@skrr-ai/cli 0.1.46 → 0.1.48

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -22,11 +22,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
-exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
-exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = void 0;
+exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
+exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = void 0;
+exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
+exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -63,6 +63,7 @@ Object.defineProperty(exports, "handleMidStreamAuthExpiry", { enumerable: true,
 // Reauth messaging
 var messages_js_1 = require("./messages.js");
 Object.defineProperty(exports, "formatReauthMessage", { enumerable: true, get: function () { return messages_js_1.formatReauthMessage; } });
+Object.defineProperty(exports, "reauthCommand", { enumerable: true, get: function () { return messages_js_1.reauthCommand; } });
 Object.defineProperty(exports, "EXIT_NEEDS_REAUTH", { enumerable: true, get: function () { return messages_js_1.EXIT_NEEDS_REAUTH; } });
 // Pure HTTP→{Permanent, Transient, Success} response classification —
 // exposed so RN-side clients can apply the same mapping daemon uses.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/messages.d.ts

@@ -1,4 +1,20 @@
 export type AuthFailureReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'UNKNOWN_401' | 'UNKNOWN';
+/**
+ * The command that recovers this process from a re-auth latch.
+ *
+ * ONE function owns this, because the answer is printed twice in the same
+ * millisecond — once in the human block below and once on the machine-readable
+ * `[oversky-reauth]` line a log scraper pages on — and the two used to be
+ * written independently. They disagreed: the block said `skrrd login --device`
+ * while the error line said `skrr login`, naming a different binary and
+ * different flags for one action, so an operator reading either one did
+ * something the other did not describe (OSK-10224).
+ *
+ * The binary is whatever the consumer registered with
+ * `configureAuthCore({ binaryName })` — the binary the user actually typed —
+ * and `--device` is added only when there is no TTY to open a browser from.
+ */
+export declare function reauthCommand(): string;
 export declare function formatReauthMessage(reason: AuthFailureReason | string): string;
 /**
  * Exit code for "permanent auth failure during initial connect" — picked to

