@skrr-ai/cli 0.1.114 → 0.1.116

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -1,284 +1,196 @@
 "use strict";
-/**
- * OSK-3892 — spawn-env sanitization, shared by every OverSky process that
- * spawns a model-driven child.
- *
- * ── Why this lives in auth-core ────────────────────────────────────────────
- *
- * The daemon has stripped its own credentials out of `process.env` before every
- * harness spawn since `daemon/src/env-sanitize.ts` was written. `skrr code` spawns
- * THE SAME engine — `daemon/src/backends/acp.ts` and `cli/src/lib/first-party-harness.ts`
- * resolve the same binary, from the same managed location — and had no
- * equivalent, so `OVERSKY_TOKEN` (a cloud-reusable platform credential that
- * authenticates every `/api/*` call as the human) entered the environment of a
- * process that executes model-directed tools.
- *
- * The CLI cannot import `daemon/src`: separate packages, and the daemon already
- * depends on the CLI, so the reverse edge would be a cycle. `auth-core` is the
- * one package BOTH already resolve — it is a daemon dependency and is copied
- * verbatim into the published CLI by `cli/scripts/vendor-monorepo-deps.js` — so
- * this is the same move `harnessTrust.ts` made, for the same reason, with no
- * build or release wiring to change.
- *
- * ── What deliberately did NOT move ────────────────────────────────────────
- *
- * `filterCustomEnv` and the `BLOCKED_CUSTOM_ENV_*` constants stay in the daemon.
- * They govern SERVER-PROVIDED `customEnv` — a different threat model (stopping
- * THEIR values coming IN and overriding the sandbox, rather than stopping OUR
- * secrets leaking OUT) and a daemon-only concern: no other process is handed an
- * env map by the control plane.
- *
- * ── The one asymmetry a consumer must decide for itself ───────────────────
- *
- * This is a DENY-LIST over the parent's own environment, and it strips provider
- * credentials because the daemon delivers a child's model credential explicitly
- * (`cred.env`, after the trust gate) and never by ambient inheritance. A parent
- * whose supported mode IS ambient inheritance — `skrr code` running BYOK, where
- * the user's own key is the credential the run is meant to spend — has to
- * re-admit that credential deliberately after this filter. See
- * `cli/src/lib/first-party-harness.ts` (`engineSpawnEnv`). Do not soften the list here to
- * serve that case: a deny-list with a hole is not a deny-list.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOOPBACK_NO_PROXY_HOSTS = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
-exports.isDaemonChildEnv = isDaemonChildEnv;
-exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
-exports.envHasProxy = envHasProxy;
-exports.withLoopbackNoProxy = withLoopbackNoProxy;
-/**
- * Env vars that must NEVER reach a spawned subprocess.
- *
- * A malicious or compromised cloud-issued prompt that achieves command
- * execution should NOT also exfiltrate every credential the parent has
- * in its own env. We use a deny-list (strip these, keep everything
- * else) because real tools legitimately need PATH, HOME, USER, LANG,
- * etc.
- *
- * Categories:
- *   - Daemon/Claude/Anthropic auth — direct account takeover.
- *   - AWS — STS / IAM credentials, full cloud access.
- *   - GitHub / npm / OpenAI — package-publish, repo, model access.
- *   - OverSky internal secrets — match by prefix.
- *   - DYLD/LD preload — library-injection vector for in-process compromise.
- */
-exports.SENSITIVE_ENV_VARS = new Set([
-    'CLAUDE_CODE_OAUTH_TOKEN',
-    'OVERSKY_TOKEN',
-    // The renamed credential alias (cli/src/lib/config.ts honors both spellings).
-    // Same double coverage as OVERSKY_TOKEN — name AND the SKRR_ prefix below.
-    'SKRR_TOKEN',
-    'AWS_ACCESS_KEY_ID',
-    'AWS_SECRET_ACCESS_KEY',
-    'AWS_SESSION_TOKEN',
-    'GH_TOKEN',
-    'GITHUB_TOKEN',
-    'NPM_TOKEN',
-    'OPENAI_API_KEY',
-    'ANTHROPIC_API_KEY',
-    // Provider keys are parent-process credentials just as much as the two
-    // original OpenAI/Anthropic entries.  A child must receive one only through
-    // its backend's per-request, trust-gated credential contract; inheriting an
-    // operator export turns a compromised harness into a provider-account
-    // takeover. Keep this explicit rather than guessing from a suffix: ordinary
-    // application variables sometimes end in `_KEY` and are not credentials.
-    'OPENROUTER_API_KEY',
-    'GEMINI_API_KEY',
-    'GOOGLE_API_KEY',
-    'MOONSHOT_API_KEY',
-    'AZURE_OPENAI_API_KEY',
-    'COHERE_API_KEY',
-    'DEEPSEEK_API_KEY',
-    'MISTRAL_API_KEY',
-    'PERPLEXITY_API_KEY',
-    'XAI_API_KEY',
-    'HUGGINGFACE_HUB_TOKEN',
-    'LITELLM_MASTER_KEY',
-    'DYLD_INSERT_LIBRARIES',
-    'LD_PRELOAD',
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var spawnEnv_exports = {};
+__export(spawnEnv_exports, {
+  DAEMON_CHILD_ENV: () => DAEMON_CHILD_ENV,
+  LOOPBACK_NO_PROXY_HOSTS: () => LOOPBACK_NO_PROXY_HOSTS,
+  SENSITIVE_ENV_NAME_TOKENS: () => SENSITIVE_ENV_NAME_TOKENS,
+  SENSITIVE_ENV_PREFIXES: () => SENSITIVE_ENV_PREFIXES,
+  SENSITIVE_ENV_PREFIX_EXCEPTIONS: () => SENSITIVE_ENV_PREFIX_EXCEPTIONS,
+  SENSITIVE_ENV_SUFFIXES: () => SENSITIVE_ENV_SUFFIXES,
+  SENSITIVE_ENV_VARS: () => SENSITIVE_ENV_VARS,
+  envHasProxy: () => envHasProxy,
+  isDaemonChildEnv: () => isDaemonChildEnv,
+  sanitizeSpawnEnv: () => sanitizeSpawnEnv,
+  withLoopbackNoProxy: () => withLoopbackNoProxy
+});
+module.exports = __toCommonJS(spawnEnv_exports);
+const SENSITIVE_ENV_VARS = /* @__PURE__ */ new Set([
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "OVERSKY_TOKEN",
+  // The renamed credential alias (cli/src/lib/config.ts honors both spellings).
+  // Same double coverage as OVERSKY_TOKEN — name AND the SKRR_ prefix below.
+  "SKRR_TOKEN",
+  "AWS_ACCESS_KEY_ID",
+  "AWS_SECRET_ACCESS_KEY",
+  "AWS_SESSION_TOKEN",
+  "GH_TOKEN",
+  "GITHUB_TOKEN",
+  "NPM_TOKEN",
+  "OPENAI_API_KEY",
+  "ANTHROPIC_API_KEY",
+  // Provider keys are parent-process credentials just as much as the two
+  // original OpenAI/Anthropic entries.  A child must receive one only through
+  // its backend's per-request, trust-gated credential contract; inheriting an
+  // operator export turns a compromised harness into a provider-account
+  // takeover. Keep this explicit rather than guessing from a suffix: ordinary
+  // application variables sometimes end in `_KEY` and are not credentials.
+  "OPENROUTER_API_KEY",
+  "GEMINI_API_KEY",
+  "GOOGLE_API_KEY",
+  "MOONSHOT_API_KEY",
+  "AZURE_OPENAI_API_KEY",
+  "COHERE_API_KEY",
+  "DEEPSEEK_API_KEY",
+  "MISTRAL_API_KEY",
+  "PERPLEXITY_API_KEY",
+  "XAI_API_KEY",
+  "HUGGINGFACE_HUB_TOKEN",
+  "LITELLM_MASTER_KEY",
+  "DYLD_INSERT_LIBRARIES",
+  "LD_PRELOAD"
 ]);
-/** Variable name prefixes that should be stripped (catches families like AWS_*). */
-exports.SENSITIVE_ENV_PREFIXES = [
-    'AWS_',
-    'OVERSKY_',
-    // The renamed product namespace: SKRR_TOKEN, SKRR_REFRESH_TOKEN, the
-    // session-authority aliases (SKRR_SESSION_*, SKRR_BASE_URL), and the
-    // daemon's control-plane identity (SKRR_MACHINE_UUID, SKRR_LEASE_GENERATION)
-    // all carry authority a model-driven child must not inherit. Non-secret
-    // lane essentials live in SENSITIVE_ENV_PREFIX_EXCEPTIONS below.
-    'SKRR_',
+const SENSITIVE_ENV_PREFIXES = [
+  "AWS_",
+  "OVERSKY_",
+  // The renamed product namespace: SKRR_TOKEN, SKRR_REFRESH_TOKEN, the
+  // session-authority aliases (SKRR_SESSION_*, SKRR_BASE_URL), and the
+  // daemon's control-plane identity (SKRR_MACHINE_UUID, SKRR_LEASE_GENERATION)
+  // all carry authority a model-driven child must not inherit. Non-secret
+  // lane essentials live in SENSITIVE_ENV_PREFIX_EXCEPTIONS below.
+  "SKRR_"
 ];
-/**
- * Credential-shaped suffixes are also forbidden. A fixed provider list is
- * never complete: a newly configured provider would otherwise leak its key
- * into every harness until an engineer remembers to edit this file. The
- * parent's own credentials must be delivered through a backend's explicit
- * per-request allow-list, never by ambient inheritance.
- */
-exports.SENSITIVE_ENV_SUFFIXES = [
-    '_API_KEY',
-    '_API_TOKEN',
-    '_AUTH_TOKEN',
-    '_ACCESS_TOKEN',
-    '_REFRESH_TOKEN',
-    '_SECRET',
-    '_SECRET_KEY',
-    '_PASSWORD',
-    '_CREDENTIALS',
+const SENSITIVE_ENV_SUFFIXES = [
+  "_API_KEY",
+  "_API_TOKEN",
+  "_AUTH_TOKEN",
+  "_ACCESS_TOKEN",
+  "_REFRESH_TOKEN",
+  "_SECRET",
+  "_SECRET_KEY",
+  "_PASSWORD",
+  "_CREDENTIALS"
 ];
-/**
- * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
- * the name, not only at its end. Rotation slots put the qualifier AFTER the
- * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
- * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
- * second copy of a live secret would ride into a harness while the first was
- * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
- * `SECRETARY` untouched.
- */
-exports.SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
-/** Specific names to keep — the prefix sweeps are broad on purpose. */
-exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
-    // Headless flag is read by spawned tools to know they're inside the daemon —
-    // not a secret. Add more here if a tool legitimately needs an OVERSKY_ var.
-    'OVERSKY_HEADLESS',
-    'OVERSKY_LAUNCHD_LABEL',
-    // OSK-1108 — canonical supervisor marker; spawned tools read it to
-    // know they're inside a supervised daemon on Linux/Windows in addition
-    // to macOS launchd. Not a secret.
-    'OVERSKY_SUPERVISOR',
-    // A deployment URL, not a credential. The rename to SKRR_SERVER_URL was
-    // chosen precisely because it survives the sanitizer
-    // (daemon/src/dedicated-tenant-env.ts), so a spawned lane's `skrr` reaches
-    // the deployment this machine is registered with.
-    'SKRR_SERVER_URL',
-    // The Dedicated Runtime workload marker the exec wrapper stamps into every
-    // tenant lane; grandchildren spawned from a lane (e.g. `skrr code` → the
-    // engine) must keep it to detect they already run as the workload uid. Not
-    // a secret — it authorizes nothing without the matching real uid.
-    'SKRR_WORKLOAD_UID',
-    // OSK-13254 — "this process descends from a skrrd agent/tool spawn". It only
-    // ever REMOVES authority (a `skrr` that sees it borrows from the daemon and
-    // never reads or writes a stored CLI session), so it must survive every later
-    // re-sanitization: a Bash tool that runs `skrr code`, whose engine runs `skrr`,
-    // is still the agent's process. See `DAEMON_CHILD_ENV` below.
-    'SKRR_DAEMON_CHILD',
+const SENSITIVE_ENV_NAME_TOKENS = ["SECRET"];
+const SENSITIVE_ENV_PREFIX_EXCEPTIONS = /* @__PURE__ */ new Set([
+  // Headless flag is read by spawned tools to know they're inside the daemon —
+  // not a secret. Add more here if a tool legitimately needs an OVERSKY_ var.
+  "OVERSKY_HEADLESS",
+  "OVERSKY_LAUNCHD_LABEL",
+  // OSK-1108 — canonical supervisor marker; spawned tools read it to
+  // know they're inside a supervised daemon on Linux/Windows in addition
+  // to macOS launchd. Not a secret.
+  "OVERSKY_SUPERVISOR",
+  // A deployment URL, not a credential. The rename to SKRR_SERVER_URL was
+  // chosen precisely because it survives the sanitizer
+  // (daemon/src/dedicated-tenant-env.ts), so a spawned lane's `skrr` reaches
+  // the deployment this machine is registered with.
+  "SKRR_SERVER_URL",
+  // The Dedicated Runtime workload marker the exec wrapper stamps into every
+  // tenant lane; grandchildren spawned from a lane (e.g. `skrr code` → the
+  // engine) must keep it to detect they already run as the workload uid. Not
+  // a secret — it authorizes nothing without the matching real uid.
+  "SKRR_WORKLOAD_UID",
+  // OSK-13254 — "this process descends from a skrrd agent/tool spawn". It only
+  // ever REMOVES authority (a `skrr` that sees it borrows from the daemon and
+  // never reads or writes a stored CLI session), so it must survive every later
+  // re-sanitization: a Bash tool that runs `skrr code`, whose engine runs `skrr`,
+  // is still the agent's process. See `DAEMON_CHILD_ENV` below.
+  "SKRR_DAEMON_CHILD"
 ]);
-/**
- * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
- * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
- *
- * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
- * daemon's loopback broker, never adopts a CLI refresh session of its own, and
- * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
- * person's own terminal — including the web terminal, which is a human surface
- * (`humanTerminalEnv`) — does not carry it.
- *
- * The marker can only take authority away, so a process that forges it hurts
- * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
- * that deletes it can do whatever the person's own shell can. Where a uid
- * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
- * guest descriptor already offers only the access-token mode, so a durable CLI
- * family cannot be minted there whatever the environment says.
- */
-exports.DAEMON_CHILD_ENV = 'SKRR_DAEMON_CHILD';
-/**
- * True when `env` carries the daemon-child marker with ANY non-empty value.
- * Deliberately no "0 means off": the marker only narrows authority, so the
- * one value that could switch it off is the one a request-carried environment
- * would forge.
- */
+const DAEMON_CHILD_ENV = "SKRR_DAEMON_CHILD";
 function isDaemonChildEnv(env) {
-    return Boolean(env[exports.DAEMON_CHILD_ENV]?.trim());
+  return Boolean(env[DAEMON_CHILD_ENV]?.trim());
 }
-/**
- * Build a sanitized snapshot of the parent's own env for a spawned
- * child, stripping credentials and library-injection vectors while
- * preserving everything else (PATH, HOME, USER, LANG, terminal vars,
- * etc.) so legitimate tools keep working.
- */
 function sanitizeSpawnEnv(env) {
-    const out = {};
-    for (const [key, value] of Object.entries(env)) {
-        if (value === undefined)
-            continue;
-        // Explicit deny wins unconditionally — even if key is in SENSITIVE_ENV_PREFIX_EXCEPTIONS.
-        if (exports.SENSITIVE_ENV_VARS.has(key))
-            continue;
-        let stripped = false;
-        for (const prefix of exports.SENSITIVE_ENV_PREFIXES) {
-            if (key.startsWith(prefix) && !exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS.has(key)) {
-                stripped = true;
-                break;
-            }
-        }
-        if (!stripped && exports.SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
-            stripped = true;
-        }
-        if (!stripped) {
-            const segments = key.split('_');
-            if (exports.SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
-                stripped = true;
-            }
-        }
-        if (stripped)
-            continue;
-        out[key] = value;
+  const out = {};
+  for (const [key, value] of Object.entries(env)) {
+    if (value === void 0)
+      continue;
+    if (SENSITIVE_ENV_VARS.has(key))
+      continue;
+    let stripped = false;
+    for (const prefix of SENSITIVE_ENV_PREFIXES) {
+      if (key.startsWith(prefix) && !SENSITIVE_ENV_PREFIX_EXCEPTIONS.has(key)) {
+        stripped = true;
+        break;
+      }
     }
-    return withLoopbackNoProxy(out);
+    if (!stripped && SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
+      stripped = true;
+    }
+    if (!stripped) {
+      const segments = key.split("_");
+      if (SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
+        stripped = true;
+      }
+    }
+    if (stripped)
+      continue;
+    out[key] = value;
+  }
+  return withLoopbackNoProxy(out);
 }
-/**
- * OSK-12134 — loopback names a spawned child must reach directly, never through
- * a proxy. A harness talks to this machine constantly: the daemon's local
- * bridges (browser, delegated CLI, message intents), the inference broker, and
- * the engine's own loopback services (skrr Code's `session/new` reaches a local
- * directory service and failed with "service failure" behind a shell proxy).
- */
-exports.LOOPBACK_NO_PROXY_HOSTS = ['127.0.0.1', 'localhost', '::1'];
+const LOOPBACK_NO_PROXY_HOSTS = ["127.0.0.1", "localhost", "::1"];
 const PROXY_ENV_VARS = [
-    'HTTP_PROXY',
-    'http_proxy',
-    'HTTPS_PROXY',
-    'https_proxy',
-    'ALL_PROXY',
-    'all_proxy',
+  "HTTP_PROXY",
+  "http_proxy",
+  "HTTPS_PROXY",
+  "https_proxy",
+  "ALL_PROXY",
+  "all_proxy"
 ];
-/** True when `env` names a proxy some client in the child might honour. */
 function envHasProxy(env) {
-    return PROXY_ENV_VARS.some((name) => typeof env[name] === 'string' && env[name].trim() !== '');
+  return PROXY_ENV_VARS.some((name) => typeof env[name] === "string" && env[name].trim() !== "");
 }
 function appendNoProxyHosts(list, hosts) {
-    const entries = list
-        .split(',')
-        .map((entry) => entry.trim().toLowerCase())
-        .filter(Boolean);
-    // `*` already exempts everything, and some clients honour it only as the
-    // entire value, so appending to it would break them.
-    if (entries.includes('*'))
-        return list;
-    const missing = hosts.filter((host) => !entries.includes(host));
-    if (missing.length === 0)
-        return list;
-    const kept = list.replace(/[\s,]+$/, '');
-    return kept ? `${kept},${missing.join(',')}` : missing.join(',');
+  const entries = list.split(",").map((entry) => entry.trim().toLowerCase()).filter(Boolean);
+  if (entries.includes("*"))
+    return list;
+  const missing = hosts.filter((host) => !entries.includes(host));
+  if (missing.length === 0)
+    return list;
+  const kept = list.replace(/[\s,]+$/, "");
+  return kept ? `${kept},${missing.join(",")}` : missing.join(",");
 }
-/**
- * Return `env` with the loopback hosts appended to BOTH `NO_PROXY` and
- * `no_proxy`, when (and only when) it names a proxy. Tools disagree on which
- * spelling they read and whether they fall back to the other, so an unset
- * spelling is seeded from the other one before the hosts are appended —
- * seeding only the hosts would silently drop every existing exemption for a
- * tool that prefers the unset spelling. Existing entries keep their order.
- *
- * Exported for a parent that layers a proxy onto the child's env AFTER
- * {@link sanitizeSpawnEnv}: call it again on the final map.
- */
 function withLoopbackNoProxy(env) {
-    if (!envHasProxy(env))
-        return env;
-    const upper = env.NO_PROXY?.trim() ? env.NO_PROXY : undefined;
-    const lower = env.no_proxy?.trim() ? env.no_proxy : undefined;
-    return {
-        ...env,
-        NO_PROXY: appendNoProxyHosts(upper ?? lower ?? '', exports.LOOPBACK_NO_PROXY_HOSTS),
-        no_proxy: appendNoProxyHosts(lower ?? upper ?? '', exports.LOOPBACK_NO_PROXY_HOSTS),
-    };
+  if (!envHasProxy(env))
+    return env;
+  const upper = env.NO_PROXY?.trim() ? env.NO_PROXY : void 0;
+  const lower = env.no_proxy?.trim() ? env.no_proxy : void 0;
+  return {
+    ...env,
+    NO_PROXY: appendNoProxyHosts(upper ?? lower ?? "", LOOPBACK_NO_PROXY_HOSTS),
+    no_proxy: appendNoProxyHosts(lower ?? upper ?? "", LOOPBACK_NO_PROXY_HOSTS)
+  };
 }
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  DAEMON_CHILD_ENV,
+  LOOPBACK_NO_PROXY_HOSTS,
+  SENSITIVE_ENV_NAME_TOKENS,
+  SENSITIVE_ENV_PREFIXES,
+  SENSITIVE_ENV_PREFIX_EXCEPTIONS,
+  SENSITIVE_ENV_SUFFIXES,
+  SENSITIVE_ENV_VARS,
+  envHasProxy,
+  isDaemonChildEnv,
+  sanitizeSpawnEnv,
+  withLoopbackNoProxy
+});