@skrr-ai/cli 0.1.88 → 0.1.90

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/dedicatedRuntimeWakeWire.js

@@ -0,0 +1,117 @@
+"use strict";
+/**
+ * The Dedicated Runtime wake-progress wire contract (power-control task W5,
+ * `dedicated-runtime-power-and-demand-wake-2026-10-07.md` §5.3, §7.2, §9).
+ *
+ * Declared ONCE, here, for the same reason `computerWire.ts` is: the browser,
+ * the React Native app and the CLI import it, and none of them may spell the
+ * event, the capability or a code a second time. `dedicatedRuntimeWakeWire.test.ts`
+ * fails on a second spelling in the API.
+ *
+ * WHAT IT IS
+ * ---------------------------------------------------------------------------
+ * A person opens a terminal, an SSH channel, a service call or the Computer on a
+ * STOPPED Dedicated Runtime. That is wake progress, not an error: the relay asks
+ * `requestWake` (source `person`) to start the machine, then tells THAT request,
+ * in stages, how far the start has got, until the machine is assignable and the
+ * original request is served, or a bound runs out and it says why and what to do.
+ *
+ * THE CLIENT ANNOUNCES IT
+ * ---------------------------------------------------------------------------
+ * A client that has not announced `dedicated_wake_progress_v1` in the open
+ * request's `capabilities` array is NEVER sent `dedicated:wake:progress` and is
+ * never made to wait: it gets an immediate typed refusal instead. (A client
+ * socket has no registration step to announce on, so the announcement rides each
+ * request — stateless, nothing held in the relay.)
+ *
+ * THE VOCABULARY
+ * ---------------------------------------------------------------------------
+ * `phase` uses the cold-start measurement's phase names
+ * (`scripts/dedicated-runtime/measure-cold-start.js` `COLD_START_PHASES`), so
+ * what the person sees and what F4 measures are the same words. A spec holds the
+ * two lists equal.
+ *
+ * NOT A SPINNER WITHOUT A BOUND
+ * ---------------------------------------------------------------------------
+ * `boundMs` is carried on every event so a surface can show elapsed-of-bound.
+ * The bound sits ABOVE a slow-but-working start (design §9): running out says
+ * "this is taking longer than expected" and the machine is left starting; it is
+ * never an accusation that the machine is dead.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEDICATED_WAKE_POLL_MS = exports.DEDICATED_WAKE_BOUND_MS = exports.DEDICATED_WAKE_CODES = exports.DEDICATED_WAKE_SURFACES = exports.DEDICATED_WAKE_STATES = exports.DEDICATED_WAKE_PHASES = exports.DEDICATED_WAKE_CAPABILITIES = exports.DEDICATED_WAKE_EVENTS = void 0;
+exports.clientAnnouncesWakeProgress = clientAnnouncesWakeProgress;
+/** API -> client, on the same socket as the request it belongs to. */
+exports.DEDICATED_WAKE_EVENTS = {
+    progress: 'dedicated:wake:progress',
+};
+/** Announced in the open request's `capabilities` array. */
+exports.DEDICATED_WAKE_CAPABILITIES = {
+    progress: 'dedicated_wake_progress_v1',
+};
+/** Same names, same order as `WAKE_PHASES` in api/server/services/DedicatedRuntime/wakePhases.js (pinned by a test). */
+exports.DEDICATED_WAKE_PHASES = [
+    'start_requested',
+    'provider_start_accepted',
+    'instance_running',
+    'daemon_connected',
+    'first_heartbeat',
+    'assignable',
+];
+/**
+ * - `waking`    a start is in flight; `phase` says how far.
+ * - `ready`     assignable; the original request is about to be served.
+ * - `deferred`  the machine is stopping; nothing was started. Retry after `retryAfterSeconds`.
+ * - `refused`   the start was refused, with `code`, `reason`, `detail`, `fix`.
+ * - `timed_out` the bound ran out while it was still starting. Not a failure of the machine.
+ */
+exports.DEDICATED_WAKE_STATES = [
+    'waking',
+    'ready',
+    'deferred',
+    'refused',
+    'timed_out',
+];
+/** The surfaces a wake can be asked from. */
+exports.DEDICATED_WAKE_SURFACES = [
+    'terminal',
+    'ssh',
+    'services',
+    'templates',
+    'computer',
+    'http',
+];
+/**
+ * Typed refusals. Each is a different fact with a different next step; none of
+ * them is the generic "Dedicated Runtime dispatch was refused".
+ */
+exports.DEDICATED_WAKE_CODES = {
+    /** Stopped, and this request did not (or could not) wake it. */
+    stopped: 'DEDICATED_RUNTIME_STOPPED',
+    /** A stop is finishing; retry when it has. */
+    stopping: 'DEDICATED_RUNTIME_STOPPING',
+    /** A start is in flight (ours or someone's). */
+    starting: 'DEDICATED_RUNTIME_STARTING',
+    /** The bound ran out while it was still starting. */
+    timeout: 'DEDICATED_RUNTIME_WAKE_TIMEOUT',
+    /** The start was refused: the plan no longer includes the machine. */
+    entitlement: 'DEDICATED_RUNTIME_WAKE_REFUSED_ENTITLEMENT',
+    /** The start was refused: the spend cap was reached. */
+    spendCap: 'DEDICATED_RUNTIME_WAKE_REFUSED_SPEND_CAP',
+    /** Any other refusal; `reason` names it. */
+    refused: 'DEDICATED_RUNTIME_WAKE_REFUSED',
+    /** The start was requested and the machine fell back to stopped or failed. */
+    failed: 'DEDICATED_RUNTIME_WAKE_FAILED',
+};
+/**
+ * How long a surface waits for a start before saying it is taking longer than
+ * expected. Above the slow-but-working case: a cold start on a fresh guest
+ * takes 25-30 s for the browser alone, and the AMI boot is longer. It is a
+ * bound on what we show, never a verdict on the machine.
+ */
+exports.DEDICATED_WAKE_BOUND_MS = 180_000;
+/** How often the relay re-reads the lease while waiting. */
+exports.DEDICATED_WAKE_POLL_MS = 2_000;
+function clientAnnouncesWakeProgress(capabilities) {
+    return Array.isArray(capabilities) && capabilities.includes(exports.DEDICATED_WAKE_CAPABILITIES.progress);
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -30,7 +30,7 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
-export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
+export { getMachineUuid, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -24,9 +24,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.isStaticTokenKind = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
-exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
-exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = void 0;
+exports.qualifyMachineUuid = exports.getMachineUuidProfile = exports.setMachineUuidProfile = exports.getHardwareMachineUuid = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
+exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.MACHINE_IDENTITY_FILENAME = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -284,6 +284,11 @@ Object.defineProperty(exports, "__getDeviceIdentityStateForTest", { enumerable:
 // OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
 var machineUuid_js_1 = require("./machineUuid.js");
 Object.defineProperty(exports, "getMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuid; } });
+Object.defineProperty(exports, "getHardwareMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getHardwareMachineUuid; } });
+Object.defineProperty(exports, "setMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.setMachineUuidProfile; } });
+Object.defineProperty(exports, "getMachineUuidProfile", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuidProfile; } });
+Object.defineProperty(exports, "qualifyMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.qualifyMachineUuid; } });
+Object.defineProperty(exports, "MACHINE_IDENTITY_FILENAME", { enumerable: true, get: function () { return machineUuid_js_1.MACHINE_IDENTITY_FILENAME; } });
 Object.defineProperty(exports, "hostedRuntimeIdOverride", { enumerable: true, get: function () { return machineUuid_js_1.hostedRuntimeIdOverride; } });
 Object.defineProperty(exports, "HOSTED_RUNTIME_MACHINE_SOURCES", { enumerable: true, get: function () { return machineUuid_js_1.HOSTED_RUNTIME_MACHINE_SOURCES; } });
 Object.defineProperty(exports, "__resetMachineUuidCacheForTest", { enumerable: true, get: function () { return machineUuid_js_1.__resetMachineUuidCacheForTest; } });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.d.ts

@@ -18,19 +18,43 @@ export declare const HOSTED_RUNTIME_MACHINE_SOURCES: ReadonlySet<string>;
  */
 export declare function hostedRuntimeIdOverride(name: string, env?: NodeJS.ProcessEnv): string | null;
 /**
- * Return a stable, machine-scoped UUID. Cached for the process lifetime.
