@skrr-ai/cli 0.1.92 → 0.1.94

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/computerWire.js

@@ -155,6 +155,14 @@ export const DAEMON_COMPUTER_EVENTS = {
      * `computer_declared_services_v1`.
      */
     services: 'daemon:computer:services',
+    /**
+     * Read the tail of the daemon's OWN process log (a bounded, redacted copy of
+     * what its logger wrote since it started), for the owner who asks why their
+     * machine reconnected. Carries a `requestId` and the principal the API
+     * authorized (`observe`); the daemon checks the principal against the grant
+     * set it holds. Needs `computer_daemon_log_v1`.
+     */
+    daemonLog: 'daemon:computer:log',
     // daemon → API
     /** The answer to any request that carried a `requestId`. */
     ack: 'daemon:computer:ack',
@@ -315,6 +323,15 @@ export const COMPUTER_CAPABILITIES = {
      * browser; nothing is proxied to it. Announced by the relay that serves it.
      */
     declaredServices: 'computer_declared_services_v1',
+    /**
+     * The daemon serves the tail of its own process log
+     * (`daemon:computer:log`): an in-memory ring of lines its logger
+     * wrote, redacted before they enter the ring, read at the `watch` tier. It
+     * is NOT syslog or the journal and never reads either. Announced by the relay
+     * that serves it; a personal machine's daemon announces it too and refuses
+     * the read `consent_missing` until `skrr computer allow`.
+     */
+    daemonLog: 'computer_daemon_log_v1',
     /**
      * The page follows the controlling window (§6.2 "a stable viewport", §7.1,
      * OSK-13808): a browser `viewport` input, sent only by the attachment that
@@ -1197,3 +1214,32 @@ export function computerShowsDesktop(phase) {
 export function computerOffersPowerActions(machineKind) {
     return machineKind === 'dedicated';
 }
+// ---------------------------------------------------------------------------
+// The daemon's own log (`computer_daemon_log_v1`)
+// ---------------------------------------------------------------------------
+/**
+ * Why the daemon's log is a wire feature at all: the tenant uid on a Dedicated
+ * Runtime guest cannot read syslog or the journal, so an owner could not see
+ * why their machine's daemon reconnected or failed. The daemon keeps the last
+ * lines its OWN logger wrote in memory and serves them; it opens no file and no
+ * system log for this.
+ */
+export const COMPUTER_DAEMON_LOG_LEVELS = ['trace', 'debug', 'info', 'warn', 'error'];
+/** Every bound is the daemon's to enforce and the API's to validate against. */
+export const COMPUTER_DAEMON_LOG_LIMITS = {
+    /** Lines the daemon keeps in memory; older ones fall off the front. */
+    ringLines: 2000,
+    /** A line longer than this is cut and marked, never kept whole. */
+    lineChars: 1000,
+    /** Lines returned when the caller names none. */
+    defaultLines: 100,
+    /** The most lines one answer carries. */
+    maxLines: 500,
+    /** The most bytes (UTF-8) one answer's text carries; far under the 1 MiB SSE frame. */
+    maxBytes: 192 * 1024,
+    /** The longest look-back a `sinceMs` may ask for (24 h; the ring is shorter anyway). */
+    maxSinceMs: 24 * 60 * 60 * 1000,
+    /** Requests the daemon answers per `rateWindowMs`; one more is `rate_limited`. */
+    rateMax: 30,
+    rateWindowMs: 60 * 1000,
+};

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/sessionPermissionAuthority.d.ts

@@ -1,33 +1,5 @@
-/**
- * Session permission authority — the ONE rule that decides whether a session's
- * execution contract governs the run's permissions, shared by the server and
- * the daemon (OSK-11975 introduced it; it was implemented twice — the server
- * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
- * which is exactly how a new contract kind or a new source value would drift
- * them apart).
- *
- * The wire model:
- *
- *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
- *     permissions govern" can never ride INSIDE it. It is a top-level session
- *     field: `permissionSource`.
- *   - `'agent'` means the Agent's own configured permission mode, tool policy,
- *     Grants, session env, MCP servers and machine consent govern the run,
- *     exactly as for an unattended Task of the same Agent. Today only a
- *     `commitment` contract may carry it.
- *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
- *     still governs permissions — the marker is the version signal, so its
- *     absence must keep the legacy fence, not silently lift it.
- *   - `task_delivery` contracts always govern, marker or not.
- *
- * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
- * (`permissionSourceForContract`), so on its own side the predicate reduces to
- * "a commitment never governs" — `contractGovernsPermissions(c,
- * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
- * daemon reads the marker it received, because it cannot distinguish "new
- * server, agent permissions" from "old server, contract fence" any other way.
- * Both call the same function; only the input differs.
- */
+/** Commitment context never overrides Agent permissions. Version 3 admission
+ * rejects old contracts; typed Task delivery is a separate frozen operation. */
 /** The wire vocabulary for `permissionSource`. Top-level session field. */
 export declare const SESSION_PERMISSION_SOURCES: readonly ["agent"];
 export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number];
@@ -37,7 +9,7 @@ export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number
  * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
  * the marker never reaches a daemon that would ignore it.
  */
-export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v2_agent_permissions";
+export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v3";
 /**
  * The minimal contract shape this rule reads. The predicate only ever needs
  * `kind` — keeping the input structural means this module never imports the
@@ -50,8 +22,7 @@ export type PermissionContractKind = {
 } | null | undefined;
 /**
  * Untrusted wire input: anything but an exact vocabulary literal reads as
- * absent. Never widen by coercion — an unrecognized future value must degrade
- * to "contract governs", the conservative answer.
+ * absent. An unknown marker carries no authority. Contract admission is validated separately.
  */
 export declare function normalizeSessionPermissionSource(value: unknown): SessionPermissionSource | undefined;
 /**
@@ -60,18 +31,10 @@ export declare function normalizeSessionPermissionSource(value: unknown): Sessio
  * kind keeps its own authority and stamps nothing.
  */
 export declare function permissionSourceForContract(contract: PermissionContractKind): SessionPermissionSource | undefined;
-/**
- * Whether the contract is the run's PERMISSION authority — the single place
- * this rule lives.
- *
- * True for a non-commitment contract regardless of marker, and for a
- * commitment whose server did not declare agent permissions. False for no
- * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
- * which then follows the Agent's own permissions exactly as a Task does while
- * the contract keeps its non-permission roles (normalized shape, ephemeral
- * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+/** Only typed Task delivery owns an effect-specific permission boundary.
+ * A Commitment is context for the Agent and cannot grant or restrict tools.
  */
-export declare function contractGovernsPermissions(contract: PermissionContractKind, permissionSource: unknown): boolean;
+export declare function contractGovernsPermissions(contract: PermissionContractKind, _permissionSource?: unknown): boolean;
 /**
  * The contract when it governs permissions, else `undefined` — for the sites
  * that used `executionContract` as "is this run permission-fenced".

