@skrr-ai/cli 0.1.25 → 0.1.27

package/dist/lib/edge-error-page.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * edge-error-page.ts — say what an HTML error page from the EDGE means, instead
+ * of printing it.
+ *
+ * Every API route answers in JSON. An HTML page in an error response therefore
+ * did not come from the API: it is CloudFront, its web application firewall, or
+ * a load balancer answering in the API's place. Printed as-is it is a screen of
+ * markup whose one useful line ("Request blocked", a request id) is buried, and
+ * treated as an API answer it is misleading in a specific way — a 403 reads as
+ * "you lack permission", and CloudFront's 504 page tells the reader to "try again
+ * later", which for a write that is still running repeats it.
+ *
+ * Both happened to `skrr machines dedicated exec` (OSK-8700, OSK-8705): a shell
+ * command containing `http://10.0.0.10/` came back as CloudFront's raw
+ * "403 ERROR / Request blocked" page, and a command running past 60 seconds as
+ * its raw 504 page while it kept running on the machine.
+ *
+ * General on purpose: nothing here knows which command asked.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isHtmlErrorPage = isHtmlErrorPage;
+exports.describeEdgeErrorPage = describeEdgeErrorPage;
+const HTML_START = /^\s*(<!doctype html\b|<html\b)/i;
+const EDGE_MARK = /Generated by cloudfront|The request could not be satisfied/i;
+const REQUEST_ID = /Request ID:\s*([A-Za-z0-9_=-]{8,128})/i;
+const MARKUP = /<(html|head|body|title|h1|pre)\b/i;
+function isJson(body) {
+    const trimmed = body.trim();
+    if (!trimmed.startsWith('{') && !trimmed.startsWith('['))
+        return false;
+    try {
+        JSON.parse(trimmed);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * True when an error response body is an HTML page rather than an API answer.
+ *
+ * A JSON body is never a page, whatever its text says: an API refusal that
+ * quotes "The request could not be satisfied" or an HTML fragment in its message
+ * must keep its own words (the base command's handler already gates on "no JSON
+ * body"; this makes every caller agree). The CloudFront wording counts only
+ * inside markup, never on its own.
+ */
+function isHtmlErrorPage(body) {
+    if (typeof body !== 'string' || !body || isJson(body))
+        return false;
+    return HTML_START.test(body) || (MARKUP.test(body) && EDGE_MARK.test(body));
+}
+function readOnly(method) {
+    const upper = (method || 'GET').toUpperCase();
+    return upper === 'GET' || upper === 'HEAD' || upper === 'OPTIONS';
+}
+function where(host) {
+    return host ? ` (${host})` : '';
+}
+/**
+ * Describe an HTML error page, or return null when the body is not one (a JSON
+ * refusal from the API must keep its own words).
+ */
+function describeEdgeErrorPage(input) {
+    const { body, method, host } = input;
+    const status = Number(input.status) || 0;
+    if (!isHtmlErrorPage(body))
+        return null;
+    const requestId = REQUEST_ID.exec(String(body))?.[1];
+    const quote = requestId ? ` Edge request id: ${requestId} — quote it when reporting this.` : '';
+    const writeOutcome = readOnly(method)
+        ? 'This request changed nothing; retry shortly.'
+        : 'For a write, the request may still have been carried out, or may still be running — check before sending it again.';
+    if (status === 403) {
+        return {
+            status,
+            code: 'EDGE_REQUEST_BLOCKED',
+            ...(requestId ? { requestId } : {}),
+            message: `The request was blocked at the edge before it reached the API${where(host)}: a web ` +
+                'application firewall rule matched something in it. This is not a problem with your ' +
+                'account or permissions. Content that resembles an attack can be enough — a URL with an ' +
+                'IP address, a relative path (../), markup or SQL, even inside a command or a document — ' +
+                'and sending the same request again will be blocked again.' +
+                quote,
+            retryable: false,
+        };
+    }
+    if (status === 504) {
+        return {
+            status,
+            code: 'EDGE_GATEWAY_TIMEOUT',
+            ...(requestId ? { requestId } : {}),
+            message: `The edge stopped waiting for the API${where(host)} and answered HTTP 504. ` +
+                writeOutcome +
+                quote,
+            retryable: readOnly(method),
+        };
+    }
+    if (status === 502 || status === 503) {
+        return {
+            status,
+            code: 'EDGE_ORIGIN_UNAVAILABLE',
+            ...(requestId ? { requestId } : {}),
+            message: `The edge could not get an answer from the API${where(host)} (HTTP ${status}). ` +
+                writeOutcome +
+                quote,
+            retryable: readOnly(method),
+        };
+    }
+    return {
+        status,
+        code: 'EDGE_ERROR_PAGE',
+        ...(requestId ? { requestId } : {}),
+        message: `The request did not get an API response: something in front of the API${where(host)} ` +
+            `answered HTTP ${status || 'error'} with an HTML page.` +
+            quote,
+        retryable: false,
+    };
+}

package/dist/lib/harnesses.d.ts

@@ -50,6 +50,12 @@ export interface Harness {
     version?: number;
     claudeEngine?: 'cli' | 'sdk';
     lastSeenAt?: string;
+    /**
+     * Registration metadata. A managed machine's rows carry `machineProduct` and
+     * `machineLeaseId`, which is the only link from a lease to the harness rows its
+     * daemon registered — the lease payload names no daemon.
+     */
+    metadata?: Record<string, unknown>;
 }
 /**
  * One open lease, as `/api/machines/leases` actually returns it.
@@ -105,7 +111,15 @@ export interface HarnessLease {
     createdAt?: string;
     updatedAt?: string;
 }
-/** `pause | resume | destroy | terminate | health-check` (MachineLeaseService). */
+/**
+ * Every action `POST /api/machines/leases/:id/actions/:action` accepts —
+ * `MACHINE_LEASE_ACTIONS` in MachineLeaseService. Which of them a given lease
+ * supports is its product's `lifecycleCapabilities`, decided by the server.
+ *
+ * `start`, `stop`, `restart` and `snapshot` were missing, so this command
+ * refused every Dedicated Runtime lifecycle verb at argument parsing — before
+ * the server that accepts them was asked — while claiming to mirror its set.
+ */
 export declare const HARNESS_LEASE_ACTIONS: string[];
 /** `user` (the default) or `workspace`. */
 export type HarnessDefaultScope = 'user' | 'workspace';

package/dist/lib/harnesses.js

@@ -23,8 +23,26 @@ exports.releaseHarnessLease = releaseHarnessLease;
 exports.performHarnessLeaseAction = performHarnessLeaseAction;
 exports.setHarnessLeaseBilling = setHarnessLeaseBilling;
 const api_fetch_1 = require("./api-fetch");
-/** `pause | resume | destroy | terminate | health-check` (MachineLeaseService). */
-exports.HARNESS_LEASE_ACTIONS = ['pause', 'resume', 'destroy', 'terminate', 'health-check'];
+/**
+ * Every action `POST /api/machines/leases/:id/actions/:action` accepts —
+ * `MACHINE_LEASE_ACTIONS` in MachineLeaseService. Which of them a given lease
+ * supports is its product's `lifecycleCapabilities`, decided by the server.
+ *
+ * `start`, `stop`, `restart` and `snapshot` were missing, so this command
+ * refused every Dedicated Runtime lifecycle verb at argument parsing — before
+ * the server that accepts them was asked — while claiming to mirror its set.
+ */
+exports.HARNESS_LEASE_ACTIONS = [
+    'pause',
+    'resume',
+    'start',
+    'stop',
+    'restart',
+    'snapshot',
+    'destroy',
+    'terminate',
+    'health-check',
+];
 // ── Fleet reads ────────────────────────────────────────────────────────────
 async function listHarnesses(filters = {}) {
     const params = new URLSearchParams();

package/dist/lib/hosted-machines.js

@@ -25,6 +25,7 @@ exports.execHostedMachine = execHostedMachine;
 exports.waitForHostedMachineReady = waitForHostedMachineReady;
 exports.offlineForLabel = offlineForLabel;
 const api_fetch_1 = require("./api-fetch");
+const edge_error_page_1 = require("./edge-error-page");
 function curateHostedMachineList(response) {
     return {
         object: 'list',
@@ -148,6 +149,12 @@ function formatHostedMachineApiError(err) {
     if (err.status === 401) {
         return null;
     }
+    // An HTML page is the edge answering in the API's place; describe it rather
+    // than printing its markup (OSK-8700).
+    const edge = (0, edge_error_page_1.describeEdgeErrorPage)({ status: err.status, body: err.body, method: err.method });
+    if (edge) {
+        return edge.message;
+    }
     try {
         const parsed = JSON.parse(err.body);
         return parsed.message || parsed.error || parsed.code || null;

package/dist/lib/node-adapter.js

@@ -277,7 +277,7 @@ function createNodeAdapter(opts = {}) {
         const accessToken = outcome.outcome.accessToken;
         setAdapterCredentialOverride({
             token: accessToken,
-            source: 'keychain',
+            source: outcome.outcome.storedIn === 'keychain' ? 'keychain' : 'file',
             kind: (0, auth_core_1.classifyTokenKind)(accessToken),
         });
         onTokenRefresh?.(accessToken, outcome.outcome.refreshToken);

package/dist/lib/sky-code.d.ts

@@ -94,6 +94,32 @@ export declare function resolveEngine(env?: NodeJS.ProcessEnv): EngineResolution
  * into a mode the user did not ask for.
  */
 export declare function buildEngineArgs(subcommand: string | null, passthrough: readonly string[]): string[];
+/**
+ * The uid the Dedicated Runtime workload exec wrapper stamps into everything it
+ * launches (`infrastructure/packer/files/skrr-workload-exec.c`). Mirrors the
+ * daemon's `DEDICATED_WORKLOAD_UID_ENV`.
+ */
+export declare const DEDICATED_WORKLOAD_UID_ENV = "SKRR_WORKLOAD_UID";
+/**
+ * True when this process is tenant code on a Dedicated Runtime guest: a
+ * terminal, `skrr machines dedicated exec`, an agent's Bash, or an engine
+ * session the daemon launched.
+ *
+ * The variable alone is not enough — anyone can export it — so the process must
+ * also BE that uid, the same two-part test the daemon applies. Getting it wrong
+ * only changes which message is printed; nothing is authorized by it.
+ */
+export declare function isDedicatedRuntimeWorkload(env?: NodeJS.ProcessEnv, getuid?: (() => number) | undefined): boolean;
+/**
+ * Why nothing installs an engine on a Dedicated Runtime.
+ *
+ * The daemon there installs into its own 0700 home, which the workload identity
+ * that runs every engine cannot enter, so both the daemon and the control plane
+ * refuse (`DEDICATED_RUNTIME_ENGINE_SHIPS_WITH_IMAGE`). A build in the user's
+ * own HOME would run in this terminal but never in a session the daemon starts,
+ * so it is not offered either.
+ */
+export declare const DEDICATED_RUNTIME_ENGINE_MESSAGE = "On a Dedicated Runtime, coding engines ship with the machine image. They cannot be installed on a running machine; a newer engine arrives with a newer image.";
 /**
  * Message shown when no engine is installed.
  *
@@ -116,8 +142,11 @@ export declare function buildEngineArgs(subcommand: string | null, passthrough:
  * Keep this in step with what actually ships. An install instruction that does
  * not work is worse than none: it moves the failure from "I could not find how
  * to install it" to "I did what it said and it broke".
+ *
+ * That is exactly why a Dedicated Runtime gets different text: every route
+ * below fails there (see {@link DEDICATED_RUNTIME_ENGINE_MESSAGE}).
  */
-export declare function notInstalledMessage(): string;
+export declare function notInstalledMessage(env?: NodeJS.ProcessEnv): string;
 /**
  * Spawn the engine with stdio inherited, resolving with its exit code.
  *

package/dist/lib/sky-code.js

@@ -17,13 +17,14 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ENGINE_PATH_ENV = void 0;
+exports.DEDICATED_RUNTIME_ENGINE_MESSAGE = exports.DEDICATED_WORKLOAD_UID_ENV = exports.ENGINE_PATH_ENV = void 0;
 exports.engineHome = engineHome;
 exports.skyCodeInstructionHome = skyCodeInstructionHome;
 exports.managedEnginePath = managedEnginePath;
 exports.legacyManagedEnginePath = legacyManagedEnginePath;
 exports.resolveEngine = resolveEngine;
 exports.buildEngineArgs = buildEngineArgs;
+exports.isDedicatedRuntimeWorkload = isDedicatedRuntimeWorkload;
 exports.notInstalledMessage = notInstalledMessage;
 exports.inheritedProviderCredentials = inheritedProviderCredentials;
 exports.hasProviderCredential = hasProviderCredential;
@@ -204,6 +205,35 @@ function resolveEngine(env = process.env) {
 function buildEngineArgs(subcommand, passthrough) {
     return subcommand === null ? [...passthrough] : [subcommand, ...passthrough];
 }
+/**
+ * The uid the Dedicated Runtime workload exec wrapper stamps into everything it
+ * launches (`infrastructure/packer/files/skrr-workload-exec.c`). Mirrors the
+ * daemon's `DEDICATED_WORKLOAD_UID_ENV`.
+ */
+exports.DEDICATED_WORKLOAD_UID_ENV = 'SKRR_WORKLOAD_UID';
+/**
+ * True when this process is tenant code on a Dedicated Runtime guest: a
+ * terminal, `skrr machines dedicated exec`, an agent's Bash, or an engine
+ * session the daemon launched.
+ *
+ * The variable alone is not enough — anyone can export it — so the process must
+ * also BE that uid, the same two-part test the daemon applies. Getting it wrong
+ * only changes which message is printed; nothing is authorized by it.
+ */
+function isDedicatedRuntimeWorkload(env = process.env, getuid = process.getuid?.bind(process)) {
+    const uid = Number(env[exports.DEDICATED_WORKLOAD_UID_ENV]);
+    return Number.isInteger(uid) && uid > 0 && typeof getuid === 'function' && getuid() === uid;
+}
+/**
+ * Why nothing installs an engine on a Dedicated Runtime.
+ *
+ * The daemon there installs into its own 0700 home, which the workload identity
+ * that runs every engine cannot enter, so both the daemon and the control plane
+ * refuse (`DEDICATED_RUNTIME_ENGINE_SHIPS_WITH_IMAGE`). A build in the user's
+ * own HOME would run in this terminal but never in a session the daemon starts,
+ * so it is not offered either.
+ */
+exports.DEDICATED_RUNTIME_ENGINE_MESSAGE = 'On a Dedicated Runtime, coding engines ship with the machine image. They cannot be installed on a running machine; a newer engine arrives with a newer image.';
 /**
  * Message shown when no engine is installed.
  *
@@ -226,8 +256,20 @@ function buildEngineArgs(subcommand, passthrough) {
  * Keep this in step with what actually ships. An install instruction that does
  * not work is worse than none: it moves the failure from "I could not find how
  * to install it" to "I did what it said and it broke".
+ *
+ * That is exactly why a Dedicated Runtime gets different text: every route
+ * below fails there (see {@link DEDICATED_RUNTIME_ENGINE_MESSAGE}).
  */
-function notInstalledMessage() {
+function notInstalledMessage(env = process.env) {
+    if (isDedicatedRuntimeWorkload(env)) {
+        return [
+            'The skrr Code engine (`sky-code`) is not on this machine.',
+            '',
+            exports.DEDICATED_RUNTIME_ENGINE_MESSAGE,
+            'This machine was built from an image without it; it arrives when the',
+            "machine's image is replaced. `claude` and `codex` are on the image now.",
+        ].join('\n');
+    }
     return [
         'The skrr Code engine (`sky-code`) is not installed on this machine.',
         '',

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -32,7 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -11,7 +11,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
 exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
+exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -289,6 +289,7 @@ Object.defineProperty(exports, "sanitizeSpawnEnv", { enumerable: true, get: func
 Object.defineProperty(exports, "SENSITIVE_ENV_VARS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_VARS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIXES; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
+Object.defineProperty(exports, "SENSITIVE_ENV_NAME_TOKENS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_NAME_TOKENS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -65,6 +65,16 @@ export declare const SENSITIVE_ENV_PREFIXES: readonly string[];
  * per-request allow-list, never by ambient inheritance.
  */
 export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -40,7 +40,7 @@
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
 exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 /**
  * Env vars that must NEVER reach a spawned subprocess.
@@ -110,6 +110,16 @@ exports.SENSITIVE_ENV_SUFFIXES = [
     '_PASSWORD',
     '_CREDENTIALS',
 ];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+exports.SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
@@ -145,6 +155,12 @@ function sanitizeSpawnEnv(env) {
         if (!stripped && exports.SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
             stripped = true;
         }
+        if (!stripped) {
+            const segments = key.split('_');
+            if (exports.SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
+                stripped = true;
+            }
+        }
         if (stripped)
             continue;
         out[key] = value;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -32,7 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -135,7 +135,7 @@ export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConf
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.d.ts

@@ -65,6 +65,16 @@ export declare const SENSITIVE_ENV_PREFIXES: readonly string[];
  * per-request allow-list, never by ambient inheritance.
  */
 export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.js

@@ -106,6 +106,16 @@ export const SENSITIVE_ENV_SUFFIXES = [
     '_PASSWORD',
     '_CREDENTIALS',
 ];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export const SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
@@ -141,6 +151,12 @@ export function sanitizeSpawnEnv(env) {
         if (!stripped && SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
             stripped = true;
         }
+        if (!stripped) {
+            const segments = key.split('_');
+            if (SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
+                stripped = true;
+            }
+        }
         if (stripped)
             continue;
         out[key] = value;

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {