@skrr-ai/cli 0.1.26 → 0.1.28

package/dist/lib/dedicated-machines.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEDICATED_FILE_MAX_BYTES = exports.DEDICATED_FILE_CHUNK_BYTES = exports.DEDICATED_EXEC_MAX_TIMEOUT_MS = exports.DEDICATED_MACHINE_PRODUCT = exports.DEDICATED_LEASE_ACTIONS = void 0;
+exports.DEDICATED_FILE_MAX_BYTES = exports.DEDICATED_FILE_CHUNK_BYTES = exports.DEDICATED_EXEC_DEFAULT_TIMEOUT_MS = exports.DEDICATED_EXEC_MAX_TIMEOUT_MS = exports.DEDICATED_MACHINE_PRODUCT = exports.DEDICATED_LEASE_ACTIONS = void 0;
 exports.dedicatedRuntimeCreateInput = dedicatedRuntimeCreateInput;
 exports.isDedicatedRepositoryRef = isDedicatedRepositoryRef;
 exports.createDedicatedRuntime = createDedicatedRuntime;
@@ -8,10 +8,13 @@ exports.listDedicatedRuntimes = listDedicatedRuntimes;
 exports.getDedicatedRuntime = getDedicatedRuntime;
 exports.performDedicatedLeaseAction = performDedicatedLeaseAction;
 exports.growDedicatedRuntime = growDedicatedRuntime;
+exports.restoreDeletedDedicatedRuntime = restoreDeletedDedicatedRuntime;
 exports.setDedicatedRuntimeSpendingLimit = setDedicatedRuntimeSpendingLimit;
 exports.closeDedicatedRuntimeIncidentHold = closeDedicatedRuntimeIncidentHold;
 exports.destroyDedicatedRuntime = destroyDedicatedRuntime;
 exports.execDedicatedRuntime = execDedicatedRuntime;
+exports.startDedicatedRuntimeExecution = startDedicatedRuntimeExecution;
+exports.observeDedicatedRuntimeExecution = observeDedicatedRuntimeExecution;
 exports.readDedicatedRuntimeFileChunk = readDedicatedRuntimeFileChunk;
 exports.writeDedicatedRuntimeFileChunk = writeDedicatedRuntimeFileChunk;
 exports.parseDedicatedCopyEndpoints = parseDedicatedCopyEndpoints;
@@ -20,14 +23,17 @@ exports.dedicatedLeaseState = dedicatedLeaseState;
 exports.dedicatedLeaseDisplayName = dedicatedLeaseDisplayName;
 exports.formatUsdCents = formatUsdCents;
 exports.dedicatedSpendSummary = dedicatedSpendSummary;
+exports.describeDedicatedDeletion = describeDedicatedDeletion;
 exports.describeDedicatedLease = describeDedicatedLease;
 exports.dedicatedLeaseHarnesses = dedicatedLeaseHarnesses;
+exports.dedicatedLeaseIdForDaemon = dedicatedLeaseIdForDaemon;
 exports.dedicatedTerminalHarness = dedicatedTerminalHarness;
 exports.selectDedicatedAttachHarness = selectDedicatedAttachHarness;
 exports.dedicatedCatalogFromProducts = dedicatedCatalogFromProducts;
 exports.dedicatedRuntimeApiErrorCode = dedicatedRuntimeApiErrorCode;
 exports.formatDedicatedRuntimeApiError = formatDedicatedRuntimeApiError;
 const api_fetch_1 = require("./api-fetch");
+const edge_error_page_1 = require("./edge-error-page");
 exports.DEDICATED_LEASE_ACTIONS = [
     'start',
     'stop',
@@ -85,11 +91,20 @@ function isDedicatedRepositoryRef(value) {
 // unreachable by domain-api-parity while being perfectly reachable, which is the
 // reading that trains people to allowlist things that are fine. Same shape as
 // `withQuery` on the `request.*` side.
-function withDedicatedScope(path, scope) {
-    if (!scope.workspaceId)
+//
+// Query parameters therefore go in `query`, never into the literal: the coverage
+// reader matches the literal against the route table, and a `?name=` inside it
+// makes the endpoint read as unreachable.
+function withDedicatedScope(path, scope, query = {}) {
+    const params = Object.entries(query);
+    if (scope.workspaceId)
+        params.push(['workspaceId', scope.workspaceId]);
+    if (params.length === 0)
         return path;
     const separator = path.includes('?') ? '&' : '?';
-    return `${path}${separator}workspaceId=${encodeURIComponent(scope.workspaceId)}`;
+    return `${path}${separator}${params
+        .map(([name, value]) => `${encodeURIComponent(name)}=${encodeURIComponent(value)}`)
+        .join('&')}`;
 }
 async function createDedicatedRuntime(input) {
     const { requestId, workspaceId, ...body } = input;
@@ -117,6 +132,25 @@ async function growDedicatedRuntime(leaseId, storageGb, options = {}) {
         ...(options.requestId ? { headers: { 'Idempotency-Key': options.requestId } } : {}),
     });
 }
+/**
+ * Restore a deleted Dedicated Runtime into a NEW machine, from the final recovery
+ * point its deletion kept. Only inside the deletion's recovery window, and once
+ * per deletion; the response's `lease` is the new machine. The cap defaults to
+ * the deleted machine's.
+ */
+async function restoreDeletedDedicatedRuntime(leaseId, options = {}) {
+    const body = {};
+    if (options.displayName)
+        body.displayName = options.displayName;
+    if (options.monthlySpendingLimitCents !== undefined) {
+        body.monthlySpendingLimitCents = options.monthlySpendingLimitCents;
+    }
+    return (0, api_fetch_1.apiFetch)(withDedicatedScope(`/api/machines/dedicated/${encodeURIComponent(leaseId)}/restore`, options), {
+        method: 'POST',
+        body,
+        ...(options.requestId ? { headers: { 'Idempotency-Key': options.requestId } } : {}),
+    });
+}
 /**
  * Change the monthly spending cap of one lease.
  *
@@ -143,8 +177,16 @@ async function destroyDedicatedRuntime(leaseId, options = {}) {
 }
 /** The server's ceiling for one exec; documented beside the route. */
 exports.DEDICATED_EXEC_MAX_TIMEOUT_MS = 10 * 60 * 1000;
+/** The server's default when a command names no timeout. */
+exports.DEDICATED_EXEC_DEFAULT_TIMEOUT_MS = 2 * 60 * 1000;
 /**
- * Run one command on the machine as the workload user.
+ * Run one command on the machine as the workload user, in ONE request.
+ *
+ * The synchronous route, kept for servers that predate `executions`. It holds
+ * the request open while the command runs, so behind CloudFront a command that
+ * runs past ~60 s is cut off at the edge while it keeps running (OSK-8705).
+ * `runDedicatedExec` (dedicated-exec.ts) starts and observes instead, and falls
+ * back to this only when the server has no `executions` route.
  *
  * Not idempotent and not retried: `apiFetch` gives each call a fresh
  * idempotency key, which is the rule for an unfenced write — running the same
@@ -160,6 +202,27 @@ async function execDedicatedRuntime(leaseId, input, scope = {}) {
         },
     });
 }
+/**
+ * Start one command. `requestId` is the idempotency key: the same id, for the
+ * same command on the same lease, returns the execution it already started —
+ * so a retry after a lost response never runs the command twice.
+ */
+async function startDedicatedRuntimeExecution(leaseId, input, options) {
+    return (0, api_fetch_1.apiFetch)(withDedicatedScope(`/api/machines/dedicated/${encodeURIComponent(leaseId)}/executions`, options), {
+        method: 'POST',
+        body: {
+            command: input.command,
+            ...(input.cwd ? { cwd: input.cwd } : {}),
+            ...(input.timeoutMs !== undefined ? { timeoutMs: input.timeoutMs } : {}),
+        },
+        headers: { 'X-Idempotency-Key': options.requestId },
+        ...(options.signal ? { signal: options.signal } : {}),
+    });
+}
+/** Read a started command, letting the server hold the answer up to `waitMs` for it to end. */
+async function observeDedicatedRuntimeExecution(leaseId, executionId, options) {
+    return (0, api_fetch_1.apiFetch)(withDedicatedScope(`/api/machines/dedicated/${encodeURIComponent(leaseId)}/executions/${encodeURIComponent(executionId)}`, options, { waitMs: String(Math.max(0, Math.floor(options.waitMs))) }), options.signal ? { signal: options.signal } : {});
+}
 /** Mirrors the daemon's bounds (daemon/src/tools/file-transfer.ts). */
 exports.DEDICATED_FILE_CHUNK_BYTES = 512 * 1024;
 exports.DEDICATED_FILE_MAX_BYTES = 64 * 1024 * 1024;
@@ -234,12 +297,30 @@ function dedicatedSpendSummary(lease) {
  * lease that is still `requested` has no resources, daemon or spend yet, and a
  * missing value is omitted rather than printed as a column of dashes.
  */
+/** One line saying what a deletion still allows. */
+function describeDedicatedDeletion(deletion, leaseId) {
+    if (deletion.restoredToLeaseId) {
+        return `restored into ${deletion.restoredToLeaseId}`;
+    }
+    if (deletion.status === 'completed') {
+        return `permanently deleted${deletion.completedAt ? ` ${deletion.completedAt}` : ''}; no copy remains`;
+    }
+    if (deletion.status === 'purging') {
+        return 'recovery window closed; every copy is being deleted';
+    }
+    if (deletion.restorable) {
+        return `restorable until ${deletion.recoverableUntil} — \`skrr machines dedicated restore ${leaseId || '<lease-id>'}\``;
+    }
+    return 'nothing to restore; every copy is deleted when the window closes';
+}
 function describeDedicatedLease(lease, harnesses = []) {
     const lines = [dedicatedLeaseDisplayName(lease)];
     const row = (label, value) => {
         if (value === undefined || value === null || value === '')
             return;
-        lines.push(`  ${label.padEnd(13)}${value}`);
+        // At least one space: `restored from` is as wide as the column and printed
+        // as `restored fromrtl_…`.
+        lines.push(`  ${`${label} `.padEnd(13)}${value}`);
     };
     row('id', dedicatedLeaseId(lease));
     row('state', lease.stateReason
@@ -291,6 +372,11 @@ function describeDedicatedLease(lease, harnesses = []) {
             .filter(Boolean)
             .join(' · '));
     }
+    const deletion = storage.deletion;
+    if (deletion?.status) {
+        row('deleted', describeDedicatedDeletion(deletion, dedicatedLeaseId(lease)));
+    }
+    row('restored from', lease.recovery?.restoredFromLeaseId);
     const hold = lease.recovery?.incidentHold;
     if (hold?.status === 'open') {
         row('incident', `hold open since ${hold.heldAt || '?'} — the failed source volume is billed until \`incident-close\``);
@@ -328,6 +414,29 @@ function dedicatedLeaseHarnesses(lease, harnesses) {
     })
         .sort((a, b) => seenAt(b) - seenAt(a));
 }
+/**
+ * The lease of the machine this process is running on, from the harness rows.
+ *
+ * Nothing in a workload process's environment names its lease — the daemon's
+ * environment (lease, generation, credentials) sits on the other side of the uid
+ * split by design. The CLI hand-off descriptor the daemon publishes to the
+ * workload group does carry the daemon's id, and every harness row that daemon
+ * registered carries `metadata.machineLeaseId`. Joining the two answers "which
+ * machine am I" with no new daemon surface.
+ */
+function dedicatedLeaseIdForDaemon(daemonId, harnesses) {
+    if (!daemonId)
+        return null;
+    const leaseIds = new Set(harnesses
+        .filter((harness) => harness.daemonId === daemonId &&
+        harness.metadata?.machineProduct === exports.DEDICATED_MACHINE_PRODUCT &&
+        typeof harness.metadata?.machineLeaseId === 'string')
+        .map((harness) => String(harness.metadata?.machineLeaseId)));
+    // One daemon serves one lease. Two would mean rows from a replaced
+    // generation disagree, and guessing between them is how `self` would act on
+    // the wrong machine.
+    return leaseIds.size === 1 ? [...leaseIds][0] : null;
+}
 /**
  * The row an interactive terminal opens on: online, local, with a daemon.
  *
@@ -485,6 +594,10 @@ function dedicatedRuntimeApiErrorCode(err) {
     if (!(err instanceof api_fetch_1.ApiFetchError)) {
         return undefined;
     }
+    const edge = (0, edge_error_page_1.describeEdgeErrorPage)({ status: err.status, body: err.body, method: err.method });
+    if (edge) {
+        return edge.code;
+    }
     try {
         const parsed = JSON.parse(err.body || '');
         if (typeof parsed.code === 'string' && parsed.code) {
@@ -503,6 +616,12 @@ function formatDedicatedRuntimeApiError(err) {
     if (err.status === 401) {
         return null;
     }
+    // An HTML page is the edge answering in the API's place — a WAF block or a
+    // gateway timeout. Printing its markup told nobody anything (OSK-8700).
+    const edge = (0, edge_error_page_1.describeEdgeErrorPage)({ status: err.status, body: err.body, method: err.method });
+    if (edge) {
+        return edge.message;
+    }
     const notFound = describeLeaseNotFound(err);
     if (notFound) {
         return notFound;

