@skrr-ai/cli 0.1.95 → 0.1.96

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/cliHandoffWire.js

@@ -133,3 +133,15 @@ export function parseCliHandoffDpopProofResponse(value) {
         return null;
     return { proof: v.proof };
 }
+/** Persisted credential families; deployed values must not change. */
+export const DELEGATED_AGENT_CLI_ID_PREFIX = 'oversky-daemon-agent-cli-';
+export const WORKLOAD_CLI_ID_PREFIX = 'oversky-daemon-workload-cli-';
+export function classifyCliFamilyId(id) {
+    if (typeof id !== 'string')
+        return 'person';
+    if (id.startsWith(DELEGATED_AGENT_CLI_ID_PREFIX))
+        return 'agent';
+    if (id.startsWith(WORKLOAD_CLI_ID_PREFIX))
+        return 'workload';
+    return 'person';
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/githubPushRefusal.d.ts

@@ -0,0 +1,9 @@
+/** GitHub push diagnostics must never escape this parser as raw stderr. */
+export declare const GITHUB_WORKFLOW_PERMISSION_REQUIRED = "github_workflow_permission_required";
+export type GitHubPushRefusal = {
+    code: typeof GITHUB_WORKFLOW_PERMISSION_REQUIRED;
+    tokenKind: 'github_app' | 'oauth_app' | 'personal_access_token' | 'unknown';
+    paths: string[];
+};
+export declare function isWorkflowPath(value: unknown): boolean;
+export declare function classifyGitHubPushRefusal(text: unknown): GitHubPushRefusal | null;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/githubPushRefusal.js

@@ -0,0 +1,44 @@
+/** GitHub push diagnostics must never escape this parser as raw stderr. */
+export const GITHUB_WORKFLOW_PERMISSION_REQUIRED = 'github_workflow_permission_required';
+function workflowPath(value) {
+    if (typeof value !== 'string' || value.length > 240)
+        return null;
+    const path = value.replaceAll('\\', '/');
+    if (!/^\.github\/workflows\/[A-Za-z0-9_. /-]+$/.test(path))
+        return null;
+    const parts = path.split('/');
+    if (parts.some((part) => !part.trim() || part !== part.trim() || part === '.' || part === '..'))
+        return null;
+    return path;
+}
+export function isWorkflowPath(value) {
+    return workflowPath(value) !== null;
+}
+export function classifyGitHubPushRefusal(text) {
+    if (typeof text !== 'string')
+        return null;
+    // Bound parsing work. Git prints the rejection LAST, after any amount of
+    // progress output, so keep the tail; truncated diagnostics keep the generic refusal.
+    const input = text.slice(-64 * 1024);
+    const pattern = /refusing to allow (?:a|an) (GitHub App|OAuth App|Personal Access Token) to create or update workflow [`'"]([^`'"\r\n]+)[`'"] without [`'"]workflows?[`'"] (?:permission|scope)/gi;
+    const paths = [];
+    let tokenKind = 'unknown';
+    for (const match of input.matchAll(pattern)) {
+        const path = workflowPath(match[2]);
+        if (!path)
+            continue;
+        if (tokenKind === 'unknown') {
+            tokenKind =
+                match[1].toLowerCase() === 'github app'
+                    ? 'github_app'
+                    : match[1].toLowerCase() === 'oauth app'
+                        ? 'oauth_app'
+                        : 'personal_access_token';
+        }
+        if (!paths.includes(path))
+            paths.push(path);
+        if (paths.length === 10)
+            break;
+    }
+    return paths.length ? { code: GITHUB_WORKFLOW_PERMISSION_REQUIRED, tokenKind, paths } : null;
+}

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -14,6 +14,16 @@
         "default": "./dist/cjs/index.js"
       }
     },
+    "./github-push-refusal": {
+      "import": {
+        "types": "./dist/esm/githubPushRefusal.d.ts",
+        "default": "./dist/esm/githubPushRefusal.js"
+      },
+      "require": {
+        "types": "./dist/cjs/githubPushRefusal.d.ts",
+        "default": "./dist/cjs/githubPushRefusal.js"
+      }
+    },
     "./refresh-classification": {
       "import": {
         "types": "./dist/esm/refreshClassification.d.ts",