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/messages.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EXIT_NEEDS_REAUTH = void 0;
+exports.reauthCommand = reauthCommand;
 exports.formatReauthMessage = formatReauthMessage;
 /**
  * User-facing messages for auth state transitions.
@@ -21,17 +22,33 @@ const REASON_HUMAN = {
     UNKNOWN_401: 'skrr needs you to sign in again.',
     UNKNOWN: 'skrr needs you to sign in again.',
 };
+/**
+ * The command that recovers this process from a re-auth latch.
+ *
+ * ONE function owns this, because the answer is printed twice in the same
+ * millisecond — once in the human block below and once on the machine-readable
+ * `[oversky-reauth]` line a log scraper pages on — and the two used to be
+ * written independently. They disagreed: the block said `skrrd login --device`
+ * while the error line said `skrr login`, naming a different binary and
+ * different flags for one action, so an operator reading either one did
+ * something the other did not describe (OSK-10224).
+ *
+ * The binary is whatever the consumer registered with
+ * `configureAuthCore({ binaryName })` — the binary the user actually typed —
+ * and `--device` is added only when there is no TTY to open a browser from.
+ */
+function reauthCommand() {
+    const bin = (0, runtime_js_1.getAuthBinaryName)();
+    return process.stdout.isTTY ? `${bin} login` : `${bin} login --device`;
+}
 function formatReauthMessage(reason) {
     const norm = REASON_HUMAN[reason] || REASON_HUMAN.UNKNOWN;
-    const isHeadless = !process.stdout.isTTY;
-    const bin = (0, runtime_js_1.getAuthBinaryName)();
-    const cmd = isHeadless ? `${bin} login --device` : `${bin} login`;
     return [
         '',
         'skrr cannot connect — re-authentication required.',
         `  Reason: ${norm}`,
         '',
-        `  To continue, run:  ${cmd}`,
+        `  To continue, run:  ${reauthCommand()}`,
         '',
     ].join('\n');
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -75,7 +75,7 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
  * `SECRETARY` untouched.
  */
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -61,6 +61,9 @@ exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 exports.SENSITIVE_ENV_VARS = new Set([
     'CLAUDE_CODE_OAUTH_TOKEN',
     'OVERSKY_TOKEN',
+    // The renamed credential alias (cli/src/lib/config.ts honors both spellings).
+    // Same double coverage as OVERSKY_TOKEN — name AND the SKRR_ prefix below.
+    'SKRR_TOKEN',
     'AWS_ACCESS_KEY_ID',
     'AWS_SECRET_ACCESS_KEY',
     'AWS_SESSION_TOKEN',
@@ -91,7 +94,16 @@ exports.SENSITIVE_ENV_VARS = new Set([
     'LD_PRELOAD',
 ]);
 /** Variable name prefixes that should be stripped (catches families like AWS_*). */
-exports.SENSITIVE_ENV_PREFIXES = ['AWS_', 'OVERSKY_'];
+exports.SENSITIVE_ENV_PREFIXES = [
+    'AWS_',
+    'OVERSKY_',
+    // The renamed product namespace: SKRR_TOKEN, SKRR_REFRESH_TOKEN, the
+    // session-authority aliases (SKRR_SESSION_*, SKRR_BASE_URL), and the
+    // daemon's control-plane identity (SKRR_MACHINE_UUID, SKRR_LEASE_GENERATION)
+    // all carry authority a model-driven child must not inherit. Non-secret
+    // lane essentials live in SENSITIVE_ENV_PREFIX_EXCEPTIONS below.
+    'SKRR_',
+];
 /**
  * Credential-shaped suffixes are also forbidden. A fixed provider list is
  * never complete: a newly configured provider would otherwise leak its key
@@ -120,7 +132,7 @@ exports.SENSITIVE_ENV_SUFFIXES = [
  * `SECRETARY` untouched.
  */
 exports.SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
     // not a secret. Add more here if a tool legitimately needs an OVERSKY_ var.
@@ -130,6 +142,16 @@ exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // know they're inside a supervised daemon on Linux/Windows in addition
     // to macOS launchd. Not a secret.
     'OVERSKY_SUPERVISOR',
+    // A deployment URL, not a credential. The rename to SKRR_SERVER_URL was
+    // chosen precisely because it survives the sanitizer
+    // (daemon/src/dedicated-tenant-env.ts), so a spawned lane's `skrr` reaches
+    // the deployment this machine is registered with.
+    'SKRR_SERVER_URL',
+    // The Dedicated Runtime workload marker the exec wrapper stamps into every
+    // tenant lane; grandchildren spawned from a lane (e.g. `skrr code` → the
+    // engine) must keep it to detect they already run as the workload uid. Not
+    // a secret — it authorizes nothing without the matching real uid.
+    'SKRR_WORKLOAD_UID',
 ]);
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonScopes.d.ts

@@ -29,29 +29,35 @@
  * never rename in place.
  */
 /**
- * The canonical daemon scope vocabulary. Six strings, frozen.
+ * The canonical daemon scope vocabulary. Seven strings, append-only.
  *
  *   - `daemon:tools:bash`        — bash tool execution
  *   - `daemon:tools:fs:read`     — Read tool (file read)
  *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
  *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
+ *   - `daemon:native-ui:control` — native app GUI control via the helper
  *   - `daemon:session:replay`    — `daemon:session:replay` socket event
  *   - `daemon:offline-queue`     — daemon-initiated offline queue
  *
  * Order is the consent-screen render order: tools-first, I/O second,
  * control-flow last.
+ *
+ * `daemon:native-ui:control` is deliberately NOT folded into
+ * `daemon:tools:bash`: a token minted to run shell commands must not
+ * thereby be able to click around the user's desktop (OSK-11009).
  */
 export declare const SCOPES: Readonly<{
     readonly TOOLS_BASH: "daemon:tools:bash";
     readonly TOOLS_FS_READ: "daemon:tools:fs:read";
     readonly TOOLS_FS_WRITE: "daemon:tools:fs:write";
     readonly BROWSER_CDP: "daemon:browser:cdp";
+    readonly NATIVE_UI_CONTROL: "daemon:native-ui:control";
     readonly SESSION_REPLAY: "daemon:session:replay";
     readonly OFFLINE_QUEUE: "daemon:offline-queue";
 }>;
 export type DaemonScope = (typeof SCOPES)[keyof typeof SCOPES];
 /**
- * The six daemon scopes in canonical order. Frozen so consumers can
+ * The seven daemon scopes in canonical order. Frozen so consumers can
  * pass it directly to OAuth `scope` parameters without defensive
  * copies.
  */
@@ -64,7 +70,7 @@ export declare const VALID_DAEMON_SCOPE_SET: ReadonlySet<string>;
 export declare function isDaemonScope(s: unknown): s is DaemonScope;
 /**
  * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
- * to the six daemon scopes; lives on `OAuthClient.allowedScopes` for
+ * to the daemon scopes; lives on `OAuthClient.allowedScopes` for
  * the `oversky-cli` client. See the data-schemas canonical for the
  * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
  * grandfather sentinel `expandScopes(undefined)` would over-grant).

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonScopes.js

@@ -29,28 +29,34 @@
  * never rename in place.
  */
 /**
- * The canonical daemon scope vocabulary. Six strings, frozen.
+ * The canonical daemon scope vocabulary. Seven strings, append-only.
  *
  *   - `daemon:tools:bash`        — bash tool execution
  *   - `daemon:tools:fs:read`     — Read tool (file read)
  *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
  *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
+ *   - `daemon:native-ui:control` — native app GUI control via the helper
  *   - `daemon:session:replay`    — `daemon:session:replay` socket event
  *   - `daemon:offline-queue`     — daemon-initiated offline queue
  *
  * Order is the consent-screen render order: tools-first, I/O second,
  * control-flow last.
+ *
+ * `daemon:native-ui:control` is deliberately NOT folded into
+ * `daemon:tools:bash`: a token minted to run shell commands must not
+ * thereby be able to click around the user's desktop (OSK-11009).
  */
 export const SCOPES = Object.freeze({
     TOOLS_BASH: 'daemon:tools:bash',
     TOOLS_FS_READ: 'daemon:tools:fs:read',
     TOOLS_FS_WRITE: 'daemon:tools:fs:write',
     BROWSER_CDP: 'daemon:browser:cdp',
+    NATIVE_UI_CONTROL: 'daemon:native-ui:control',
     SESSION_REPLAY: 'daemon:session:replay',
     OFFLINE_QUEUE: 'daemon:offline-queue',
 });
 /**
- * The six daemon scopes in canonical order. Frozen so consumers can
+ * The seven daemon scopes in canonical order. Frozen so consumers can
  * pass it directly to OAuth `scope` parameters without defensive
  * copies.
  */
@@ -59,6 +65,7 @@ export const ALL_DAEMON_SCOPES = Object.freeze([
     SCOPES.TOOLS_FS_READ,
     SCOPES.TOOLS_FS_WRITE,
     SCOPES.BROWSER_CDP,
+    SCOPES.NATIVE_UI_CONTROL,
     SCOPES.SESSION_REPLAY,
     SCOPES.OFFLINE_QUEUE,
 ]);
@@ -72,7 +79,7 @@ export function isDaemonScope(s) {
 }
 /**
  * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
- * to the six daemon scopes; lives on `OAuthClient.allowedScopes` for
+ * to the daemon scopes; lives on `OAuthClient.allowedScopes` for
  * the `oversky-cli` client. See the data-schemas canonical for the
  * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
  * grandfather sentinel `expandScopes(undefined)` would over-grant).

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.d.ts

@@ -320,6 +320,14 @@ declare const ENGINE_ENV_SUFFIXES: Readonly<{
      * engine must treat it as a hint: enforcement stays server-side.
      */
     maxInputTokens: "MAX_INPUT_TOKENS";
+    /**
+     * The session id the engine stamps into processes it spawns — the one
+     * variable on this table the engine WRITES rather than reads, so a child
+     * process (e.g. `skrr code handover --carry-session`) can name the session it
+     * is running inside without being told. Read with
+     * `readFirstPartyHarnessEngineEnv`: current namespace first, then legacy.
+     */
+    sessionId: "SESSION_ID";
 }>;
 export type FirstPartyHarnessEngineEnvKey = keyof typeof ENGINE_ENV_SUFFIXES;
 /**
@@ -357,7 +365,7 @@ export declare const FIRST_PARTY_HARNESS_ENGINE: Readonly<{
      * `readFirstPartyHarnessEngineEnv` to read one the way the engine does and
      * `firstPartyHarnessEngineEnvEntries` to set one every engine build honours.
      */
-    env: Readonly<Record<"appName" | "serverPassword" | "serverUsername" | "home" | "config" | "scriptName" | "allowUpstreamEgress" | "compatOpencode" | "noCompatPrompts" | "maxInputTokens", string>>;
+    env: Readonly<Record<"appName" | "serverPassword" | "serverUsername" | "home" | "config" | "scriptName" | "allowUpstreamEgress" | "compatOpencode" | "noCompatPrompts" | "maxInputTokens" | "sessionId", string>>;
 }>;
 /**
  * Every name the engine reads for one purpose, current namespace first — the