+ * The HARDWARE identity of this machine (IOPlatformUUID / machine-id /
+ * MachineGuid, or a control-plane-issued value on a hosted runtime). Cached for
+ * the process lifetime. Same machine -> same value across reboots.
  *
- * Callers should treat this as opaque: the format differs per platform
- * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid).
- * The guarantee is only: same machine -> same value across reboots, and the
- * same value from every binary that calls this function.
- *
- * On a hosted runtime the control-plane-issued `OVERSKY_MACHINE_UUID` wins.
+ * Almost nothing should call this: `getMachineUuid()` is what goes on the wire,
+ * and it equals this for the default profile.
  *
  * Falls back to a deterministic hostname+username hash if the platform
  * probe fails. This preserves server-side record continuity even on
  * locked-down machines that refuse ioreg / registry access.
  */
+export declare function getHardwareMachineUuid(): string;
+/** The profile's persisted machine-identity choice, beside its other state. */
+export declare const MACHINE_IDENTITY_FILENAME = "machine-identity.json";
+/** The server caps `machineUuid` at 64 characters; 36 + 15 fits, and so does a 41-character fallback. */
+export declare function qualifyMachineUuid(hardware: string, profile: string): string;
+/**
+ * Tell this module which profile the process runs as. Called wherever a binary
+ * resolves its profile (`setActiveProfile` in the daemon and in the CLI), so the
+ * identity cannot depend on call order. `null`, '' and the default profile all
+ * mean "the hardware identity".
+ */
+export declare function setMachineUuidProfile(profile: string | null | undefined): void;
+export declare function getMachineUuidProfile(): string | null;
+/**
+ * Return the `machineUuid` this process sends to the server.
+ *
+ * Callers should treat this as opaque: the format differs per platform
+ * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid), and a
+ * non-default profile that started new carries a `:p-<hash>` suffix. The
+ * guarantee is only: same machine + same profile -> same value across reboots,
+ * and the same value from every binary of that profile that calls this function.
+ *
+ * Equals the hardware identity for the default profile, for a hosted runtime
+ * (the control-plane-issued `OVERSKY_MACHINE_UUID` wins) and for a non-default
+ * profile that already held credentials; see the block above.
+ */
 export declare function getMachineUuid(): string;
 /** @internal test seam — forget the cached value so the next call re-probes. */
 export declare function __resetMachineUuidCacheForTest(): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.js

@@ -3,8 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.HOSTED_RUNTIME_MACHINE_SOURCES = void 0;
+exports.MACHINE_IDENTITY_FILENAME = exports.HOSTED_RUNTIME_MACHINE_SOURCES = void 0;
 exports.hostedRuntimeIdOverride = hostedRuntimeIdOverride;
+exports.getHardwareMachineUuid = getHardwareMachineUuid;
+exports.qualifyMachineUuid = qualifyMachineUuid;
+exports.setMachineUuidProfile = setMachineUuidProfile;
+exports.getMachineUuidProfile = getMachineUuidProfile;
 exports.getMachineUuid = getMachineUuid;
 exports.__resetMachineUuidCacheForTest = __resetMachineUuidCacheForTest;
 /**
@@ -34,7 +38,9 @@ exports.__resetMachineUuidCacheForTest = __resetMachineUuidCacheForTest;
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_os_1 = __importDefault(require("node:os"));
+const node_path_1 = __importDefault(require("node:path"));
 const node_child_process_1 = require("node:child_process");
+const configRoot_js_1 = require("./configRoot.js");
 /**
  * Daemon sources whose identity is ISSUED by the control plane rather than
  * derived from the host: the provisioner mints the daemon id and machine uuid
@@ -106,20 +112,18 @@ function readMachineUuidWindows() {
     }
 }
 /**
- * Return a stable, machine-scoped UUID. Cached for the process lifetime.