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/sessionPermissionAuthority.js

@@ -1,33 +1,5 @@
-/**
- * Session permission authority — the ONE rule that decides whether a session's
- * execution contract governs the run's permissions, shared by the server and
- * the daemon (OSK-11975 introduced it; it was implemented twice — the server
- * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
- * which is exactly how a new contract kind or a new source value would drift
- * them apart).
- *
- * The wire model:
- *
- *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
- *     permissions govern" can never ride INSIDE it. It is a top-level session
- *     field: `permissionSource`.
- *   - `'agent'` means the Agent's own configured permission mode, tool policy,
- *     Grants, session env, MCP servers and machine consent govern the run,
- *     exactly as for an unattended Task of the same Agent. Today only a
- *     `commitment` contract may carry it.
- *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
- *     still governs permissions — the marker is the version signal, so its
- *     absence must keep the legacy fence, not silently lift it.
- *   - `task_delivery` contracts always govern, marker or not.
- *
- * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
- * (`permissionSourceForContract`), so on its own side the predicate reduces to
- * "a commitment never governs" — `contractGovernsPermissions(c,
- * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
- * daemon reads the marker it received, because it cannot distinguish "new
- * server, agent permissions" from "old server, contract fence" any other way.
- * Both call the same function; only the input differs.
- */
+/** Commitment context never overrides Agent permissions. Version 3 admission
+ * rejects old contracts; typed Task delivery is a separate frozen operation. */
 /** The wire vocabulary for `permissionSource`. Top-level session field. */
 export const SESSION_PERMISSION_SOURCES = ['agent'];
 /**
@@ -36,11 +8,10 @@ export const SESSION_PERMISSION_SOURCES = ['agent'];
  * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
  * the marker never reaches a daemon that would ignore it.
  */
-export const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = 'commitment_execution_contract_v2_agent_permissions';
+export const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = 'commitment_execution_contract_v3';
 /**
  * Untrusted wire input: anything but an exact vocabulary literal reads as
- * absent. Never widen by coercion — an unrecognized future value must degrade
- * to "contract governs", the conservative answer.
+ * absent. An unknown marker carries no authority. Contract admission is validated separately.
  */
 export function normalizeSessionPermissionSource(value) {
     return SESSION_PERMISSION_SOURCES.includes(value)
@@ -55,21 +26,11 @@ export function normalizeSessionPermissionSource(value) {
 export function permissionSourceForContract(contract) {
     return contract?.kind === 'commitment' ? 'agent' : undefined;
 }
-/**
- * Whether the contract is the run's PERMISSION authority — the single place
- * this rule lives.
- *
- * True for a non-commitment contract regardless of marker, and for a
- * commitment whose server did not declare agent permissions. False for no
- * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
- * which then follows the Agent's own permissions exactly as a Task does while
- * the contract keeps its non-permission roles (normalized shape, ephemeral
- * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+/** Only typed Task delivery owns an effect-specific permission boundary.
+ * A Commitment is context for the Agent and cannot grant or restrict tools.
  */
-export function contractGovernsPermissions(contract, permissionSource) {
-    if (!contract)
-        return false;
-    return !(contract.kind === 'commitment' && normalizeSessionPermissionSource(permissionSource) === 'agent');
+export function contractGovernsPermissions(contract, _permissionSource) {
+    return Boolean(contract && contract.kind !== 'commitment');
 }
 /**
  * The contract when it governs permissions, else `undefined` — for the sites

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.16",
+  "version": "0.4.18",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {
@@ -133,6 +133,16 @@
         "types": "./dist/cjs/dedicatedRuntimeWakeWire.d.ts",
         "default": "./dist/cjs/dedicatedRuntimeWakeWire.js"
       }
+    },
+    "./commitment-execution-contract": {
+      "import": {
+        "types": "./dist/esm/commitmentExecutionContract.d.ts",
+        "default": "./dist/esm/commitmentExecutionContract.js"
+      },
+      "require": {
+        "types": "./dist/cjs/commitmentExecutionContract.d.ts",
+        "default": "./dist/cjs/commitmentExecutionContract.js"
+      }
     }
   },
   "dependencies": {