@skrr-ai/cli 0.1.32 → 0.1.34

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessHome.js

@@ -0,0 +1,314 @@
+"use strict";
+/**
+ * Where the first-party harness lives on disk, and the one-time move that keeps
+ * that true across a rename.
+ *
+ * ── Why one implementation ────────────────────────────────────────────────
+ *
+ * Three processes put an engine under the skrr root and read it back: the daemon
+ * installer, the CLI (`skrr code`), and the desktop app's bundled-engine
+ * install. Each used to build `<root>/sky-code/bin/sky-code` itself, and they
+ * already disagreed once about which root that was (see `configRoot.ts`). A
+ * rename that every one of them had to perform independently would disagree
+ * again, so the paths AND the move live here.
+ *
+ * ── The move ──────────────────────────────────────────────────────────────
+ *
+ * Idempotent, lossless, and safe to run concurrently from all three:
+ *
+ *   1. The HOME follows the engine's namespace. If `<root>/<appName>` does not
+ *      exist and `<root>/<legacyAppName>` is a real directory, rename it and
+ *      leave the legacy name as a relative symlink. (No legacy app name exists
+ *      yet; this step is what an engine-namespace rename will use.)
+ *   2. The BINARY follows the provider. Inside `<home>/bin`, if the canonical
+ *      binary does not exist and an alias binary is a real file, rename it and
+ *      each companion (rollback copy, provenance sidecar), leaving a relative
+ *      symlink at every old name.
+ *
+ * The two follow different names on purpose: the home is shared with the
+ * engine, which reads its config and managed `AGENTS.md` from it, so it can only
+ * move when the engine's namespace does (`firstPartyHarnessHomeDirname`). The
+ * symlinks are the compatibility story, not an afterthought: every CLI and
+ * daemon already installed reads the legacy binary path, and a symlink keeps
+ * them working with no coordination.
+ *
+ * It never overwrites, never deletes, and never renames THROUGH a symlink, so
+ * running it twice, or after a downgrade, changes nothing. Any error leaves the
+ * tree exactly as it was and is reported rather than thrown: a failed move must
+ * degrade to reading the old path, not to an engine that cannot start.
+ *
+ * Skipped on Windows, where creating a symlink needs a privilege a normal user
+ * does not hold, and where no engine artifact is published anyway.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = void 0;
+exports.firstPartyHarnessHomeDir = firstPartyHarnessHomeDir;
+exports.firstPartyHarnessBinDir = firstPartyHarnessBinDir;
+exports.firstPartyHarnessInstalledBinaryPath = firstPartyHarnessInstalledBinaryPath;
+exports.migrateFirstPartyHarnessHome = migrateFirstPartyHarnessHome;
+exports.linkFirstPartyHarnessAliases = linkFirstPartyHarnessAliases;
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const configRoot_js_1 = require("./configRoot.js");
+const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
+/** Suffix of the rollback copy the installer keeps beside the binary. */
+exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = '.previous';
+/**
+ * Suffix of the provenance record beside the binary. The `oversky` in it is a
+ * persisted file name that already exists on machines, not the product name.
+ */
+exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = '.oversky-provenance.json';
+/** `<root>/<engine appName>` — the engine home, shared by the platform and the engine. */
+function firstPartyHarnessHomeDir(env = process.env) {
+    return node_path_1.default.join((0, configRoot_js_1.resolveConfigRoot)(env), (0, firstPartyHarness_js_1.firstPartyHarnessHomeDirname)());
+}
+/** `<home>/bin`, where the platform installs the engine binary. */
+function firstPartyHarnessBinDir(env = process.env) {
+    return node_path_1.default.join(firstPartyHarnessHomeDir(env), 'bin');
+}
+/** The installed binary path for a spelling (canonical by default) — lookup order is canonical first. */
+function firstPartyHarnessInstalledBinaryPath(env = process.env, provider = firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider, platform = process.platform) {
+    return node_path_1.default.join(firstPartyHarnessBinDir(env), (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(provider, platform));
+}
+const NODE_FS = {
+    lstat(p) {
+        try {
+            return (0, node_fs_1.lstatSync)(p);
+        }
+        catch {
+            return null;
+        }
+    },
+    readlink(p) {
+        try {
+            return (0, node_fs_1.lstatSync)(p).isSymbolicLink() ? (0, node_fs_1.readlinkSync)(p) : null;
+        }
+        catch {
+            return null;
+        }
+    },
+    rename: node_fs_1.renameSync,
+    symlink(target, at, type) {
+        (0, node_fs_1.symlinkSync)(target, at, type);
+    },
+};
+function isRealDirectory(stat) {
+    return stat !== null && stat.isDirectory() && !stat.isSymbolicLink();
+}
+function isRealFile(stat) {
+    return stat !== null && stat.isFile() && !stat.isSymbolicLink();
+}
+function describe(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+/** Companions that travel with the binary, binary first. */
+const COMPANION_SUFFIXES = [
+    '',
+    exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX,
+    exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX,
+];
+/**
+ * How much newer an alias binary must be before it is treated as a later
+ * install rather than the same one. Clock and filesystem-granularity slack.
+ */
+const NEWER_THRESHOLD_MS = 1000;
+/**
+ * Move a legacy engine home and binary onto the canonical names. See the file
+ * header for the exact contract. Returns what it did; never throws.
+ *
+ * Inside `<home>/bin` it resolves the three layouts a rename can leave:
+ *
+ *   - canonical ABSENT, an alias is a real file — the ordinary legacy install.
+ *     The alias moves to canonical and a link is left at its name.
+ *   - canonical is a LINK to an alias that is a real file — what an alias link
+ *     left DURING the expand phase becomes once the flip swaps which spelling is
+ *     canonical. Leaving it means the next install writes its provenance record
+ *     THROUGH the link onto the old binary's record, and the legacy name then
+ *     verifies as `tampered`. The real file is adopted onto the canonical name
+ *     (a rename replaces the link itself, never what it points at).
+ *   - canonical and an alias are BOTH real files and the alias is newer — a
+ *     client that predates the flip installed an update under the old name. The
+ *     newer engine is what every reader should run, so it is promoted: the older
+ *     canonical binary becomes the rollback copy, and the alias becomes a link.
+ *
+ * Any other layout is left exactly as it is.
+ */
+function migrateFirstPartyHarnessHome(options = {}) {
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    const fs = options.fs ?? NODE_FS;
+    if (platform === 'win32') {
+        return { moved: [], errors: [], skipped: 'unsupported-platform' };
+    }
+    const moved = [];
+    const errors = [];
+    const canonical = firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider;
+    const root = (0, configRoot_js_1.resolveConfigRoot)(env);
+    const canonicalHome = firstPartyHarnessHomeDir(env);
+    // 1. The home directory — follows the engine's namespace.
+    if (fs.lstat(canonicalHome) === null) {
+        for (const legacyAppName of firstPartyHarness_js_1.FIRST_PARTY_HARNESS_ENGINE.legacyAppNames) {
+            const aliasHome = node_path_1.default.join(root, legacyAppName);
+            if (!isRealDirectory(fs.lstat(aliasHome)))
+                continue;
+            try {
+                fs.rename(aliasHome, canonicalHome);
+            }
+            catch (err) {
+                // A concurrent migrator may have won; step 2 still runs against
+                // whatever is now at the canonical path.
+                errors.push(`could not move ${aliasHome} to ${canonicalHome}: ${describe(err)}`);
+                break;
+            }
+            moved.push(`${aliasHome} -> ${canonicalHome}`);
+            try {
+                fs.symlink(node_path_1.default.basename(canonicalHome), aliasHome, 'dir');
+                moved.push(`symlink ${aliasHome} -> ${node_path_1.default.basename(canonicalHome)}`);
+            }
+            catch (err) {
+                errors.push(`moved ${aliasHome} but could not leave a symlink behind: ${describe(err)}`);
+            }
+            break;
+        }
+    }
+    // 2. The binary and its companions — follow the provider — inside the home.
+    const binDir = node_path_1.default.join(canonicalHome, 'bin');
+    if (!isRealDirectory(fs.lstat(binDir))) {
+        return { moved, errors };
+    }
+    const canonicalName = (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(canonical, platform);
+    const canonicalBinary = node_path_1.default.join(binDir, canonicalName);
+    const canonicalStat = fs.lstat(canonicalBinary);
+    const aliasNames = firstPartyHarness_js_1.FIRST_PARTY_HARNESS.aliases.map((alias) => (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(alias, platform));
+    /** Move `<from><suffix>` onto `<to><suffix>` and leave a link; `replaceable` says what may sit at the target. */
+    const relocate = (fromName, suffix, replaceable) => {
+        const from = node_path_1.default.join(binDir, `${fromName}${suffix}`);
+        const to = node_path_1.default.join(binDir, `${canonicalName}${suffix}`);
+        const toStat = fs.lstat(to);
+        if (!isRealFile(fs.lstat(from)) || !replaceable(to, toStat))
+            return 'skipped';
+        try {
+            // `rename` replaces a LINK at `to` itself, never the file it points at.
+            fs.rename(from, to);
+        }
+        catch (err) {
+            errors.push(`could not move ${from} to ${to}: ${describe(err)}`);
+            return 'failed';
+        }
+        moved.push(`${from} -> ${to}`);
+        try {
+            fs.symlink(node_path_1.default.basename(to), from, 'file');
+            moved.push(`symlink ${from} -> ${node_path_1.default.basename(to)}`);
+        }
+        catch (err) {
+            errors.push(`moved ${from} but could not leave a symlink behind: ${describe(err)}`);
+        }
+        return 'moved';
+    };
+    // 2a. Canonical absent: an ordinary legacy install.
+    if (canonicalStat === null) {
+        const aliasName = aliasNames.find((name) => isRealFile(fs.lstat(node_path_1.default.join(binDir, name))));
+        if (aliasName) {
+            for (const suffix of COMPANION_SUFFIXES) {
+                const outcome = relocate(aliasName, suffix, (_to, toStat) => toStat === null);
+                if (suffix === '' && outcome !== 'moved')
+                    break;
+            }
+        }
+        return { moved, errors };
+    }
+    // 2b. Canonical is a link to a real alias file: adopt the file.
+    const linkText = fs.readlink(canonicalBinary);
+    if (linkText !== null) {
+        const linkedName = node_path_1.default.basename(linkText);
+        if (node_path_1.default.dirname(linkText) === '.' &&
+            aliasNames.includes(linkedName) &&
+            isRealFile(fs.lstat(node_path_1.default.join(binDir, linkedName)))) {
+            for (const suffix of COMPANION_SUFFIXES) {
+                const outcome = relocate(linkedName, suffix, (to, toStat) => toStat === null || fs.readlink(to) === `${linkedName}${suffix}`);
+                if (suffix === '' && outcome !== 'moved')
+                    break;
+            }
+        }
+        return { moved, errors };
+    }
+    // 2c. Both real, alias newer: an update installed under the old name.
+    if (isRealFile(canonicalStat)) {
+        const newer = aliasNames
+            .map((name) => ({ name, stat: fs.lstat(node_path_1.default.join(binDir, name)) }))
+            .filter((entry) => isRealFile(entry.stat))
+            .filter((entry) => entry.stat.mtimeMs - canonicalStat.mtimeMs > NEWER_THRESHOLD_MS)
+            .sort((a, b) => b.stat.mtimeMs - a.stat.mtimeMs)[0];
+        if (newer) {
+            const previous = `${canonicalBinary}${exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX}`;
+            const previousStat = fs.lstat(previous);
+            if (previousStat !== null && !isRealFile(previousStat)) {
+                errors.push(`${previous} is not a regular file; left the newer ${newer.name} in place`);
+                return { moved, errors };
+            }
+            try {
+                // The older canonical engine becomes the rollback copy — the same
+                // meaning `.previous` has after any install.
+                fs.rename(canonicalBinary, previous);
+            }
+            catch (err) {
+                errors.push(`could not keep ${canonicalBinary} as ${previous}: ${describe(err)}`);
+                return { moved, errors };
+            }
+            moved.push(`${canonicalBinary} -> ${previous}`);
+            for (const suffix of ['', exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX]) {
+                // The alias's sidecar describes the alias's bytes, so it replaces the
+                // canonical one: a record must always sit beside the binary it describes.
+                const outcome = relocate(newer.name, suffix, (to, toStat) => suffix === '' ? toStat === null : toStat === null || isRealFile(toStat));
+                if (suffix === '' && outcome !== 'moved')
+                    break;
+            }
+        }
+    }
+    return { moved, errors };
+}
+/**
+ * Leave a relative symlink at every alias name — binary and provenance sidecar —
+ * that does not exist yet, pointing at the canonical file.
+ *
+ * Call after installing the canonical binary. A platform CLI or daemon installed
+ * before a rename resolves the legacy name; the link keeps it on the current
+ * engine. It never replaces anything that exists, whether a real file (an older
+ * engine someone may still run) or a link someone else placed. Never throws.
+ */
+function linkFirstPartyHarnessAliases(options = {}) {
+    const env = options.env ?? process.env;
+    const platform = options.platform ?? process.platform;
+    const fs = options.fs ?? NODE_FS;
+    if (platform === 'win32') {
+        return { moved: [], errors: [], skipped: 'unsupported-platform' };
+    }
+    const moved = [];
+    const errors = [];
+    const binDir = firstPartyHarnessBinDir(env);
+    const canonicalName = (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider, platform);
+    if (!isRealFile(fs.lstat(node_path_1.default.join(binDir, canonicalName)))) {
+        return { moved, errors };
+    }
+    for (const alias of firstPartyHarness_js_1.FIRST_PARTY_HARNESS.aliases) {
+        const aliasName = (0, firstPartyHarness_js_1.firstPartyHarnessBinaryName)(alias, platform);
+        // Sidecar FIRST: a verifier that finds the binary link must find its record.
+        for (const suffix of [exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX, '']) {
+            const target = `${canonicalName}${suffix}`;
+            const at = node_path_1.default.join(binDir, `${aliasName}${suffix}`);
+            if (!isRealFile(fs.lstat(node_path_1.default.join(binDir, target))) || fs.lstat(at) !== null)
+                continue;
+            try {
+                fs.symlink(target, at, 'file');
+                moved.push(`symlink ${at} -> ${target}`);
+            }
+            catch (err) {
+                errors.push(`could not link ${at} -> ${target}: ${describe(err)}`);
+            }
+        }
+    }
+    return { moved, errors };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessTrust.d.ts

@@ -3,7 +3,7 @@
  *
  * ── Why this lives in auth-core ────────────────────────────────────────────
  *
- * `sky code doctor` must tell a user what tier their harness is and what that
+ * `skrr code doctor` must tell a user what tier their harness is and what that
  * means for credentials and permission prompts. The daemon is the authority for
  * that answer, but the CLI cannot import `daemon/src` — separate packages, and
  * the daemon already depends on the CLI, so the reverse edge would be a cycle.
@@ -18,7 +18,7 @@
  * parsed the daemon's source to catch drift. That guard worked — and it was still
  * only a guard. The regression it existed to catch had already shipped once: the
  * doctor described Tier 2 behaviour for a day after the owner decision of
- * 2026-08-11 moved `sky-code` to Tier 1, and a unit test asserting the stale
+ * 2026-08-11 moved the first-party harness to Tier 1, and a unit test asserting the stale
  * string made the wrong claim look load-bearing.
  *
  * ── What deliberately did NOT move ────────────────────────────────────────
@@ -44,10 +44,16 @@ export type HarnessTrustTier = 1 | 2 | 3;
  * map resolves to, so adding trust is always a deliberate, reviewable edit and
  * never an omission.
  *
- * `sky-code` is Tier 1 by OWNER DECISION (2026-08-11). The full reasoning, and
- * the measured cost of the Tier 2 posture it replaced, is recorded in
- * `daemon/src/harness-trust.ts` beside the gates that read it — the argument
+ * The first-party harness is Tier 1 by OWNER DECISION (2026-08-11). The full
+ * reasoning, and the measured cost of the Tier 2 posture it replaced, is recorded
+ * in `daemon/src/harness-trust.ts` beside the gates that read it — the argument
  * belongs where the enforcement is, not in a shared vocabulary module.
+ *
+ * It is entered under EVERY spelling (`firstPartyHarnessSpellings`), not only the
+ * canonical one. A backend name reaches this lookup from a daemon of any version,
+ * and an alias that fell through to the Tier 3 default would silently strip the
+ * harness of the trust the owner granted it — a failure that looks like a
+ * permission prompt storm, not like a rename.
  */
 export declare const HARNESS_TIERS: Readonly<Record<string, HarnessTrustTier>>;
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/harnessTrust.js

@@ -4,7 +4,7 @@
  *
  * ── Why this lives in auth-core ────────────────────────────────────────────
  *
- * `sky code doctor` must tell a user what tier their harness is and what that
+ * `skrr code doctor` must tell a user what tier their harness is and what that
  * means for credentials and permission prompts. The daemon is the authority for
  * that answer, but the CLI cannot import `daemon/src` — separate packages, and
  * the daemon already depends on the CLI, so the reverse edge would be a cycle.
@@ -19,7 +19,7 @@
  * parsed the daemon's source to catch drift. That guard worked — and it was still
  * only a guard. The regression it existed to catch had already shipped once: the
  * doctor described Tier 2 behaviour for a day after the owner decision of
- * 2026-08-11 moved `sky-code` to Tier 1, and a unit test asserting the stale
+ * 2026-08-11 moved the first-party harness to Tier 1, and a unit test asserting the stale
  * string made the wrong claim look load-bearing.