package/dist/lib/edge-error-page.d.ts

@@ -0,0 +1,49 @@
+/**
+ * edge-error-page.ts — say what an HTML error page from the EDGE means, instead
+ * of printing it.
+ *
+ * Every API route answers in JSON. An HTML page in an error response therefore
+ * did not come from the API: it is CloudFront, its web application firewall, or
+ * a load balancer answering in the API's place. Printed as-is it is a screen of
+ * markup whose one useful line ("Request blocked", a request id) is buried, and
+ * treated as an API answer it is misleading in a specific way — a 403 reads as
+ * "you lack permission", and CloudFront's 504 page tells the reader to "try again
+ * later", which for a write that is still running repeats it.
+ *
+ * Both happened to `skrr machines dedicated exec` (OSK-8700, OSK-8705): a shell
+ * command containing `http://10.0.0.10/` came back as CloudFront's raw
+ * "403 ERROR / Request blocked" page, and a command running past 60 seconds as
+ * its raw 504 page while it kept running on the machine.
+ *
+ * General on purpose: nothing here knows which command asked.
+ */
+export type EdgeErrorCode = 'EDGE_REQUEST_BLOCKED' | 'EDGE_GATEWAY_TIMEOUT' | 'EDGE_ORIGIN_UNAVAILABLE' | 'EDGE_ERROR_PAGE';
+export interface EdgeErrorPage {
+    status: number;
+    code: EdgeErrorCode;
+    /** The edge's own id for the request (CloudFront prints one), when the page carries it. */
+    requestId?: string;
+    message: string;
+    /** Whether sending the identical request again can help. */
+    retryable: boolean;
+}
+/**
+ * True when an error response body is an HTML page rather than an API answer.
+ *
+ * A JSON body is never a page, whatever its text says: an API refusal that
+ * quotes "The request could not be satisfied" or an HTML fragment in its message
+ * must keep its own words (the base command's handler already gates on "no JSON
+ * body"; this makes every caller agree). The CloudFront wording counts only
+ * inside markup, never on its own.
+ */
+export declare function isHtmlErrorPage(body: string | null | undefined): boolean;
+/**
+ * Describe an HTML error page, or return null when the body is not one (a JSON
+ * refusal from the API must keep its own words).
+ */
+export declare function describeEdgeErrorPage(input: {
+    status: number | undefined;
+    body: string | null | undefined;
+    method?: string | null;
+    host?: string | null;
+}): EdgeErrorPage | null;

