@skrr-ai/cli 0.1.92 → 0.1.94

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/computerWire.js

@@ -27,7 +27,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMPUTER_BROWSER_DIALOG_KINDS = exports.COMPUTER_INPUT_TEXT_MAX_LENGTH = exports.COMPUTER_BROWSER_INPUT_PLATFORMS = exports.COMPUTER_BROWSER_VIEWPORT_LIMITS = exports.COMPUTER_BROWSER_INPUT_TYPES = exports.COMPUTER_TERMINAL_CAVEATS = exports.COMPUTER_TERMINAL_HISTORY_CAUSES = exports.COMPUTER_TERMINAL_LIFETIMES = exports.COMPUTER_TERMINAL_INPUT_TYPES = exports.COMPUTER_TERMINAL_SIGNALS = exports.COMPUTER_DIAGNOSTICS_MAX_STREAMS = exports.COMPUTER_DIAGNOSTICS_INTERVAL_MS = exports.COMPUTER_DIAGNOSTIC_COUNTERS = exports.COMPUTER_FRAME_ACK_TIMEOUT_MS = exports.COMPUTER_FRAME_MAX_BYTES = exports.COMPUTER_BROWSER_VIEWPORT = exports.COMPUTER_SURFACE_END_REASONS = exports.COMPUTER_SURFACE_STATES = exports.COMPUTER_SURFACE_KINDS = exports.COMPUTER_CONTROL_ACTIVITY_CHANGES = exports.COMPUTER_CONTROL_CHANGE_REASONS = exports.COMPUTER_SURFACE_UNPIN_REASONS = exports.COMPUTER_SURFACE_PIN_ACTIONS = exports.COMPUTER_SHARE_MODES = exports.COMPUTER_SHARE_ACTIONS = exports.COMPUTER_CONTROL_ACTIONS = exports.COMPUTER_AGENT_WRITE_WAIT_MS = exports.COMPUTER_RECONNECT_GRACE_MS = exports.COMPUTER_RECLAIM_WARNING_MS = exports.COMPUTER_CONTROL_IDLE_MS = exports.COMPUTER_HANDBACK_NOTE_MAX_LENGTH = exports.COMPUTER_GRANT_TIERS = exports.COMPUTER_OPERATIONS = exports.COMPUTER_ACCESS_LEVELS = exports.COMPUTER_ACTOR_ENGINE_MAX_LENGTH = exports.COMPUTER_PLATFORM_ROUTE_SESSION_PREFIXES = exports.COMPUTER_ACTIVITY_ACTOR_KINDS = exports.COMPUTER_ACTOR_KINDS = exports.COMPUTER_REFUSAL_CODES = exports.COMPUTER_CAPABILITY_VALUES = exports.COMPUTER_CAPABILITIES = exports.COMPUTER_MANIFEST_REORDER_WAIT_MS = exports.COMPUTER_RESYNC_TIMEOUT_MS = exports.COMPUTER_API_ANSWERED_EVENT_KEYS = exports.COMPUTER_SERVER_EVENT_KEYS = exports.DAEMON_COMPUTER_REPORT_EVENT_KEYS = exports.DAEMON_COMPUTER_EVENT_NAMES = exports.COMPUTER_EVENT_NAMES = exports.DAEMON_COMPUTER_EVENTS = exports.COMPUTER_EVENTS = void 0;
 exports.COMPUTER_DECLARED_SERVICES_MAX = exports.COMPUTER_DECLARED_SERVICE_PROTOCOLS = exports.COMPUTER_SERVICES_TOOL_ERROR_PREFIX = exports.COMPUTER_SERVICES_TOOL_NAME = exports.COMPUTER_DECLARED_SERVICE_ACTIONS = exports.COMPUTER_COMMAND_OUTPUT_STREAMS = exports.COMPUTER_COMMAND_START_REFUSALS = exports.COMPUTER_COMMAND_UNKNOWN_END_SIGNAL = exports.COMPUTER_COMMAND_NOT_STARTED_SIGNAL = exports.COMPUTER_COMMAND_OUTCOMES = exports.COMPUTER_LIFECYCLE_EVENTS = exports.COMPUTER_COMMAND_PHASES = exports.COMPUTER_ACTIVITY_WITHHELD_PLACEHOLDER = exports.COMPUTER_ACTIVITY_OUTPUT_MAX_LENGTH = exports.COMPUTER_ACTIVITY_SUMMARY_MAX_LENGTH = exports.COMPUTER_ACTIVITY_KINDS = exports.COMPUTER_FILE_CONTENTS_TAG_PATTERN = exports.COMPUTER_FILE_CONTENTS_TAG_MAX_ENTRIES = exports.COMPUTER_FILE_CHANGES = exports.COMPUTER_FILES_CHANGED_MAX_CHANGES = exports.COMPUTER_FILES_WATCH_DEGRADED_REASONS = exports.COMPUTER_FILE_WITHHELD_REASONS = exports.COMPUTER_FILE_TYPES = exports.COMPUTER_FILE_GIT_STATUS_BUDGET_MS = exports.COMPUTER_FILE_SEARCH_MAX_QUERY_LENGTH = exports.COMPUTER_FILE_SEARCH_MAX_BUDGET_MS = exports.COMPUTER_FILE_SEARCH_DEFAULT_BUDGET_MS = exports.COMPUTER_FILE_SEARCH_MAX_LIMIT = exports.COMPUTER_FILE_SEARCH_DEFAULT_LIMIT = exports.COMPUTER_FILE_GIT_MARKS = exports.COMPUTER_FILE_SEARCH_STATES = exports.COMPUTER_FILE_SEARCH_OPERATIONS = exports.COMPUTER_FILE_OPERATIONS = exports.COMPUTER_BROWSER_URL_MAX_LENGTH = exports.COMPUTER_BROWSER_TAB_ACTIONS = exports.COMPUTER_BROWSER_HISTORY_ACTIONS = exports.COMPUTER_BROWSER_COPY_MAX_LENGTH = exports.COMPUTER_TERMINAL_CWD_MAX_LENGTH = exports.COMPUTER_BROWSER_FILE_CHOOSER_PATH_MAX_LENGTH = exports.COMPUTER_BROWSER_FILE_CHOOSER_ACCEPT_MAX_LENGTH = exports.COMPUTER_BROWSER_FILE_CHOOSER_MAX_FILES = exports.COMPUTER_BROWSER_FILE_CHOOSER_OUTCOMES = exports.COMPUTER_BROWSER_FILE_CHOOSER_MODES = exports.COMPUTER_BROWSER_DOWNLOADS_MAX = exports.COMPUTER_BROWSER_DOWNLOAD_STATES = exports.COMPUTER_BROWSER_DIALOG_CREDENTIAL_MAX_LENGTH = exports.COMPUTER_BROWSER_DIALOG_PROMPT_MAX_LENGTH = exports.COMPUTER_BROWSER_DIALOG_MESSAGE_MAX_LENGTH = exports.COMPUTER_BROWSER_DIALOG_ANSWERERS = exports.COMPUTER_BROWSER_DIALOG_OUTCOMES = void 0;
-exports.COMPUTER_LEASE_STATE_POWER_PHASE = exports.COMPUTER_START_REFUSALS = exports.COMPUTER_PERSONAL_SIGN_IN_REASONS = exports.COMPUTER_PERSONAL_POWER_PHASES = exports.COMPUTER_POWER_PHASES = exports.COMPUTER_MACHINE_KINDS = exports.COMPUTER_DECLARED_SERVICE_PROBLEMS = exports.COMPUTER_DECLARED_SERVICE_NAME_PATTERN = exports.COMPUTER_DECLARED_SERVICE_HOST = exports.COMPUTER_DECLARED_SERVICE_PATH_MAX_LENGTH = exports.COMPUTER_DECLARED_SERVICE_NAME_MAX_LENGTH = void 0;
+exports.COMPUTER_DAEMON_LOG_LIMITS = exports.COMPUTER_DAEMON_LOG_LEVELS = exports.COMPUTER_LEASE_STATE_POWER_PHASE = exports.COMPUTER_START_REFUSALS = exports.COMPUTER_PERSONAL_SIGN_IN_REASONS = exports.COMPUTER_PERSONAL_POWER_PHASES = exports.COMPUTER_POWER_PHASES = exports.COMPUTER_MACHINE_KINDS = exports.COMPUTER_DECLARED_SERVICE_PROBLEMS = exports.COMPUTER_DECLARED_SERVICE_NAME_PATTERN = exports.COMPUTER_DECLARED_SERVICE_HOST = exports.COMPUTER_DECLARED_SERVICE_PATH_MAX_LENGTH = exports.COMPUTER_DECLARED_SERVICE_NAME_MAX_LENGTH = void 0;
 exports.normalizeComputerRefusalCode = normalizeComputerRefusalCode;
 exports.isComputerPlatformRouteSession = isComputerPlatformRouteSession;
 exports.computerTierOperations = computerTierOperations;
@@ -176,6 +176,14 @@ exports.DAEMON_COMPUTER_EVENTS = {
      * `computer_declared_services_v1`.
      */
     services: 'daemon:computer:services',
+    /**
+     * Read the tail of the daemon's OWN process log (a bounded, redacted copy of
+     * what its logger wrote since it started), for the owner who asks why their
+     * machine reconnected. Carries a `requestId` and the principal the API
+     * authorized (`observe`); the daemon checks the principal against the grant
+     * set it holds. Needs `computer_daemon_log_v1`.
+     */
+    daemonLog: 'daemon:computer:log',
     // daemon → API
     /** The answer to any request that carried a `requestId`. */
     ack: 'daemon:computer:ack',
@@ -336,6 +344,15 @@ exports.COMPUTER_CAPABILITIES = {
      * browser; nothing is proxied to it. Announced by the relay that serves it.
      */
     declaredServices: 'computer_declared_services_v1',
+    /**
+     * The daemon serves the tail of its own process log
+     * (`daemon:computer:log`): an in-memory ring of lines its logger
+     * wrote, redacted before they enter the ring, read at the `watch` tier. It
+     * is NOT syslog or the journal and never reads either. Announced by the relay
+     * that serves it; a personal machine's daemon announces it too and refuses
+     * the read `consent_missing` until `skrr computer allow`.
+     */
+    daemonLog: 'computer_daemon_log_v1',
     /**
      * The page follows the controlling window (§6.2 "a stable viewport", §7.1,
      * OSK-13808): a browser `viewport` input, sent only by the attachment that
@@ -1218,3 +1235,32 @@ function computerShowsDesktop(phase) {
 function computerOffersPowerActions(machineKind) {
     return machineKind === 'dedicated';
 }
+// ---------------------------------------------------------------------------
+// The daemon's own log (`computer_daemon_log_v1`)
+// ---------------------------------------------------------------------------
+/**
+ * Why the daemon's log is a wire feature at all: the tenant uid on a Dedicated
+ * Runtime guest cannot read syslog or the journal, so an owner could not see
+ * why their machine's daemon reconnected or failed. The daemon keeps the last
+ * lines its OWN logger wrote in memory and serves them; it opens no file and no
+ * system log for this.
+ */
+exports.COMPUTER_DAEMON_LOG_LEVELS = ['trace', 'debug', 'info', 'warn', 'error'];
+/** Every bound is the daemon's to enforce and the API's to validate against. */
+exports.COMPUTER_DAEMON_LOG_LIMITS = {
+    /** Lines the daemon keeps in memory; older ones fall off the front. */
+    ringLines: 2000,
+    /** A line longer than this is cut and marked, never kept whole. */
+    lineChars: 1000,
+    /** Lines returned when the caller names none. */
+    defaultLines: 100,
+    /** The most lines one answer carries. */
+    maxLines: 500,
+    /** The most bytes (UTF-8) one answer's text carries; far under the 1 MiB SSE frame. */
+    maxBytes: 192 * 1024,
+    /** The longest look-back a `sinceMs` may ask for (24 h; the ring is shorter anyway). */
+    maxSinceMs: 24 * 60 * 60 * 1000,
+    /** Requests the daemon answers per `rateWindowMs`; one more is `rate_limited`. */
+    rateMax: 30,
+    rateWindowMs: 60 * 1000,
+};

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/sessionPermissionAuthority.d.ts

@@ -1,33 +1,5 @@
-/**
- * Session permission authority — the ONE rule that decides whether a session's
- * execution contract governs the run's permissions, shared by the server and
- * the daemon (OSK-11975 introduced it; it was implemented twice — the server
- * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
- * which is exactly how a new contract kind or a new source value would drift
- * them apart).
- *
- * The wire model:
- *
- *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
- *     permissions govern" can never ride INSIDE it. It is a top-level session
- *     field: `permissionSource`.
- *   - `'agent'` means the Agent's own configured permission mode, tool policy,
- *     Grants, session env, MCP servers and machine consent govern the run,
- *     exactly as for an unattended Task of the same Agent. Today only a
- *     `commitment` contract may carry it.
- *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
- *     still governs permissions — the marker is the version signal, so its
- *     absence must keep the legacy fence, not silently lift it.
- *   - `task_delivery` contracts always govern, marker or not.
- *
- * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
- * (`permissionSourceForContract`), so on its own side the predicate reduces to
- * "a commitment never governs" — `contractGovernsPermissions(c,
- * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
- * daemon reads the marker it received, because it cannot distinguish "new
- * server, agent permissions" from "old server, contract fence" any other way.
- * Both call the same function; only the input differs.
- */
+/** Commitment context never overrides Agent permissions. Version 3 admission
+ * rejects old contracts; typed Task delivery is a separate frozen operation. */
 /** The wire vocabulary for `permissionSource`. Top-level session field. */
 export declare const SESSION_PERMISSION_SOURCES: readonly ["agent"];
 export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number];
@@ -37,7 +9,7 @@ export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number
  * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
  * the marker never reaches a daemon that would ignore it.
  */
-export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v2_agent_permissions";
+export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v3";
 /**
  * The minimal contract shape this rule reads. The predicate only ever needs
  * `kind` — keeping the input structural means this module never imports the
@@ -50,8 +22,7 @@ export type PermissionContractKind = {
 } | null | undefined;
 /**
  * Untrusted wire input: anything but an exact vocabulary literal reads as
- * absent. Never widen by coercion — an unrecognized future value must degrade
- * to "contract governs", the conservative answer.
+ * absent. An unknown marker carries no authority. Contract admission is validated separately.
  */
 export declare function normalizeSessionPermissionSource(value: unknown): SessionPermissionSource | undefined;
 /**
@@ -60,18 +31,10 @@ export declare function normalizeSessionPermissionSource(value: unknown): Sessio
  * kind keeps its own authority and stamps nothing.
  */
 export declare function permissionSourceForContract(contract: PermissionContractKind): SessionPermissionSource | undefined;
-/**
- * Whether the contract is the run's PERMISSION authority — the single place
- * this rule lives.
- *
- * True for a non-commitment contract regardless of marker, and for a
- * commitment whose server did not declare agent permissions. False for no
- * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
- * which then follows the Agent's own permissions exactly as a Task does while
- * the contract keeps its non-permission roles (normalized shape, ephemeral
- * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+/** Only typed Task delivery owns an effect-specific permission boundary.
+ * A Commitment is context for the Agent and cannot grant or restrict tools.
  */
-export declare function contractGovernsPermissions(contract: PermissionContractKind, permissionSource: unknown): boolean;
+export declare function contractGovernsPermissions(contract: PermissionContractKind, _permissionSource?: unknown): boolean;
 /**
  * The contract when it governs permissions, else `undefined` — for the sites
  * that used `executionContract` as "is this run permission-fenced".

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/sessionPermissionAuthority.js

@@ -1,34 +1,6 @@
 "use strict";
-/**
- * Session permission authority — the ONE rule that decides whether a session's
- * execution contract governs the run's permissions, shared by the server and
- * the daemon (OSK-11975 introduced it; it was implemented twice — the server
- * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
- * which is exactly how a new contract kind or a new source value would drift
- * them apart).
- *
- * The wire model:
- *
- *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
- *     permissions govern" can never ride INSIDE it. It is a top-level session
- *     field: `permissionSource`.
- *   - `'agent'` means the Agent's own configured permission mode, tool policy,
- *     Grants, session env, MCP servers and machine consent govern the run,
- *     exactly as for an unattended Task of the same Agent. Today only a
- *     `commitment` contract may carry it.
- *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
- *     still governs permissions — the marker is the version signal, so its
- *     absence must keep the legacy fence, not silently lift it.
- *   - `task_delivery` contracts always govern, marker or not.
