@skrr-ai/cli 0.1.35 → 0.1.36

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarness.js

@@ -20,7 +20,9 @@
  *
  *   1. set `displayName` and `provider`;
  *   2. move the old `provider` to the front of `aliases`;
- *   3. leave `wireProvider` on the spelling installed daemons still speak;
+ *   3. set `wireProvider` to the old spelling as a literal — installed daemons
+ *      still speak it — and derive it from `provider` again only in the wire
+ *      phase, once every peer accepts the new one;
  *   4. regenerate `first-party-harness.json`
  *      (`node --import tsx scripts/emit-first-party-harness-json.mjs`);
  *   5. ship the data migration, which is generic over `aliases`.
@@ -34,9 +36,11 @@
  *                canonical at the edge. Nothing new is ever written with one.
  * `wireProvider` What the server and a daemon say to EACH OTHER — the
  *                capability a daemon advertises, `daemon:<p>:request|response`,
- *                the `provider` of a session RPC. It moves LAST, because a
- *                daemon on a user's machine may be any version and the server
- *                cannot tell which one sent a request.
+ *                the `provider` of a session RPC. It moves after the flip and
+ *                BEFORE contract, because a daemon on a user's machine may be
+ *                any version and the server cannot tell which one sent a
+ *                request: only a released daemon that already advertises the
+ *                canonical capability lets the old one age out of the fleet.
  *
  * The old code treated those three as one string, which is why no single
  * change could rename it safely. See
@@ -96,21 +100,24 @@ function defineIdentity(identity) {
     }
     return Object.freeze({ ...identity, aliases: Object.freeze([...identity.aliases]) });
 }
+/** The canonical slug. Written once, and read by every field that names the current spelling. */
+const PROVIDER = 'skrr-code';
 /**
  * THE identity — the only literal product name in the codebase.
  *
- * Phase: FLIPPED. `skrr-code` is canonical — stored, returned and rendered.
- * `sky-code` is still accepted on every ingress, and it is still the WIRE
- * spelling: daemons on users' machines may predate the rename, so the server
- * and a daemon keep exchanging `sky-code` until contract (OSK-8663) empties
- * `aliases` and moves `wireProvider`.
+ * Phase: WIRE MOVED. `skrr-code` is canonical — stored, returned, rendered — and
+ * it is now also what the server and a daemon say to each other. `sky-code` is
+ * still accepted on every ingress, so a daemon released before this change
+ * (which advertises and answers on `sky-code`) keeps working against a server
+ * that speaks `skrr-code`, and the reverse. Contract (OSK-8663) empties
+ * `aliases` once no connected daemon still advertises the old capability.
  */
 const IDENTITY = {
     displayName: 'skrr Code',
     command: 'skrr code',
-    provider: 'skrr-code',
+    provider: PROVIDER,
     aliases: ['sky-code'],
-    wireProvider: 'sky-code',
+    wireProvider: PROVIDER,
 };
 exports.FIRST_PARTY_HARNESS = defineIdentity(IDENTITY);
 /** The canonical slug with its literal type, for `as const` tuples and keyed tables. */

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/firstPartyHarnessChannels.js

@@ -150,7 +150,13 @@ function firstPartyHarnessFeedCandidates(env = process.env) {
  * caret range. An installed CLI that picks up this version must still find the
  * names it was compiled against, or it crashes at import. These aliases leave in
  * the contract phase (OSK-8663), with a minor-version bump — never a patch.
+ *
+ * The ones that name a feed name the LEGACY one, the spelling a caller compiled
+ * against them was built for — the retired alias, not `wireProvider`, which has
+ * moved to canonical.
  */
+/** The spelling the deprecated names were written for. */
+const LEGACY_SPELLING = firstPartyHarness_js_1.FIRST_PARTY_HARNESS.aliases[0] ?? firstPartyHarness_js_1.FIRST_PARTY_HARNESS.provider;
 /** @deprecated Use `FIRST_PARTY_HARNESS_CHANNELS`. */
 exports.SKY_CODE_CHANNELS = exports.FIRST_PARTY_HARNESS_CHANNELS;
 /** @deprecated Use `DEFAULT_FIRST_PARTY_HARNESS_CHANNEL`. */
@@ -158,7 +164,7 @@ exports.DEFAULT_SKY_CODE_CHANNEL = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL;
 /** @deprecated Read the channel with `resolveFirstPartyHarnessChannel`; the variable has a neutral name now. */
 exports.SKY_CODE_CHANNEL_ENV = firstPartyHarness_js_1.FIRST_PARTY_HARNESS_ENV.channel.legacy[0];
 /** @deprecated Use `firstPartyHarnessManifestFile()`. Names the legacy file. */
-exports.SKY_CODE_MANIFEST_FILE = (0, firstPartyHarness_js_1.firstPartyHarnessManifestFile)(firstPartyHarness_js_1.FIRST_PARTY_HARNESS.wireProvider);
+exports.SKY_CODE_MANIFEST_FILE = (0, firstPartyHarness_js_1.firstPartyHarnessManifestFile)(LEGACY_SPELLING);
 /** @deprecated Use `isFirstPartyHarnessChannel`. */
 exports.isSkyCodeChannel = isFirstPartyHarnessChannel;
 /** @deprecated Use `resolveFirstPartyHarnessChannel`. */
@@ -166,7 +172,7 @@ exports.resolveSkyCodeChannel = resolveFirstPartyHarnessChannel;
 /** @deprecated Use `firstPartyHarnessChannelPrefix`. */
 exports.skyCodeChannelPrefix = firstPartyHarnessChannelPrefix;
 /** @deprecated Use `firstPartyHarnessDefaultFeedBase()`. Names the legacy feed. */
-exports.DEFAULT_SKY_CODE_FEED_BASE = (0, firstPartyHarness_js_1.firstPartyHarnessDefaultFeedBase)(firstPartyHarness_js_1.FIRST_PARTY_HARNESS.wireProvider);
+exports.DEFAULT_SKY_CODE_FEED_BASE = (0, firstPartyHarness_js_1.firstPartyHarnessDefaultFeedBase)(LEGACY_SPELLING);
 /** @deprecated Read the feed with `firstPartyHarnessFeedBase`; the variable has a neutral name now. */
 exports.SKY_CODE_FEED_BASE_ENV = firstPartyHarness_js_1.FIRST_PARTY_HARNESS_ENV.updateFeedBase.legacy[0];
 /**
@@ -176,5 +182,5 @@ exports.SKY_CODE_FEED_BASE_ENV = firstPartyHarness_js_1.FIRST_PARTY_HARNESS_ENV.
  */
 function skyCodeFeedBase(env = process.env) {
     const override = (0, firstPartyHarness_js_1.readFirstPartyHarnessEnv)(env, 'updateFeedBase').value;
-    return (override || (0, firstPartyHarness_js_1.firstPartyHarnessDefaultFeedBase)(firstPartyHarness_js_1.FIRST_PARTY_HARNESS.wireProvider)).replace(/\/+$/, '');
+    return (override || (0, firstPartyHarness_js_1.firstPartyHarnessDefaultFeedBase)(LEGACY_SPELLING)).replace(/\/+$/, '');
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.d.ts

@@ -19,7 +19,9 @@
  *
  *   1. set `displayName` and `provider`;
  *   2. move the old `provider` to the front of `aliases`;
- *   3. leave `wireProvider` on the spelling installed daemons still speak;
+ *   3. set `wireProvider` to the old spelling as a literal — installed daemons
+ *      still speak it — and derive it from `provider` again only in the wire
+ *      phase, once every peer accepts the new one;
  *   4. regenerate `first-party-harness.json`
  *      (`node --import tsx scripts/emit-first-party-harness-json.mjs`);
  *   5. ship the data migration, which is generic over `aliases`.
@@ -33,9 +35,11 @@
  *                canonical at the edge. Nothing new is ever written with one.
  * `wireProvider` What the server and a daemon say to EACH OTHER — the
  *                capability a daemon advertises, `daemon:<p>:request|response`,
- *                the `provider` of a session RPC. It moves LAST, because a
- *                daemon on a user's machine may be any version and the server
- *                cannot tell which one sent a request.
+ *                the `provider` of a session RPC. It moves after the flip and
+ *                BEFORE contract, because a daemon on a user's machine may be
+ *                any version and the server cannot tell which one sent a
+ *                request: only a released daemon that already advertises the
+ *                canonical capability lets the old one age out of the fleet.
  *
  * The old code treated those three as one string, which is why no single
  * change could rename it safely. See
@@ -63,18 +67,19 @@ export interface FirstPartyHarnessIdentity {
 /**
  * THE identity — the only literal product name in the codebase.
  *
- * Phase: FLIPPED. `skrr-code` is canonical — stored, returned and rendered.
- * `sky-code` is still accepted on every ingress, and it is still the WIRE
- * spelling: daemons on users' machines may predate the rename, so the server
- * and a daemon keep exchanging `sky-code` until contract (OSK-8663) empties
- * `aliases` and moves `wireProvider`.
+ * Phase: WIRE MOVED. `skrr-code` is canonical — stored, returned, rendered — and
+ * it is now also what the server and a daemon say to each other. `sky-code` is
+ * still accepted on every ingress, so a daemon released before this change
+ * (which advertises and answers on `sky-code`) keeps working against a server
+ * that speaks `skrr-code`, and the reverse. Contract (OSK-8663) empties
+ * `aliases` once no connected daemon still advertises the old capability.
  */
 declare const IDENTITY: {
     readonly displayName: "skrr Code";
     readonly command: "skrr code";
     readonly provider: "skrr-code";
     readonly aliases: readonly ["sky-code"];
-    readonly wireProvider: "sky-code";
+    readonly wireProvider: "skrr-code";
 };
 /** The canonical slug, as a literal type. */
 export type FirstPartyHarnessCanonicalProvider = typeof IDENTITY.provider;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.js

@@ -19,7 +19,9 @@
  *
  *   1. set `displayName` and `provider`;
  *   2. move the old `provider` to the front of `aliases`;
- *   3. leave `wireProvider` on the spelling installed daemons still speak;
+ *   3. set `wireProvider` to the old spelling as a literal — installed daemons
+ *      still speak it — and derive it from `provider` again only in the wire
+ *      phase, once every peer accepts the new one;
  *   4. regenerate `first-party-harness.json`
  *      (`node --import tsx scripts/emit-first-party-harness-json.mjs`);
  *   5. ship the data migration, which is generic over `aliases`.
@@ -33,9 +35,11 @@
  *                canonical at the edge. Nothing new is ever written with one.
  * `wireProvider` What the server and a daemon say to EACH OTHER — the
  *                capability a daemon advertises, `daemon:<p>:request|response`,
- *                the `provider` of a session RPC. It moves LAST, because a
- *                daemon on a user's machine may be any version and the server
- *                cannot tell which one sent a request.
+ *                the `provider` of a session RPC. It moves after the flip and
+ *                BEFORE contract, because a daemon on a user's machine may be
+ *                any version and the server cannot tell which one sent a
+ *                request: only a released daemon that already advertises the
+ *                canonical capability lets the old one age out of the fleet.
  *
  * The old code treated those three as one string, which is why no single
  * change could rename it safely. See
@@ -67,21 +71,24 @@ function defineIdentity(identity) {
     }
     return Object.freeze({ ...identity, aliases: Object.freeze([...identity.aliases]) });
 }
+/** The canonical slug. Written once, and read by every field that names the current spelling. */
+const PROVIDER = 'skrr-code';
 /**
  * THE identity — the only literal product name in the codebase.
  *
- * Phase: FLIPPED. `skrr-code` is canonical — stored, returned and rendered.
- * `sky-code` is still accepted on every ingress, and it is still the WIRE
- * spelling: daemons on users' machines may predate the rename, so the server
- * and a daemon keep exchanging `sky-code` until contract (OSK-8663) empties
- * `aliases` and moves `wireProvider`.
+ * Phase: WIRE MOVED. `skrr-code` is canonical — stored, returned, rendered — and
+ * it is now also what the server and a daemon say to each other. `sky-code` is
+ * still accepted on every ingress, so a daemon released before this change
+ * (which advertises and answers on `sky-code`) keeps working against a server
+ * that speaks `skrr-code`, and the reverse. Contract (OSK-8663) empties
+ * `aliases` once no connected daemon still advertises the old capability.
  */
 const IDENTITY = {
     displayName: 'skrr Code',
     command: 'skrr code',
-    provider: 'skrr-code',
+    provider: PROVIDER,
     aliases: ['sky-code'],
-    wireProvider: 'sky-code',
+    wireProvider: PROVIDER,
 };
 export const FIRST_PARTY_HARNESS = defineIdentity(IDENTITY);
 /** The canonical slug with its literal type, for `as const` tuples and keyed tables. */

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarnessChannels.js

@@ -140,7 +140,13 @@ export function firstPartyHarnessFeedCandidates(env = process.env) {
  * caret range. An installed CLI that picks up this version must still find the
  * names it was compiled against, or it crashes at import. These aliases leave in
  * the contract phase (OSK-8663), with a minor-version bump — never a patch.
+ *
+ * The ones that name a feed name the LEGACY one, the spelling a caller compiled
+ * against them was built for — the retired alias, not `wireProvider`, which has
+ * moved to canonical.
  */
+/** The spelling the deprecated names were written for. */
+const LEGACY_SPELLING = FIRST_PARTY_HARNESS.aliases[0] ?? FIRST_PARTY_HARNESS.provider;
 /** @deprecated Use `FIRST_PARTY_HARNESS_CHANNELS`. */
 export const SKY_CODE_CHANNELS = FIRST_PARTY_HARNESS_CHANNELS;
 /** @deprecated Use `DEFAULT_FIRST_PARTY_HARNESS_CHANNEL`. */
@@ -148,7 +154,7 @@ export const DEFAULT_SKY_CODE_CHANNEL = DEFAULT_FIRST_PARTY_HARNESS_CHANNEL;
 /** @deprecated Read the channel with `resolveFirstPartyHarnessChannel`; the variable has a neutral name now. */
 export const SKY_CODE_CHANNEL_ENV = FIRST_PARTY_HARNESS_ENV.channel.legacy[0];
 /** @deprecated Use `firstPartyHarnessManifestFile()`. Names the legacy file. */
-export const SKY_CODE_MANIFEST_FILE = firstPartyHarnessManifestFile(FIRST_PARTY_HARNESS.wireProvider);
+export const SKY_CODE_MANIFEST_FILE = firstPartyHarnessManifestFile(LEGACY_SPELLING);
 /** @deprecated Use `isFirstPartyHarnessChannel`. */
 export const isSkyCodeChannel = isFirstPartyHarnessChannel;
 /** @deprecated Use `resolveFirstPartyHarnessChannel`. */
@@ -156,7 +162,7 @@ export const resolveSkyCodeChannel = resolveFirstPartyHarnessChannel;
 /** @deprecated Use `firstPartyHarnessChannelPrefix`. */
 export const skyCodeChannelPrefix = firstPartyHarnessChannelPrefix;
 /** @deprecated Use `firstPartyHarnessDefaultFeedBase()`. Names the legacy feed. */
-export const DEFAULT_SKY_CODE_FEED_BASE = firstPartyHarnessDefaultFeedBase(FIRST_PARTY_HARNESS.wireProvider);
+export const DEFAULT_SKY_CODE_FEED_BASE = firstPartyHarnessDefaultFeedBase(LEGACY_SPELLING);
 /** @deprecated Read the feed with `firstPartyHarnessFeedBase`; the variable has a neutral name now. */
 export const SKY_CODE_FEED_BASE_ENV = FIRST_PARTY_HARNESS_ENV.updateFeedBase.legacy[0];
 /**
@@ -166,5 +172,5 @@ export const SKY_CODE_FEED_BASE_ENV = FIRST_PARTY_HARNESS_ENV.updateFeedBase.leg
  */
 export function skyCodeFeedBase(env = process.env) {
     const override = readFirstPartyHarnessEnv(env, 'updateFeedBase').value;
-    return (override || firstPartyHarnessDefaultFeedBase(FIRST_PARTY_HARNESS.wireProvider)).replace(/\/+$/, '');
+    return (override || firstPartyHarnessDefaultFeedBase(LEGACY_SPELLING)).replace(/\/+$/, '');
 }

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {

package/dist/node_modules/@skrr-ai/data-provider/package.json

@@ -3,7 +3,7 @@
   "version": "0.9.5",
   "main": "index.js",
   "dependencies": {
-    "@skrr-ai/auth-core": "^0.1.2"
+    "@skrr-ai/auth-core": "^0.2.0"
   },
   "_vendoredBy": "cli/scripts/vendor-monorepo-deps.js"
 }

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/loopback-server.d.ts

@@ -38,6 +38,8 @@ export interface LoopbackServerOptions {
     port?: number;
     /** Private Unix-domain socket transport. Mutually exclusive with TCP host/port. */
     socketPath?: string;
+    /** Optional trusted group that may connect to the per-session Unix socket. */
+    socketGroupId?: number;
     /** URL advertised to a client that uses `fetch(..., { unix: socketPath })`. */
     advertisedBaseUrl?: string;
     /** Bounded before buffering so a local child cannot exhaust daemon memory. */

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/loopback-server.js

@@ -87,9 +87,14 @@ class ModelProxyLoopbackServer {
                 const addr = server.address();
                 this.boundPort = typeof addr === 'object' && addr ? addr.port : this.opts.port;
                 if (this.opts.socketPath && process.platform !== 'win32') {
-                    // The parent directory is owned by the daemon; this closes the
-                    // remaining filesystem-discovery surface on the socket itself.
-                    (0, node_fs_1.chmodSync)(this.opts.socketPath, 0o600);
+                    const sharedGroup = Number.isSafeInteger(this.opts.socketGroupId);
+                    if (sharedGroup) {
+                        (0, node_fs_1.chownSync)(this.opts.socketPath, typeof process.getuid === 'function' ? process.getuid() : -1, this.opts.socketGroupId);
+                    }
+                    // Private by default. A Dedicated Runtime explicitly names its
+                    // root-owned workload group because the daemon and harness use
+                    // different uids; no other local user gains access.
+                    (0, node_fs_1.chmodSync)(this.opts.socketPath, sharedGroup ? 0o660 : 0o600);
                 }
                 resolve();
             };

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/managed-inference-broker.d.ts

@@ -115,6 +115,8 @@ export interface ManagedInferenceBrokerOptions {
     /** Immutable managed lease contract issued alongside the virtual key. */
     modelScope?: ManagedInferenceModelScope;
     fetchImpl?: FetchLike;
+    /** Trusted cross-uid group for a Dedicated Runtime harness child. */
+    socketGroupId?: number;
 }
 export interface ManagedInferenceBrokerSession {
     /** Safe-to-deliver child environment. It intentionally never includes the gateway key. */

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/managed-inference-broker.js

@@ -378,12 +378,17 @@ async function startManagedInferenceBroker(options) {
     // can be deeply nested. The random mkdtemp directory is private to this
     // daemon process; the socket itself is chmod 0600 by the listener.
     const socketDirectory = (0, node_fs_1.mkdtempSync)('/tmp/oversky-inference-');
-    (0, node_fs_1.chmodSync)(socketDirectory, 0o700);
+    const sharedSocketGroup = Number.isSafeInteger(options.socketGroupId);
+    if (sharedSocketGroup) {
+        (0, node_fs_1.chownSync)(socketDirectory, typeof process.getuid === 'function' ? process.getuid() : -1, options.socketGroupId);
+    }
+    (0, node_fs_1.chmodSync)(socketDirectory, sharedSocketGroup ? 0o750 : 0o700);
     const socketPath = (0, node_path_1.join)(socketDirectory, 'broker.sock');
     const server = new loopback_server_js_1.ModelProxyLoopbackServer({
         relayToken,
         forwarder,
         socketPath,
+        ...(sharedSocketGroup ? { socketGroupId: options.socketGroupId } : {}),
         advertisedBaseUrl: exports.INFERENCE_BROKER_ORIGIN,
         ...(envelope ? { maxBodyBytes: envelope.maxInputBytes } : {}),
     });

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/loopback-server.d.ts

@@ -38,6 +38,8 @@ export interface LoopbackServerOptions {
     port?: number;
     /** Private Unix-domain socket transport. Mutually exclusive with TCP host/port. */
     socketPath?: string;
+    /** Optional trusted group that may connect to the per-session Unix socket. */
+    socketGroupId?: number;
     /** URL advertised to a client that uses `fetch(..., { unix: socketPath })`. */
     advertisedBaseUrl?: string;
     /** Bounded before buffering so a local child cannot exhaust daemon memory. */

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/loopback-server.js

@@ -15,7 +15,7 @@
  */
 import { createServer } from 'node:http';
 import { timingSafeEqual } from 'node:crypto';
-import { chmodSync, unlinkSync } from 'node:fs';
+import { chmodSync, chownSync, unlinkSync } from 'node:fs';
 import { MODEL_PROXY_ERROR, MODEL_PROXY_MAX_BODY_BYTES, ModelProxyError, } from './contract.js';
 class RequestBodyTooLargeError extends Error {
     maxBodyBytes;
@@ -84,9 +84,14 @@ export class ModelProxyLoopbackServer {
                 const addr = server.address();
                 this.boundPort = typeof addr === 'object' && addr ? addr.port : this.opts.port;
                 if (this.opts.socketPath && process.platform !== 'win32') {
-                    // The parent directory is owned by the daemon; this closes the
-                    // remaining filesystem-discovery surface on the socket itself.
-                    chmodSync(this.opts.socketPath, 0o600);
+                    const sharedGroup = Number.isSafeInteger(this.opts.socketGroupId);
+                    if (sharedGroup) {
+                        chownSync(this.opts.socketPath, typeof process.getuid === 'function' ? process.getuid() : -1, this.opts.socketGroupId);
+                    }
+                    // Private by default. A Dedicated Runtime explicitly names its
+                    // root-owned workload group because the daemon and harness use
+                    // different uids; no other local user gains access.
+                    chmodSync(this.opts.socketPath, sharedGroup ? 0o660 : 0o600);
                 }
                 resolve();
             };

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/managed-inference-broker.d.ts

@@ -115,6 +115,8 @@ export interface ManagedInferenceBrokerOptions {
     /** Immutable managed lease contract issued alongside the virtual key. */
     modelScope?: ManagedInferenceModelScope;
     fetchImpl?: FetchLike;
+    /** Trusted cross-uid group for a Dedicated Runtime harness child. */
+    socketGroupId?: number;
 }
 export interface ManagedInferenceBrokerSession {
     /** Safe-to-deliver child environment. It intentionally never includes the gateway key. */

package/dist/node_modules/@skrr-ai/inference-broker/dist/esm/managed-inference-broker.js

@@ -10,7 +10,7 @@
  * endpoint while it is alive.
  */
 import { randomBytes, timingSafeEqual } from 'node:crypto';
-import { chmodSync, mkdtempSync, rmSync } from 'node:fs';
+import { chmodSync, chownSync, mkdtempSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { ModelProxyLoopbackServer } from './loopback-server.js';
 import { MODEL_PROXY_ERROR, ModelProxyError } from './contract.js';
@@ -368,12 +368,17 @@ export async function startManagedInferenceBroker(options) {
     // can be deeply nested. The random mkdtemp directory is private to this
     // daemon process; the socket itself is chmod 0600 by the listener.
     const socketDirectory = mkdtempSync('/tmp/oversky-inference-');
-    chmodSync(socketDirectory, 0o700);
+    const sharedSocketGroup = Number.isSafeInteger(options.socketGroupId);
+    if (sharedSocketGroup) {
+        chownSync(socketDirectory, typeof process.getuid === 'function' ? process.getuid() : -1, options.socketGroupId);
+    }
+    chmodSync(socketDirectory, sharedSocketGroup ? 0o750 : 0o700);
     const socketPath = join(socketDirectory, 'broker.sock');
     const server = new ModelProxyLoopbackServer({
         relayToken,
         forwarder,
         socketPath,
+        ...(sharedSocketGroup ? { socketGroupId: options.socketGroupId } : {}),
         advertisedBaseUrl: INFERENCE_BROKER_ORIGIN,
         ...(envelope ? { maxBodyBytes: envelope.maxInputBytes } : {}),
     });

package/dist/node_modules/@skrr-ai/inference-broker/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/inference-broker",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "main": "dist/cjs/index.js",
   "types": "dist/cjs/index.d.ts",
   "exports": {