  *
  * ── What deliberately did NOT move ────────────────────────────────────────
@@ -40,6 +40,7 @@ exports.HARNESS_TIERS = void 0;
 exports.getHarnessTier = getHarnessTier;
 exports.credentialPolicyForTier = credentialPolicyForTier;
 exports.tierPermitsConfiguredAutoMode = tierPermitsConfiguredAutoMode;
+const firstPartyHarness_js_1 = require("./firstPartyHarness.js");
 /**
  * Trust tier by backend name.
  *
@@ -48,20 +49,26 @@ exports.tierPermitsConfiguredAutoMode = tierPermitsConfiguredAutoMode;
  * map resolves to, so adding trust is always a deliberate, reviewable edit and
  * never an omission.
  *
- * `sky-code` is Tier 1 by OWNER DECISION (2026-08-11). The full reasoning, and
- * the measured cost of the Tier 2 posture it replaced, is recorded in
- * `daemon/src/harness-trust.ts` beside the gates that read it — the argument
+ * The first-party harness is Tier 1 by OWNER DECISION (2026-08-11). The full
+ * reasoning, and the measured cost of the Tier 2 posture it replaced, is recorded
+ * in `daemon/src/harness-trust.ts` beside the gates that read it — the argument
  * belongs where the enforcement is, not in a shared vocabulary module.
+ *
+ * It is entered under EVERY spelling (`firstPartyHarnessSpellings`), not only the
+ * canonical one. A backend name reaches this lookup from a daemon of any version,
+ * and an alias that fell through to the Tier 3 default would silently strip the
+ * harness of the trust the owner granted it — a failure that looks like a
+ * permission prompt storm, not like a rename.
  */
 exports.HARNESS_TIERS = Object.freeze({
-    // --- Tier 1: first-party / audited ---
+    // --- Tier 1: vendor first-party / audited ---
     claude: 1,
     codex: 1,
     opencode: 1,
     'opencode-acp': 1,
     gemini: 1,
     'gemini-acp': 1,
-    'sky-code': 1,
+    ...Object.fromEntries((0, firstPartyHarness_js_1.firstPartyHarnessSpellings)().map((spelling) => [spelling, 1])),
     // --- Tier 2: reviewed open-source community harnesses ---
     goose: 2,
     aider: 2,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -35,7 +35,9 @@ export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConf
 export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
-export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';
+export * from './firstPartyHarness.js';
+export { FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX, FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX, firstPartyHarnessBinDir, firstPartyHarnessHomeDir, firstPartyHarnessInstalledBinaryPath, linkFirstPartyHarnessAliases, migrateFirstPartyHarnessHome, type FirstPartyHarnessHomeFs, type FirstPartyHarnessHomeMigration, } from './firstPartyHarnessHome.js';
+export { DEFAULT_FIRST_PARTY_HARNESS_CHANNEL, FIRST_PARTY_HARNESS_CHANNELS, firstPartyHarnessChannelPrefix, firstPartyHarnessFeedBase, firstPartyHarnessFeedCandidates, isFirstPartyHarnessChannel, resolveChannelManifestUrl, resolveFirstPartyHarnessChannel, type FirstPartyHarnessChannel, type FirstPartyHarnessFeedCandidate, DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './firstPartyHarnessChannels.js';
 export { OVERSKY_RELEASE_PUBLIC_KEYS, type ReleaseKey } from './releaseKeys.js';
 export { MAX_SIGS, buildArtifactMessage, buildManifestMessage, getDeltaFor, verifyArtifact, verifyManifest, type DaemonVersionManifest, type DeltaDescriptor, type ManifestSignature, type PlatformArtifact, type VerifyResult, } from './releaseManifest.js';
 export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -7,11 +7,25 @@
  * wire up its logger, config dir, kill switches, and binary name — then
  * uses the rest of the API uniformly.
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
 exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
+exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -271,7 +285,7 @@ Object.defineProperty(exports, "parsePairUrl", { enumerable: true, get: function
 Object.defineProperty(exports, "pairUint8ArrayToBase64", { enumerable: true, get: function () { return daemonPair_js_1.uint8ArrayToBase64; } });
 Object.defineProperty(exports, "pairUint8ArrayToBase64Url", { enumerable: true, get: function () { return daemonPair_js_1.uint8ArrayToBase64Url; } });
 // OSK-3897 — harness trust tiers, shared by the daemon (the authority) and the
-// CLI (which publishes the fact in `sky code doctor`). The PROVENANCE half stays
+// CLI (which publishes the fact in `skrr code doctor`). The PROVENANCE half stays
 // in the daemon on purpose: a tier is a published fact, provenance is evidence
 // about bytes on disk that only the spawning process can gather.
 var harnessTrust_js_1 = require("./harnessTrust.js");
@@ -304,18 +318,41 @@ Object.defineProperty(exports, "DEFAULT_BINARY_NAME", { enumerable: true, get: f
 var legacyStatePreflight_js_1 = require("./legacyStatePreflight.js");
 Object.defineProperty(exports, "findLegacyLocalState", { enumerable: true, get: function () { return legacyStatePreflight_js_1.findLegacyLocalState; } });
 Object.defineProperty(exports, "describeLegacyState", { enumerable: true, get: function () { return legacyStatePreflight_js_1.describeLegacyState; } });
-var skyCodeChannels_js_1 = require("./skyCodeChannels.js");
-Object.defineProperty(exports, "DEFAULT_SKY_CODE_CHANNEL", { enumerable: true, get: function () { return skyCodeChannels_js_1.DEFAULT_SKY_CODE_CHANNEL; } });
-Object.defineProperty(exports, "DEFAULT_SKY_CODE_FEED_BASE", { enumerable: true, get: function () { return skyCodeChannels_js_1.DEFAULT_SKY_CODE_FEED_BASE; } });
-Object.defineProperty(exports, "SKY_CODE_CHANNELS", { enumerable: true, get: function () { return skyCodeChannels_js_1.SKY_CODE_CHANNELS; } });
-Object.defineProperty(exports, "SKY_CODE_CHANNEL_ENV", { enumerable: true, get: function () { return skyCodeChannels_js_1.SKY_CODE_CHANNEL_ENV; } });
-Object.defineProperty(exports, "SKY_CODE_MANIFEST_FILE", { enumerable: true, get: function () { return skyCodeChannels_js_1.SKY_CODE_MANIFEST_FILE; } });
-Object.defineProperty(exports, "isSkyCodeChannel", { enumerable: true, get: function () { return skyCodeChannels_js_1.isSkyCodeChannel; } });
-Object.defineProperty(exports, "resolveChannelManifestUrl", { enumerable: true, get: function () { return skyCodeChannels_js_1.resolveChannelManifestUrl; } });
-Object.defineProperty(exports, "resolveSkyCodeChannel", { enumerable: true, get: function () { return skyCodeChannels_js_1.resolveSkyCodeChannel; } });
-Object.defineProperty(exports, "skyCodeChannelPrefix", { enumerable: true, get: function () { return skyCodeChannels_js_1.skyCodeChannelPrefix; } });
-Object.defineProperty(exports, "skyCodeFeedBase", { enumerable: true, get: function () { return skyCodeChannels_js_1.skyCodeFeedBase; } });
-Object.defineProperty(exports, "SKY_CODE_FEED_BASE_ENV", { enumerable: true, get: function () { return skyCodeChannels_js_1.SKY_CODE_FEED_BASE_ENV; } });
+// The first-party harness identity: the ONE place its product name is written.
+// Pure, and also published as the `./first-party-harness` subpath for browser and
+// React Native consumers. See firstPartyHarness.ts.
+__exportStar(require("./firstPartyHarness.js"), exports);
+// Where the first-party harness lives under the skrr root, and the one-time move
+// that keeps legacy installs working across a rename. Node-only.