- *
- * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
- * (`permissionSourceForContract`), so on its own side the predicate reduces to
- * "a commitment never governs" — `contractGovernsPermissions(c,
- * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
- * daemon reads the marker it received, because it cannot distinguish "new
- * server, agent permissions" from "old server, contract fence" any other way.
- * Both call the same function; only the input differs.
- */
+/** Commitment context never overrides Agent permissions. Version 3 admission
+ * rejects old contracts; typed Task delivery is a separate frozen operation. */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = exports.SESSION_PERMISSION_SOURCES = void 0;
 exports.normalizeSessionPermissionSource = normalizeSessionPermissionSource;
@@ -43,11 +15,10 @@ exports.SESSION_PERMISSION_SOURCES = ['agent'];
  * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
  * the marker never reaches a daemon that would ignore it.
  */
-exports.COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = 'commitment_execution_contract_v2_agent_permissions';
+exports.COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = 'commitment_execution_contract_v3';
 /**
  * Untrusted wire input: anything but an exact vocabulary literal reads as
- * absent. Never widen by coercion — an unrecognized future value must degrade
- * to "contract governs", the conservative answer.
+ * absent. An unknown marker carries no authority. Contract admission is validated separately.
  */
 function normalizeSessionPermissionSource(value) {
     return exports.SESSION_PERMISSION_SOURCES.includes(value)
@@ -62,21 +33,11 @@ function normalizeSessionPermissionSource(value) {
 function permissionSourceForContract(contract) {
     return contract?.kind === 'commitment' ? 'agent' : undefined;
 }
-/**
- * Whether the contract is the run's PERMISSION authority — the single place
- * this rule lives.
- *
- * True for a non-commitment contract regardless of marker, and for a
- * commitment whose server did not declare agent permissions. False for no
- * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
- * which then follows the Agent's own permissions exactly as a Task does while
- * the contract keeps its non-permission roles (normalized shape, ephemeral
- * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+/** Only typed Task delivery owns an effect-specific permission boundary.
+ * A Commitment is context for the Agent and cannot grant or restrict tools.
  */
-function contractGovernsPermissions(contract, permissionSource) {
-    if (!contract)
-        return false;
-    return !(contract.kind === 'commitment' && normalizeSessionPermissionSource(permissionSource) === 'agent');
+function contractGovernsPermissions(contract, _permissionSource) {
+    return Boolean(contract && contract.kind !== 'commitment');
 }
 /**
  * The contract when it governs permissions, else `undefined` — for the sites

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/commitmentExecutionContract.d.ts

@@ -0,0 +1,45 @@
+/** Mode-free responsibility context. Tool permissions belong to the Agent runtime. */
+export declare const COMMITMENT_EXECUTION_CONTRACT_VERSION: 3;
+export declare const COMMITMENT_EXECUTION_CONTRACT_CAPABILITY = "commitment_execution_contract_v3";
+export interface CommitmentExecutionContract {
+    version: 3;
+    kind: 'commitment' | 'task_delivery';
+    responsibilityRef: {
+        kind: 'commitment' | 'task';
+        id: string;
+        version: number;
+    };
+    responsibility: string;
+    event: Record<string, unknown> | null;
+    workspace: {
+        kind: 'ephemeral';
+        base: string;
+        fetchBase?: true;
+    };
+    delivery: {
+        version: 1;
+        mode: 'report_only' | 'local_patch' | 'draft_pr' | 'push_branch' | 'direct_branch';
+        [key: string]: unknown;
+    };
+    capabilitySources: unknown[];
+    evidence?: {
+        version: 1;
+        ci: unknown[];
+    };
+    workspacePolicy: Record<string, unknown>;
+    deliverySource?: {
+        parentTaskId: string;
+        branch: string;
+        headSha: string;
+        baseCommit: string;
+        runtime: {
+            kind: 'local_daemon' | 'hosted_machine';
+            id: string;
+        };
+    };
+    mustNot: string[];
+    return: 'commitment_result_v1' | 'task_output';
+}
+export declare function eventRepository(event: Record<string, unknown> | null | undefined): string;
+/** One strict parser used at storage admission and at runtime admission. */
+export declare function normalizeCommitmentExecutionContract(value: unknown): CommitmentExecutionContract | null;