@skrr-ai/cli 0.1.27 → 0.1.28

package/dist/lib/dedicated-machines.js

@@ -318,7 +318,9 @@ function describeDedicatedLease(lease, harnesses = []) {
     const row = (label, value) => {
         if (value === undefined || value === null || value === '')
             return;
-        lines.push(`  ${label.padEnd(13)}${value}`);
+        // At least one space: `restored from` is as wide as the column and printed
+        // as `restored fromrtl_…`.
+        lines.push(`  ${`${label} `.padEnd(13)}${value}`);
     };
     row('id', dedicatedLeaseId(lease));
     row('state', lease.stateReason

package/dist/lib/sky-code.js

@@ -36,6 +36,7 @@ const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
 const node_path_1 = __importDefault(require("node:path"));
 const auth_core_1 = require("@skrr-ai/auth-core");
+const inference_broker_1 = require("@skrr-ai/inference-broker");
 const config_1 = require("./config");
 // Deliberately does NOT import the managed marker any more. This module used to
 // read it to decide whether a run was managed; that decision now arrives as a
@@ -468,11 +469,20 @@ function engineSpawnEnv(env, extraEnv,
 // Required, not defaulted: the safe value differs per call and a parameter that
 // can be forgotten on a security boundary will be.
 mode) {
-    return {
+    const spawnEnv = {
         ...(0, auth_core_1.sanitizeSpawnEnv)(env),
         ...(mode === 'managed' ? {} : inheritedProviderCredentials(env)),
         ...extraEnv,
     };
+    if (mode !== 'managed')
+        return spawnEnv;
+    // OSK-8758 — a managed engine reaches the broker at a synthetic host, and must
+    // never address that host to a proxy. Behind an egress proxy (a Dedicated
+    // Runtime guest) Bun wrote every broker request in proxy form, and a runtime
+    // that honoured the proxy over the socket would send the prompt to it. Layered
+    // over the env built above, so it extends whatever list the engine would
+    // otherwise have received rather than replacing it.
+    return { ...spawnEnv, ...(0, inference_broker_1.inferenceBrokerNoProxyEnv)(spawnEnv) };
 }
 async function execEngine(args, env = process.env, options = {}) {
     // Resolve the binary FIRST, before `prepare` runs.

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/index.d.ts

@@ -51,7 +51,7 @@
  * ESM and CJS are both emitted because the daemon is ESM and the CLI is CJS, and
  * this package exists precisely so both can host the broker.
  */
-export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, type ManagedSessionStatus, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, type GatewayCredential, type ManagedCapabilityRefresh, type ManagedCapabilityRefreshResult, type ManagedInferenceBrokerOptions, type ManagedInferenceBrokerSession, type ManagedInferenceInputTokenAccounting, type ManagedInferenceModelScope, type ManagedInferenceRequestEnvelope, type ManagedReasoningPolicy, } from './managed-inference-broker.js';
+export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, INFERENCE_BROKER_HOST, inferenceBrokerNoProxyEnv, type ManagedSessionStatus, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, type GatewayCredential, type ManagedCapabilityRefresh, type ManagedCapabilityRefreshResult, type ManagedInferenceBrokerOptions, type ManagedInferenceBrokerSession, type ManagedInferenceInputTokenAccounting, type ManagedInferenceModelScope, type ManagedInferenceRequestEnvelope, type ManagedReasoningPolicy, } from './managed-inference-broker.js';
 export { minimumCapabilityWindowMs, scheduleRenewalDelay, startRenewalLoop, type CapabilityRefreshOutcome, type RenewalLoop, type RenewalLoopOptions, type RenewalOutcome, type RenewalStopReason, } from './managed-inference-renewal.js';
 export { ModelProxyLoopbackServer, type ModelProxyForwarder } from './loopback-server.js';
 export * from './contract.js';

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/index.js

@@ -67,13 +67,15 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ModelProxyLoopbackServer = exports.startRenewalLoop = exports.scheduleRenewalDelay = exports.minimumCapabilityWindowMs = exports.isManagedInferenceModelScope = exports.startManagedInferenceBroker = exports.buildManagedInferenceRelayCredential = exports.MANAGED_STATUS_PATH = exports.MANAGED_PROMPT_CACHING_ENV = exports.MANAGED_SESSION_ENV = exports.INFERENCE_BROKER_SOCKET_ENV = exports.INFERENCE_BROKER_ORIGIN = void 0;
+exports.ModelProxyLoopbackServer = exports.startRenewalLoop = exports.scheduleRenewalDelay = exports.minimumCapabilityWindowMs = exports.isManagedInferenceModelScope = exports.startManagedInferenceBroker = exports.buildManagedInferenceRelayCredential = exports.inferenceBrokerNoProxyEnv = exports.INFERENCE_BROKER_HOST = exports.MANAGED_STATUS_PATH = exports.MANAGED_PROMPT_CACHING_ENV = exports.MANAGED_SESSION_ENV = exports.INFERENCE_BROKER_SOCKET_ENV = exports.INFERENCE_BROKER_ORIGIN = void 0;
 var managed_inference_broker_js_1 = require("./managed-inference-broker.js");
 Object.defineProperty(exports, "INFERENCE_BROKER_ORIGIN", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_ORIGIN; } });
 Object.defineProperty(exports, "INFERENCE_BROKER_SOCKET_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_SOCKET_ENV; } });
 Object.defineProperty(exports, "MANAGED_SESSION_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_SESSION_ENV; } });
 Object.defineProperty(exports, "MANAGED_PROMPT_CACHING_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_PROMPT_CACHING_ENV; } });
 Object.defineProperty(exports, "MANAGED_STATUS_PATH", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_STATUS_PATH; } });
+Object.defineProperty(exports, "INFERENCE_BROKER_HOST", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_HOST; } });
+Object.defineProperty(exports, "inferenceBrokerNoProxyEnv", { enumerable: true, get: function () { return managed_inference_broker_js_1.inferenceBrokerNoProxyEnv; } });
 Object.defineProperty(exports, "buildManagedInferenceRelayCredential", { enumerable: true, get: function () { return managed_inference_broker_js_1.buildManagedInferenceRelayCredential; } });
 Object.defineProperty(exports, "startManagedInferenceBroker", { enumerable: true, get: function () { return managed_inference_broker_js_1.startManagedInferenceBroker; } });
 Object.defineProperty(exports, "isManagedInferenceModelScope", { enumerable: true, get: function () { return managed_inference_broker_js_1.isManagedInferenceModelScope; } });

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/loopback-server.js

@@ -131,6 +131,14 @@ class ModelProxyLoopbackServer {
             writeError(res, 401, contract_js_1.MODEL_PROXY_ERROR.UNAUTHORIZED, 'Invalid relay token.');
             return;
         }
+        // Judged after authentication, so an unauthenticated caller learns nothing
+        // about which request forms this relay accepts; and before the body is read,
+        // so a refused request is never buffered.
+        const path = originFormPath(req.url ?? '/', new URL(this.baseUrl()).origin);
+        if (path === null) {
+            req.resume();
+            throw new contract_js_1.ModelProxyError(contract_js_1.MODEL_PROXY_ERROR.REQUEST_REJECTED, 'model proxy loopback accepts only requests addressed to its own origin');
+        }
         const body = await readBody(req, this.opts.maxBodyBytes);
         const controller = new AbortController();
         this.activeRequests.add(controller);
@@ -143,7 +151,7 @@ class ModelProxyLoopbackServer {
         });
         const headers = normalizeIncomingHeaders(req.headers);
         try {
-            const upstream = await this.opts.forwarder.forward({ method: req.method ?? 'POST', path: req.url ?? '/', headers, body }, { signal: controller.signal });
+            const upstream = await this.opts.forwarder.forward({ method: req.method ?? 'POST', path, headers, body }, { signal: controller.signal });
             res.writeHead(upstream.status, upstream.headers);
             for await (const chunk of upstream.body) {
                 if (!res.write(chunk)) {
@@ -179,6 +187,61 @@ function constantTimeEqual(a, b) {
         return false;
     return (0, node_crypto_1.timingSafeEqual)(bufA, bufB);
 }
+/**
+ * The request-target as the ORIGIN-FORM path the forwarder contract carries, or
+ * null when the request was addressed somewhere else.
+ *
+ * HTTP/1.1 gives a POST two request-target forms. Origin-form (`/v1/messages`) is
+ * what a client sends an origin server; absolute-form
+ * (`http://host/v1/messages`) is what it sends a forward PROXY — and RFC 9112
+ * §3.2.2 still requires a server to accept it. Node passes either through as
+ * `req.url`, verbatim.
+ *
+ * OSK-8758 is why this matters here. A Dedicated Runtime guest exports
+ * HTTP(S)_PROXY for its egress proxy, and the broker's synthetic
+ * `oversky-inference-broker.invalid` is in no NO_PROXY. Bun keeps dialing the Unix
+ * socket named by `fetch({ unix })` but writes the request line in proxy form, so
+ * every managed turn reached the broker with an absolute URL for a "path", failed
+ * its exact route allowlist, and was refused as an unapproved upstream route —
+ * while a laptop, with no proxy configured, sent origin-form and worked.
+ *
+ * Accepted only when the target denotes EXACTLY the request origin-form would
+ * have, so this is a parsing fix and never a widening:
+ *
+ *   - the origin must be this relay's own advertised origin. This loopback is not a
+ *     forward proxy: a foreign origin is refused here, even one a downstream egress
+ *     allowlist would accept — naming the upstream is not a way to reach it;
+ *   - no userinfo, which a request-target may not carry;
+ *   - the path and query must survive URL parsing byte-for-byte. The WHATWG parser
+ *     resolves dot segments and rewrites `\` to `/`, and origin-form bytes reach the
+ *     forwarder unnormalized, so a spelling the forwarder would refuse in one form
+ *     cannot become an approved route in the other.
+ *
+ * Anything that is not absolute-form (origin-form and the odd `*`) is returned
+ * untouched, exactly as before, for the forwarder to judge.
+ */
+function originFormPath(rawTarget, ownOrigin) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(rawTarget))
+        return rawTarget;
+    let target;
+    try {
+        target = new URL(rawTarget);
+    }
+    catch {
+        return null;
+    }
+    // `origin` is the string "null" for every non-special scheme, so two unrelated
+    // opaque origins would otherwise compare equal.
+    if (target.origin === 'null' || target.origin !== ownOrigin)
+        return null;
+    if (target.username || target.password)
+        return null;
+    const authorityEnd = rawTarget.indexOf('/', rawTarget.indexOf('://') + 3);
+    if (authorityEnd < 0)
+        return null;
+    const path = rawTarget.slice(authorityEnd);
+    return path === `${target.pathname}${target.search}` ? path : null;
+}
 function normalizeIncomingHeaders(headers) {
     const out = {};
     for (const [key, value] of Object.entries(headers)) {

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/managed-inference-broker.d.ts

@@ -177,7 +177,37 @@ export interface ManagedSessionStatus {
     };
 }
 export declare const INFERENCE_BROKER_ORIGIN = "http://oversky-inference-broker.invalid";
+/** The synthetic host inside {@link INFERENCE_BROKER_ORIGIN}. Never resolved. */
+export declare const INFERENCE_BROKER_HOST: string;
 export declare const INFERENCE_BROKER_SOCKET_ENV = "OVERSKY_INFERENCE_BROKER_SOCKET";
+/**
+ * OSK-8758 — the proxy exemption a process holding the broker environment needs.
+ *
+ * The broker is reached over a Unix socket, but its base URLs name
+ * {@link INFERENCE_BROKER_HOST}, and an engine that honours HTTP(S)_PROXY treats
+ * that name like any other host. On a Dedicated Runtime guest, which exports an
+ * egress proxy, Bun kept dialing the socket but wrote the request line in proxy
+ * form, and the broker refused every turn. The loopback server now accepts that
+ * form. This makes sure it is never produced: engine traffic to the synthetic host
+ * is not addressed to a proxy at all. A runtime that one day honours the proxy
+ * over `fetch({ unix })` would otherwise send the prompt to the egress proxy.
+ *
+ * Returns BOTH spellings, for layering LAST over the environment the child would
+ * otherwise receive (`env`), because tools disagree on which one they read and
+ * whether they fall back to the other:
+ *
+ *   - existing entries keep their order, and the host is appended once;
+ *   - a spelling that is unset (or empty) is seeded from the other one before the
+ *     host is appended. Seeding only the host would silently drop every existing
+ *     exemption for a tool that prefers the unset spelling, which today reads the
+ *     other through its fallback;
+ *   - a list that is `*` already exempts everything and is left alone, because
+ *     some clients honour `*` only as the entire value.
+ */
+export declare function inferenceBrokerNoProxyEnv(env: Readonly<Record<string, string | undefined>>): {
+    NO_PROXY: string;
+    no_proxy: string;
+};
 export declare const MANAGED_SESSION_ENV = "OVERSKY_MANAGED_SESSION";
 export declare const MANAGED_PROMPT_CACHING_ENV = "OVERSKY_MANAGED_PROMPT_CACHING";
 export declare function managedClientModelId(scope: ManagedInferenceModelScope): string;

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/managed-inference-broker.js

@@ -11,7 +11,8 @@
  * endpoint while it is alive.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MANAGED_PROMPT_CACHING_ENV = exports.MANAGED_SESSION_ENV = exports.INFERENCE_BROKER_SOCKET_ENV = exports.INFERENCE_BROKER_ORIGIN = exports.MANAGED_STATUS_PATH = void 0;
+exports.MANAGED_PROMPT_CACHING_ENV = exports.MANAGED_SESSION_ENV = exports.INFERENCE_BROKER_SOCKET_ENV = exports.INFERENCE_BROKER_HOST = exports.INFERENCE_BROKER_ORIGIN = exports.MANAGED_STATUS_PATH = void 0;
+exports.inferenceBrokerNoProxyEnv = inferenceBrokerNoProxyEnv;
 exports.managedClientModelId = managedClientModelId;
 exports.isGatewayCredential = isGatewayCredential;
 exports.isManagedInferenceModelScope = isManagedInferenceModelScope;
@@ -37,7 +38,48 @@ const managed_inference_renewal_js_1 = require("./managed-inference-renewal.js")
  */
 exports.MANAGED_STATUS_PATH = '/oversky/managed-status';
 exports.INFERENCE_BROKER_ORIGIN = 'http://oversky-inference-broker.invalid';
+/** The synthetic host inside {@link INFERENCE_BROKER_ORIGIN}. Never resolved. */
+exports.INFERENCE_BROKER_HOST = new URL(exports.INFERENCE_BROKER_ORIGIN).hostname;
 exports.INFERENCE_BROKER_SOCKET_ENV = 'OVERSKY_INFERENCE_BROKER_SOCKET';
+/**
+ * OSK-8758 — the proxy exemption a process holding the broker environment needs.
+ *
+ * The broker is reached over a Unix socket, but its base URLs name
+ * {@link INFERENCE_BROKER_HOST}, and an engine that honours HTTP(S)_PROXY treats
+ * that name like any other host. On a Dedicated Runtime guest, which exports an
+ * egress proxy, Bun kept dialing the socket but wrote the request line in proxy
+ * form, and the broker refused every turn. The loopback server now accepts that
+ * form. This makes sure it is never produced: engine traffic to the synthetic host
+ * is not addressed to a proxy at all. A runtime that one day honours the proxy
+ * over `fetch({ unix })` would otherwise send the prompt to the egress proxy.
+ *
+ * Returns BOTH spellings, for layering LAST over the environment the child would
+ * otherwise receive (`env`), because tools disagree on which one they read and
+ * whether they fall back to the other:
+ *
+ *   - existing entries keep their order, and the host is appended once;
+ *   - a spelling that is unset (or empty) is seeded from the other one before the
+ *     host is appended. Seeding only the host would silently drop every existing
+ *     exemption for a tool that prefers the unset spelling, which today reads the
+ *     other through its fallback;
+ *   - a list that is `*` already exempts everything and is left alone, because
+ *     some clients honour `*` only as the entire value.
+ */
+function inferenceBrokerNoProxyEnv(env) {
+    const upper = nonEmpty(env.NO_PROXY);
+    const lower = nonEmpty(env.no_proxy);
+    return {
+        NO_PROXY: withInferenceBrokerHost(upper ?? lower ?? ''),
+        no_proxy: withInferenceBrokerHost(lower ?? upper ?? ''),
+    };
+}
+function withInferenceBrokerHost(list) {
+    const entries = list.split(',').map((entry) => entry.trim().toLowerCase());
+    if (entries.includes('*') || entries.includes(exports.INFERENCE_BROKER_HOST))
+        return list;
+    const kept = list.replace(/[\s,]+$/, '');
+    return kept ? `${kept},${exports.INFERENCE_BROKER_HOST}` : exports.INFERENCE_BROKER_HOST;
+}
 exports.MANAGED_SESSION_ENV = 'OVERSKY_MANAGED_SESSION';
 exports.MANAGED_PROMPT_CACHING_ENV = 'OVERSKY_MANAGED_PROMPT_CACHING';
 const ALLOWED_PATHS = new Set([