+var firstPartyHarnessHome_js_1 = require("./firstPartyHarnessHome.js");
+Object.defineProperty(exports, "FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX; } });
+Object.defineProperty(exports, "FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX; } });
+Object.defineProperty(exports, "firstPartyHarnessBinDir", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.firstPartyHarnessBinDir; } });
+Object.defineProperty(exports, "firstPartyHarnessHomeDir", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.firstPartyHarnessHomeDir; } });
+Object.defineProperty(exports, "firstPartyHarnessInstalledBinaryPath", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.firstPartyHarnessInstalledBinaryPath; } });
+Object.defineProperty(exports, "linkFirstPartyHarnessAliases", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.linkFirstPartyHarnessAliases; } });
+Object.defineProperty(exports, "migrateFirstPartyHarnessHome", { enumerable: true, get: function () { return firstPartyHarnessHome_js_1.migrateFirstPartyHarnessHome; } });
+var firstPartyHarnessChannels_js_1 = require("./firstPartyHarnessChannels.js");
+Object.defineProperty(exports, "DEFAULT_FIRST_PARTY_HARNESS_CHANNEL", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL; } });
+Object.defineProperty(exports, "FIRST_PARTY_HARNESS_CHANNELS", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.FIRST_PARTY_HARNESS_CHANNELS; } });
+Object.defineProperty(exports, "firstPartyHarnessChannelPrefix", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.firstPartyHarnessChannelPrefix; } });
+Object.defineProperty(exports, "firstPartyHarnessFeedBase", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.firstPartyHarnessFeedBase; } });
+Object.defineProperty(exports, "firstPartyHarnessFeedCandidates", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.firstPartyHarnessFeedCandidates; } });
+Object.defineProperty(exports, "isFirstPartyHarnessChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.isFirstPartyHarnessChannel; } });
+Object.defineProperty(exports, "resolveChannelManifestUrl", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.resolveChannelManifestUrl; } });
+Object.defineProperty(exports, "resolveFirstPartyHarnessChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.resolveFirstPartyHarnessChannel; } });
+// Deprecated names kept for installed CLIs that resolve this published package
+// with a caret range. Removed in the contract phase with a minor bump.
+Object.defineProperty(exports, "DEFAULT_SKY_CODE_CHANNEL", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.DEFAULT_SKY_CODE_CHANNEL; } });
+Object.defineProperty(exports, "DEFAULT_SKY_CODE_FEED_BASE", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.DEFAULT_SKY_CODE_FEED_BASE; } });
+Object.defineProperty(exports, "SKY_CODE_CHANNELS", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.SKY_CODE_CHANNELS; } });
+Object.defineProperty(exports, "SKY_CODE_CHANNEL_ENV", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.SKY_CODE_CHANNEL_ENV; } });
+Object.defineProperty(exports, "SKY_CODE_MANIFEST_FILE", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.SKY_CODE_MANIFEST_FILE; } });
+Object.defineProperty(exports, "isSkyCodeChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.isSkyCodeChannel; } });
+Object.defineProperty(exports, "resolveSkyCodeChannel", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.resolveSkyCodeChannel; } });
+Object.defineProperty(exports, "skyCodeChannelPrefix", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.skyCodeChannelPrefix; } });
+Object.defineProperty(exports, "skyCodeFeedBase", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.skyCodeFeedBase; } });
+Object.defineProperty(exports, "SKY_CODE_FEED_BASE_ENV", { enumerable: true, get: function () { return firstPartyHarnessChannels_js_1.SKY_CODE_FEED_BASE_ENV; } });
 // Daemon release trust: the pinned ed25519 keys and the canonical signature
 // messages. Shared because BOTH the daemon (self-update) and the CLI
 // (`skrr daemon install`, which runs when there is no daemon to ask) verify the

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseManifest.js

@@ -26,7 +26,7 @@ exports.getDeltaFor = getDeltaFor;
  *
  * WHY IT LIVES IN auth-core NOW
  *
- * It lived in `daemon/src/release-manifest.ts`, and `skyCodeChannels.ts` beside
+ * It lived in `daemon/src/release-manifest.ts`, and `firstPartyHarnessChannels.ts` beside
  * it recorded the reason for stopping there: "the installer, the signature
  * verification and the promotion machinery stay in the daemon, which is the
  * only process that performs them." That premise held exactly until the CLI

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -5,8 +5,8 @@
  * ── Why this lives in auth-core ────────────────────────────────────────────
  *
  * The daemon has stripped its own credentials out of `process.env` before every
- * harness spawn since `daemon/src/env-sanitize.ts` was written. `sky code` spawns
- * THE SAME engine — `daemon/src/backends/acp.ts` and `cli/src/lib/sky-code.ts`
+ * harness spawn since `daemon/src/env-sanitize.ts` was written. `skrr code` spawns
+ * THE SAME engine — `daemon/src/backends/acp.ts` and `cli/src/lib/first-party-harness.ts`
  * resolve the same binary, from the same managed location — and had no
  * equivalent, so `OVERSKY_TOKEN` (a cloud-reusable platform credential that
  * authenticates every `/api/*` call as the human) entered the environment of a
@@ -32,10 +32,10 @@
  * This is a DENY-LIST over the parent's own environment, and it strips provider
  * credentials because the daemon delivers a child's model credential explicitly
  * (`cred.env`, after the trust gate) and never by ambient inheritance. A parent
- * whose supported mode IS ambient inheritance — `sky code` running BYOK, where
+ * whose supported mode IS ambient inheritance — `skrr code` running BYOK, where
  * the user's own key is the credential the run is meant to spend — has to
  * re-admit that credential deliberately after this filter. See
- * `cli/src/lib/sky-code.ts` (`engineSpawnEnv`). Do not soften the list here to
+ * `cli/src/lib/first-party-harness.ts` (`engineSpawnEnv`). Do not soften the list here to
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -6,8 +6,8 @@
  * ── Why this lives in auth-core ────────────────────────────────────────────
  *
  * The daemon has stripped its own credentials out of `process.env` before every
- * harness spawn since `daemon/src/env-sanitize.ts` was written. `sky code` spawns
- * THE SAME engine — `daemon/src/backends/acp.ts` and `cli/src/lib/sky-code.ts`
+ * harness spawn since `daemon/src/env-sanitize.ts` was written. `skrr code` spawns
+ * THE SAME engine — `daemon/src/backends/acp.ts` and `cli/src/lib/first-party-harness.ts`
  * resolve the same binary, from the same managed location — and had no
  * equivalent, so `OVERSKY_TOKEN` (a cloud-reusable platform credential that
  * authenticates every `/api/*` call as the human) entered the environment of a
@@ -33,10 +33,10 @@
  * This is a DENY-LIST over the parent's own environment, and it strips provider
  * credentials because the daemon delivers a child's model credential explicitly
  * (`cred.env`, after the trust gate) and never by ambient inheritance. A parent
- * whose supported mode IS ambient inheritance — `sky code` running BYOK, where
+ * whose supported mode IS ambient inheritance — `skrr code` running BYOK, where
  * the user's own key is the credential the run is meant to spend — has to
  * re-admit that credential deliberately after this filter. See
- * `cli/src/lib/sky-code.ts` (`engineSpawnEnv`). Do not soften the list here to
+ * `cli/src/lib/first-party-harness.ts` (`engineSpawnEnv`). Do not soften the list here to
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/configRoot.d.ts

@@ -10,7 +10,7 @@
  *   - The CLI's engine path honoured `OVERSKY_CONFIG_DIR` while its config did
  *     not, so a relocated root moved the engine and left the credentials in
  *     `$HOME`. Fixed by teaching `config.ts` the variable — which promptly
- *     re-created the split in the mirror image, because `sky-code.ts` still read
+ *     re-created the split in the mirror image, because the engine resolver still read
  *     only the old name.
  *   - The daemon then had the same shape, and fixing the CLI's half turned it
  *     into a CLI/daemon divergence: with the variable set, the two halves of one
@@ -32,7 +32,7 @@
  * child process it is about to spawn, and so tests need no process-wide mutation.
  */
 export declare function resolveConfigRoot(env?: NodeJS.ProcessEnv): string;
-/** A path under the skrr root, e.g. `configRootPath(env, 'sky-code', 'bin')`. */
+/** A path under the skrr root, e.g. `configRootPath(env, 'daemon', 'logs')`. */
 export declare function configRootPath(env: NodeJS.ProcessEnv, ...segments: string[]): string;
 /**
  * Has the operator explicitly relocated the root?

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/configRoot.js

@@ -12,7 +12,7 @@ import path from 'node:path';
  *   - The CLI's engine path honoured `OVERSKY_CONFIG_DIR` while its config did
  *     not, so a relocated root moved the engine and left the credentials in
  *     `$HOME`. Fixed by teaching `config.ts` the variable — which promptly
- *     re-created the split in the mirror image, because `sky-code.ts` still read
+ *     re-created the split in the mirror image, because the engine resolver still read
  *     only the old name.
  *   - The daemon then had the same shape, and fixing the CLI's half turned it
  *     into a CLI/daemon divergence: with the variable set, the two halves of one
@@ -37,7 +37,7 @@ export function resolveConfigRoot(env = process.env) {
     const override = (env.SKRR_CONFIG_DIR || env.OVERSKY_CONFIG_DIR)?.trim();
     return override || path.join(homedir(), '.skrr');
 }
-/** A path under the skrr root, e.g. `configRootPath(env, 'sky-code', 'bin')`. */
+/** A path under the skrr root, e.g. `configRootPath(env, 'daemon', 'logs')`. */
 export function configRootPath(env, ...segments) {
     return path.join(resolveConfigRoot(env), ...segments);
 }