+ * The HARDWARE identity of this machine (IOPlatformUUID / machine-id /
+ * MachineGuid, or a control-plane-issued value on a hosted runtime). Cached for
+ * the process lifetime. Same machine -> same value across reboots.
  *
- * Callers should treat this as opaque: the format differs per platform
- * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid).
- * The guarantee is only: same machine -> same value across reboots, and the
- * same value from every binary that calls this function.
- *
- * On a hosted runtime the control-plane-issued `OVERSKY_MACHINE_UUID` wins.
+ * Almost nothing should call this: `getMachineUuid()` is what goes on the wire,
+ * and it equals this for the default profile.
  *
  * Falls back to a deterministic hostname+username hash if the platform
  * probe fails. This preserves server-side record continuity even on
  * locked-down machines that refuse ioreg / registry access.
  */
-function getMachineUuid() {
+function getHardwareMachineUuid() {
     const hostedMachineUuid = hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID');
     if (hostedMachineUuid)
         return hostedMachineUuid;
@@ -150,7 +154,143 @@ function getMachineUuid() {
     cachedMachineUuid = fallback;
     return fallback;
 }
+// ---------------------------------------------------------------------------
+// Profile-qualified machine identity (OSK-13845)
+//
+// The server keys a Daemon row on (user, machineUuid), pins ONE device key to
+// that row, and groups Harness rows into one "machine" by it. A profile is the
+// documented way to run a second, isolated daemon on the same computer, and
+// while the machineUuid was hardware only a second profile landed on the FIRST
+// profile's row: it replaced the machine page's Daemon and working directory,
+// re-registered every harness under itself, and its interactive login re-pinned
+// the row's device key (OSK-12063), so the default profile's next refresh was
+// refused DEVICE_KEY_MISMATCH and every `skrr` call failed until a re-login.
+//
+// So a profile that STARTS NEW on a machine is qualified:
+// `<hardware>:p-<12 hex of sha256(profile)>`. Two rules keep everything that
+// exists where it is:
+//
+//   - the default profile is NEVER qualified: its identity is the hardware value
+//     it has always had, so no existing machine row changes;
+//   - a non-default profile that already holds credentials (an
+//     `auth-binding.json` or a persisted daemon identity) keeps the hardware
+//     value. Its refresh tokens are bound to that row and the server refuses a
+//     refresh whose machineUuid differs from the stored one (H7), so qualifying
+//     it would sign it out. It stays a second daemon on the shared row.
+//
+// The choice is made ONCE, from that evidence, and written to the profile's
+// `machine-identity.json`; afterwards it is read, never re-derived. Deriving it
+// every time would flip a profile from qualified to shared the moment its own
+// first login wrote `auth-binding.json`.
+// ---------------------------------------------------------------------------
+/** The profile's persisted machine-identity choice, beside its other state. */
+exports.MACHINE_IDENTITY_FILENAME = 'machine-identity.json';
+/** Files that prove a profile already holds credentials bound to the shared row. */
+const PRE_EXISTING_PROFILE_EVIDENCE = ['auth-binding.json', 'daemon-identity.json'];
+const DEFAULT_PROFILE_NAME = 'default';
+/** The server caps `machineUuid` at 64 characters; 36 + 15 fits, and so does a 41-character fallback. */
+function qualifyMachineUuid(hardware, profile) {
+    const digest = node_crypto_1.default
+        .createHash('sha256')
+        .update(`profile:${profile}`)
+        .digest('hex')
+        .slice(0, 12);
+    return `${hardware}:p-${digest}`;
+}
+let activeMachineProfile = null;
+const profileChoiceCache = new Map();
+/**
+ * Tell this module which profile the process runs as. Called wherever a binary
+ * resolves its profile (`setActiveProfile` in the daemon and in the CLI), so the
+ * identity cannot depend on call order. `null`, '' and the default profile all
+ * mean "the hardware identity".
+ */
+function setMachineUuidProfile(profile) {
+    activeMachineProfile = typeof profile === 'string' && profile.trim() ? profile.trim() : null;
+}
+function getMachineUuidProfile() {
+    return activeMachineProfile;
+}
+function readPersistedChoice(file, hardware, profile) {
+    try {
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(file, 'utf-8'));
+        // A file from another machine (a restored backup, a synced home) is absent.
+        if (parsed?.version !== 1 || parsed.hardware !== hardware)
+            return null;
+        // Only the two values this module can produce are accepted: a hand-edited or
+        // foreign string must never become an identity.
+        if (parsed.machineUuid === hardware)
+            return hardware;
+        const qualified = qualifyMachineUuid(hardware, profile);
+        return parsed.machineUuid === qualified ? qualified : null;
+    }
+    catch {
+        return null;
+    }
+}
+function persistChoice(dir, file, hardware, machineUuid, reason) {
+    try {
+        node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
+        const body = { version: 1, hardware, machineUuid, reason, decidedAt: new Date().toISOString() };
+        node_fs_1.default.writeFileSync(tmp, `${JSON.stringify(body)}\n`, { mode: 0o600 });
+        node_fs_1.default.renameSync(tmp, file);
+    }
+    catch {
+        // Not persisted: the in-process cache keeps this process consistent, and the
+        // next process decides again from the same evidence.
+    }
+}
+/** The identity a NON-default profile registers under. Never throws. */
+function resolveProfileMachineUuid(profile, hardware) {
+    const cacheKey = `${hardware}\u0000${profile}`;
+    const cached = profileChoiceCache.get(cacheKey);
+    if (cached)
+        return cached;
+    const dir = node_path_1.default.join((0, configRoot_js_1.resolveConfigRoot)(), 'profiles', profile);
+    const file = node_path_1.default.join(dir, exports.MACHINE_IDENTITY_FILENAME);
+    let chosen = readPersistedChoice(file, hardware, profile);
+    if (!chosen) {
+        const preExisting = PRE_EXISTING_PROFILE_EVIDENCE.some((name) => {
+            try {
+                return node_fs_1.default.existsSync(node_path_1.default.join(dir, name));
+            }
+            catch {
+                return false;
+            }
+        });
+        chosen = preExisting ? hardware : qualifyMachineUuid(hardware, profile);
+        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile');
+    }
+    profileChoiceCache.set(cacheKey, chosen);
+    return chosen;
+}
+/**
+ * Return the `machineUuid` this process sends to the server.
+ *
+ * Callers should treat this as opaque: the format differs per platform
+ * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid), and a
+ * non-default profile that started new carries a `:p-<hash>` suffix. The
+ * guarantee is only: same machine + same profile -> same value across reboots,
+ * and the same value from every binary of that profile that calls this function.
+ *
+ * Equals the hardware identity for the default profile, for a hosted runtime
+ * (the control-plane-issued `OVERSKY_MACHINE_UUID` wins) and for a non-default
+ * profile that already held credentials; see the block above.
+ */
+function getMachineUuid() {
+    const hardware = getHardwareMachineUuid();
+    // A hosted runtime's identity is ISSUED and fenced by the control plane.
+    if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID'))
+        return hardware;
+    const profile = activeMachineProfile;
+    if (!profile || profile === DEFAULT_PROFILE_NAME)
+        return hardware;
+    return resolveProfileMachineUuid(profile, hardware);
+}
 /** @internal test seam — forget the cached value so the next call re-probes. */
 function __resetMachineUuidCacheForTest() {
     cachedMachineUuid = null;
+    activeMachineProfile = null;
+    profileChoiceCache.clear();
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/computerWire.d.ts

@@ -33,6 +33,22 @@ export declare const COMPUTER_EVENTS: {
     readonly attach: "computer:attach";
     /** client → API: leave. */
     readonly detach: "computer:detach";
+    /**
+     * client → API: read the whole manifest again ON THE SAME ATTACHMENT, after
+     * a missed delta or a `stale_epoch` (OSK-13815). The ack carries what an
+     * attach's does — the attachment id (unchanged), the manifest and the
+     * operations — or a typed refusal; `not_found` means the attachment is gone
+     * and only then does the client attach afresh. Re-reading state must never
+     * change who the reader is: a control lease is bound to the attachment
+     * (`holderAttachmentId`), and a resync that detached and attached again
+     * orphaned the hold the person had just taken. Answered by the API, which
+     * renews the binding with the daemon exactly as its periodic re-check does
+     * (a repeated `daemon:computer:attach` with the same id), so it has no
+     * daemon mirror and needs no daemon capability. An API that predates it
+     * never answers; the client bounds the wait and falls back to attaching
+     * afresh.
+     */
+    readonly resync: "computer:resync";
     /** API → client: this attachment was detached, with the reason (revoked, stale generation, …). */
     readonly detached: "computer:detached";
     /** API → client: a whole manifest, or a revisioned delta. */
@@ -162,6 +178,22 @@ export declare const DAEMON_COMPUTER_EVENT_NAMES: readonly DaemonComputerEventNa
 export declare const DAEMON_COMPUTER_REPORT_EVENT_KEYS: readonly ["ack", "manifest", "data", "activity", "detached", "filesChanged", "diagnostics"];
 /** The API → client events; every other `computer:*` event flows client → API. */
 export declare const COMPUTER_SERVER_EVENT_KEYS: readonly ["detached", "manifest", "data", "activity", "filesChanged"];
+/**
+ * Client → API requests the API answers itself, with no `daemon:computer:*`
+ * mirror: every other client request is relayed to the daemon under the same
+ * key. `resync` renews the binding through the daemon's existing attach
+ * (OSK-13815).
+ */
+export declare const COMPUTER_API_ANSWERED_EVENT_KEYS: readonly ["resync"];
+/** How long the client waits for a `computer:resync` answer before attaching afresh (an API that predates it never answers). */
+export declare const COMPUTER_RESYNC_TIMEOUT_MS = 12000;
+/**
+ * How long a client holds a manifest delta that arrived AHEAD of its
+ * predecessor before reading the hole as a loss (OSK-13815). Deltas fan out
+ * through a relay of several replicas; a reorder is milliseconds, a loss is
+ * forever, and only a loss needs the whole manifest again.
+ */
+export declare const COMPUTER_MANIFEST_REORDER_WAIT_MS = 300;
 /**
  * One capability per wire addition, each withheld positively at dispatch: the
  * API never sends a computer event to a daemon that did not announce the
@@ -263,6 +295,42 @@ export declare const COMPUTER_CAPABILITIES: {
      * browser; nothing is proxied to it. Announced by the relay that serves it.
      */
     readonly declaredServices: "computer_declared_services_v1";
+    /**
+     * The page follows the controlling window (§6.2 "a stable viewport", §7.1,
+     * OSK-13808): a browser `viewport` input, sent only by the attachment that
+     * holds the browser's lease at the current epoch, sizes the streamed page
+     * to that window's content box (`COMPUTER_BROWSER_VIEWPORT_LIMITS`). Only
+     * while a person holds control: handing back — or the hold lapsing, being
+     * revoked or moving to the agent any other way — restores the browser's own
+     * viewport before the agent can act, so an agent never inherits a person's
+     * size. Watchers keep seeing the page at whatever size it is, scaled to
+     * fit. Announced only where the browser driver can override and restore
+     * the page's metrics; without it the window scales the fixed page, as
+     * before, and never sends the input.
+     */
+    readonly browserViewport: "computer_browser_viewport_v1";
+    /**
+     * A browser surface whose browser is still starting says so (OSK-13824): its
+     * descriptor carries `starting: { since }` from the moment its Chromium
+     * begins to launch until that launch ends (running, or failed), and the
+     * window shows "Starting the browser…" instead of subscribing into a
+     * refusal. A cold start on a fresh guest takes 25–30 s. A daemon announcing
+     * this states the ABSENCE of `starting` too: a browser surface without it
+     * is not starting. Without the announcement a client cannot tell, and falls
+     * back to reading a surface it saw open moments ago as starting.
+     */
+    readonly browserStarting: "computer_browser_starting_v1";
+    /**
+     * An agent actor on the machine's activity and control leases (OSK-13827)
+     * names the REAL agent: `agentId` is the agent's own id for tool-call and
+     * browser sessions too (v1 daemons put the SESSION id there for tool calls,
+     * so no reader could ever name them), and may carry `engine`, the harness
+     * the session runs on, so one agent's sessions on different engines can be
+     * told apart. A daemon announcing this states what it sends; the server
+     * withholds `engine` from every other daemon's actors, and a reader treats
+     * an actor without it as it always did.
+     */
+    readonly activityActorV2: "computer_activity_actor_v2";
 };
 export type ComputerCapabilityKey = keyof typeof COMPUTER_CAPABILITIES;
 export type ComputerCapability = (typeof COMPUTER_CAPABILITIES)[ComputerCapabilityKey];
@@ -271,14 +339,13 @@ export declare const COMPUTER_CAPABILITY_VALUES: [ComputerCapability, ...Compute
  * Every refusal and limit the computer protocol can answer with. Callers branch
  * on the code; a message beside it is free text and may change.
  */
-export declare const COMPUTER_REFUSAL_CODES: readonly ["human_control", "stale_epoch", "stale_generation", "file_changed", "capability_missing", "unauthorized", "control_denied", "not_holder", "attachment_limit", "observer_limit", "watch_limit", "grant_limit", "browser_limit", "rate_limited", "not_found", "surface_ended", "machine_unavailable", "daemon_unreachable", "timeout", "invalid_request", "consent_missing", "path_withheld", "too_large", "service_limit"];
+export declare const COMPUTER_REFUSAL_CODES: readonly ["human_control", "stale_epoch", "stale_generation", "file_changed", "capability_missing", "unauthorized", "control_denied", "not_holder", "attachment_limit", "observer_limit", "watch_limit", "grant_limit", "browser_limit", "rate_limited", "not_found", "surface_ended", "machine_unavailable", "daemon_unreachable", "relay_error", "timeout", "invalid_request", "consent_missing", "path_withheld", "too_large", "service_limit"];
 export type ComputerRefusalCode = (typeof COMPUTER_REFUSAL_CODES)[number];
 /**
- * Older spellings the daemon boundary accepts for one release (§5.2). After
- * that release this map is emptied, and nothing else names the old spelling.
+ * The code when it is a computer refusal, else `null`. There is one spelling
+ * per code: the browser's older spelling of `human_control` was accepted for
+ * one release and retired with the old browser events (§5.2, OSK-13509).
  */
-export declare const COMPUTER_LEGACY_REFUSAL_SPELLINGS: Readonly<Record<string, ComputerRefusalCode>>;
-/** The canonical code for a received spelling, or `null` when it is not a computer refusal. */
 export declare function normalizeComputerRefusalCode(code: unknown): ComputerRefusalCode | null;
 export declare const COMPUTER_ACTOR_KINDS: readonly ["agent", "human"];
 export type ComputerActorKind = (typeof COMPUTER_ACTOR_KINDS)[number];
@@ -291,13 +358,36 @@ export type ComputerActorKind = (typeof COMPUTER_ACTOR_KINDS)[number];
  */
 export declare const COMPUTER_ACTIVITY_ACTOR_KINDS: readonly ["agent", "human", "system"];
 export type ComputerActivityActorKind = (typeof COMPUTER_ACTIVITY_ACTOR_KINDS)[number];
+/**
+ * The session ids the PLATFORM's own routes run daemon tools under — the web
+ * Files surface (`computer-files:` on a personal machine, `dedicated-runtime:`
+ * on a Dedicated Runtime) and the owner's `skrr machines dedicated` commands.
+ * No agent and no model is behind such a session: the person who asked is
+ * known to the API (which audits it), not to the daemon. So an activity event
+ * produced under one names no agent (OSK-13790: a person's upload used to read
+ * "agent created …"). Built by `ComputerFileService.runPersonalMachineTool`
+ * and `DedicatedRuntimeMachineAccess.runDedicatedRuntimeTool`.
+ */
+export declare const COMPUTER_PLATFORM_ROUTE_SESSION_PREFIXES: readonly ["dedicated-runtime:", "computer-files:"];
+/** Whether a tool call's session is one of the platform's own routes, not an agent's. */
+export declare function isComputerPlatformRouteSession(sessionId: unknown): boolean;
 /** An agent session, as the wire names it. Same session = same `agentId` AND `sessionId`. */
 export interface ComputerWireAgentActor {
     kind: 'agent';
     agentId: string;
     sessionId: string;
     label: string;
+    /**
+     * The engine the session runs on (`claude-code`, `codex`, …), as the daemon
+     * names its backend. Present only from a daemon that announced
+     * `computer_activity_actor_v2` (`COMPUTER_CAPABILITIES.activityActorV2`).
+     * A display distinction between one agent's sessions, never an identity:
+     * `sameComputerActor` still compares the agent id and the session id.
+     */
+    engine?: string;
 }
+/** The longest `engine` the wire carries; a longer one is not an engine name. */
+export declare const COMPUTER_ACTOR_ENGINE_MAX_LENGTH = 64;
 export interface ComputerWireHumanActor {
     kind: 'human';
     userId: string;
@@ -420,7 +510,11 @@ export type ComputerSurfaceState = (typeof COMPUTER_SURFACE_STATES)[number];
  */
 export declare const COMPUTER_SURFACE_END_REASONS: readonly ["machine_stopped", "closed_by_owner", "closed", "process_exited", "daemon_restarted", "browser_crashed", "expired", "browser_reset"];
 export type ComputerSurfaceEndReason = (typeof COMPUTER_SURFACE_END_REASONS)[number];
-/** The browser's fixed logical viewport, whoever is looking (§6.2). */
+/**
+ * The browser's logical viewport whoever is looking (§6.2): what the agent
+ * always works at. A person holding control may size the page to their window
+ * (`computer_browser_viewport_v1`); handing back restores this.
+ */
 export declare const COMPUTER_BROWSER_VIEWPORT: Readonly<{
     width: 1280;
     height: 800;
@@ -492,8 +586,41 @@ export interface ComputerTerminalInfo {
     };
     caveats?: ComputerTerminalCaveat[];
 }
-/** Input a browser surface takes. `tab` needs `computer_browser_tabs_v1`. */
-export declare const COMPUTER_BROWSER_INPUT_TYPES: readonly ["pointer", "key", "text", "navigate", "history", "tab"];
+/**
+ * Input a browser surface takes. `tab` needs `computer_browser_tabs_v1`;
+ * `viewport` needs `computer_browser_viewport_v1`.
+ */
+export declare const COMPUTER_BROWSER_INPUT_TYPES: readonly ["pointer", "key", "text", "navigate", "history", "tab", "viewport"];
+/**
+ * What a `viewport` input may ask of the page (OSK-13808), in CSS pixels: the
+ * controlling window's content box, bounded so no window can make the page
+ * absurd for the agent that gets it back, and aspect-clamped (`minAspect` and
+ * `maxAspect` are width ÷ height) so a sliver of a window cannot either.
+ * Device pixel ratio is not part of it: the page keeps the browser's own, so a
+ * high-density screen changes no layout and no picture size.
+ */
+export declare const COMPUTER_BROWSER_VIEWPORT_LIMITS: Readonly<{
+    minWidth: 320;
+    maxWidth: 2560;
+    minHeight: 240;
+    maxHeight: 1600;
+    minAspect: 0.4;
+    maxAspect: 3.2;
+}>;
+/**
+ * The size a `viewport` input asks for, made legal: whole CSS pixels inside
+ * `COMPUTER_BROWSER_VIEWPORT_LIMITS`, its aspect inside the clamp. Total and
+ * idempotent: the window sends what this returns and the daemon applies what
+ * this returns, so both ends agree on the page a size produces. Null for a size
+ * with no area (a hidden or collapsed window asks for nothing).
+ */
+export declare function clampComputerBrowserViewport(size: {
+    width: number;
+    height: number;
+}): {
+    width: number;
+    height: number;
+} | null;
 /**
  * The client OS a browser `key` input comes from. A person's shortcuts are
  * mapped onto the Linux page's by the daemon: on `mac`, Command is Control,