@skrr-ai/cli 0.1.24 → 0.1.26

package/dist/lib/sky-code.d.ts

@@ -94,6 +94,32 @@ export declare function resolveEngine(env?: NodeJS.ProcessEnv): EngineResolution
  * into a mode the user did not ask for.
  */
 export declare function buildEngineArgs(subcommand: string | null, passthrough: readonly string[]): string[];
+/**
+ * The uid the Dedicated Runtime workload exec wrapper stamps into everything it
+ * launches (`infrastructure/packer/files/skrr-workload-exec.c`). Mirrors the
+ * daemon's `DEDICATED_WORKLOAD_UID_ENV`.
+ */
+export declare const DEDICATED_WORKLOAD_UID_ENV = "SKRR_WORKLOAD_UID";
+/**
+ * True when this process is tenant code on a Dedicated Runtime guest: a
+ * terminal, `skrr machines dedicated exec`, an agent's Bash, or an engine
+ * session the daemon launched.
+ *
+ * The variable alone is not enough — anyone can export it — so the process must
+ * also BE that uid, the same two-part test the daemon applies. Getting it wrong
+ * only changes which message is printed; nothing is authorized by it.
+ */
+export declare function isDedicatedRuntimeWorkload(env?: NodeJS.ProcessEnv, getuid?: (() => number) | undefined): boolean;
+/**
+ * Why nothing installs an engine on a Dedicated Runtime.
+ *
+ * The daemon there installs into its own 0700 home, which the workload identity
+ * that runs every engine cannot enter, so both the daemon and the control plane
+ * refuse (`DEDICATED_RUNTIME_ENGINE_SHIPS_WITH_IMAGE`). A build in the user's
+ * own HOME would run in this terminal but never in a session the daemon starts,
+ * so it is not offered either.
+ */
+export declare const DEDICATED_RUNTIME_ENGINE_MESSAGE = "On a Dedicated Runtime, coding engines ship with the machine image. They cannot be installed on a running machine; a newer engine arrives with a newer image.";
 /**
  * Message shown when no engine is installed.
  *
@@ -116,8 +142,11 @@ export declare function buildEngineArgs(subcommand: string | null, passthrough:
  * Keep this in step with what actually ships. An install instruction that does
  * not work is worse than none: it moves the failure from "I could not find how
  * to install it" to "I did what it said and it broke".
+ *
+ * That is exactly why a Dedicated Runtime gets different text: every route
+ * below fails there (see {@link DEDICATED_RUNTIME_ENGINE_MESSAGE}).
  */
-export declare function notInstalledMessage(): string;
+export declare function notInstalledMessage(env?: NodeJS.ProcessEnv): string;
 /**
  * Spawn the engine with stdio inherited, resolving with its exit code.
  *

package/dist/lib/sky-code.js

@@ -17,13 +17,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ENGINE_PATH_ENV = void 0;
+exports.DEDICATED_RUNTIME_ENGINE_MESSAGE = exports.DEDICATED_WORKLOAD_UID_ENV = exports.ENGINE_PATH_ENV = void 0;
 exports.engineHome = engineHome;
 exports.skyCodeInstructionHome = skyCodeInstructionHome;
 exports.managedEnginePath = managedEnginePath;
 exports.legacyManagedEnginePath = legacyManagedEnginePath;
 exports.resolveEngine = resolveEngine;
 exports.buildEngineArgs = buildEngineArgs;
+exports.isDedicatedRuntimeWorkload = isDedicatedRuntimeWorkload;
 exports.notInstalledMessage = notInstalledMessage;
 exports.inheritedProviderCredentials = inheritedProviderCredentials;
 exports.hasProviderCredential = hasProviderCredential;
@@ -204,6 +205,35 @@ function resolveEngine(env = process.env) {
 function buildEngineArgs(subcommand, passthrough) {
     return subcommand === null ? [...passthrough] : [subcommand, ...passthrough];
 }
+/**
+ * The uid the Dedicated Runtime workload exec wrapper stamps into everything it
+ * launches (`infrastructure/packer/files/skrr-workload-exec.c`). Mirrors the
+ * daemon's `DEDICATED_WORKLOAD_UID_ENV`.
+ */
+exports.DEDICATED_WORKLOAD_UID_ENV = 'SKRR_WORKLOAD_UID';
+/**
+ * True when this process is tenant code on a Dedicated Runtime guest: a
+ * terminal, `skrr machines dedicated exec`, an agent's Bash, or an engine
+ * session the daemon launched.
+ *
+ * The variable alone is not enough — anyone can export it — so the process must
+ * also BE that uid, the same two-part test the daemon applies. Getting it wrong
+ * only changes which message is printed; nothing is authorized by it.
+ */
+function isDedicatedRuntimeWorkload(env = process.env, getuid = process.getuid?.bind(process)) {
+    const uid = Number(env[exports.DEDICATED_WORKLOAD_UID_ENV]);
+    return Number.isInteger(uid) && uid > 0 && typeof getuid === 'function' && getuid() === uid;
+}
+/**
+ * Why nothing installs an engine on a Dedicated Runtime.
+ *
+ * The daemon there installs into its own 0700 home, which the workload identity
+ * that runs every engine cannot enter, so both the daemon and the control plane
+ * refuse (`DEDICATED_RUNTIME_ENGINE_SHIPS_WITH_IMAGE`). A build in the user's
+ * own HOME would run in this terminal but never in a session the daemon starts,
+ * so it is not offered either.
+ */
+exports.DEDICATED_RUNTIME_ENGINE_MESSAGE = 'On a Dedicated Runtime, coding engines ship with the machine image. They cannot be installed on a running machine; a newer engine arrives with a newer image.';
 /**
  * Message shown when no engine is installed.
  *
@@ -226,8 +256,20 @@ function buildEngineArgs(subcommand, passthrough) {
  * Keep this in step with what actually ships. An install instruction that does
  * not work is worse than none: it moves the failure from "I could not find how
  * to install it" to "I did what it said and it broke".
+ *
+ * That is exactly why a Dedicated Runtime gets different text: every route
+ * below fails there (see {@link DEDICATED_RUNTIME_ENGINE_MESSAGE}).
  */
-function notInstalledMessage() {
+function notInstalledMessage(env = process.env) {
+    if (isDedicatedRuntimeWorkload(env)) {
+        return [
+            'The skrr Code engine (`sky-code`) is not on this machine.',
+            '',
+            exports.DEDICATED_RUNTIME_ENGINE_MESSAGE,
+            'This machine was built from an image without it; it arrives when the',
+            "machine's image is replaced. `claude` and `codex` are on the image now.",
+        ].join('\n');
+    }
     return [
         'The skrr Code engine (`sky-code`) is not installed on this machine.',
         '',

package/dist/lib/triggers.js

@@ -147,6 +147,13 @@ exports.TRIGGER_EVENT_CATALOG = {
         'task.assigned',
         'task.completed',
         'task.archived',
+        'task.unassigned',
+        'task.scheduled',
+        'task.rescheduled',
+        'task.unscheduled',
+        'task.deleted',
+        'task.execution_completed',
+        'task.execution_failed',
     ],
     space: [
         'space.created',

package/dist/lib/work-sync.d.ts

@@ -27,9 +27,44 @@ export type WorkSyncEventStats = {
     p95Bytes: number | null;
     mismatchCount: number;
 };
+/**
+ * What happened to WRITES of one operation kind, from the durable command queue.
+ * Rates are `null` when their denominator is zero: conflict rates are over
+ * settled commands (accepted + dead-lettered), the duplicate rate over deliveries.
+ */
+export type WorkSyncCommandStats = {
+    commands: number;
+    deliveries: number;
+    duplicateDeliveries: number;
+    accepted: number;
+    pending: number;
+    deadLettered: number;
+    versionConflicts: number;
+    authorizationChanged: number;
+    expired: number;
+    retryExhausted: number;
+    otherRejections: number;
+    rates: {
+        versionConflict: number | null;
+        authorizationChanged: number | null;
+        duplicateDelivery: number | null;
+    };
+};
 export type WorkSyncTelemetrySummary = {
     sampledEvents: number;
     events: Record<string, WorkSyncEventStats>;
+    /** Absent from a server older than the write-side rates. */
+    commands?: Record<string, WorkSyncCommandStats>;
+    /**
+     * Cold opens of a task detail plane that found (hit) or did not find (miss) a
+     * completed coverage record on the device. `hitRate` is null with no cold
+     * opens. Absent from a server older than the coverage read path.
+     */
+    coverage?: {
+        hits: number;
+        misses: number;
+        hitRate: number | null;
+    };
     repairBacklog: number;
     rollout: {
         verdict: 'ready' | 'hold' | 'insufficient_evidence';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -32,7 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -11,7 +11,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
 exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
+exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -289,6 +289,7 @@ Object.defineProperty(exports, "sanitizeSpawnEnv", { enumerable: true, get: func
 Object.defineProperty(exports, "SENSITIVE_ENV_VARS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_VARS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIXES; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
+Object.defineProperty(exports, "SENSITIVE_ENV_NAME_TOKENS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_NAME_TOKENS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/kek/linux.js

@@ -64,7 +64,6 @@ exports.__resetKekCacheForTest = __resetKekCacheForTest;
  * cleaning up the corresponding Secret Service entry when finished.
  */
 const node_child_process_1 = require("node:child_process");
-const node_util_1 = require("node:util");
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -104,7 +103,6 @@ const HKDF_INFO = Buffer.from('oversky-cred-kek-v1');
 /** Filesystem paths for Tier-3 IKM components. */
 const PATH_LOGINUID = '/proc/self/loginuid';
 const PATH_MACHINE_ID = '/etc/machine-id';
-const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
 let _execFileForTest = null;
 /**
  * @internal Test seam — inject a mock execFile for hermetic tests so the
@@ -118,23 +116,38 @@ function __setExecFileForTest(fn) {
     _secretToolProbeCache = undefined;
     _tierSelection = null;
 }
-/** Default execFile wrapper used when no test override is installed. */
-const defaultExec = async (file, args, options) => {
-    const result = await execFileAsync(file, args, {
-        encoding: 'utf-8',
-        ...(options ?? {}),
+/**
+ * Default execFile wrapper used when no test override is installed.
+ *
+ * `input` is WRITTEN to the child's stdin here, and stdin is always closed. The
+ * previous version forwarded `input` as an execFile option — but only the SYNC
+ * child_process functions honour `input`; async `execFile` ignores it. So
+ * `secret-tool store`, which reads the secret from stdin, got neither the secret
+ * nor EOF and waited forever: Tier-2 enrollment could not complete on any Linux
+ * desktop with a working Secret Service. Closing stdin also means no other call
+ * can block on a tool that unexpectedly reads it.
+ */
+const defaultExec = (file, args, options) => new Promise((resolve, reject) => {
+    const { input, ...execOptions } = options ?? {};
+    const child = (0, node_child_process_1.execFile)(file, args, { encoding: 'utf-8', ...execOptions }, (err, stdout, stderr) => {
+        // Defensive coercion — when callers override the encoding, output may
+        // surface as Buffer; normalize both shapes.
+        const out = typeof stdout === 'string' ? stdout : Buffer.from(stdout).toString('utf-8');
+        const errOut = typeof stderr === 'string' ? stderr : Buffer.from(stderr).toString('utf-8');
+        if (err) {
+            // Same shape promisify(execFile) produced, which the probe reads.
+            reject(Object.assign(err, { stdout: out, stderr: errOut }));
+            return;
+        }
+        resolve({ stdout: out, stderr: errOut });
     });
-    // Defensive coercion — when callers override the encoding, stdout may
-    // surface as Buffer/Uint8Array; the typeof guard keeps both shapes safe.
-    return {
-        stdout: typeof result.stdout === 'string'
-            ? result.stdout
-            : Buffer.from(result.stdout).toString('utf-8'),
-        stderr: typeof result.stderr === 'string'
-            ? result.stderr
-            : Buffer.from(result.stderr).toString('utf-8'),
-    };
-};
+    if (child.stdin) {
+        // A child that exits without reading stdin makes the write fail with EPIPE;
+        // the exit status is what reports that, not this stream.
+        child.stdin.on('error', () => undefined);
+        child.stdin.end(input ?? '');
+    }
+});
 function exec(file, args, options) {
     const impl = _execFileForTest ?? defaultExec;
     return impl(file, args, { encoding: 'utf-8', ...options });
@@ -166,6 +179,41 @@ function readFileTrimmed(path) {
 // ---------------------------------------------------------------------------
 /** `undefined` = not yet probed; `boolean` = cached probe outcome. */
 let _secretToolProbeCache;
+/**
+ * True when `secret-tool` never started, as opposed to starting and exiting
+ * non-zero.
+ *
+ * `execFile` reports the two differently: a process that ran and failed carries
+ * its numeric exit code, and a spawn that failed carries a STRING errno. Only
+ * `ENOENT` used to count as "missing", so every other spawn failure read as a
+ * working binary — and the probe then picked the libsecret tier, whose `store`
+ * cannot succeed either, which disables the credential envelope and makes the CLI
+ * refuse to persist any credential at all.
+ *
+ * The case that found it: a PATH entry the process may not search. execvp
+ * reports EACCES rather than ENOENT once it has met one, and a systemd unit that
+ * makes /snap inaccessible while PATH still lists /snap/bin (the Dedicated Runtime
+ * daemon sandbox did) turns every missing binary into EACCES.
+ */
+function secretToolDidNotRun(err) {
+    const { code, status } = err;
+    return (typeof code === 'string' && SECRET_TOOL_UNRUNNABLE.has(code)) || status === 127;
+}
+/**
+ * Spawn errnos that mean the binary cannot be executed from here, permanently
+ * for this process. Deliberately NOT every string errno: EAGAIN, EMFILE or ENOMEM
+ * are transient, and caching "absent" on one of those would move a machine whose
+ * libsecret works onto the machine-id tier for the rest of the process — where the
+ * existing wrapped key cannot be opened and would be re-enrolled over.
+ */
+const SECRET_TOOL_UNRUNNABLE = new Set([
+    'ENOENT',
+    'EACCES',
+    'ENOTDIR',
+    'ELOOP',
+    'ENOEXEC',
+    'EPERM',
+]);
 /**
  * Probe secret-tool availability. Two checks:
  *   1. `secret-tool --version` — ENOENT or exit 127 means binary missing.
@@ -183,9 +231,7 @@ async function probeSecretTool() {
         await exec('secret-tool', ['--version']);
     }
     catch (err) {
-        const code = err.code;
-        const status = err.status;
-        if (code === 'ENOENT' || status === 127) {
+        if (secretToolDidNotRun(err)) {
             _secretToolProbeCache = false;
             return false;
         }
@@ -199,6 +245,10 @@ async function probeSecretTool() {
         _secretToolProbeCache = true;
     }
     catch (err) {
+        if (secretToolDidNotRun(err)) {
+            _secretToolProbeCache = false;
+            return false;
+        }
         const stderr = err.stderr ?? '';
         const isTransportError = DBUS_TRANSPORT_ERRORS.some((s) => stderr.includes(s));
         if (isTransportError) {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -65,6 +65,16 @@ export declare const SENSITIVE_ENV_PREFIXES: readonly string[];
  * per-request allow-list, never by ambient inheritance.
  */
 export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -40,7 +40,7 @@
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
 exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 /**
  * Env vars that must NEVER reach a spawned subprocess.
@@ -110,6 +110,16 @@ exports.SENSITIVE_ENV_SUFFIXES = [
     '_PASSWORD',
     '_CREDENTIALS',
 ];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+exports.SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
@@ -145,6 +155,12 @@ function sanitizeSpawnEnv(env) {
         if (!stripped && exports.SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
             stripped = true;
         }
+        if (!stripped) {
+            const segments = key.split('_');
+            if (exports.SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
+                stripped = true;
+            }
+        }
         if (stripped)
             continue;
         out[key] = value;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -32,7 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -135,7 +135,7 @@ export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConf
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/linux.js

@@ -54,7 +54,6 @@
  * cleaning up the corresponding Secret Service entry when finished.
  */
 import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
 import crypto from 'node:crypto';
 import os from 'node:os';
 import fs from 'node:fs';
@@ -94,7 +93,6 @@ const HKDF_INFO = Buffer.from('oversky-cred-kek-v1');
 /** Filesystem paths for Tier-3 IKM components. */
 const PATH_LOGINUID = '/proc/self/loginuid';
 const PATH_MACHINE_ID = '/etc/machine-id';
-const execFileAsync = promisify(execFile);
 let _execFileForTest = null;
 /**
  * @internal Test seam — inject a mock execFile for hermetic tests so the
@@ -108,23 +106,38 @@ export function __setExecFileForTest(fn) {
     _secretToolProbeCache = undefined;
     _tierSelection = null;
 }
-/** Default execFile wrapper used when no test override is installed. */
-const defaultExec = async (file, args, options) => {
-    const result = await execFileAsync(file, args, {
-        encoding: 'utf-8',
-        ...(options ?? {}),
+/**
+ * Default execFile wrapper used when no test override is installed.
+ *
+ * `input` is WRITTEN to the child's stdin here, and stdin is always closed. The
+ * previous version forwarded `input` as an execFile option — but only the SYNC
+ * child_process functions honour `input`; async `execFile` ignores it. So
+ * `secret-tool store`, which reads the secret from stdin, got neither the secret
+ * nor EOF and waited forever: Tier-2 enrollment could not complete on any Linux
+ * desktop with a working Secret Service. Closing stdin also means no other call
+ * can block on a tool that unexpectedly reads it.
+ */
+const defaultExec = (file, args, options) => new Promise((resolve, reject) => {
+    const { input, ...execOptions } = options ?? {};
+    const child = execFile(file, args, { encoding: 'utf-8', ...execOptions }, (err, stdout, stderr) => {
+        // Defensive coercion — when callers override the encoding, output may
+        // surface as Buffer; normalize both shapes.
+        const out = typeof stdout === 'string' ? stdout : Buffer.from(stdout).toString('utf-8');
+        const errOut = typeof stderr === 'string' ? stderr : Buffer.from(stderr).toString('utf-8');
+        if (err) {
+            // Same shape promisify(execFile) produced, which the probe reads.
+            reject(Object.assign(err, { stdout: out, stderr: errOut }));
+            return;
+        }
+        resolve({ stdout: out, stderr: errOut });
     });
-    // Defensive coercion — when callers override the encoding, stdout may
-    // surface as Buffer/Uint8Array; the typeof guard keeps both shapes safe.
-    return {
-        stdout: typeof result.stdout === 'string'
-            ? result.stdout
-            : Buffer.from(result.stdout).toString('utf-8'),
-        stderr: typeof result.stderr === 'string'
-            ? result.stderr
-            : Buffer.from(result.stderr).toString('utf-8'),
-    };
-};
+    if (child.stdin) {
+        // A child that exits without reading stdin makes the write fail with EPIPE;
+        // the exit status is what reports that, not this stream.
+        child.stdin.on('error', () => undefined);
+        child.stdin.end(input ?? '');
+    }
+});
 function exec(file, args, options) {
     const impl = _execFileForTest ?? defaultExec;
     return impl(file, args, { encoding: 'utf-8', ...options });
@@ -156,6 +169,41 @@ function readFileTrimmed(path) {
 // ---------------------------------------------------------------------------
 /** `undefined` = not yet probed; `boolean` = cached probe outcome. */
 let _secretToolProbeCache;
+/**
+ * True when `secret-tool` never started, as opposed to starting and exiting
+ * non-zero.
+ *
+ * `execFile` reports the two differently: a process that ran and failed carries
+ * its numeric exit code, and a spawn that failed carries a STRING errno. Only
+ * `ENOENT` used to count as "missing", so every other spawn failure read as a
+ * working binary — and the probe then picked the libsecret tier, whose `store`
+ * cannot succeed either, which disables the credential envelope and makes the CLI
+ * refuse to persist any credential at all.
+ *
+ * The case that found it: a PATH entry the process may not search. execvp
+ * reports EACCES rather than ENOENT once it has met one, and a systemd unit that
+ * makes /snap inaccessible while PATH still lists /snap/bin (the Dedicated Runtime
+ * daemon sandbox did) turns every missing binary into EACCES.
+ */
+function secretToolDidNotRun(err) {
+    const { code, status } = err;
+    return (typeof code === 'string' && SECRET_TOOL_UNRUNNABLE.has(code)) || status === 127;
+}
+/**
+ * Spawn errnos that mean the binary cannot be executed from here, permanently
+ * for this process. Deliberately NOT every string errno: EAGAIN, EMFILE or ENOMEM
+ * are transient, and caching "absent" on one of those would move a machine whose
+ * libsecret works onto the machine-id tier for the rest of the process — where the
+ * existing wrapped key cannot be opened and would be re-enrolled over.
+ */
+const SECRET_TOOL_UNRUNNABLE = new Set([
+    'ENOENT',
+    'EACCES',
+    'ENOTDIR',
+    'ELOOP',
+    'ENOEXEC',
+    'EPERM',
+]);
 /**
  * Probe secret-tool availability. Two checks:
  *   1. `secret-tool --version` — ENOENT or exit 127 means binary missing.
@@ -173,9 +221,7 @@ async function probeSecretTool() {
         await exec('secret-tool', ['--version']);
     }
     catch (err) {
-        const code = err.code;
-        const status = err.status;
-        if (code === 'ENOENT' || status === 127) {
+        if (secretToolDidNotRun(err)) {
             _secretToolProbeCache = false;
             return false;
         }
@@ -189,6 +235,10 @@ async function probeSecretTool() {
         _secretToolProbeCache = true;
     }
     catch (err) {
+        if (secretToolDidNotRun(err)) {
+            _secretToolProbeCache = false;
+            return false;
+        }
         const stderr = err.stderr ?? '';
         const isTransportError = DBUS_TRANSPORT_ERRORS.some((s) => stderr.includes(s));
         if (isTransportError) {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.d.ts

@@ -65,6 +65,16 @@ export declare const SENSITIVE_ENV_PREFIXES: readonly string[];
  * per-request allow-list, never by ambient inheritance.
  */
 export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.js

@@ -106,6 +106,16 @@ export const SENSITIVE_ENV_SUFFIXES = [
     '_PASSWORD',
     '_CREDENTIALS',
 ];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export const SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
@@ -141,6 +151,12 @@ export function sanitizeSpawnEnv(env) {
         if (!stripped && SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
             stripped = true;
         }
+        if (!stripped) {
+            const segments = key.split('_');
+            if (SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
+                stripped = true;
+            }
+        }
         if (stripped)
             continue;
         out[key] = value;

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {