@skrr-ai/cli 0.1.92 → 0.1.94

package/dist/lib/task-batch.js

@@ -0,0 +1,227 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeApiFailure = describeApiFailure;
+exports.isBatchRouteMissing = isBatchRouteMissing;
+exports.chunkItems = chunkItems;
+exports.batchIdempotencyKey = batchIdempotencyKey;
+exports.createNodesViaBatch = createNodesViaBatch;
+exports.patchTasksViaBatch = patchTasksViaBatch;
+/**
+ * Domain lib for `POST|PATCH /api/tasks/batch` (docs/architecture/task-batch-api-2026-10-08.md).
+ *
+ * `tasks create-tree` and `tasks bulk-update` reach the batch routes through
+ * `dataService.createTasksBatch|updateTasksBatch` and nothing else. This file owns
+ * the parts a command should not restate: chunking at the server cap, a
+ * deterministic idempotency key per chunk, tempId translation, and the "this
+ * server has no batch route" signal that sends a command back to its serial path.
+ */
+const node_crypto_1 = require("node:crypto");
+const data_provider_1 = require("@skrr-ai/data-provider");
+/** Normalize a thrown API error (or a per-item batch error) into one shape. */
+function describeApiFailure(err) {
+    const e = err;
+    let code = e.code;
+    let message = e.message ?? String(err);
+    if (e.body) {
+        try {
+            const parsed = JSON.parse(e.body);
+            code = parsed.code ?? code;
+            message = parsed.message ?? parsed.error ?? message;
+        }
+        catch {
+            /* non-JSON body */
+        }
+    }
+    const status = e.status;
+    return {
+        message,
+        ...(status ? { status } : {}),
+        ...(code ? { code } : {}),
+        retryable: status === 408 || status === 425 || status === 429 || (status ?? 0) >= 500,
+    };
+}
+/**
+ * A server that predates the batch routes answers 404 (no such POST route) or
+ * 405. A processed batch is ALWAYS a 200 (or 400/413/429 with a code), so a
+ * bare 404/405 on the batch call itself means "route missing", never "task
+ * not found".
+ */
+function isBatchRouteMissing(err) {
+    const status = err?.status;
+    return status === 404 || status === 405;
+}
+function chunkItems(items, size = data_provider_1.TASK_BATCH_MAX_ITEMS ?? 100) {
+    const out = [];
+    for (let i = 0; i < items.length; i += size)
+        out.push(items.slice(i, i + size));
+    return out;
+}
+/**
+ * Same chunk, same key: a retry of an interrupted command replays the stored
+ * result instead of creating twice. The key is a fingerprint of the items, so a
+ * DIFFERENT chunk can never collide with it (the server answers 422 on a key
+ * reused with a different body).
+ */
+function batchIdempotencyKey(kind, items) {
+    const digest = (0, node_crypto_1.createHash)('sha256').update((0, data_provider_1.stableJson)(items)).digest('hex').slice(0, 40);
+    return `cli-${kind}-batch:${digest}`;
+}
+/**
+ * Create `nodes` (parents before children) in chunks. `mapping` holds key -> id
+ * for nodes that already exist and is extended in place. Stops after the first
+ * chunk that reports a failure, as the serial path stopped at its first failure.
+ */
+async function createNodesViaBatch(nodes, mapping) {
+    const rows = [];
+    const failures = [];
+    for (const [chunkIndex, chunk] of chunkItems(nodes).entries()) {
+        const inChunk = new Map(chunk.map((node, i) => [node.key, `n${i}`]));
+        const items = [];
+        const sent = [];
+        for (const [i, node] of chunk.entries()) {
+            const { parentId: _ignored, ...payload } = node.payload;
+            const item = { ...payload, tempId: `n${i}` };
+            if (node.parentKey) {
+                const sameChunk = inChunk.get(node.parentKey);
+                if (sameChunk)
+                    item.parentTempId = sameChunk;
+                else if (mapping[node.parentKey])
+                    item.parentId = mapping[node.parentKey];
+                else {
+                    failures.push({
+                        key: node.key,
+                        skipped: true,
+                        error: {
+                            message: `Parent "${node.parentKey}" was not created, so "${node.key}" was not attempted`,
+                            code: 'BATCH_PARENT_NOT_CREATED',
+                            retryable: false,
+                        },
+                    });
+                    continue;
+                }
+            }
+            else if (node.payload.parentId) {
+                item.parentId = node.payload.parentId;
+            }
+            items.push(item);
+            sent.push(node);
+        }
+        if (items.length === 0)
+            break;
+        let response;
+        try {
+            response = await data_provider_1.dataService.createTasksBatch(items, {
+                idempotencyKey: batchIdempotencyKey('create', items),
+            });
+        }
+        catch (err) {
+            if (chunkIndex === 0 && isBatchRouteMissing(err))
+                return { supported: false };
+            failures.push({ key: sent[0].key, skipped: false, error: describeApiFailure(err) });
+            for (const node of sent.slice(1)) {
+                failures.push({
+                    key: node.key,
+                    skipped: true,
+                    error: {
+                        message: `Not attempted: the batch request containing "${sent[0].key}" failed`,
+                        code: 'BATCH_NOT_ATTEMPTED',
+                        retryable: true,
+                    },
+                });
+            }
+            break;
+        }
+        let failed = false;
+        for (const [i, result] of response.results.entries()) {
+            const node = sent[i];
+            if (!node)
+                continue;
+            if (result.ok && result.id) {
+                mapping[node.key] = result.id;
+                rows.push({
+                    key: node.key,
+                    id: result.id,
+                    ...(result.identifier ? { identifier: result.identifier } : {}),
+                    status: result.status === 'exists' ? 'exists' : 'created',
+                    ...(result.externalKey ? { externalKey: result.externalKey } : {}),
+                });
+            }
+            else {
+                failed = true;
+                failures.push({
+                    key: node.key,
+                    skipped: result.status === 'skipped',
+                    error: result.error
+                        ? {
+                            message: result.error.message,
+                            status: result.error.status,
+                            code: result.error.code,
+                            retryable: result.error.retryable,
+                        }
+                        : { message: 'Task was not created', retryable: false },
+                });
+            }
+        }
+        if (failed)
+            break;
+    }
+    return { supported: true, rows, failures };
+}
+/**
+ * Apply `updates` in chunks; `results[i]` answers `updates[i]`. A chunk the
+ * server never processed is reported `skipped` for every row rather than lost.
+ */
+async function patchTasksViaBatch(updates) {
+    const results = [];
+    let aborted = null;
+    let offset = 0;
+    for (const [chunkIndex, chunk] of chunkItems(updates).entries()) {
+        if (aborted) {
+            for (const [i, update] of chunk.entries()) {
+                results.push({
+                    index: offset + i,
+                    id: update.id,
+                    ok: false,
+                    status: 'skipped',
+                    error: {
+                        status: aborted.status ?? 0,
+                        code: 'BATCH_NOT_ATTEMPTED',
+                        message: 'Not attempted: an earlier batch request failed',
+                        retryable: true,
+                    },
+                });
+            }
+            offset += chunk.length;
+            continue;
+        }
+        try {
+            const response = await data_provider_1.dataService.updateTasksBatch(chunk, {
+                idempotencyKey: batchIdempotencyKey('patch', chunk),
+            });
+            for (const [i, result] of response.results.entries()) {
+                results.push({ ...result, index: offset + i });
+            }
+        }
+        catch (err) {
+            if (chunkIndex === 0 && isBatchRouteMissing(err))
+                return { supported: false };
+            aborted = describeApiFailure(err);
+            for (const [i, update] of chunk.entries()) {
+                results.push({
+                    index: offset + i,
+                    id: update.id,
+                    ok: false,
+                    status: 'failed',
+                    error: {
+                        status: aborted.status ?? 0,
+                        code: aborted.code ?? 'BATCH_REQUEST_FAILED',
+                        message: aborted.message,
+                        retryable: aborted.retryable,
+                    },
+                });
+            }
+        }
+        offset += chunk.length;
+    }
+    return { supported: true, results };
+}

package/dist/lib/terminal-qr.d.ts

@@ -0,0 +1,55 @@
+/**
+ * A QR code a phone can scan off a terminal.
+ *
+ * The ENCODER is `qrcode-terminal`'s vendored QR model (the same zero-dependency
+ * package the daemon already ships for its login QR, pinned in the lockfile).
+ * Its own renderer is not used, because it is the part that decides whether a
+ * phone can read the result, and it gets two things wrong for that:
+ *
+ *  - a ONE-module border. The QR spec asks for a four-module quiet zone, and a
+ *    scanner looking at a terminal full of other text needs it most;
+ *  - it paints light modules as `█` in the terminal's FOREGROUND colour, so on
+ *    a light-themed terminal the code comes out inverted, which many scanners
+ *    refuse.
+ *
+ * This renderer draws half-blocks (two modules per character row, so the code
+ * is square in a ~1:2 character cell) in EXPLICIT colours — black on bright
+ * white — so it scans the same on dark and light themes, with a full quiet zone.
+ *
+ * The QR is always a convenience printed beside the URL, never instead of it:
+ * `qrRenderDecision` says no for a pipe, `NO_COLOR`, `OVERSKY_NO_QR` / `SKRR_NO_QR`
+ * or a terminal too narrow to hold it, and the caller prints the URL alone.
+ */
+/** The spec's quiet zone, in modules. */
+export declare const QR_QUIET_ZONE = 4;
+/**
+ * The module matrix for `text`, quiet zone included. Level M: a share URL is
+ * well under 100 bytes, so the extra damage tolerance costs nothing in size.
+ */
+export declare function qrMatrix(text: string, level?: 'L' | 'M' | 'Q' | 'H'): boolean[][];
+/**
+ * Render with half blocks: the upper half of each character is the top
+ * module (foreground, black), the lower half the bottom module (background,
+ * white). Returns the lines, each `matrix width` characters wide.
+ */
+export declare function renderQr(text: string): string[];
+/** The QR's width in terminal columns (one column per module). */
+export declare function qrWidth(text: string): number;
+export type QrRenderDecision = {
+    render: true;
+} | {
+    render: false;
+    reason: string;
+};
+/**
+ * Whether a QR for `text` can be drawn on `stream`. Default-deny when the
+ * stream does not say it is a TTY, so captured output never carries block
+ * glyphs or escape codes.
+ */
+export declare function qrRenderDecision(text: string, { env, stream, }?: {
+    env?: NodeJS.ProcessEnv;
+    stream?: {
+        isTTY?: boolean;
+        columns?: number;
+    };
+}): QrRenderDecision;

package/dist/lib/terminal-qr.js

@@ -0,0 +1,119 @@
+"use strict";
+/**
+ * A QR code a phone can scan off a terminal.
+ *
+ * The ENCODER is `qrcode-terminal`'s vendored QR model (the same zero-dependency
+ * package the daemon already ships for its login QR, pinned in the lockfile).
+ * Its own renderer is not used, because it is the part that decides whether a
+ * phone can read the result, and it gets two things wrong for that:
+ *
+ *  - a ONE-module border. The QR spec asks for a four-module quiet zone, and a
+ *    scanner looking at a terminal full of other text needs it most;
+ *  - it paints light modules as `█` in the terminal's FOREGROUND colour, so on
+ *    a light-themed terminal the code comes out inverted, which many scanners
+ *    refuse.
+ *
+ * This renderer draws half-blocks (two modules per character row, so the code
+ * is square in a ~1:2 character cell) in EXPLICIT colours — black on bright
+ * white — so it scans the same on dark and light themes, with a full quiet zone.
+ *
+ * The QR is always a convenience printed beside the URL, never instead of it:
+ * `qrRenderDecision` says no for a pipe, `NO_COLOR`, `OVERSKY_NO_QR` / `SKRR_NO_QR`
+ * or a terminal too narrow to hold it, and the caller prints the URL alone.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QR_QUIET_ZONE = void 0;
+exports.qrMatrix = qrMatrix;
+exports.renderQr = renderQr;
+exports.qrWidth = qrWidth;
+exports.qrRenderDecision = qrRenderDecision;
+// The vendored model has no published types; this is its whole surface here.
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const QRCodeModel = require('qrcode-terminal/vendor/QRCode');
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const QRErrorCorrectLevel = require('qrcode-terminal/vendor/QRCode/QRErrorCorrectLevel');
+/** The spec's quiet zone, in modules. */
+exports.QR_QUIET_ZONE = 4;
+/**
+ * The module matrix for `text`, quiet zone included. Level M: a share URL is
+ * well under 100 bytes, so the extra damage tolerance costs nothing in size.
+ */
+function qrMatrix(text, level = 'M') {
+    const qr = new QRCodeModel(-1, QRErrorCorrectLevel[level]);
+    qr.addData(text);
+    qr.make();
+    const count = qr.getModuleCount();
+    const size = count + exports.QR_QUIET_ZONE * 2;
+    const matrix = [];
+    for (let row = 0; row < size; row += 1) {
+        const line = [];
+        for (let col = 0; col < size; col += 1) {
+            const r = row - exports.QR_QUIET_ZONE;
+            const c = col - exports.QR_QUIET_ZONE;
+            line.push(r >= 0 && c >= 0 && r < count && c < count ? qr.isDark(r, c) : false);
+        }
+        matrix.push(line);
+    }
+    return matrix;
+}
+/** Indexed by (top dark ? 2 : 0) + (bottom dark ? 1 : 0). */
+const HALF_BLOCK = [' ', '▄', '▀', '█'];
+const DARK_ON_LIGHT = '\x1b[30;107m';
+const RESET = '\x1b[0m';
+/**
+ * Render with half blocks: the upper half of each character is the top
+ * module (foreground, black), the lower half the bottom module (background,
+ * white). Returns the lines, each `matrix width` characters wide.
+ */
+function renderQr(text) {
+    const matrix = qrMatrix(text);
+    const size = matrix.length;
+    const lines = [];
+    for (let row = 0; row < size; row += 2) {
+        let line = '';
+        for (let col = 0; col < size; col += 1) {
+            const top = matrix[row][col];
+            const bottom = row + 1 < size ? matrix[row + 1][col] : false;
+            line += HALF_BLOCK[(top ? 2 : 0) + (bottom ? 1 : 0)];
+        }
+        lines.push(`${DARK_ON_LIGHT}${line}${RESET}`);
+    }
+    return lines;
+}
+/** The QR's width in terminal columns (one column per module). */
+function qrWidth(text) {
+    return qrMatrix(text).length;
+}
+function truthy(value) {
+    if (typeof value !== 'string')
+        return false;
+    const v = value.trim().toLowerCase();
+    return v !== '' && v !== '0' && v !== 'false' && v !== 'no';
+}
+/**
+ * Whether a QR for `text` can be drawn on `stream`. Default-deny when the
+ * stream does not say it is a TTY, so captured output never carries block
+ * glyphs or escape codes.
+ */
+function qrRenderDecision(text, { env = process.env, stream = process.stdout, } = {}) {
+    // https://no-color.org: present and non-empty disables colour. The QR IS
+    // colour (it is drawn in explicit black and white), so it goes too.
+    if (typeof env.NO_COLOR === 'string' && env.NO_COLOR !== '') {
+        return { render: false, reason: 'NO_COLOR is set' };
+    }
+    if (truthy(env.SKRR_NO_QR) || truthy(env.OVERSKY_NO_QR)) {
+        return { render: false, reason: 'QR codes are turned off (SKRR_NO_QR)' };
+    }
+    if (stream.isTTY !== true) {
+        return { render: false, reason: 'output is not a terminal' };
+    }
+    const columns = typeof stream.columns === 'number' ? stream.columns : 0;
+    const width = qrWidth(text);
+    if (columns > 0 && columns < width) {
+        return {
+            render: false,
+            reason: `the terminal is ${columns} columns wide and the code needs ${width}`,
+        };
+    }
+    return { render: true };
+}

package/dist/lib/web-url.d.ts

@@ -45,6 +45,9 @@ export type WebUrlRef = {
 } | {
     kind: 'agent';
     agentId: string;
+} | {
+    kind: 'storeListing';
+    agentId: string;
 } | {
     kind: 'compass';
     agentId: string;
@@ -96,6 +99,14 @@ export type WebUrlRef = {
 export declare function webPath(ref: WebUrlRef): string | null;
 /** Absolute web URL (`<webOrigin><path>`), or `null` when the ref lacks its id. */
 export declare function webUrl(baseURL: string, ref: WebUrlRef): string | null;
+/** The origin that serves the SPA for a configured baseURL (see `toWebOrigin`). */
+export declare function webOrigin(baseURL: string): string;
+/**
+ * Every origin that serves the skrr web app: the configured deployment's, each
+ * environment's from the one domain contract, and prod's retained previous
+ * origin. A URL on any other host is not a skrr page.
+ */
+export declare function firstPartyWebOrigins(baseURL: string): string[];
 /** A persisted personalized Task View always opens as a focused modal on /tasks. */
 export declare function taskViewUrl(baseURL: string, viewId: string): string;
 type EntityRecord = Record<string, unknown>;

package/dist/lib/web-url.js

@@ -19,6 +19,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.webPath = webPath;
 exports.webUrl = webUrl;
+exports.webOrigin = webOrigin;
+exports.firstPartyWebOrigins = firstPartyWebOrigins;
 exports.taskViewUrl = taskViewUrl;
 exports.taskUrlFrom = taskUrlFrom;
 exports.spaceUrlFrom = spaceUrlFrom;
@@ -42,6 +44,7 @@ exports.withNorthstarUrl = withNorthstarUrl;
 exports.withAgentUrl = withAgentUrl;
 exports.withDataUrls = withDataUrls;
 exports.workflowUrlFrom = workflowUrlFrom;
+const data_provider_1 = require("@skrr-ai/data-provider");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 /**
  * Site-relative canonical path for an entity, or `null` when the required id is
@@ -93,6 +96,10 @@ function webPath(ref) {
             const agentId = encodeId(ref.agentId);
             return agentId ? `/agent/${agentId}` : null;
         }
+        case 'storeListing': {
+            // The path comes from data-provider's one builder, never spelled here.
+            return ref.agentId ? (0, data_provider_1.publicAgentListingPath)(ref.agentId) : null;
+        }
         case 'compass': {
             const agentId = encodeId(ref.agentId);
             const compassId = encodeId(ref.compassId);
@@ -178,6 +185,23 @@ const WEB_ORIGIN_FROM_API = {
     // deliberately kept (LEGACY_PROD_BASE_URL), so its api. host must map too.
     'https://api.oversky.ai': 'https://oversky.ai',
 };
+/** The origin that serves the SPA for a configured baseURL (see `toWebOrigin`). */
+function webOrigin(baseURL) {
+    return toWebOrigin(baseURL);
+}
+/**
+ * Every origin that serves the skrr web app: the configured deployment's, each
+ * environment's from the one domain contract, and prod's retained previous
+ * origin. A URL on any other host is not a skrr page.
+ */
+function firstPartyWebOrigins(baseURL) {
+    const origins = new Set([
+        toWebOrigin(baseURL).toLowerCase(),
+        ...Object.values(publicEndpoints_generated_1.OVERSKY_ENVIRONMENT_ENDPOINTS).map((e) => e.appUrl.toLowerCase()),
+        ...Object.values(WEB_ORIGIN_FROM_API).map((origin) => origin.toLowerCase()),
+    ]);
+    return [...origins].filter(Boolean);
+}
 function toWebOrigin(baseURL) {
     const trimmed = trimTrailingSlash(baseURL);
     return WEB_ORIGIN_FROM_API[trimmed.toLowerCase()] ?? trimmed;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/commitmentExecutionContract.d.ts

@@ -0,0 +1,45 @@
+/** Mode-free responsibility context. Tool permissions belong to the Agent runtime. */
+export declare const COMMITMENT_EXECUTION_CONTRACT_VERSION: 3;
+export declare const COMMITMENT_EXECUTION_CONTRACT_CAPABILITY = "commitment_execution_contract_v3";
+export interface CommitmentExecutionContract {
+    version: 3;
+    kind: 'commitment' | 'task_delivery';
+    responsibilityRef: {
+        kind: 'commitment' | 'task';
+        id: string;
+        version: number;
+    };
+    responsibility: string;
+    event: Record<string, unknown> | null;
+    workspace: {
+        kind: 'ephemeral';
+        base: string;
+        fetchBase?: true;
+    };
+    delivery: {
+        version: 1;
+        mode: 'report_only' | 'local_patch' | 'draft_pr' | 'push_branch' | 'direct_branch';
+        [key: string]: unknown;
+    };
+    capabilitySources: unknown[];
+    evidence?: {
+        version: 1;
+        ci: unknown[];
+    };
+    workspacePolicy: Record<string, unknown>;
+    deliverySource?: {
+        parentTaskId: string;
+        branch: string;
+        headSha: string;
+        baseCommit: string;
+        runtime: {
+            kind: 'local_daemon' | 'hosted_machine';
+            id: string;
+        };
+    };
+    mustNot: string[];
+    return: 'commitment_result_v1' | 'task_output';
+}
+export declare function eventRepository(event: Record<string, unknown> | null | undefined): string;
+/** One strict parser used at storage admission and at runtime admission. */
+export declare function normalizeCommitmentExecutionContract(value: unknown): CommitmentExecutionContract | null;