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/index.d.ts

@@ -51,7 +51,7 @@
  * ESM and CJS are both emitted because the daemon is ESM and the CLI is CJS, and
  * this package exists precisely so both can host the broker.
  */
-export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, type ManagedSessionStatus, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, type GatewayCredential, type ManagedCapabilityRefresh, type ManagedCapabilityRefreshResult, type ManagedInferenceBrokerOptions, type ManagedInferenceBrokerSession, type ManagedInferenceInputTokenAccounting, type ManagedInferenceModelScope, type ManagedInferenceRequestEnvelope, type ManagedReasoningPolicy, } from './managed-inference-broker.js';
+export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, INFERENCE_BROKER_HOST, inferenceBrokerNoProxyEnv, type ManagedSessionStatus, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, type GatewayCredential, type ManagedCapabilityRefresh, type ManagedCapabilityRefreshResult, type ManagedInferenceBrokerOptions, type ManagedInferenceBrokerSession, type ManagedInferenceInputTokenAccounting, type ManagedInferenceModelScope, type ManagedInferenceRequestEnvelope, type ManagedReasoningPolicy, } from './managed-inference-broker.js';
 export { minimumCapabilityWindowMs, scheduleRenewalDelay, startRenewalLoop, type CapabilityRefreshOutcome, type RenewalLoop, type RenewalLoopOptions, type RenewalOutcome, type RenewalStopReason, } from './managed-inference-renewal.js';
 export { ModelProxyLoopbackServer, type ModelProxyForwarder } from './loopback-server.js';
 export * from './contract.js';

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/index.js

@@ -51,7 +51,7 @@
  * ESM and CJS are both emitted because the daemon is ESM and the CLI is CJS, and
  * this package exists precisely so both can host the broker.
  */
-export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, } from './managed-inference-broker.js';
+export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, INFERENCE_BROKER_HOST, inferenceBrokerNoProxyEnv, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, } from './managed-inference-broker.js';
 export { minimumCapabilityWindowMs, scheduleRenewalDelay, startRenewalLoop, } from './managed-inference-renewal.js';
 export { ModelProxyLoopbackServer } from './loopback-server.js';
 // Re-exported in full because `daemon/src/model-proxy/contract.ts` becomes a

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/loopback-server.js

@@ -128,6 +128,14 @@ export class ModelProxyLoopbackServer {
             writeError(res, 401, MODEL_PROXY_ERROR.UNAUTHORIZED, 'Invalid relay token.');
             return;
         }
+        // Judged after authentication, so an unauthenticated caller learns nothing
+        // about which request forms this relay accepts; and before the body is read,
+        // so a refused request is never buffered.
+        const path = originFormPath(req.url ?? '/', new URL(this.baseUrl()).origin);
+        if (path === null) {
+            req.resume();
+            throw new ModelProxyError(MODEL_PROXY_ERROR.REQUEST_REJECTED, 'model proxy loopback accepts only requests addressed to its own origin');
+        }
         const body = await readBody(req, this.opts.maxBodyBytes);
         const controller = new AbortController();
         this.activeRequests.add(controller);
@@ -140,7 +148,7 @@ export class ModelProxyLoopbackServer {
         });
         const headers = normalizeIncomingHeaders(req.headers);
         try {
-            const upstream = await this.opts.forwarder.forward({ method: req.method ?? 'POST', path: req.url ?? '/', headers, body }, { signal: controller.signal });
+            const upstream = await this.opts.forwarder.forward({ method: req.method ?? 'POST', path, headers, body }, { signal: controller.signal });
             res.writeHead(upstream.status, upstream.headers);
             for await (const chunk of upstream.body) {
                 if (!res.write(chunk)) {
@@ -175,6 +183,61 @@ function constantTimeEqual(a, b) {
         return false;
     return timingSafeEqual(bufA, bufB);
 }
+/**
+ * The request-target as the ORIGIN-FORM path the forwarder contract carries, or
+ * null when the request was addressed somewhere else.
+ *
+ * HTTP/1.1 gives a POST two request-target forms. Origin-form (`/v1/messages`) is
+ * what a client sends an origin server; absolute-form
+ * (`http://host/v1/messages`) is what it sends a forward PROXY — and RFC 9112
+ * §3.2.2 still requires a server to accept it. Node passes either through as
+ * `req.url`, verbatim.
+ *
+ * OSK-8758 is why this matters here. A Dedicated Runtime guest exports
+ * HTTP(S)_PROXY for its egress proxy, and the broker's synthetic
+ * `oversky-inference-broker.invalid` is in no NO_PROXY. Bun keeps dialing the Unix
+ * socket named by `fetch({ unix })` but writes the request line in proxy form, so
+ * every managed turn reached the broker with an absolute URL for a "path", failed
+ * its exact route allowlist, and was refused as an unapproved upstream route —
+ * while a laptop, with no proxy configured, sent origin-form and worked.
+ *
+ * Accepted only when the target denotes EXACTLY the request origin-form would
+ * have, so this is a parsing fix and never a widening:
+ *
+ *   - the origin must be this relay's own advertised origin. This loopback is not a
+ *     forward proxy: a foreign origin is refused here, even one a downstream egress
+ *     allowlist would accept — naming the upstream is not a way to reach it;
+ *   - no userinfo, which a request-target may not carry;
+ *   - the path and query must survive URL parsing byte-for-byte. The WHATWG parser
+ *     resolves dot segments and rewrites `\` to `/`, and origin-form bytes reach the
+ *     forwarder unnormalized, so a spelling the forwarder would refuse in one form
+ *     cannot become an approved route in the other.
+ *
+ * Anything that is not absolute-form (origin-form and the odd `*`) is returned
+ * untouched, exactly as before, for the forwarder to judge.
+ */
+function originFormPath(rawTarget, ownOrigin) {
+    if (!/^[a-z][a-z0-9+.-]*:\/\//i.test(rawTarget))
+        return rawTarget;
+    let target;
+    try {
+        target = new URL(rawTarget);
+    }
+    catch {
+        return null;
+    }
+    // `origin` is the string "null" for every non-special scheme, so two unrelated
+    // opaque origins would otherwise compare equal.
+    if (target.origin === 'null' || target.origin !== ownOrigin)
+        return null;
+    if (target.username || target.password)
+        return null;
+    const authorityEnd = rawTarget.indexOf('/', rawTarget.indexOf('://') + 3);
+    if (authorityEnd < 0)
+        return null;
+    const path = rawTarget.slice(authorityEnd);
+    return path === `${target.pathname}${target.search}` ? path : null;
+}
 function normalizeIncomingHeaders(headers) {
     const out = {};
     for (const [key, value] of Object.entries(headers)) {

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/managed-inference-broker.d.ts

@@ -177,7 +177,37 @@ export interface ManagedSessionStatus {
     };
 }
 export declare const INFERENCE_BROKER_ORIGIN = "http://oversky-inference-broker.invalid";
+/** The synthetic host inside {@link INFERENCE_BROKER_ORIGIN}. Never resolved. */
+export declare const INFERENCE_BROKER_HOST: string;
 export declare const INFERENCE_BROKER_SOCKET_ENV = "OVERSKY_INFERENCE_BROKER_SOCKET";
+/**
+ * OSK-8758 — the proxy exemption a process holding the broker environment needs.
+ *
+ * The broker is reached over a Unix socket, but its base URLs name
+ * {@link INFERENCE_BROKER_HOST}, and an engine that honours HTTP(S)_PROXY treats
+ * that name like any other host. On a Dedicated Runtime guest, which exports an
+ * egress proxy, Bun kept dialing the socket but wrote the request line in proxy
+ * form, and the broker refused every turn. The loopback server now accepts that
+ * form. This makes sure it is never produced: engine traffic to the synthetic host
+ * is not addressed to a proxy at all. A runtime that one day honours the proxy
+ * over `fetch({ unix })` would otherwise send the prompt to the egress proxy.
+ *
+ * Returns BOTH spellings, for layering LAST over the environment the child would
+ * otherwise receive (`env`), because tools disagree on which one they read and
+ * whether they fall back to the other:
+ *
+ *   - existing entries keep their order, and the host is appended once;
+ *   - a spelling that is unset (or empty) is seeded from the other one before the
+ *     host is appended. Seeding only the host would silently drop every existing
+ *     exemption for a tool that prefers the unset spelling, which today reads the
+ *     other through its fallback;
+ *   - a list that is `*` already exempts everything and is left alone, because
+ *     some clients honour `*` only as the entire value.
+ */
+export declare function inferenceBrokerNoProxyEnv(env: Readonly<Record<string, string | undefined>>): {
+    NO_PROXY: string;
+    no_proxy: string;
+};
 export declare const MANAGED_SESSION_ENV = "OVERSKY_MANAGED_SESSION";
 export declare const MANAGED_PROMPT_CACHING_ENV = "OVERSKY_MANAGED_PROMPT_CACHING";
 export declare function managedClientModelId(scope: ManagedInferenceModelScope): string;

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/managed-inference-broker.js

@@ -28,7 +28,48 @@ import { startRenewalLoop, } from './managed-inference-renewal.js';
  */
 export const MANAGED_STATUS_PATH = '/oversky/managed-status';
 export const INFERENCE_BROKER_ORIGIN = 'http://oversky-inference-broker.invalid';
+/** The synthetic host inside {@link INFERENCE_BROKER_ORIGIN}. Never resolved. */
+export const INFERENCE_BROKER_HOST = new URL(INFERENCE_BROKER_ORIGIN).hostname;
 export const INFERENCE_BROKER_SOCKET_ENV = 'OVERSKY_INFERENCE_BROKER_SOCKET';
+/**
+ * OSK-8758 — the proxy exemption a process holding the broker environment needs.
+ *
+ * The broker is reached over a Unix socket, but its base URLs name
+ * {@link INFERENCE_BROKER_HOST}, and an engine that honours HTTP(S)_PROXY treats
+ * that name like any other host. On a Dedicated Runtime guest, which exports an
+ * egress proxy, Bun kept dialing the socket but wrote the request line in proxy
+ * form, and the broker refused every turn. The loopback server now accepts that
+ * form. This makes sure it is never produced: engine traffic to the synthetic host
+ * is not addressed to a proxy at all. A runtime that one day honours the proxy
+ * over `fetch({ unix })` would otherwise send the prompt to the egress proxy.
+ *
+ * Returns BOTH spellings, for layering LAST over the environment the child would
+ * otherwise receive (`env`), because tools disagree on which one they read and
+ * whether they fall back to the other:
+ *
+ *   - existing entries keep their order, and the host is appended once;
+ *   - a spelling that is unset (or empty) is seeded from the other one before the
+ *     host is appended. Seeding only the host would silently drop every existing
+ *     exemption for a tool that prefers the unset spelling, which today reads the
+ *     other through its fallback;
+ *   - a list that is `*` already exempts everything and is left alone, because
+ *     some clients honour `*` only as the entire value.
+ */
+export function inferenceBrokerNoProxyEnv(env) {
+    const upper = nonEmpty(env.NO_PROXY);
+    const lower = nonEmpty(env.no_proxy);
+    return {
+        NO_PROXY: withInferenceBrokerHost(upper ?? lower ?? ''),
+        no_proxy: withInferenceBrokerHost(lower ?? upper ?? ''),
+    };
+}
+function withInferenceBrokerHost(list) {
+    const entries = list.split(',').map((entry) => entry.trim().toLowerCase());
+    if (entries.includes('*') || entries.includes(INFERENCE_BROKER_HOST))
+        return list;
+    const kept = list.replace(/[\s,]+$/, '');
+    return kept ? `${kept},${INFERENCE_BROKER_HOST}` : INFERENCE_BROKER_HOST;
+}
 export const MANAGED_SESSION_ENV = 'OVERSKY_MANAGED_SESSION';
 export const MANAGED_PROMPT_CACHING_ENV = 'OVERSKY_MANAGED_PROMPT_CACHING';
 const ALLOWED_PATHS = new Set([

package/dist/node_modules/@skrr-ai/inference-broker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/inference-broker",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "main": "dist/cjs/index.js",
   "types": "dist/cjs/index.d.ts",
   "exports": {