package/dist/lib/edge-error-page.js

@@ -0,0 +1,120 @@
+"use strict";
+/**
+ * edge-error-page.ts — say what an HTML error page from the EDGE means, instead
+ * of printing it.
+ *
+ * Every API route answers in JSON. An HTML page in an error response therefore
+ * did not come from the API: it is CloudFront, its web application firewall, or
+ * a load balancer answering in the API's place. Printed as-is it is a screen of
+ * markup whose one useful line ("Request blocked", a request id) is buried, and
+ * treated as an API answer it is misleading in a specific way — a 403 reads as
+ * "you lack permission", and CloudFront's 504 page tells the reader to "try again
+ * later", which for a write that is still running repeats it.
+ *
+ * Both happened to `skrr machines dedicated exec` (OSK-8700, OSK-8705): a shell
+ * command containing `http://10.0.0.10/` came back as CloudFront's raw
+ * "403 ERROR / Request blocked" page, and a command running past 60 seconds as
+ * its raw 504 page while it kept running on the machine.
+ *
+ * General on purpose: nothing here knows which command asked.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isHtmlErrorPage = isHtmlErrorPage;
+exports.describeEdgeErrorPage = describeEdgeErrorPage;
+const HTML_START = /^\s*(<!doctype html\b|<html\b)/i;
+const EDGE_MARK = /Generated by cloudfront|The request could not be satisfied/i;
+const REQUEST_ID = /Request ID:\s*([A-Za-z0-9_=-]{8,128})/i;
+const MARKUP = /<(html|head|body|title|h1|pre)\b/i;
+function isJson(body) {
+    const trimmed = body.trim();
+    if (!trimmed.startsWith('{') && !trimmed.startsWith('['))
+        return false;
+    try {
+        JSON.parse(trimmed);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * True when an error response body is an HTML page rather than an API answer.
+ *
+ * A JSON body is never a page, whatever its text says: an API refusal that
+ * quotes "The request could not be satisfied" or an HTML fragment in its message
+ * must keep its own words (the base command's handler already gates on "no JSON
+ * body"; this makes every caller agree). The CloudFront wording counts only
+ * inside markup, never on its own.
+ */
+function isHtmlErrorPage(body) {
+    if (typeof body !== 'string' || !body || isJson(body))
+        return false;
+    return HTML_START.test(body) || (MARKUP.test(body) && EDGE_MARK.test(body));
+}
+function readOnly(method) {
+    const upper = (method || 'GET').toUpperCase();
+    return upper === 'GET' || upper === 'HEAD' || upper === 'OPTIONS';
+}
+function where(host) {
+    return host ? ` (${host})` : '';
+}
+/**
+ * Describe an HTML error page, or return null when the body is not one (a JSON
+ * refusal from the API must keep its own words).
+ */
+function describeEdgeErrorPage(input) {
+    const { body, method, host } = input;
+    const status = Number(input.status) || 0;
+    if (!isHtmlErrorPage(body))
+        return null;
+    const requestId = REQUEST_ID.exec(String(body))?.[1];
+    const quote = requestId ? ` Edge request id: ${requestId} — quote it when reporting this.` : '';
+    const writeOutcome = readOnly(method)
+        ? 'This request changed nothing; retry shortly.'
+        : 'For a write, the request may still have been carried out, or may still be running — check before sending it again.';
+    if (status === 403) {
+        return {
+            status,
+            code: 'EDGE_REQUEST_BLOCKED',
+            ...(requestId ? { requestId } : {}),
+            message: `The request was blocked at the edge before it reached the API${where(host)}: a web ` +
+                'application firewall rule matched something in it. This is not a problem with your ' +
+                'account or permissions. Content that resembles an attack can be enough — a URL with an ' +
+                'IP address, a relative path (../), markup or SQL, even inside a command or a document — ' +
+                'and sending the same request again will be blocked again.' +
+                quote,
+            retryable: false,
+        };
+    }
+    if (status === 504) {
+        return {
+            status,
+            code: 'EDGE_GATEWAY_TIMEOUT',
+            ...(requestId ? { requestId } : {}),
+            message: `The edge stopped waiting for the API${where(host)} and answered HTTP 504. ` +
+                writeOutcome +
+                quote,
+            retryable: readOnly(method),
+        };
+    }
+    if (status === 502 || status === 503) {
+        return {
+            status,
+            code: 'EDGE_ORIGIN_UNAVAILABLE',
+            ...(requestId ? { requestId } : {}),
+            message: `The edge could not get an answer from the API${where(host)} (HTTP ${status}). ` +
+                writeOutcome +
+                quote,
+            retryable: readOnly(method),
+        };
+    }
+    return {
+        status,
+        code: 'EDGE_ERROR_PAGE',
+        ...(requestId ? { requestId } : {}),
+        message: `The request did not get an API response: something in front of the API${where(host)} ` +
+            `answered HTTP ${status || 'error'} with an HTML page.` +
+            quote,
+        retryable: false,
+    };
+}

package/dist/lib/harnesses.d.ts

@@ -111,7 +111,15 @@ export interface HarnessLease {
     createdAt?: string;
     updatedAt?: string;
 }
-/** `pause | resume | destroy | terminate | health-check` (MachineLeaseService). */
+/**
+ * Every action `POST /api/machines/leases/:id/actions/:action` accepts —
+ * `MACHINE_LEASE_ACTIONS` in MachineLeaseService. Which of them a given lease
+ * supports is its product's `lifecycleCapabilities`, decided by the server.
+ *
+ * `start`, `stop`, `restart` and `snapshot` were missing, so this command
+ * refused every Dedicated Runtime lifecycle verb at argument parsing — before
+ * the server that accepts them was asked — while claiming to mirror its set.
+ */
 export declare const HARNESS_LEASE_ACTIONS: string[];
 /** `user` (the default) or `workspace`. */
 export type HarnessDefaultScope = 'user' | 'workspace';

package/dist/lib/harnesses.js

@@ -23,8 +23,26 @@ exports.releaseHarnessLease = releaseHarnessLease;
 exports.performHarnessLeaseAction = performHarnessLeaseAction;
 exports.setHarnessLeaseBilling = setHarnessLeaseBilling;
 const api_fetch_1 = require("./api-fetch");
-/** `pause | resume | destroy | terminate | health-check` (MachineLeaseService). */
-exports.HARNESS_LEASE_ACTIONS = ['pause', 'resume', 'destroy', 'terminate', 'health-check'];
+/**
+ * Every action `POST /api/machines/leases/:id/actions/:action` accepts —
+ * `MACHINE_LEASE_ACTIONS` in MachineLeaseService. Which of them a given lease
+ * supports is its product's `lifecycleCapabilities`, decided by the server.
+ *
+ * `start`, `stop`, `restart` and `snapshot` were missing, so this command
+ * refused every Dedicated Runtime lifecycle verb at argument parsing — before
+ * the server that accepts them was asked — while claiming to mirror its set.
+ */
+exports.HARNESS_LEASE_ACTIONS = [
+    'pause',
+    'resume',
+    'start',
+    'stop',
+    'restart',
+    'snapshot',
+    'destroy',
+    'terminate',
+    'health-check',
+];
 // ── Fleet reads ────────────────────────────────────────────────────────────
 async function listHarnesses(filters = {}) {
     const params = new URLSearchParams();

package/dist/lib/hosted-machines.js

@@ -25,6 +25,7 @@ exports.execHostedMachine = execHostedMachine;
 exports.waitForHostedMachineReady = waitForHostedMachineReady;
 exports.offlineForLabel = offlineForLabel;
 const api_fetch_1 = require("./api-fetch");
+const edge_error_page_1 = require("./edge-error-page");
 function curateHostedMachineList(response) {
     return {
         object: 'list',
@@ -148,6 +149,12 @@ function formatHostedMachineApiError(err) {
     if (err.status === 401) {
         return null;
     }
+    // An HTML page is the edge answering in the API's place; describe it rather
+    // than printing its markup (OSK-8700).
+    const edge = (0, edge_error_page_1.describeEdgeErrorPage)({ status: err.status, body: err.body, method: err.method });
+    if (edge) {
+        return edge.message;
+    }
     try {
         const parsed = JSON.parse(err.body);
         return parsed.message || parsed.error || parsed.code || null;

package/dist/lib/sky-code.js

@@ -36,6 +36,7 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = __importDefault(require("node:path"));
 const auth_core_1 = require("@skrr-ai/auth-core");
+const inference_broker_1 = require("@skrr-ai/inference-broker");
 const config_1 = require("./config");
 // Deliberately does NOT import the managed marker any more. This module used to
 // read it to decide whether a run was managed; that decision now arrives as a
@@ -468,11 +469,20 @@ function engineSpawnEnv(env, extraEnv,
 // Required, not defaulted: the safe value differs per call and a parameter that
 // can be forgotten on a security boundary will be.
 mode) {
-    return {
+    const spawnEnv = {
         ...(0, auth_core_1.sanitizeSpawnEnv)(env),
         ...(mode === 'managed' ? {} : inheritedProviderCredentials(env)),
         ...extraEnv,
     };
+    if (mode !== 'managed')
+        return spawnEnv;
+    // OSK-8758 — a managed engine reaches the broker at a synthetic host, and must
+    // never address that host to a proxy. Behind an egress proxy (a Dedicated
+    // Runtime guest) Bun wrote every broker request in proxy form, and a runtime
+    // that honoured the proxy over the socket would send the prompt to it. Layered
+    // over the env built above, so it extends whatever list the engine would
+    // otherwise have received rather than replacing it.
+    return { ...spawnEnv, ...(0, inference_broker_1.inferenceBrokerNoProxyEnv)(spawnEnv) };
 }
 async function execEngine(args, env = process.env, options = {}) {
     // Resolve the binary FIRST, before `prepare` runs.

package/dist/node_modules/@skrr-ai/data-provider/index.js

@@ -41331,6 +41331,18 @@ var nI = { get: function(e2, t2) {
       }
     });
   });
+}, patchWithOptions: function(e2, t2, o2) {
+  return v(this, void 0, void 0, function() {
+    var r2;
+    return h(this, function(a2) {
+      switch (a2.label) {
+        case 0:
+          return r2 = zk("PATCH", e2, t2, null == o2 ? void 0 : o2.headers), Mk ? [2, Mk.patch(e2, t2, Ok(f(f({}, o2), { headers: r2 })))] : [4, n.patch(e2, JSON.stringify(t2), f(f({}, o2), { headers: f({ "Content-Type": "application/json" }, r2) }))];
+        case 1:
+          return [2, a2.sent().data];
+      }
+    });
+  });
 }, refreshToken: Zk, dispatchTokenUpdatedEvent: eI, broadcastLogout: $k, classifyRefreshFailure: Xk, noteRefreshSuccess: function() {
   Yk();
 } };

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/index.d.ts

@@ -51,7 +51,7 @@
  * ESM and CJS are both emitted because the daemon is ESM and the CLI is CJS, and
  * this package exists precisely so both can host the broker.
  */
-export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, type ManagedSessionStatus, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, type GatewayCredential, type ManagedCapabilityRefresh, type ManagedCapabilityRefreshResult, type ManagedInferenceBrokerOptions, type ManagedInferenceBrokerSession, type ManagedInferenceInputTokenAccounting, type ManagedInferenceModelScope, type ManagedInferenceRequestEnvelope, type ManagedReasoningPolicy, } from './managed-inference-broker.js';
+export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, INFERENCE_BROKER_HOST, inferenceBrokerNoProxyEnv, type ManagedSessionStatus, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, type GatewayCredential, type ManagedCapabilityRefresh, type ManagedCapabilityRefreshResult, type ManagedInferenceBrokerOptions, type ManagedInferenceBrokerSession, type ManagedInferenceInputTokenAccounting, type ManagedInferenceModelScope, type ManagedInferenceRequestEnvelope, type ManagedReasoningPolicy, } from './managed-inference-broker.js';
 export { minimumCapabilityWindowMs, scheduleRenewalDelay, startRenewalLoop, type CapabilityRefreshOutcome, type RenewalLoop, type RenewalLoopOptions, type RenewalOutcome, type RenewalStopReason, } from './managed-inference-renewal.js';
 export { ModelProxyLoopbackServer, type ModelProxyForwarder } from './loopback-server.js';
 export * from './contract.js';

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/index.js

@@ -67,13 +67,15 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ModelProxyLoopbackServer = exports.startRenewalLoop = exports.scheduleRenewalDelay = exports.minimumCapabilityWindowMs = exports.isManagedInferenceModelScope = exports.startManagedInferenceBroker = exports.buildManagedInferenceRelayCredential = exports.MANAGED_STATUS_PATH = exports.MANAGED_PROMPT_CACHING_ENV = exports.MANAGED_SESSION_ENV = exports.INFERENCE_BROKER_SOCKET_ENV = exports.INFERENCE_BROKER_ORIGIN = void 0;
+exports.ModelProxyLoopbackServer = exports.startRenewalLoop = exports.scheduleRenewalDelay = exports.minimumCapabilityWindowMs = exports.isManagedInferenceModelScope = exports.startManagedInferenceBroker = exports.buildManagedInferenceRelayCredential = exports.inferenceBrokerNoProxyEnv = exports.INFERENCE_BROKER_HOST = exports.MANAGED_STATUS_PATH = exports.MANAGED_PROMPT_CACHING_ENV = exports.MANAGED_SESSION_ENV = exports.INFERENCE_BROKER_SOCKET_ENV = exports.INFERENCE_BROKER_ORIGIN = void 0;
 var managed_inference_broker_js_1 = require("./managed-inference-broker.js");
 Object.defineProperty(exports, "INFERENCE_BROKER_ORIGIN", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_ORIGIN; } });
 Object.defineProperty(exports, "INFERENCE_BROKER_SOCKET_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_SOCKET_ENV; } });
 Object.defineProperty(exports, "MANAGED_SESSION_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_SESSION_ENV; } });
 Object.defineProperty(exports, "MANAGED_PROMPT_CACHING_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_PROMPT_CACHING_ENV; } });
 Object.defineProperty(exports, "MANAGED_STATUS_PATH", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_STATUS_PATH; } });
+Object.defineProperty(exports, "INFERENCE_BROKER_HOST", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_HOST; } });
+Object.defineProperty(exports, "inferenceBrokerNoProxyEnv", { enumerable: true, get: function () { return managed_inference_broker_js_1.inferenceBrokerNoProxyEnv; } });
 Object.defineProperty(exports, "buildManagedInferenceRelayCredential", { enumerable: true, get: function () { return managed_inference_broker_js_1.buildManagedInferenceRelayCredential; } });
 Object.defineProperty(exports, "startManagedInferenceBroker", { enumerable: true, get: function () { return managed_inference_broker_js_1.startManagedInferenceBroker; } });
 Object.defineProperty(exports, "isManagedInferenceModelScope", { enumerable: true, get: function () { return managed_inference_broker_js_1.isManagedInferenceModelScope; } });

