@skrr-ai/cli 0.1.93 → 0.1.95

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessPermissionControls.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Read-only capability wire for ordinary agent turns. This is NOT a session
+ * authorization request or an effective permission profile. In particular,
+ * an ACP approval callback is not a process sandbox, and access to a loopback
+ * inference broker is not a grant to make arbitrary outbound connections.
+ *
+ * Daemons advertise what their adapters implement; execution still validates
+ * the requested policy independently. Consumers never infer controls from a
+ * provider name, a missing report, or the unified permission-mode vocabulary.
+ */
+export interface HarnessPermissionControls {
+    version: 1;
+    plan: 'harness' | 'reported-actions' | 'unsupported' | 'unknown';
+    approval: 'harness' | 'reported-actions' | 'none' | 'unknown';
+    filesystem: 'harness-sandbox' | 'tool-path-guards' | 'reported-actions' | 'not-restricted-by-daemon' | 'unknown';
+    strictToolPolicy: {
+        modes: readonly ('none' | 'allowlist')[];
+        enforcement: 'harness' | 'negotiated' | 'unsupported' | 'unknown';
+    };
+    organizationToolDenylist: 'unsupported' | 'unknown';
+    networkEgress: 'not-restricted-by-daemon' | 'unknown';
+}
+export interface HarnessPermissionControlReport {
+    controls: HarnessPermissionControls | null;
+    source: 'daemon' | 'daemon_record' | 'unreported';
+}
+/**
+ * Presence/registration metadata is untrusted input. Copy only the v1 enum
+ * vocabulary: unknown future claims and malformed profiles yield no report,
+ * rather than a green badge. Additive fields are stripped for compatibility.
+ */
+export declare function parseHarnessPermissionControls(value: unknown): HarnessPermissionControls | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessPermissionControls.js

@@ -0,0 +1,62 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseHarnessPermissionControls = parseHarnessPermissionControls;
+const PLAN = ['harness', 'reported-actions', 'unsupported', 'unknown'];
+const APPROVAL = ['harness', 'reported-actions', 'none', 'unknown'];
+const FILESYSTEM = [
+    'harness-sandbox',
+    'tool-path-guards',
+    'reported-actions',
+    'not-restricted-by-daemon',
+    'unknown',
+];
+const TOOL_ENFORCEMENT = ['harness', 'negotiated', 'unsupported', 'unknown'];
+/**
+ * Presence/registration metadata is untrusted input. Copy only the v1 enum
+ * vocabulary: unknown future claims and malformed profiles yield no report,
+ * rather than a green badge. Additive fields are stripped for compatibility.
+ */
+function parseHarnessPermissionControls(value) {
+    try {
+        if (!value || typeof value !== 'object' || Array.isArray(value))
+            return null;
+        const row = value;
+        const { version, plan, approval, filesystem, organizationToolDenylist, networkEgress, strictToolPolicy, } = row;
+        const strict = strictToolPolicy;
+        if (!strict || typeof strict !== 'object' || Array.isArray(strict))
+            return null;
+        const strictModes = strict.modes;
+        const enforcement = strict.enforcement;
+        if (version !== 1 ||
+            !PLAN.includes(plan) ||
+            !APPROVAL.includes(approval) ||
+            !FILESYSTEM.includes(filesystem) ||
+            !['unsupported', 'unknown'].includes(organizationToolDenylist) ||
+            !['not-restricted-by-daemon', 'unknown'].includes(networkEgress) ||
+            !TOOL_ENFORCEMENT.includes(enforcement) ||
+            !Array.isArray(strictModes) ||
+            strictModes.length > 2 ||
+            !strictModes.every((mode) => mode === 'none' || mode === 'allowlist'))
+            return null;
+        const modes = [...new Set(strictModes)];
+        if (((enforcement === 'unsupported' || enforcement === 'unknown') && modes.length > 0) ||
+            ((enforcement === 'harness' || enforcement === 'negotiated') && modes.length === 0))
+            return null;
+        return Object.freeze({
+            version: 1,
+            plan: plan,
+            approval: approval,
+            filesystem: filesystem,
+            strictToolPolicy: Object.freeze({
+                modes: Object.freeze(modes),
+                enforcement: enforcement,
+            }),
+            organizationToolDenylist: organizationToolDenylist,
+            networkEgress: networkEgress,
+        });
+    }
+    catch {
+        // Malicious accessors/proxies must not break a read surface.
+        return null;
+    }
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -46,3 +46,5 @@ export { OVERSKY_RELEASE_PUBLIC_KEYS, type ReleaseKey } from './releaseKeys.js';
 export { MAX_SIGS, TRUSTED_FEED_ORIGINS, buildArtifactMessage, buildManifestMessage, getDeltaFor, isTrustedArtifactOrigin, verifyArtifact, verifyManifest, type DaemonVersionManifest, type DeltaDescriptor, type ManifestSignature, type PlatformArtifact, type VerifyResult, } from './releaseManifest.js';
 export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';
 export { PROFILES_SEGMENT, SUPERSEDED_MARKER_SUFFIX, SUPERSEDED_COPY_SUFFIX, profileStateDir, legacyProfileStateDir, resolveProfileStateDir, resolveProfileStateFile, profileStateFileLocations, profileStateFilePathsToClear, consolidateProfileState, type ResolvedProfileStateDir, type ConsolidationSpec, type ConsolidationStatus, type ConsolidationOutcome, } from './profileStateDir.js';
+export * from './harnessPermissionControls.js';
+export { compareReleaseVersions } from './releaseVersions.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -26,7 +26,7 @@ exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__rese
 exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
 exports.qualifyMachineUuid = exports.getMachineUuidProfile = exports.setMachineUuidProfile = exports.getHardwareMachineUuid = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
 exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.MACHINE_IDENTITY_FILENAME = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = void 0;
+exports.compareReleaseVersions = exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -438,3 +438,6 @@ Object.defineProperty(exports, "resolveProfileStateFile", { enumerable: true, ge
 Object.defineProperty(exports, "profileStateFileLocations", { enumerable: true, get: function () { return profileStateDir_js_1.profileStateFileLocations; } });
 Object.defineProperty(exports, "profileStateFilePathsToClear", { enumerable: true, get: function () { return profileStateDir_js_1.profileStateFilePathsToClear; } });
 Object.defineProperty(exports, "consolidateProfileState", { enumerable: true, get: function () { return profileStateDir_js_1.consolidateProfileState; } });
+__exportStar(require("./harnessPermissionControls.js"), exports);
+var releaseVersions_js_1 = require("./releaseVersions.js");
+Object.defineProperty(exports, "compareReleaseVersions", { enumerable: true, get: function () { return releaseVersions_js_1.compareReleaseVersions; } });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.js

@@ -211,11 +211,14 @@ function setMachineUuidProfile(profile) {
 function getMachineUuidProfile() {
     return activeMachineProfile;
 }
-function readPersistedChoice(file, hardware, profile) {
+function readPersistedChoice(file, hardware, profile, requireProfile = false) {
     try {
         const parsed = JSON.parse(node_fs_1.default.readFileSync(file, 'utf-8'));
         // A file from another machine (a restored backup, a synced home) is absent.
-        if (parsed?.version !== 1 || parsed.hardware !== hardware)
+        if (parsed?.version !== 1 ||
+            parsed.hardware !== hardware ||
+            (parsed.profile !== undefined && parsed.profile !== profile) ||
+            (requireProfile && parsed.profile !== profile))
             return null;
         // Only the two values this module can produce are accepted: a hand-edited or
         // foreign string must never become an identity.
@@ -228,11 +231,18 @@ function readPersistedChoice(file, hardware, profile) {
         return null;
     }
 }
-function persistChoice(dir, file, hardware, machineUuid, reason) {
+function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
     try {
         node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
         const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
-        const body = { version: 1, hardware, machineUuid, reason, decidedAt: new Date().toISOString() };
+        const body = {
+            version: 1,
+            hardware,
+            machineUuid,
+            profile,
+            reason,
+            decidedAt: new Date().toISOString(),
+        };
         node_fs_1.default.writeFileSync(tmp, `${JSON.stringify(body)}\n`, { mode: 0o600 });
         node_fs_1.default.renameSync(tmp, file);
     }
@@ -241,6 +251,20 @@ function persistChoice(dir, file, hardware, machineUuid, reason) {
         // next process decides again from the same evidence.
     }
 }
+/** A nonsecret recovery copy survives product uninstall. Each profile has its
+ * own file, so concurrent profiles never overwrite a shared identity map. A
+ * copied home cannot adopt another machine's value: the hardware is verified
+ * and only this module's hardware/qualified values are admitted. */
+function recoveryChoicePath(profile) {
+    const name = node_crypto_1.default.createHash('sha256').update(profile).digest('hex');
+    return node_path_1.default.join(node_os_1.default.homedir(), '.local', 'state', 'skrr', 'machine-identities', `${name}.json`);
+}
+function preserveRecoveryChoice(profile, hardware, machineUuid) {
+    const file = recoveryChoicePath(profile);
+    if (readPersistedChoice(file, hardware, profile, true) === machineUuid)
+        return;
+    persistChoice(node_path_1.default.dirname(file), file, hardware, machineUuid, 'restored_profile', profile);
+}
 /** The identity a NON-default profile registers under. Never throws. */
 function resolveProfileMachineUuid(profile, hardware) {
     const cacheKey = `${hardware}\u0000${profile}`;
@@ -250,6 +274,11 @@ function resolveProfileMachineUuid(profile, hardware) {
     const dir = node_path_1.default.join((0, configRoot_js_1.resolveConfigRoot)(), 'profiles', profile);
     const file = node_path_1.default.join(dir, exports.MACHINE_IDENTITY_FILENAME);
     let chosen = readPersistedChoice(file, hardware, profile);
+    if (!chosen) {
+        chosen = readPersistedChoice(recoveryChoicePath(profile), hardware, profile, true);
+        if (chosen)
+            persistChoice(dir, file, hardware, chosen, 'restored_profile', profile);
+    }
     if (!chosen) {
         const preExisting = PRE_EXISTING_PROFILE_EVIDENCE.some((name) => {
             try {
@@ -260,8 +289,9 @@ function resolveProfileMachineUuid(profile, hardware) {
             }
         });
         chosen = preExisting ? hardware : qualifyMachineUuid(hardware, profile);
-        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile');
+        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile);
     }
+    preserveRecoveryChoice(profile, hardware, chosen);
     profileChoiceCache.set(cacheKey, chosen);
     return chosen;
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releasePolicy.d.ts

@@ -0,0 +1,63 @@
+import { type ReleaseKey } from './releaseKeys.js';
+export type ReleaseChannel = 'stable' | 'canary' | 'beta' | 'internal';
+export interface ContractRange {
+    minimum: number;
+    maximum: number;
+}
+export interface ComponentReleasePolicy {
+    version: string;
+    minimumVersion?: string;
+    contracts?: Record<string, ContractRange>;
+}
+export interface ReleasePolicySignature {
+    keyId: string;
+    sig: string;
+}
+export interface SignedReleasePolicy {
+    schemaVersion: 1;
+    releaseId: string;
+    issuedAt: string;
+    expiresAt: string;
+    channel: ReleaseChannel;
+    /** Percentage in basis points (0–10000), avoiding floating-point policy. */
+    rolloutBasisPoints: number;
+    cohortSeed: string;
+    components: Record<string, ComponentReleasePolicy>;
+    keyId: string;
+    sig: string;
+    sigs?: ReleasePolicySignature[];
+}
+export type PolicyVerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+} | {
+    disabled: true;
+};
+export interface ReleasePolicyAssessment {
+    valid: boolean;
+    eligible: boolean;
+    reason?: string;
+}
+/** Canonical, versioned signature message. Never sign JSON.stringify directly. */
+export declare function buildReleasePolicyMessage(policy: Omit<SignedReleasePolicy, 'sig' | 'sigs'>): string;
+export declare function verifyReleasePolicy(policy: SignedReleasePolicy, keys?: readonly ReleaseKey[]): PolicyVerifyResult;
+export declare function isReleasePolicyCohortEligible(policy: SignedReleasePolicy, subject: string): boolean;
+/**
+ * Verify expiry, daemon target binding, contract ranges, channel, and cohort.
+ * `autonomous=false` intentionally bypasses cohort gating: an operator who
+ * explicitly runs an update may recover a machine outside the staged cohort,
+ * but cannot bypass invalid signatures, an expired policy, or incompatibility.
+ */
+export declare function assessReleasePolicy(args: {
+    policy: SignedReleasePolicy;
+    targetDaemonVersion: string;
+    /** Defaults to daemon for backwards-compatible daemon policy assessment. */
+    targetComponent?: string;
+    channel: ReleaseChannel;
+    contracts: Record<string, number>;
+    cohortSubject: string;
+    autonomous: boolean;
+    now?: Date;
+}): ReleasePolicyAssessment;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releasePolicy.js

@@ -0,0 +1,169 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildReleasePolicyMessage = buildReleasePolicyMessage;
+exports.verifyReleasePolicy = verifyReleasePolicy;
+exports.isReleasePolicyCohortEligible = isReleasePolicyCohortEligible;
+exports.assessReleasePolicy = assessReleasePolicy;
+/**
+ * Signed multi-component release policy.
+ *
+ * The daemon artifact manifest authenticates a daemon binary. This envelope
+ * authenticates the *decision* to offer that binary to a cohort, and records
+ * the component contract that makes a CLI/daemon/desktop combination safe.
+ * It is separately signed so it can be added to a v1 artifact manifest without
+ * changing the legacy manifest signature bytes or blocking old daemons.
+ */
+const node_crypto_1 = require("node:crypto");
+const releaseKeys_js_1 = require("./releaseKeys.js");
+const MAX_SIGS = 8;
+function stableJson(value) {
+    if (value === null ||
+        typeof value === 'boolean' ||
+        typeof value === 'number' ||
+        typeof value === 'string') {
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    if (!value || typeof value !== 'object')
+        throw new Error('policy contains an unsupported value');
+    const record = value;
+    return `{${Object.keys(record)
+        .sort()
+        .map((key) => `${JSON.stringify(key)}:${stableJson(record[key])}`)
+        .join(',')}}`;
+}
+/** Canonical, versioned signature message. Never sign JSON.stringify directly. */
+function buildReleasePolicyMessage(policy) {
+    return ['oversky-release-policy', 'v1', stableJson(policy)].join('\n');
+}
+function verifyOne(message, signature, keys) {
+    if (keys.length === 0)
+        return { disabled: true };
+    if (!signature)
+        return { ok: false, reason: 'missing signature' };
+    const messageBytes = Buffer.from(message, 'utf8');
+    const signatureBytes = Buffer.from(signature, 'base64');
+    for (const keySpec of keys) {
+        try {
+            const key = (0, node_crypto_1.createPublicKey)({
+                key: Buffer.from(keySpec.publicKeySpkiB64, 'base64'),
+                format: 'der',
+                type: 'spki',
+            });
+            if ((0, node_crypto_1.verify)(null, messageBytes, key, signatureBytes))
+                return { ok: true };
+        }
+        catch {
+            /* malformed signatures and keys are a verification failure */
+        }
+    }
+    return { ok: false, reason: 'signature did not verify against any pinned key' };
+}
+function policyShapeIsValid(policy) {
+    if (!policy ||
+        typeof policy !== 'object' ||
+        policy.schemaVersion !== 1 ||
+        !/^[0-9A-Za-z._:-]+$/.test(policy.releaseId) ||
+        !['stable', 'canary', 'beta', 'internal'].includes(policy.channel) ||
+        !Number.isInteger(policy.rolloutBasisPoints) ||
+        policy.rolloutBasisPoints < 0 ||
+        policy.rolloutBasisPoints > 10_000 ||
+        typeof policy.cohortSeed !== 'string' ||
+        policy.cohortSeed.length < 8 ||
+        !policy.components ||
+        typeof policy.components !== 'object' ||
+        Array.isArray(policy.components)) {
+        return false;
+    }
+    const issued = Date.parse(policy.issuedAt);
+    const expires = Date.parse(policy.expiresAt);
+    if (!Number.isFinite(issued) || !Number.isFinite(expires) || expires <= issued)
+        return false;
+    return Object.values(policy.components).every((component) => component &&
+        typeof component === 'object' &&
+        !Array.isArray(component) &&
+        (!component.contracts ||
+            (typeof component.contracts === 'object' && !Array.isArray(component.contracts))) &&
+        typeof component.version === 'string' &&
+        component.version.length > 0 &&
+        Object.values(component.contracts ?? {}).every((range) => range &&
+            typeof range === 'object' &&
+            !Array.isArray(range) &&
+            Number.isInteger(range.minimum) &&
+            Number.isInteger(range.maximum) &&
+            range.minimum >= 0 &&
+            range.maximum >= range.minimum));
+}
+function verifyReleasePolicy(policy, keys = releaseKeys_js_1.OVERSKY_RELEASE_PUBLIC_KEYS) {
+    if (!policyShapeIsValid(policy))
+        return { ok: false, reason: 'invalid release-policy shape' };
+    const { sig, sigs, ...unsigned } = policy;
+    const message = buildReleasePolicyMessage(unsigned);
+    if (Array.isArray(sigs) && sigs.length > 0) {
+        if (keys.length === 0)
+            return { disabled: true };
+        for (const entry of sigs.slice(0, MAX_SIGS)) {
+            if (!entry || typeof entry.sig !== 'string')
+                continue;
+            const verdict = verifyOne(message, entry.sig, keys);
+            if ('ok' in verdict && verdict.ok)
+                return verdict;
+        }
+        return { ok: false, reason: 'no policy multi-signature verified against a pinned key' };
+    }
+    return verifyOne(message, sig, keys);
+}
+function isReleasePolicyCohortEligible(policy, subject) {
+    if (!subject || policy.rolloutBasisPoints === 0)
+        return false;
+    if (policy.rolloutBasisPoints === 10_000)
+        return true;
+    const bucket = (0, node_crypto_1.createHash)('sha256')
+        .update(`${policy.releaseId}\n${policy.cohortSeed}\n${subject}`, 'utf8')
+        .digest()
+        .readUInt32BE(0) % 10_000;
+    return bucket < policy.rolloutBasisPoints;
+}
+/**
+ * Verify expiry, daemon target binding, contract ranges, channel, and cohort.
+ * `autonomous=false` intentionally bypasses cohort gating: an operator who
+ * explicitly runs an update may recover a machine outside the staged cohort,
+ * but cannot bypass invalid signatures, an expired policy, or incompatibility.
+ */
+function assessReleasePolicy(args) {
+    const now = args.now ?? new Date();
+    if (Date.parse(args.policy.expiresAt) <= now.getTime()) {
+        return { valid: false, eligible: false, reason: `policy expired at ${args.policy.expiresAt}` };
+    }
+    if (args.policy.channel !== args.channel) {
+        return {
+            valid: false,
+            eligible: false,
+            reason: `policy channel ${args.policy.channel} does not match ${args.channel}`,
+        };
+    }
+    const componentName = args.targetComponent ?? 'daemon';
+    const daemon = args.policy.components[componentName];
+    if (!daemon || daemon.version !== args.targetDaemonVersion) {
+        return {
+            valid: false,
+            eligible: false,
+            reason: `policy ${componentName} component does not bind the target artifact version`,
+        };
+    }
+    for (const [name, range] of Object.entries(daemon.contracts ?? {})) {
+        const actual = args.contracts[name];
+        if (!Number.isInteger(actual) || actual < range.minimum || actual > range.maximum) {
+            return {
+                valid: false,
+                eligible: false,
+                reason: `local contract ${name}=${String(actual)} is outside policy range ${range.minimum}..${range.maximum}`,
+            };
+        }
+    }
+    const eligible = !args.autonomous || isReleasePolicyCohortEligible(args.policy, args.cohortSubject);
+    return eligible
+        ? { valid: true, eligible: true }
+        : { valid: true, eligible: false, reason: 'machine is outside rollout cohort' };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseVersions.d.ts

@@ -0,0 +1,2 @@
+/** SemVer precedence shared by every local release consumer. Invalid inputs are never ordered. */
+export declare function compareReleaseVersions(a: string, b: string): -1 | 0 | 1 | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseVersions.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compareReleaseVersions = compareReleaseVersions;
+/** SemVer precedence shared by every local release consumer. Invalid inputs are never ordered. */
+function compareReleaseVersions(a, b) {
+    const parse = (value) => {
+        if (typeof value !== 'string')
+            return null;
+        const match = /^(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$/.exec(value.trim());
+        if (!match)
+            return null;
+        const prerelease = match[4]?.split('.') ?? [];
+        if (prerelease.some((part) => /^\d+$/.test(part) && part.length > 1 && part[0] === '0'))
+            return null;
+        return { core: match.slice(1, 4).map(BigInt), prerelease };
+    };
+    const left = parse(a);
+    const right = parse(b);
+    if (!left || !right)
+        return null;
+    for (let i = 0; i < 3; i++) {
+        if (left.core[i] !== right.core[i])
+            return left.core[i] < right.core[i] ? -1 : 1;
+    }
+    if (!left.prerelease.length || !right.prerelease.length) {
+        return left.prerelease.length === right.prerelease.length ? 0 : left.prerelease.length ? -1 : 1;
+    }
+    for (let i = 0; i < Math.max(left.prerelease.length, right.prerelease.length); i++) {
+        const l = left.prerelease[i];
+        const r = right.prerelease[i];
+        if (l === undefined || r === undefined)
+            return l === r ? 0 : l === undefined ? -1 : 1;
+        if (l === r)
+            continue;
+        const ln = /^\d+$/.test(l);
+        const rn = /^\d+$/.test(r);
+        if (ln && rn)
+            return BigInt(l) < BigInt(r) ? -1 : 1;
+        if (ln !== rn)
+            return ln ? -1 : 1;
+        return l < r ? -1 : 1;
+    }
+    return 0;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/sessionPermissionAuthority.d.ts

@@ -1,33 +1,5 @@
-/**
- * Session permission authority — the ONE rule that decides whether a session's
- * execution contract governs the run's permissions, shared by the server and
- * the daemon (OSK-11975 introduced it; it was implemented twice — the server
- * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
- * which is exactly how a new contract kind or a new source value would drift
- * them apart).
- *
- * The wire model:
- *
- *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
- *     permissions govern" can never ride INSIDE it. It is a top-level session
- *     field: `permissionSource`.
- *   - `'agent'` means the Agent's own configured permission mode, tool policy,
- *     Grants, session env, MCP servers and machine consent govern the run,
- *     exactly as for an unattended Task of the same Agent. Today only a
- *     `commitment` contract may carry it.
- *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
- *     still governs permissions — the marker is the version signal, so its
- *     absence must keep the legacy fence, not silently lift it.
- *   - `task_delivery` contracts always govern, marker or not.
- *
- * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
- * (`permissionSourceForContract`), so on its own side the predicate reduces to
- * "a commitment never governs" — `contractGovernsPermissions(c,
- * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
- * daemon reads the marker it received, because it cannot distinguish "new
- * server, agent permissions" from "old server, contract fence" any other way.
- * Both call the same function; only the input differs.
- */
+/** Commitment context never overrides Agent permissions. Version 3 admission
+ * rejects old contracts; typed Task delivery is a separate frozen operation. */
 /** The wire vocabulary for `permissionSource`. Top-level session field. */
 export declare const SESSION_PERMISSION_SOURCES: readonly ["agent"];
 export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number];
@@ -37,7 +9,7 @@ export type SessionPermissionSource = (typeof SESSION_PERMISSION_SOURCES)[number
  * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
  * the marker never reaches a daemon that would ignore it.
  */
-export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v2_agent_permissions";
+export declare const COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = "commitment_execution_contract_v3";
 /**
  * The minimal contract shape this rule reads. The predicate only ever needs
  * `kind` — keeping the input structural means this module never imports the
@@ -50,8 +22,7 @@ export type PermissionContractKind = {
 } | null | undefined;
 /**
  * Untrusted wire input: anything but an exact vocabulary literal reads as
- * absent. Never widen by coercion — an unrecognized future value must degrade
- * to "contract governs", the conservative answer.
+ * absent. An unknown marker carries no authority. Contract admission is validated separately.
  */
 export declare function normalizeSessionPermissionSource(value: unknown): SessionPermissionSource | undefined;
 /**
@@ -60,18 +31,10 @@ export declare function normalizeSessionPermissionSource(value: unknown): Sessio
  * kind keeps its own authority and stamps nothing.
  */
 export declare function permissionSourceForContract(contract: PermissionContractKind): SessionPermissionSource | undefined;
-/**
- * Whether the contract is the run's PERMISSION authority — the single place
- * this rule lives.
- *
- * True for a non-commitment contract regardless of marker, and for a
- * commitment whose server did not declare agent permissions. False for no
- * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
- * which then follows the Agent's own permissions exactly as a Task does while
- * the contract keeps its non-permission roles (normalized shape, ephemeral
- * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+/** Only typed Task delivery owns an effect-specific permission boundary.
+ * A Commitment is context for the Agent and cannot grant or restrict tools.
  */
-export declare function contractGovernsPermissions(contract: PermissionContractKind, permissionSource: unknown): boolean;
+export declare function contractGovernsPermissions(contract: PermissionContractKind, _permissionSource?: unknown): boolean;
 /**
  * The contract when it governs permissions, else `undefined` — for the sites
  * that used `executionContract` as "is this run permission-fenced".

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/sessionPermissionAuthority.js

@@ -1,34 +1,6 @@
 "use strict";
-/**
- * Session permission authority — the ONE rule that decides whether a session's
- * execution contract governs the run's permissions, shared by the server and
- * the daemon (OSK-11975 introduced it; it was implemented twice — the server
- * read `kind !== 'commitment'`, the daemon read the `permissionSource` marker —
- * which is exactly how a new contract kind or a new source value would drift
- * them apart).
- *
- * The wire model:
- *
- *   - The contract is closed (`hasOnlyKeys` on the daemon), so "whose
- *     permissions govern" can never ride INSIDE it. It is a top-level session
- *     field: `permissionSource`.
- *   - `'agent'` means the Agent's own configured permission mode, tool policy,
- *     Grants, session env, MCP servers and machine consent govern the run,
- *     exactly as for an unattended Task of the same Agent. Today only a
- *     `commitment` contract may carry it.
- *   - A `commitment` contract WITHOUT the marker (an older server mid-deploy)
- *     still governs permissions — the marker is the version signal, so its
- *     absence must keep the legacy fence, not silently lift it.
- *   - `task_delivery` contracts always govern, marker or not.
- *
- * Server vs daemon asymmetry, on purpose: the server STAMPS the marker
- * (`permissionSourceForContract`), so on its own side the predicate reduces to
- * "a commitment never governs" — `contractGovernsPermissions(c,
- * permissionSourceForContract(c))` is exactly `kind !== 'commitment'`. The
- * daemon reads the marker it received, because it cannot distinguish "new
- * server, agent permissions" from "old server, contract fence" any other way.
- * Both call the same function; only the input differs.
- */
+/** Commitment context never overrides Agent permissions. Version 3 admission
+ * rejects old contracts; typed Task delivery is a separate frozen operation. */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = exports.SESSION_PERMISSION_SOURCES = void 0;
 exports.normalizeSessionPermissionSource = normalizeSessionPermissionSource;
@@ -43,11 +15,10 @@ exports.SESSION_PERMISSION_SOURCES = ['agent'];
  * a daemon without it (`COMMITMENT_AGENT_PERMISSIONS_RUNTIME_UNSUPPORTED`), so
  * the marker never reaches a daemon that would ignore it.
  */
-exports.COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = 'commitment_execution_contract_v2_agent_permissions';
+exports.COMMITMENT_AGENT_PERMISSIONS_CAPABILITY = 'commitment_execution_contract_v3';
 /**
  * Untrusted wire input: anything but an exact vocabulary literal reads as
- * absent. Never widen by coercion — an unrecognized future value must degrade
- * to "contract governs", the conservative answer.
+ * absent. An unknown marker carries no authority. Contract admission is validated separately.
  */
 function normalizeSessionPermissionSource(value) {
     return exports.SESSION_PERMISSION_SOURCES.includes(value)
@@ -62,21 +33,11 @@ function normalizeSessionPermissionSource(value) {
 function permissionSourceForContract(contract) {
     return contract?.kind === 'commitment' ? 'agent' : undefined;
 }
-/**
- * Whether the contract is the run's PERMISSION authority — the single place
- * this rule lives.
- *
- * True for a non-commitment contract regardless of marker, and for a
- * commitment whose server did not declare agent permissions. False for no
- * contract at all, and for a commitment carrying `permissionSource: 'agent'`,
- * which then follows the Agent's own permissions exactly as a Task does while
- * the contract keeps its non-permission roles (normalized shape, ephemeral
- * worktree, result validation, `GIT_OPTIONAL_LOCKS`, provider restriction).
+/** Only typed Task delivery owns an effect-specific permission boundary.
+ * A Commitment is context for the Agent and cannot grant or restrict tools.
  */
-function contractGovernsPermissions(contract, permissionSource) {
-    if (!contract)
-        return false;
-    return !(contract.kind === 'commitment' && normalizeSessionPermissionSource(permissionSource) === 'agent');
+function contractGovernsPermissions(contract, _permissionSource) {
+    return Boolean(contract && contract.kind !== 'commitment');
 }
 /**
  * The contract when it governs permissions, else `undefined` — for the sites