@skrr-ai/cli 0.1.93 → 0.1.94

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/sessionPermissionAuthority.d.ts

@@ -1,33 +1,5 @@
-/**
- * Session permission authority — the ONE rule that decides whether a session's
- * execution contract governs the run's permissions, shared by the server and
- * the daemon (OSK-11975 introduced it; it was implemented twice — the server
- * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
- * which is exactly how a new contract kind or a new source value would drift
- * them apart).
- *
- * The wire model:
- *
- *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
- *     permissions govern" can never ride INSIDE it. It is a top-level session
- *     field: `permissionSource`.
- *   - `'agent'` means the Agent's own configured permission mode, tool policy,
- *     Grants, session env, MCP servers and machine consent govern the run,
- *     exactly as for an unattended Task of the same Agent. Today only a
- *     `commitment` contract may carry it.
- *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
- *     still governs permissions — the marker is the version signal, so its
- *     absence must keep the legacy fence, not silently lift it.
- *   - `task_delivery` contracts always govern, marker or not.
- *
- * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
- * (`permissionSourceForContract`), so on its own side the predicate reduces to
- * "a commitment never governs" — `contractGovernsPermissions(c,
- * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
- * daemon reads the marker it received, because it cannot distinguish "new
- * server, agent permissions" from "old server, contract fence" any other way.
- * Both call the same function; only the input differs.
- */
+/** Commitment context never overrides Agent permissions. Version 3 admission
+ * rejects old contracts; typed Task delivery is a separate frozen operation. */
 /** The wire vocabulary for `permissionSource`. Top-level session field. */
 export declare const SESSION_PERMISSION_SOURCES: readonly ["agent"];
 export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number];
@@ -37,7 +9,7 @@ export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number
  * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
  * the marker never reaches a daemon that would ignore it.
  */
-export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v2_agent_permissions";
+export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v3";
 /**
  * The minimal contract shape this rule reads. The predicate only ever needs
  * `kind` — keeping the input structural means this module never imports the
@@ -50,8 +22,7 @@ export type PermissionContractKind = {
 } | null | undefined;
 /**
  * Untrusted wire input: anything but an exact vocabulary literal reads as
- * absent. Never widen by coercion — an unrecognized future value must degrade
- * to "contract governs", the conservative answer.
+ * absent. An unknown marker carries no authority. Contract admission is validated separately.
  */
 export declare function normalizeSessionPermissionSource(value: unknown): SessionPermissionSource | undefined;
 /**
@@ -60,18 +31,10 @@ export declare function normalizeSessionPermissionSource(value: unknown): Sessio
  * kind keeps its own authority and stamps nothing.
  */
 export declare function permissionSourceForContract(contract: PermissionContractKind): SessionPermissionSource | undefined;
-/**
- * Whether the contract is the run's PERMISSION authority — the single place
- * this rule lives.
- *
- * True for a non-commitment contract regardless of marker, and for a
- * commitment whose server did not declare agent permissions. False for no
- * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
- * which then follows the Agent's own permissions exactly as a Task does while
- * the contract keeps its non-permission roles (normalized shape, ephemeral
- * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+/** Only typed Task delivery owns an effect-specific permission boundary.
+ * A Commitment is context for the Agent and cannot grant or restrict tools.
  */
-export declare function contractGovernsPermissions(contract: PermissionContractKind, permissionSource: unknown): boolean;
+export declare function contractGovernsPermissions(contract: PermissionContractKind, _permissionSource?: unknown): boolean;
 /**
  * The contract when it governs permissions, else `undefined` — for the sites
  * that used `executionContract` as "is this run permission-fenced".

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/sessionPermissionAuthority.js

@@ -1,33 +1,5 @@
-/**
- * Session permission authority — the ONE rule that decides whether a session's
- * execution contract governs the run's permissions, shared by the server and
- * the daemon (OSK-11975 introduced it; it was implemented twice — the server
- * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
- * which is exactly how a new contract kind or a new source value would drift
- * them apart).
- *
- * The wire model:
- *
- *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
- *     permissions govern" can never ride INSIDE it. It is a top-level session
- *     field: `permissionSource`.
- *   - `'agent'` means the Agent's own configured permission mode, tool policy,
- *     Grants, session env, MCP servers and machine consent govern the run,
- *     exactly as for an unattended Task of the same Agent. Today only a
- *     `commitment` contract may carry it.
- *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
- *     still governs permissions — the marker is the version signal, so its
- *     absence must keep the legacy fence, not silently lift it.
- *   - `task_delivery` contracts always govern, marker or not.
- *
- * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
- * (`permissionSourceForContract`), so on its own side the predicate reduces to
- * "a commitment never governs" — `contractGovernsPermissions(c,
- * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
- * daemon reads the marker it received, because it cannot distinguish "new
- * server, agent permissions" from "old server, contract fence" any other way.
- * Both call the same function; only the input differs.
- */
+/** Commitment context never overrides Agent permissions. Version 3 admission
+ * rejects old contracts; typed Task delivery is a separate frozen operation. */
 /** The wire vocabulary for `permissionSource`. Top-level session field. */
 export const SESSION_PERMISSION_SOURCES = ['agent'];
 /**
@@ -36,11 +8,10 @@ export const SESSION_PERMISSION_SOURCES = ['agent'];
  * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
  * the marker never reaches a daemon that would ignore it.
  */
-export const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = 'commitment_execution_contract_v2_agent_permissions';
+export const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = 'commitment_execution_contract_v3';
 /**
  * Untrusted wire input: anything but an exact vocabulary literal reads as
- * absent. Never widen by coercion — an unrecognized future value must degrade
- * to "contract governs", the conservative answer.
+ * absent. An unknown marker carries no authority. Contract admission is validated separately.
  */
 export function normalizeSessionPermissionSource(value) {
     return SESSION_PERMISSION_SOURCES.includes(value)
@@ -55,21 +26,11 @@ export function normalizeSessionPermissionSource(value) {
 export function permissionSourceForContract(contract) {
     return contract?.kind === 'commitment' ? 'agent' : undefined;
 }
-/**
- * Whether the contract is the run's PERMISSION authority — the single place
- * this rule lives.
- *
- * True for a non-commitment contract regardless of marker, and for a
- * commitment whose server did not declare agent permissions. False for no
- * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
- * which then follows the Agent's own permissions exactly as a Task does while
- * the contract keeps its non-permission roles (normalized shape, ephemeral
- * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+/** Only typed Task delivery owns an effect-specific permission boundary.
+ * A Commitment is context for the Agent and cannot grant or restrict tools.
  */
-export function contractGovernsPermissions(contract, permissionSource) {
-    if (!contract)
-        return false;
-    return !(contract.kind === 'commitment' && normalizeSessionPermissionSource(permissionSource) === 'agent');
+export function contractGovernsPermissions(contract, _permissionSource) {
+    return Boolean(contract && contract.kind !== 'commitment');
 }
 /**
  * The contract when it governs permissions, else `undefined` — for the sites

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.17",
+  "version": "0.4.18",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {
@@ -133,6 +133,16 @@
         "types": "./dist/cjs/dedicatedRuntimeWakeWire.d.ts",
         "default": "./dist/cjs/dedicatedRuntimeWakeWire.js"
       }
+    },
+    "./commitment-execution-contract": {
+      "import": {
+        "types": "./dist/esm/commitmentExecutionContract.d.ts",
+        "default": "./dist/esm/commitmentExecutionContract.js"
+      },
+      "require": {
+        "types": "./dist/cjs/commitmentExecutionContract.d.ts",
+        "default": "./dist/cjs/commitmentExecutionContract.js"
+      }
     }
   },
   "dependencies": {