_MAX = exports.COMPUTER_BROWSER_DOWNLOAD_STATES = exports.COMPUTER_BROWSER_DIALOG_CREDENTIAL_MAX_LENGTH = exports.COMPUTER_BROWSER_DIALOG_PROMPT_MAX_LENGTH = exports.COMPUTER_BROWSER_DIALOG_MESSAGE_MAX_LENGTH = exports.COMPUTER_BROWSER_DIALOG_ANSWERERS = exports.COMPUTER_BROWSER_DIALOG_OUTCOMES = void 0;
+exports.COMPUTER_LEASE_STATE_POWER_PHASE = exports.COMPUTER_START_REFUSALS = exports.COMPUTER_PERSONAL_SIGN_IN_REASONS = exports.COMPUTER_PERSONAL_POWER_PHASES = exports.COMPUTER_POWER_PHASES = exports.COMPUTER_MACHINE_KINDS = exports.COMPUTER_DECLARED_SERVICE_PROBLEMS = exports.COMPUTER_DECLARED_SERVICE_NAME_PATTERN = exports.COMPUTER_DECLARED_SERVICE_HOST = exports.COMPUTER_DECLARED_SERVICE_PATH_MAX_LENGTH = exports.COMPUTER_DECLARED_SERVICE_NAME_MAX_LENGTH = void 0;
 exports.normalizeComputerRefusalCode = normalizeComputerRefusalCode;
+exports.isComputerPlatformRouteSession = isComputerPlatformRouteSession;
 exports.computerTierOperations = computerTierOperations;
 exports.computerOperationAllowed = computerOperationAllowed;
 exports.computerAccessOperations = computerAccessOperations;
 exports.computerControlChangeIsHolderChange = computerControlChangeIsHolderChange;
 exports.computerLeaseInputRefusal = computerLeaseInputRefusal;
 exports.computerLeaseAcceptsInput = computerLeaseAcceptsInput;
+exports.clampComputerBrowserViewport = clampComputerBrowserViewport;
 exports.computerFileEntityTagsEqual = computerFileEntityTagsEqual;
 exports.computerDeclaredServiceOperation = computerDeclaredServiceOperation;
 exports.computerDeclaredServiceSpec = computerDeclaredServiceSpec;
@@ -55,6 +57,22 @@ exports.COMPUTER_EVENTS = {
     attach: 'computer:attach',
     /** client → API: leave. */
     detach: 'computer:detach',
+    /**
+     * client → API: read the whole manifest again ON THE SAME ATTACHMENT, after
+     * a missed delta or a `stale_epoch` (OSK-13815). The ack carries what an
+     * attach's does — the attachment id (unchanged), the manifest and the
+     * operations — or a typed refusal; `not_found` means the attachment is gone
+     * and only then does the client attach afresh. Re-reading state must never
+     * change who the reader is: a control lease is bound to the attachment
+     * (`holderAttachmentId`), and a resync that detached and attached again
+     * orphaned the hold the person had just taken. Answered by the API, which
+     * renews the binding with the daemon exactly as its periodic re-check does
+     * (a repeated `daemon:computer:attach` with the same id), so it has no
+     * daemon mirror and needs no daemon capability. An API that predates it
+     * never answers; the client bounds the wait and falls back to attaching
+     * afresh.
+     */
+    resync: 'computer:resync',
     /** API → client: this attachment was detached, with the reason (revoked, stale generation, …). */
     detached: 'computer:detached',
     /** API → client: a whole manifest, or a revisioned delta. */
@@ -196,6 +214,24 @@ exports.COMPUTER_SERVER_EVENT_KEYS = [
     'activity',
     'filesChanged',
 ];
+/**
+ * Client → API requests the API answers itself, with no `daemon:computer:*`
+ * mirror: every other client request is relayed to the daemon under the same
+ * key. `resync` renews the binding through the daemon's existing attach
+ * (OSK-13815).
+ */
+exports.COMPUTER_API_ANSWERED_EVENT_KEYS = [
+    'resync',
+];
+/** How long the client waits for a `computer:resync` answer before attaching afresh (an API that predates it never answers). */
+exports.COMPUTER_RESYNC_TIMEOUT_MS = 12_000;
+/**
+ * How long a client holds a manifest delta that arrived AHEAD of its
+ * predecessor before reading the hole as a loss (OSK-13815). Deltas fan out
+ * through a relay of several replicas; a reorder is milliseconds, a loss is
+ * forever, and only a loss needs the whole manifest again.
+ */
+exports.COMPUTER_MANIFEST_REORDER_WAIT_MS = 300;
 // ---------------------------------------------------------------------------
 // Capabilities (§7.1)
 // ---------------------------------------------------------------------------
@@ -300,6 +336,42 @@ exports.COMPUTER_CAPABILITIES = {
      * browser; nothing is proxied to it. Announced by the relay that serves it.
      */
     declaredServices: 'computer_declared_services_v1',
+    /**
+     * The page follows the controlling window (§6.2 "a stable viewport", §7.1,
+     * OSK-13808): a browser `viewport` input, sent only by the attachment that
+     * holds the browser's lease at the current epoch, sizes the streamed page
+     * to that window's content box (`COMPUTER_BROWSER_VIEWPORT_LIMITS`). Only
+     * while a person holds control: handing back — or the hold lapsing, being
+     * revoked or moving to the agent any other way — restores the browser's own
+     * viewport before the agent can act, so an agent never inherits a person's
+     * size. Watchers keep seeing the page at whatever size it is, scaled to
+     * fit. Announced only where the browser driver can override and restore
+     * the page's metrics; without it the window scales the fixed page, as
+     * before, and never sends the input.
+     */
+    browserViewport: 'computer_browser_viewport_v1',
+    /**
+     * A browser surface whose browser is still starting says so (OSK-13824): its
+     * descriptor carries `starting: { since }` from the moment its Chromium
+     * begins to launch until that launch ends (running, or failed), and the
+     * window shows "Starting the browser…" instead of subscribing into a
+     * refusal. A cold start on a fresh guest takes 25–30 s. A daemon announcing
+     * this states the ABSENCE of `starting` too: a browser surface without it
+     * is not starting. Without the announcement a client cannot tell, and falls
+     * back to reading a surface it saw open moments ago as starting.
+     */
+    browserStarting: 'computer_browser_starting_v1',
+    /**
+     * An agent actor on the machine's activity and control leases (OSK-13827)
+     * names the REAL agent: `agentId` is the agent's own id for tool-call and
+     * browser sessions too (v1 daemons put the SESSION id there for tool calls,
+     * so no reader could ever name them), and may carry `engine`, the harness
+     * the session runs on, so one agent's sessions on different engines can be
+     * told apart. A daemon announcing this states what it sends; the server
+     * withholds `engine` from every other daemon's actors, and a reader treats
+     * an actor without it as it always did.
+     */
+    activityActorV2: 'computer_activity_actor_v2',
 };
 exports.COMPUTER_CAPABILITY_VALUES = Object.values(exports.COMPUTER_CAPABILITIES);
 // ---------------------------------------------------------------------------
@@ -341,6 +413,12 @@ exports.COMPUTER_REFUSAL_CODES = [
     'machine_unavailable',
     /** The machine's daemon is not answering. */
     'daemon_unreachable',
+    /**
+     * The relay failed while answering — an exception, not a fact about the
+     * machine. Retryable; the API log carries the same `correlationId`
+     * (OSK-13823). Never `machine_unavailable`, which says the machine is down.
+     */
+    'relay_error',
     /** A bounded wait ran out (§7.2 R4). */
     'timeout',
     'invalid_request',
@@ -354,22 +432,16 @@ exports.COMPUTER_REFUSAL_CODES = [
     'service_limit',
 ];
 /**
- * Older spellings the daemon boundary accepts for one release (§5.2). After
- * that release this map is emptied, and nothing else names the old spelling.
+ * The code when it is a computer refusal, else `null`. There is one spelling
+ * per code: the browser's older spelling of `human_control` was accepted for
+ * one release and retired with the old browser events (§5.2, OSK-13509).
  */
-exports.COMPUTER_LEGACY_REFUSAL_SPELLINGS = Object.freeze({
-    live_view_active: 'human_control',
-});
-/** The canonical code for a received spelling, or `null` when it is not a computer refusal. */
 function normalizeComputerRefusalCode(code) {
     if (typeof code !== 'string') {
         return null;
     }
-    if (exports.COMPUTER_REFUSAL_CODES.includes(code)) {
-        return code;
-    }
-    return Object.prototype.hasOwnProperty.call(exports.COMPUTER_LEGACY_REFUSAL_SPELLINGS, code)
-        ? exports.COMPUTER_LEGACY_REFUSAL_SPELLINGS[code]
+    return exports.COMPUTER_REFUSAL_CODES.includes(code)
+        ? code
         : null;
 }
 // ---------------------------------------------------------------------------
@@ -384,6 +456,27 @@ exports.COMPUTER_ACTOR_KINDS = ['agent', 'human'];
  * API and a client saw a `seq` hole no fill could close.
  */
 exports.COMPUTER_ACTIVITY_ACTOR_KINDS = [...exports.COMPUTER_ACTOR_KINDS, 'system'];
+/**
+ * The session ids the PLATFORM's own routes run daemon tools under — the web
+ * Files surface (`computer-files:` on a personal machine, `dedicated-runtime:`
+ * on a Dedicated Runtime) and the owner's `skrr machines dedicated` commands.
+ * No agent and no model is behind such a session: the person who asked is
+ * known to the API (which audits it), not to the daemon. So an activity event
+ * produced under one names no agent (OSK-13790: a person's upload used to read
+ * "agent created …"). Built by `ComputerFileService.runPersonalMachineTool`
+ * and `DedicatedRuntimeMachineAccess.runDedicatedRuntimeTool`.
+ */
+exports.COMPUTER_PLATFORM_ROUTE_SESSION_PREFIXES = [
+    'dedicated-runtime:',
+    'computer-files:',
+];
+/** Whether a tool call's session is one of the platform's own routes, not an agent's. */
+function isComputerPlatformRouteSession(sessionId) {
+    return (typeof sessionId === 'string' &&
+        exports.COMPUTER_PLATFORM_ROUTE_SESSION_PREFIXES.some((prefix) => sessionId.startsWith(prefix)));
+}
+/** The longest `engine` the wire carries; a longer one is not an engine name. */
+exports.COMPUTER_ACTOR_ENGINE_MAX_LENGTH = 64;
 /**
  * How a person present on the machine reached it: as its owner, or through a
  * grant at one of the two tiers. Agents carry no access level — an agent
@@ -552,7 +645,11 @@ exports.COMPUTER_SURFACE_END_REASONS = [
     /** Someone signed the computer's browser out everywhere, which ends every browser window. */
     'browser_reset',
 ];
-/** The browser's fixed logical viewport, whoever is looking (§6.2). */
+/**
+ * The browser's logical viewport whoever is looking (§6.2): what the agent
+ * always works at. A person holding control may size the page to their window
+ * (`computer_browser_viewport_v1`); handing back restores this.
+ */
 exports.COMPUTER_BROWSER_VIEWPORT = Object.freeze({ width: 1280, height: 800 });
 /** One frame never exceeds this, so it fits the SSE transport every guest uses (§7.2 R7). */
 exports.COMPUTER_FRAME_MAX_BYTES = 1024 * 1024;
@@ -626,7 +723,10 @@ exports.COMPUTER_TERMINAL_HISTORY_CAUSES = [
  * verified (OSK-13535).
  */
 exports.COMPUTER_TERMINAL_CAVEATS = ['windows_pty_unverified'];
-/** Input a browser surface takes. `tab` needs `computer_browser_tabs_v1`. */
+/**
+ * Input a browser surface takes. `tab` needs `computer_browser_tabs_v1`;
+ * `viewport` needs `computer_browser_viewport_v1`.
+ */
 exports.COMPUTER_BROWSER_INPUT_TYPES = [
     'pointer',
     'key',
@@ -634,7 +734,57 @@ exports.COMPUTER_BROWSER_INPUT_TYPES = [
     'navigate',
     'history',
     'tab',
+    'viewport',
 ];
+/**
+ * What a `viewport` input may ask of the page (OSK-13808), in CSS pixels: the
+ * controlling window's content box, bounded so no window can make the page
+ * absurd for the agent that gets it back, and aspect-clamped (`minAspect` and
+ * `maxAspect` are width ÷ height) so a sliver of a window cannot either.
+ * Device pixel ratio is not part of it: the page keeps the browser's own, so a
+ * high-density screen changes no layout and no picture size.
+ */
+exports.COMPUTER_BROWSER_VIEWPORT_LIMITS = Object.freeze({
+    minWidth: 320,
+    maxWidth: 2560,
+    minHeight: 240,
+    maxHeight: 1600,
+    minAspect: 0.4,
+    maxAspect: 3.2,
+});
+/**
+ * The size a `viewport` input asks for, made legal: whole CSS pixels inside
+ * `COMPUTER_BROWSER_VIEWPORT_LIMITS`, its aspect inside the clamp. Total and
+ * idempotent: the window sends what this returns and the daemon applies what
+ * this returns, so both ends agree on the page a size produces. Null for a size
+ * with no area (a hidden or collapsed window asks for nothing).
+ */
+function clampComputerBrowserViewport(size) {
+    const { width: rawWidth, height: rawHeight } = size ?? {};
+    if (!Number.isFinite(rawWidth) || !Number.isFinite(rawHeight))
+        return null;
+    if (!(rawWidth > 0) || !(rawHeight > 0))
+        return null;
+    const limits = exports.COMPUTER_BROWSER_VIEWPORT_LIMITS;
+    const bound = (value, low, high) => Math.max(low, Math.min(high, Math.round(value)));
+    let width = bound(rawWidth, limits.minWidth, limits.maxWidth);
+    let height = bound(rawHeight, limits.minHeight, limits.maxHeight);
+    if (width / height > limits.maxAspect) {
+        // Too wide: narrow it first; a height already at its floor cannot grow the other way.
+        width = Math.max(limits.minWidth, Math.floor(height * limits.maxAspect));
+        if (width / height > limits.maxAspect) {
+            height = Math.min(limits.maxHeight, Math.ceil(width / limits.maxAspect));
+        }
+    }
+    else if (width / height < limits.minAspect) {
+        // Too tall: shorten it first, then widen if the width is at its floor.
+        height = Math.max(limits.minHeight, Math.floor(width / limits.minAspect));
+        if (width / height < limits.minAspect) {
+            width = Math.min(limits.maxWidth, Math.ceil(height * limits.minAspect));
+        }
+    }
+    return { width, height };
+}
 /**
  * The client OS a browser `key` input comes from. A person's shortcuts are
  * mapped onto the Linux page's by the daemon: on `mac`, Command is Control,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dedicatedRuntimeBusyWire.d.ts

@@ -0,0 +1,107 @@
+/**
+ * The Dedicated Runtime busy-report wire contract (power-control task K2,
+ * `dedicated-runtime-power-and-demand-wake-2026-10-07.md` §7.3 / §13.5).
+ *
+ * Declared ONCE, here. The daemon is published and cannot import the API, so
+ * the capability name, the payload shape and its bounds live in this package,
+ * which every end can import (`@skrr-ai/auth-core/dedicated-runtime-busy-wire`).
+ * `dedicatedRuntimeBusyWire.test.ts` fails on a second spelling of the
+ * capability anywhere else in the repo.
+ *
+ * WHAT THE REPORT SAYS
+ * ---------------------------------------------------------------------------
+ * "Does anything run in the tenant workload slice?" — read by the guest daemon
+ * from cgroup v2 `skrr-workload.slice`, recursively (the slice root is empty by
+ * contract; processes live in leaves), with the root-owned sshd listener left
+ * out. It is a LOCAL read summarised into counts; no per-process list ever
+ * crosses the wire.
+ *
+ * FAIL CLOSED. `busy` is `true | false | 'unknown'`. Any failure to read — a
+ * missing slice, an unreadable file, a tree too large to walk, a quiesce in
+ * progress, an sshd that is not where the image promises — is `'unknown'`, and
+ * a reader MUST treat `'unknown'` as busy. `false` is only ever the daemon
+ * having positively read an empty slice.
+ *
+ * THE POLICY KNOB (OPEN PRODUCT QUESTION — not decided here)
+ * ---------------------------------------------------------------------------
+ * An idle tmux server or a shell prompt keeps a leaf populated forever. The
+ * owner decision is that tmux/SSH shells ARE protected, but whether an IDLE
+ * shell should pin the machine is undecided. So the report carries both
+ * readings and the server chooses:
+ *
+ *   - `busy`                    the STRICT reading (`policy: 'strict'`): every
+ *                                process in the slice counts. This is the
+ *                                default and the only one a server should act
+ *                                on until the product question is answered.
+ *   - `busyIgnoringIdleShells`  the same read with the `idleShell` bucket
+ *                                removed. Classification is by process name
+ *                                (a shell or tmux with nothing else running),
+ *                                a HEURISTIC: it cannot see a shell loop, so
+ *                                it must never be the default.
+ *
+ * The `breakdown` says which bucket made it busy, for the "why" text.
+ */
+export declare const DEDICATED_RUNTIME_BUSY_REPORT_CAPABILITY = "dedicated_runtime_busy_report_v1";
+/** The heartbeat key the report rides under. Sent only by a daemon that announced the capability. */
+export declare const DEDICATED_RUNTIME_BUSY_HEARTBEAT_KEY = "dedicatedRuntimeBusy";
+export declare const DEDICATED_RUNTIME_BUSY_REPORT_VERSION = 1;
+/**
+ * `strict`: every process in the slice (less the root sshd listener) counts.
+ * The only value v1 sends; the field exists so a later relaxation is a new
+ * value rather than a silent change of meaning.
+ */
+export declare const DEDICATED_RUNTIME_BUSY_POLICIES: readonly ["strict"];
+export type DedicatedRuntimeBusyPolicy = (typeof DEDICATED_RUNTIME_BUSY_POLICIES)[number];
+/**
+ * Why the daemon could not give a definite answer, or `ok`. Anything but `ok`
+ * pairs with `busy: 'unknown'`.
+ */
+export declare const DEDICATED_RUNTIME_BUSY_SLICE_HEALTH: readonly ["ok", "not_a_guest", "slice_missing", "slice_unreadable", "ssh_not_in_slice", "tree_too_large", "quiesced", "read_error"];
+export type DedicatedRuntimeBusySliceHealth = (typeof DEDICATED_RUNTIME_BUSY_SLICE_HEALTH)[number];
+export declare const DEDICATED_RUNTIME_BUSY_LIMITS: {
+    /** Service leaf names carried for the "busy because of service X" text. */
+    readonly maxServiceNames: 8;
+    readonly maxServiceNameLength: 48;
+    /** Cgroup leaves the daemon will visit; more is `tree_too_large` -> unknown. */
+    readonly maxLeaves: 64;
+    readonly maxDepth: 4;
+    /** Processes the daemon classifies per read; the rest count as workload. */
+    readonly maxClassifiedPids: 256;
+    /** Hard ceiling on the serialized report. */
+    readonly maxSerializedBytes: 1024;
+};
+export interface DedicatedRuntimeBusyBreakdown {
+    /** Processes in non-service, non-ssh leaves (the `default` leaf, the slice root) that are not idle-shell class. */
+    workload: number;
+    /** Processes in `skrr-svc-*.scope` leaves: a declared service running, always-on by design. */
+    service: number;
+    /** SSH connection plumbing in `ssh.service` that is not the root listener (non-root sshd, the session helper) and other non-shell processes there. */
+    ssh: number;
+    /** Shell or tmux processes in `default` / `ssh.service` (heuristic by name; see header). */
+    idleShell: number;
+    /** Root-owned sshd processes left out of every count above. */
+    excludedSshd: number;
+    /** True when more processes existed than were classified; the rest are in `workload`. */
+    truncated: boolean;
+    /** Up to `maxServiceNames` service leaf names that have processes. */
+    services: string[];
+}
+export interface DedicatedRuntimeBusyReport {
+    version: typeof DEDICATED_RUNTIME_BUSY_REPORT_VERSION;
+    policy: DedicatedRuntimeBusyPolicy;
+    /** Strict reading. `'unknown'` MUST be treated as busy. */
+    busy: boolean | 'unknown';
+    /** Same read with the `idleShell` bucket removed; a heuristic, not the default. */
+    busyIgnoringIdleShells: boolean | 'unknown';
+    breakdown: DedicatedRuntimeBusyBreakdown;
+    /** ISO time the daemon read the slice. */
+    readAt: string;
+    sliceHealth: DedicatedRuntimeBusySliceHealth;
+}
+/**
+ * The reader's view of a daemon's heartbeat section. Anything malformed, from
+ * a daemon that did not announce the capability, or oversized is `null`, and
+ * the caller must then treat the machine as busy. Never trusts a field it did
+ * not validate; a value is clamped, not coerced to "idle".
+ */
+export declare function parseDedicatedRuntimeBusyReport(raw: unknown): DedicatedRuntimeBusyReport | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dedicatedRuntimeBusyWire.js

@@ -0,0 +1,151 @@
+"use strict";
+/**
+ * The Dedicated Runtime busy-report wire contract (power-control task K2,
+ * `dedicated-runtime-power-and-demand-wake-2026-10-07.md` §7.3 / §13.5).
+ *
+ * Declared ONCE, here. The daemon is published and cannot import the API, so
+ * the capability name, the payload shape and its bounds live in this package,
+ * which every end can import (`@skrr-ai/auth-core/dedicated-runtime-busy-wire`).
+ * `dedicatedRuntimeBusyWire.test.ts` fails on a second spelling of the
+ * capability anywhere else in the repo.
+ *
+ * WHAT THE REPORT SAYS
+ * ---------------------------------------------------------------------------
+ * "Does anything run in the tenant workload slice?" — read by the guest daemon
+ * from cgroup v2 `skrr-workload.slice`, recursively (the slice root is empty by
+ * contract; processes live in leaves), with the root-owned sshd listener left
+ * out. It is a LOCAL read summarised into counts; no per-process list ever
+ * crosses the wire.
+ *
+ * FAIL CLOSED. `busy` is `true | false | 'unknown'`. Any failure to read — a
+ * missing slice, an unreadable file, a tree too large to walk, a quiesce in
+ * progress, an sshd that is not where the image promises — is `'unknown'`, and
+ * a reader MUST treat `'unknown'` as busy. `false` is only ever the daemon
+ * having positively read an empty slice.
+ *
+ * THE POLICY KNOB (OPEN PRODUCT QUESTION — not decided here)
+ * ---------------------------------------------------------------------------
+ * An idle tmux server or a shell prompt keeps a leaf populated forever. The
+ * owner decision is that tmux/SSH shells ARE protected, but whether an IDLE
+ * shell should pin the machine is undecided. So the report carries both
+ * readings and the server chooses:
+ *
+ *   - `busy`                    the STRICT reading (`policy: 'strict'`): every
+ *                                process in the slice counts. This is the
+ *                                default and the only one a server should act
+ *                                on until the product question is answered.
+ *   - `busyIgnoringIdleShells`  the same read with the `idleShell` bucket
+ *                                removed. Classification is by process name
+ *                                (a shell or tmux with nothing else running),
+ *                                a HEURISTIC: it cannot see a shell loop, so
+ *                                it must never be the default.
+ *
+ * The `breakdown` says which bucket made it busy, for the "why" text.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEDICATED_RUNTIME_BUSY_LIMITS = exports.DEDICATED_RUNTIME_BUSY_SLICE_HEALTH = exports.DEDICATED_RUNTIME_BUSY_POLICIES = exports.DEDICATED_RUNTIME_BUSY_REPORT_VERSION = exports.DEDICATED_RUNTIME_BUSY_HEARTBEAT_KEY = exports.DEDICATED_RUNTIME_BUSY_REPORT_CAPABILITY = void 0;
+exports.parseDedicatedRuntimeBusyReport = parseDedicatedRuntimeBusyReport;
+exports.DEDICATED_RUNTIME_BUSY_REPORT_CAPABILITY = 'dedicated_runtime_busy_report_v1';
+/** The heartbeat key the report rides under. Sent only by a daemon that announced the capability. */
+exports.DEDICATED_RUNTIME_BUSY_HEARTBEAT_KEY = 'dedicatedRuntimeBusy';
+exports.DEDICATED_RUNTIME_BUSY_REPORT_VERSION = 1;
+/**
+ * `strict`: every process in the slice (less the root sshd listener) counts.
+ * The only value v1 sends; the field exists so a later relaxation is a new
+ * value rather than a silent change of meaning.
+ */
+exports.DEDICATED_RUNTIME_BUSY_POLICIES = ['strict'];
+/**
+ * Why the daemon could not give a definite answer, or `ok`. Anything but `ok`
+ * pairs with `busy: 'unknown'`.
+ */
+exports.DEDICATED_RUNTIME_BUSY_SLICE_HEALTH = [
+    'ok',
+    'not_a_guest',
+    'slice_missing',
+    'slice_unreadable',
+    'ssh_not_in_slice',
+    'tree_too_large',
+    'quiesced',
+    'read_error',
+];
+exports.DEDICATED_RUNTIME_BUSY_LIMITS = {
+    /** Service leaf names carried for the "busy because of service X" text. */
+    maxServiceNames: 8,
+    maxServiceNameLength: 48,
+    /** Cgroup leaves the daemon will visit; more is `tree_too_large` -> unknown. */
+    maxLeaves: 64,
+    maxDepth: 4,
+    /** Processes the daemon classifies per read; the rest count as workload. */
+    maxClassifiedPids: 256,
+    /** Hard ceiling on the serialized report. */
+    maxSerializedBytes: 1024,
+};
+/**
+ * The reader's view of a daemon's heartbeat section. Anything malformed, from
+ * a daemon that did not announce the capability, or oversized is `null`, and
+ * the caller must then treat the machine as busy. Never trusts a field it did
+ * not validate; a value is clamped, not coerced to "idle".
+ */
+function parseDedicatedRuntimeBusyReport(raw) {
+    if (!raw || typeof raw !== 'object')
+        return null;
+    const r = raw;
+    if (r.version !== exports.DEDICATED_RUNTIME_BUSY_REPORT_VERSION)
+        return null;
+    if (!exports.DEDICATED_RUNTIME_BUSY_POLICIES.includes(r.policy))
+        return null;
+    const tri = (v) => v === true || v === false || v === 'unknown' ? v : undefined;
+    const busy = tri(r.busy);
+    const ignoring = tri(r.busyIgnoringIdleShells);
+    if (busy === undefined || ignoring === undefined)
+        return null;
+    if (!exports.DEDICATED_RUNTIME_BUSY_SLICE_HEALTH.includes(r.sliceHealth)) {
+        return null;
+    }
+    const readAtMs = typeof r.readAt === 'string' ? Date.parse(r.readAt) : NaN;
+    if (!Number.isFinite(readAtMs))
+        return null;
+    const b = r.breakdown;
+    if (!b || typeof b !== 'object')
+        return null;
+    const count = (v) => typeof v === 'number' && Number.isSafeInteger(v) && v >= 0 ? v : null;
+    const workload = count(b.workload);
+    const service = count(b.service);
+    const ssh = count(b.ssh);
+    const idleShell = count(b.idleShell);
+    const excludedSshd = count(b.excludedSshd);
+    if (workload === null ||
+        service === null ||
+        ssh === null ||
+        idleShell === null ||
+        excludedSshd === null ||
+        typeof b.truncated !== 'boolean' ||
+        !Array.isArray(b.services)) {
+        return null;
+    }
+    const services = b.services
+        .filter((s) => typeof s === 'string')
+        .slice(0, exports.DEDICATED_RUNTIME_BUSY_LIMITS.maxServiceNames)
+        .map((s) => s.slice(0, exports.DEDICATED_RUNTIME_BUSY_LIMITS.maxServiceNameLength));
+    const report = {
+        version: exports.DEDICATED_RUNTIME_BUSY_REPORT_VERSION,
+        policy: r.policy,
+        busy,
+        busyIgnoringIdleShells: ignoring,
+        breakdown: {
+            workload,
+            service,
+            ssh,
+            idleShell,
+            excludedSshd,
+            truncated: b.truncated,
+            services,
+        },
+        readAt: new Date(readAtMs).toISOString(),
+        sliceHealth: r.sliceHealth,
+    };
+    if (JSON.stringify(report).length > exports.DEDICATED_RUNTIME_BUSY_LIMITS.maxSerializedBytes)
+        return null;
+    return report;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dedicatedRuntimeWakeWire.d.ts

@@ -0,0 +1,115 @@
+/**
+ * The Dedicated Runtime wake-progress wire contract (power-control task W5,
+ * `dedicated-runtime-power-and-demand-wake-2026-10-07.md` §5.3, §7.2, §9).
+ *
+ * Declared ONCE, here, for the same reason `computerWire.ts` is: the browser,
+ * the React Native app and the CLI import it, and none of them may spell the
+ * event, the capability or a code a second time. `dedicatedRuntimeWakeWire.test.ts`
+ * fails on a second spelling in the API.
+ *
+ * WHAT IT IS
+ * ---------------------------------------------------------------------------
+ * A person opens a terminal, an SSH channel, a service call or the Computer on a
+ * STOPPED Dedicated Runtime. That is wake progress, not an error: the relay asks
+ * `requestWake` (source `person`) to start the machine, then tells THAT request,
+ * in stages, how far the start has got, until the machine is assignable and the
+ * original request is served, or a bound runs out and it says why and what to do.
+ *
+ * THE CLIENT ANNOUNCES IT
+ * ---------------------------------------------------------------------------
+ * A client that has not announced `dedicated_wake_progress_v1` in the open
+ * request's `capabilities` array is NEVER sent `dedicated:wake:progress` and is
+ * never made to wait: it gets an immediate typed refusal instead. (A client
+ * socket has no registration step to announce on, so the announcement rides each
+ * request — stateless, nothing held in the relay.)
+ *
+ * THE VOCABULARY
+ * ---------------------------------------------------------------------------
+ * `phase` uses the cold-start measurement's phase names
+ * (`scripts/dedicated-runtime/measure-cold-start.js` `COLD_START_PHASES`), so
+ * what the person sees and what F4 measures are the same words. A spec holds the
+ * two lists equal.
+ *
+ * NOT A SPINNER WITHOUT A BOUND
+ * ---------------------------------------------------------------------------
+ * `boundMs` is carried on every event so a surface can show elapsed-of-bound.
+ * The bound sits ABOVE a slow-but-working start (design §9): running out says
+ * "this is taking longer than expected" and the machine is left starting; it is
+ * never an accusation that the machine is dead.
+ */
+/** API -> client, on the same socket as the request it belongs to. */
+export declare const DEDICATED_WAKE_EVENTS: {
+    readonly progress: "dedicated:wake:progress";
+};
+/** Announced in the open request's `capabilities` array. */
+export declare const DEDICATED_WAKE_CAPABILITIES: {
+    readonly progress: "dedicated_wake_progress_v1";
+};
+export type DedicatedWakeCapability = (typeof DEDICATED_WAKE_CAPABILITIES)[keyof typeof DEDICATED_WAKE_CAPABILITIES];
+/** Same names, same order as `WAKE_PHASES` in api/server/services/DedicatedRuntime/wakePhases.js (pinned by a test). */
+export declare const DEDICATED_WAKE_PHASES: readonly ["start_requested", "provider_start_accepted", "instance_running", "daemon_connected", "first_heartbeat", "assignable"];
+export type DedicatedWakePhase = (typeof DEDICATED_WAKE_PHASES)[number];
+/**
+ * - `waking`    a start is in flight; `phase` says how far.
+ * - `ready`     assignable; the original request is about to be served.
+ * - `deferred`  the machine is stopping; nothing was started. Retry after `retryAfterSeconds`.
+ * - `refused`   the start was refused, with `code`, `reason`, `detail`, `fix`.
+ * - `timed_out` the bound ran out while it was still starting. Not a failure of the machine.
+ */
+export declare const DEDICATED_WAKE_STATES: readonly ["waking", "ready", "deferred", "refused", "timed_out"];
+export type DedicatedWakeState = (typeof DEDICATED_WAKE_STATES)[number];
+/** The surfaces a wake can be asked from. */
+export declare const DEDICATED_WAKE_SURFACES: readonly ["terminal", "ssh", "services", "templates", "computer", "http"];
+export type DedicatedWakeSurface = (typeof DEDICATED_WAKE_SURFACES)[number];
+/**
+ * Typed refusals. Each is a different fact with a different next step; none of
+ * them is the generic "Dedicated Runtime dispatch was refused".
+ */
+export declare const DEDICATED_WAKE_CODES: {
+    /** Stopped, and this request did not (or could not) wake it. */
+    readonly stopped: "DEDICATED_RUNTIME_STOPPED";
+    /** A stop is finishing; retry when it has. */
+    readonly stopping: "DEDICATED_RUNTIME_STOPPING";
+    /** A start is in flight (ours or someone's). */
+    readonly starting: "DEDICATED_RUNTIME_STARTING";
+    /** The bound ran out while it was still starting. */
+    readonly timeout: "DEDICATED_RUNTIME_WAKE_TIMEOUT";
+    /** The start was refused: the plan no longer includes the machine. */
+    readonly entitlement: "DEDICATED_RUNTIME_WAKE_REFUSED_ENTITLEMENT";
+    /** The start was refused: the spend cap was reached. */
+    readonly spendCap: "DEDICATED_RUNTIME_WAKE_REFUSED_SPEND_CAP";
+    /** Any other refusal; `reason` names it. */
+    readonly refused: "DEDICATED_RUNTIME_WAKE_REFUSED";
+    /** The start was requested and the machine fell back to stopped or failed. */
+    readonly failed: "DEDICATED_RUNTIME_WAKE_FAILED";
+};
+export type DedicatedWakeCode = (typeof DEDICATED_WAKE_CODES)[keyof typeof DEDICATED_WAKE_CODES];
+/**
+ * How long a surface waits for a start before saying it is taking longer than
+ * expected. Above the slow-but-working case: a cold start on a fresh guest
+ * takes 25-30 s for the browser alone, and the AMI boot is longer. It is a
+ * bound on what we show, never a verdict on the machine.
+ */
+export declare const DEDICATED_WAKE_BOUND_MS = 180000;
+/** How often the relay re-reads the lease while waiting. */
+export declare const DEDICATED_WAKE_POLL_MS = 2000;
+export interface DedicatedWakeProgress {
+    leaseId: string;
+    surface: DedicatedWakeSurface;
+    /** The id of the request this belongs to (`requestId`, `channelId`, ...). */
+    ref?: string;
+    state: DedicatedWakeState;
+    /** Present while `waking`, and on `timed_out` (where the machine had got to). */
+    phase?: DedicatedWakePhase;
+    elapsedMs: number;
+    boundMs: number;
+    /** Power reason (e.g. `wake_refused_spend_cap`) or a lifecycle reason. */
+    reason?: string;
+    /** One of `DEDICATED_WAKE_CODES` on `refused`, `deferred` and `timed_out`. */
+    code?: DedicatedWakeCode;
+    detail?: string;
+    /** What the person can do next. */
+    fix?: string | null;
+    retryAfterSeconds?: number;
+}
+export declare function clientAnnouncesWakeProgress(capabilities: unknown): boolean;