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/loopback-server.js

@@ -131,6 +131,14 @@ class ModelProxyLoopbackServer {
             writeError(res, 401, contract_js_1.MODEL_PROXY_ERROR.UNAUTHORIZED, 'Invalid relay token.');
             return;
         }
+        // Judged after authentication, so an unauthenticated caller learns nothing
+        // about which request forms this relay accepts; and before the body is read,
+        // so a refused request is never buffered.
+        const path = originFormPath(req.url ?? '/', new URL(this.baseUrl()).origin);
+        if (path === null) {
+            req.resume();
+            throw new contract_js_1.ModelProxyError(contract_js_1.MODEL_PROXY_ERROR.REQUEST_REJECTED, 'model proxy loopback accepts only requests addressed to its own origin');
+        }
         const body = await readBody(req, this.opts.maxBodyBytes);
         const controller = new AbortController();
         this.activeRequests.add(controller);
@@ -143,7 +151,7 @@ class ModelProxyLoopbackServer {
         });
         const headers = normalizeIncomingHeaders(req.headers);
         try {
-            const upstream = await this.opts.forwarder.forward({ method: req.method ?? 'POST', path: req.url ?? '/', headers, body }, { signal: controller.signal });
+            const upstream = await this.opts.forwarder.forward({ method: req.method ?? 'POST', path, headers, body }, { signal: controller.signal });
             res.writeHead(upstream.status, upstream.headers);
             for await (const chunk of upstream.body) {
                 if (!res.write(chunk)) {
@@ -179,6 +187,61 @@ function constantTimeEqual(a, b) {
         return false;
     return (0, node_crypto_1.timingSafeEqual)(bufA, bufB);
 }
+/**
+ * The request-target as the ORIGIN-FORM path the forwarder contract carries, or
+ * null when the request was addressed somewhere else.
+ *
+ * HTTP/1.1 gives a POST two request-target forms. Origin-form (`/v1/messages`) is
+ * what a client sends an origin server; absolute-form
+ * (`http://host/v1/messages`) is what it sends a forward PROXY — and RFC 9112
+ * §3.2.2 still requires a server to accept it. Node passes either through as
+ * `req.url`, verbatim.
+ *
+ * OSK-8758 is why this matters here. A Dedicated Runtime guest exports
+ * HTTP(S)_PROXY for its egress proxy, and the broker's synthetic
+ * `oversky-inference-broker.invalid` is in no NO_PROXY. Bun keeps dialing the Unix
+ * socket named by `fetch({ unix })` but writes the request line in proxy form, so
+ * every managed turn reached the broker with an absolute URL for a "path", failed
+ * its exact route allowlist, and was refused as an unapproved upstream route —
+ * while a laptop, with no proxy configured, sent origin-form and worked.
+ *
+ * Accepted only when the target denotes EXACTLY the request origin-form would
+ * have, so this is a parsing fix and never a widening:
+ *
+ *   - the origin must be this relay's own advertised origin. This loopback is not a
+ *     forward proxy: a foreign origin is refused here, even one a downstream egress
+ *     allowlist would accept — naming the upstream is not a way to reach it;
+ *   - no userinfo, which a request-target may not carry;
+ *   - the path and query must survive URL parsing byte-for-byte. The WHATWG parser
+ *     resolves dot segments and rewrites `\` to `/`, and origin-form bytes reach the
+ *     forwarder unnormalized, so a spelling the forwarder would refuse in one form
+ *     cannot become an approved route in the other.
+ *
+ * Anything that is not absolute-form (origin-form and the odd `*`) is returned
+ * untouched, exactly as before, for the forwarder to judge.
+ */
+function originFormPath(rawTarget, ownOrigin) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(rawTarget))
+        return rawTarget;
+    let target;
+    try {
+        target = new URL(rawTarget);
+    }
+    catch {
+        return null;
+    }
+    // `origin` is the string "null" for every non-special scheme, so two unrelated
+    // opaque origins would otherwise compare equal.
+    if (target.origin === 'null' || target.origin !== ownOrigin)
+        return null;
+    if (target.username || target.password)
+        return null;
+    const authorityEnd = rawTarget.indexOf('/', rawTarget.indexOf('://') + 3);
+    if (authorityEnd < 0)
+        return null;
+    const path = rawTarget.slice(authorityEnd);
+    return path === `${target.pathname}${target.search}` ? path : null;
+}
 function normalizeIncomingHeaders(headers) {
     const out = {};
     for (const [key, value] of Object.entries(headers)) {