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.js

@@ -422,6 +422,14 @@ const ENGINE_ENV_SUFFIXES = Object.freeze({
      * engine must treat it as a hint: enforcement stays server-side.
      */
     maxInputTokens: 'MAX_INPUT_TOKENS',
+    /**
+     * The session id the engine stamps into processes it spawns — the one
+     * variable on this table the engine WRITES rather than reads, so a child
+     * process (e.g. `skrr code handover --carry-session`) can name the session it
+     * is running inside without being told. Read with
+     * `readFirstPartyHarnessEngineEnv`: current namespace first, then legacy.
+     */
+    sessionId: 'SESSION_ID',
 });
 function engineEnvName(appName, key) {
     return `${appName.toUpperCase().replace(/-/g, '_')}_${ENGINE_ENV_SUFFIXES[key]}`;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -11,7 +11,7 @@ export { configureAuthCore, getAuthLogger, getAuthConfigDir, getAuthKillSwitches
 export { PermanentAuthFailure, TransientAuthFailure, type PermanentAuthReason, type ReauthState, type TokenPair, } from './types.js';
 export { decodeJwtExpiry, decodeJwtPayload } from './jwtUtils.js';
 export { isAuthExpiredSseEvent, handleMidStreamAuthExpiry, type ParsedSseLike, type AuthExpiredCallbacks, type HandleMidStreamAuthExpiryResult, } from './authExpiredDetector.js';
-export { formatReauthMessage, EXIT_NEEDS_REAUTH, type AuthFailureReason } from './messages.js';
+export { formatReauthMessage, reauthCommand, EXIT_NEEDS_REAUTH, type AuthFailureReason, } from './messages.js';
 export { classifyRefreshResponse, type RefreshResponseShape, type ClassifiedRefreshResult, type ClassifiedRefreshSuccess, type ClassifiedRefreshFailure, } from './refreshClassification.js';
 export { refreshDaemonToken, revokeDaemonRefreshSession, withAuthLock, persistReauthState, needsReauthState, clearReauthState, installLockExitHandlers, __refreshDiagnostics, __resetUnknown401StreaksForTest, UNKNOWN_401_BUDGET, } from './refresh.js';
 export { createRefreshScheduler, type RefreshScheduler, type RefreshSchedulerOptions, } from './refreshScheduler.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -23,7 +23,7 @@ export { decodeJwtExpiry, decodeJwtPayload } from './jwtUtils.js';
 // header.
 export { isAuthExpiredSseEvent, handleMidStreamAuthExpiry, } from './authExpiredDetector.js';
 // Reauth messaging
-export { formatReauthMessage, EXIT_NEEDS_REAUTH } from './messages.js';
+export { formatReauthMessage, reauthCommand, EXIT_NEEDS_REAUTH, } from './messages.js';
 // Pure HTTP→{Permanent, Transient, Success} response classification —
 // exposed so RN-side clients can apply the same mapping daemon uses.
 export { classifyRefreshResponse, } from './refreshClassification.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/messages.d.ts

@@ -1,4 +1,20 @@
 export type AuthFailureReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'UNKNOWN_401' | 'UNKNOWN';
+/**
+ * The command that recovers this process from a re-auth latch.
+ *
+ * ONE function owns this, because the answer is printed twice in the same
+ * millisecond — once in the human block below and once on the machine-readable
+ * `[oversky-reauth]` line a log scraper pages on — and the two used to be
+ * written independently. They disagreed: the block said `skrrd login --device`
+ * while the error line said `skrr login`, naming a different binary and
+ * different flags for one action, so an operator reading either one did
+ * something the other did not describe (OSK-10224).
+ *
+ * The binary is whatever the consumer registered with
+ * `configureAuthCore({ binaryName })` — the binary the user actually typed —
+ * and `--device` is added only when there is no TTY to open a browser from.
+ */
+export declare function reauthCommand(): string;
 export declare function formatReauthMessage(reason: AuthFailureReason | string): string;
 /**
  * Exit code for "permanent auth failure during initial connect" — picked to

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/messages.js

@@ -17,17 +17,33 @@ const REASON_HUMAN = {
     UNKNOWN_401: 'skrr needs you to sign in again.',
     UNKNOWN: 'skrr needs you to sign in again.',
 };
+/**
+ * The command that recovers this process from a re-auth latch.
+ *
+ * ONE function owns this, because the answer is printed twice in the same
+ * millisecond — once in the human block below and once on the machine-readable
+ * `[oversky-reauth]` line a log scraper pages on — and the two used to be
+ * written independently. They disagreed: the block said `skrrd login --device`
+ * while the error line said `skrr login`, naming a different binary and
+ * different flags for one action, so an operator reading either one did
+ * something the other did not describe (OSK-10224).
+ *
+ * The binary is whatever the consumer registered with
+ * `configureAuthCore({ binaryName })` — the binary the user actually typed —
+ * and `--device` is added only when there is no TTY to open a browser from.
+ */
+export function reauthCommand() {
+    const bin = getAuthBinaryName();
+    return process.stdout.isTTY ? `${bin} login` : `${bin} login --device`;
+}
 export function formatReauthMessage(reason) {
     const norm = REASON_HUMAN[reason] || REASON_HUMAN.UNKNOWN;
-    const isHeadless = !process.stdout.isTTY;
-    const bin = getAuthBinaryName();
-    const cmd = isHeadless ? `${bin} login --device` : `${bin} login`;
     return [
         '',
         'skrr cannot connect — re-authentication required.',
         `  Reason: ${norm}`,
         '',
-        `  To continue, run:  ${cmd}`,
+        `  To continue, run:  ${reauthCommand()}`,
         '',
     ].join('\n');
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.d.ts

@@ -75,7 +75,7 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
  * `SECRETARY` untouched.
  */
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.js

@@ -57,6 +57,9 @@
 export const SENSITIVE_ENV_VARS = new Set([
     'CLAUDE_CODE_OAUTH_TOKEN',
     'OVERSKY_TOKEN',
+    // The renamed credential alias (cli/src/lib/config.ts honors both spellings).
+    // Same double coverage as OVERSKY_TOKEN — name AND the SKRR_ prefix below.
+    'SKRR_TOKEN',
     'AWS_ACCESS_KEY_ID',
     'AWS_SECRET_ACCESS_KEY',
     'AWS_SESSION_TOKEN',
@@ -87,7 +90,16 @@ export const SENSITIVE_ENV_VARS = new Set([
     'LD_PRELOAD',
 ]);
 /** Variable name prefixes that should be stripped (catches families like AWS_*). */
-export const SENSITIVE_ENV_PREFIXES = ['AWS_', 'OVERSKY_'];
+export const SENSITIVE_ENV_PREFIXES = [
+    'AWS_',
+    'OVERSKY_',
+    // The renamed product namespace: SKRR_TOKEN, SKRR_REFRESH_TOKEN, the
+    // session-authority aliases (SKRR_SESSION_*, SKRR_BASE_URL), and the
+    // daemon's control-plane identity (SKRR_MACHINE_UUID, SKRR_LEASE_GENERATION)
+    // all carry authority a model-driven child must not inherit. Non-secret
+    // lane essentials live in SENSITIVE_ENV_PREFIX_EXCEPTIONS below.
+    'SKRR_',
+];
 /**
  * Credential-shaped suffixes are also forbidden. A fixed provider list is
  * never complete: a newly configured provider would otherwise leak its key
@@ -116,7 +128,7 @@ export const SENSITIVE_ENV_SUFFIXES = [
  * `SECRETARY` untouched.
  */
 export const SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
     // not a secret. Add more here if a tool legitimately needs an OVERSKY_ var.
@@ -126,6 +138,16 @@ export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // know they're inside a supervised daemon on Linux/Windows in addition
     // to macOS launchd. Not a secret.
     'OVERSKY_SUPERVISOR',
+    // A deployment URL, not a credential. The rename to SKRR_SERVER_URL was
+    // chosen precisely because it survives the sanitizer
+    // (daemon/src/dedicated-tenant-env.ts), so a spawned lane's `skrr` reaches
+    // the deployment this machine is registered with.
+    'SKRR_SERVER_URL',
+    // The Dedicated Runtime workload marker the exec wrapper stamps into every
+    // tenant lane; grandchildren spawned from a lane (e.g. `skrr code` → the
+    // engine) must keep it to detect they already run as the workload uid. Not
+    // a secret — it authorizes nothing without the matching real uid.
+    'SKRR_WORKLOAD_UID',
 ]);
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.2",
+  "version": "0.4.3",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {