@skrr-ai/cli 0.1.47 → 0.1.48

package/dist/lib/guest-service.js

@@ -0,0 +1,112 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GUEST_SERVICE_CALL_TIMEOUT_MS = void 0;
+exports.callGuestServiceSocket = callGuestServiceSocket;
+exports.proposeGuestService = proposeGuestService;
+exports.callGuestServiceRead = callGuestServiceRead;
+exports.readGuestSpecFile = readGuestSpecFile;
+const node_fs_1 = require("node:fs");
+const node_net_1 = require("node:net");
+const dedicated_service_1 = require("./dedicated-service");
+exports.GUEST_SERVICE_CALL_TIMEOUT_MS = 15_000;
+/**
+ * Write one document to the propose socket and read the daemon's one reply.
+ * Half-closing after the write is the "request is complete" signal — a
+ * keep-alive protocol would need framing the design does not specify.
+ */
+function callGuestServiceSocket(document, options = {}) {
+    const socketPath = options.socketPath ?? dedicated_service_1.GUEST_SERVICE_SOCKET_PATH;
+    const connect = options.connect ?? node_net_1.connect;
+    const timeoutMs = options.timeoutMs ?? exports.GUEST_SERVICE_CALL_TIMEOUT_MS;
+    return new Promise((resolve, reject) => {
+        const socket = connect(socketPath);
+        const chunks = [];
+        let done = false;
+        const fail = (error) => {
+            if (done)
+                return;
+            done = true;
+            socket.destroy();
+            reject(error);
+        };
+        const timer = setTimeout(() => {
+            fail(new dedicated_service_1.DedicatedServiceError('The machine’s daemon did not answer the service socket in time.', 'GUEST_SERVICE_TIMEOUT'));
+        }, timeoutMs);
+        socket.on('connect', () => {
+            socket.write(`${JSON.stringify(document)}\n`, () => {
+                socket.end();
+            });
+        });
+        socket.on('data', (chunk) => chunks.push(chunk));
+        socket.on('error', (err) => {
+            clearTimeout(timer);
+            if (err.code === 'ENOENT' || err.code === 'ECONNREFUSED') {
+                fail(new dedicated_service_1.DedicatedServiceError(`The service socket (${socketPath}) is not there — this machine's daemon does not offer the service lane. ` +
+                    'An agent should ask the owner to run `skrr machines dedicated service …` instead.', 'GUEST_SERVICE_UNAVAILABLE'));
+                return;
+            }
+            fail(new dedicated_service_1.DedicatedServiceError(`The service socket refused the connection: ${err.message}`, 'GUEST_SERVICE_SOCKET'));
+        });
+        socket.on('close', () => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            const text = Buffer.concat(chunks).toString('utf8').trim();
+            if (!text) {
+                reject(new dedicated_service_1.DedicatedServiceError('The daemon closed the service socket without an answer.', 'GUEST_SERVICE_EMPTY'));
+                return;
+            }
+            let reply;
+            try {
+                reply = JSON.parse(text);
+            }
+            catch {
+                reject(new dedicated_service_1.DedicatedServiceError(`The daemon answered with something that is not JSON: ${text.slice(0, 200)}`, 'GUEST_SERVICE_REPLY'));
+                return;
+            }
+            if (!reply.ok) {
+                reject(new dedicated_service_1.DedicatedServiceError(reply.error || 'The daemon refused the service request.', reply.code || 'GUEST_SERVICE_REFUSED'));
+                return;
+            }
+            resolve(reply);
+        });
+    });
+}
+/** `skrr service propose` — hand the daemon a spec, get back a proposal id. */
+async function proposeGuestService(spec, options = {}) {
+    const reply = await callGuestServiceSocket({ verb: 'propose', spec: (0, dedicated_service_1.specPayload)(spec) }, options);
+    // The daemon's pending proposal is keyed by the service name — that IS
+    // the id the owner approves with.
+    const proposalId = typeof reply.proposalId === 'string'
+        ? reply.proposalId
+        : typeof reply.name === 'string'
+            ? reply.name
+            : typeof reply.result?.proposalId === 'string'
+                ? reply.result.proposalId
+                : '';
+    return { proposalId, reply };
+}
+/**
+ * `skrr service ls|status|logs` — the read verbs on the same socket. The
+ * daemon returns `result` in whatever shape the verb defines; the commands
+ * render it, they do not reinterpret it.
+ */
+async function callGuestServiceRead(op, args = {}, options = {}) {
+    return callGuestServiceSocket({
+        verb: op,
+        ...(args.name ? { name: args.name } : {}),
+        ...(args.tailBytes !== undefined ? { tailBytes: args.tailBytes } : {}),
+    }, options);
+}
+/** Parse and validate a spec document read from a file the guest hands the daemon. */
+function readGuestSpecFile(filePath) {
+    let raw;
+    try {
+        raw = (0, node_fs_1.readFileSync)(filePath, 'utf8');
+    }
+    catch (err) {
+        throw new dedicated_service_1.DedicatedServiceError(`Cannot read ${filePath}: ${err instanceof Error ? err.message : err}`, 'SPEC_FILE');
+    }
+    return (0, dedicated_service_1.parseServiceSpecDocument)(raw, filePath);
+}

package/dist/lib/prompt.d.ts

@@ -47,6 +47,7 @@ export declare function confirmDestructive(question: string, yesFlag: boolean, f
  */
 export declare function readJsonValue(source: string | undefined): Promise<unknown>;
 export declare function readJsonBody(source: string | undefined): Promise<Record<string, unknown>>;
+export declare function readStdin(): Promise<string>;
 /**
  * Copy every defined property from `overrides` onto `base` and return the
  * result. `undefined` values are skipped so unset oclif flags don't clobber

package/dist/lib/prompt.js

@@ -38,6 +38,7 @@ exports.confirm = confirm;
 exports.confirmDestructive = confirmDestructive;
 exports.readJsonValue = readJsonValue;
 exports.readJsonBody = readJsonBody;
+exports.readStdin = readStdin;
 exports.mergeDefined = mergeDefined;
 const fs = __importStar(require("node:fs"));
 const readline = __importStar(require("node:readline"));

package/dist/lib/task-asset-upload.d.ts

@@ -1,4 +1,23 @@
 export type TaskAssetRole = 'input' | 'evidence' | 'deliverable';
+/**
+ * What the bytes ARE in the work ledger, for an upload that is the archived
+ * copy of an artifact that already has a name (`docs/policies/payout.md`).
+ *
+ * Without it the server keys the Resource on the attachment id, which is right
+ * for a screenshot and wrong for a named document: the coordinate somebody
+ * cited and the copy nobody can match to it become two Resources.
+ *
+ * Both upload paths carry it. On the direct-to-storage path it is declared at
+ * INTENT time and persisted on the attachment row, because `complete` — which
+ * writes the receipt — runs in a later request that never sees the intent's
+ * body. Without that, a Deliverable's ledger identity would depend on its
+ * SIZE, which is an implementation detail deciding a durable record.
+ */
+export interface TaskAssetLedgerResource {
+    identity: string;
+    title?: string;
+    expectationIds?: string[];
+}
 export interface UploadedTaskAsset {
     id: string;
     /**
@@ -35,6 +54,7 @@ export declare function uploadTaskAssetFile(opts: {
     taskId: string;
     filePath: string;
     role?: TaskAssetRole;
+    ledger?: TaskAssetLedgerResource;
 }): Promise<UploadedTaskAsset>;
 /**
  * Upload every `--attach` file and return the reference objects an Update or

package/dist/lib/task-asset-upload.js

@@ -105,7 +105,7 @@ async function readTaskForUpload(taskId) {
  * Throws a plain Error; callers decide how to surface it.
  */
 async function uploadTaskAssetFile(opts) {
-    const { taskId, filePath, role } = opts;
+    const { taskId, filePath, role, ledger } = opts;
     if (!fs.existsSync(filePath)) {
         throw new Error(`File not found: ${filePath}`);
     }
@@ -130,13 +130,13 @@ async function uploadTaskAssetFile(opts) {
         if (sessionPath) {
             await readTaskForUpload(taskId);
             result = direct
-                ? await sessionDirectUpload({ filePath, size, filename, mimeType, role })
-                : await sessionBufferedUpload({ filePath, filename, mimeType, role });
+                ? await sessionDirectUpload({ filePath, size, filename, mimeType, role, ledger })
+                : await sessionBufferedUpload({ filePath, filename, mimeType, role, ledger });
         }
         else {
             result = direct
-                ? await genericDirectUpload({ taskId, filePath, size, filename, mimeType, role })
-                : await genericBufferedUpload({ taskId, filePath, filename, mimeType, role });
+                ? await genericDirectUpload({ taskId, filePath, size, filename, mimeType, role, ledger })
+                : await genericBufferedUpload({ taskId, filePath, filename, mimeType, role, ledger });
         }
     }
     catch (err) {
@@ -205,23 +205,31 @@ function taskAssetMarkdownRef(asset) {
  * The buffered path holds the file in memory by design: it is capped at the
  * buffered limit, and the server needs the whole body to canonicalize it.
  */
-function fileFormData(filePath, filename, mimeType, role) {
+function fileFormData(filePath, filename, mimeType, role, ledger) {
     const fd = new FormData();
     fd.append('file', new node_buffer_1.Blob([fs.readFileSync(filePath)], { type: mimeType }), filename);
     if (role)
         fd.append('role', role);
+    if (ledger?.identity) {
+        fd.append('identity', ledger.identity);
+        if (ledger.title)
+            fd.append('title', ledger.title);
+        if (ledger.expectationIds?.length) {
+            fd.append('expectationIds', JSON.stringify(ledger.expectationIds));
+        }
+    }
     return fd;
 }
 async function genericBufferedUpload(p) {
     return data_provider_1.dataService.uploadTaskAttachment({
         taskId: p.taskId,
-        formData: fileFormData(p.filePath, p.filename, p.mimeType, p.role),
+        formData: fileFormData(p.filePath, p.filename, p.mimeType, p.role, p.ledger),
     });
 }
 async function sessionBufferedUpload(p) {
     return (0, api_fetch_1.apiFetch)((await (0, session_task_endpoints_1.sessionScopedTaskPath)('attachment')), {
         method: 'POST',
-        body: fileFormData(p.filePath, p.filename, p.mimeType, p.role),
+        body: fileFormData(p.filePath, p.filename, p.mimeType, p.role, p.ledger),
     });
 }
 async function genericDirectUpload(p) {
@@ -232,6 +240,13 @@ async function genericDirectUpload(p) {
         sizeBytes: p.size,
         sha256: await sha256OfFile(p.filePath),
         role: p.role,
+        ...(p.ledger?.identity
+            ? {
+                identity: p.ledger.identity,
+                title: p.ledger.title,
+                expectationIds: p.ledger.expectationIds,
+            }
+            : {}),
     });
     if (!intent.uploadUrl)
         return intent.attachment;
@@ -257,6 +272,13 @@ async function sessionDirectUpload(p) {
             sizeBytes: p.size,
             sha256: await sha256OfFile(p.filePath),
             ...(p.role ? { role: p.role } : {}),
+            ...(p.ledger?.identity
+                ? {
+                    identity: p.ledger.identity,
+                    title: p.ledger.title,
+                    expectationIds: p.ledger.expectationIds,
+                }
+                : {}),
         },
     });
     if (!intent.uploadUrl)

package/dist/lib/task-extras.d.ts

@@ -133,4 +133,27 @@ export declare const taskChatApi: {
      */
     taskHistory: (id: string, query?: Query) => Promise<Json>;
 };
+/**
+ * `POST /api/tasks/:taskId/labels/suggest` — the on-demand half of the
+ * create-time `_labelGuidance` hint. The server keeps the model call off the
+ * task-create path (the hottest write in the product); this is how a caller
+ * pays for ONE suggestion when it actually wants it. Advisory only: the model
+ * chooses from the declared vocabulary and nothing is written.
+ *
+ * `apiFetch` rather than `request.post` for consistency with the lib's other
+ * standalone verbs; either would do — nothing here needs the idempotency
+ * stamp, because a suggestion is a read in POST clothing.
+ */
+export interface TaskLabelSuggestion {
+    id?: string;
+    name?: string;
+}
+export interface TaskLabelSuggestionResponse {
+    taskId?: string;
+    identifier?: string;
+    /** Size of the applicable vocabulary AFTER the task's own labels are excluded. */
+    vocabularySize?: number;
+    suggestions?: TaskLabelSuggestion[];
+}
+export declare function taskLabelSuggestion(taskId: string): Promise<TaskLabelSuggestionResponse>;
 export {};

package/dist/lib/task-extras.js

@@ -6,6 +6,7 @@ exports.taskRunHandover = taskRunHandover;
 exports.taskRunFork = taskRunFork;
 exports.taskRunPromote = taskRunPromote;
 exports.parseExecutionTargetRef = parseExecutionTargetRef;
+exports.taskLabelSuggestion = taskLabelSuggestion;
 /**
  * task-extras.ts — the `/api/tasks` endpoints that have no `dataService.*`
  * wrapper, gathered so every one of them is reachable from `skrr`.
@@ -185,3 +186,8 @@ exports.taskChatApi = {
      */
     taskHistory: (id, query = {}) => data_provider_1.request.get((0, triggers_1.withQuery)(`${base(id)}/transcript`, query)),
 };
+function taskLabelSuggestion(taskId) {
+    return (0, api_fetch_1.apiFetch)(`${base(taskId)}/labels/suggest`, {
+        method: 'POST',
+    });
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonScopes.d.ts

@@ -29,29 +29,35 @@
  * never rename in place.
  */
 /**
- * The canonical daemon scope vocabulary. Six strings, frozen.
+ * The canonical daemon scope vocabulary. Seven strings, append-only.
  *
  *   - `daemon:tools:bash`        — bash tool execution
  *   - `daemon:tools:fs:read`     — Read tool (file read)
  *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
  *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
+ *   - `daemon:native-ui:control` — native app GUI control via the helper
  *   - `daemon:session:replay`    — `daemon:session:replay` socket event
  *   - `daemon:offline-queue`     — daemon-initiated offline queue
  *
  * Order is the consent-screen render order: tools-first, I/O second,
  * control-flow last.
+ *
+ * `daemon:native-ui:control` is deliberately NOT folded into
+ * `daemon:tools:bash`: a token minted to run shell commands must not
+ * thereby be able to click around the user's desktop (OSK-11009).
  */
 export declare const SCOPES: Readonly<{
     readonly TOOLS_BASH: "daemon:tools:bash";
     readonly TOOLS_FS_READ: "daemon:tools:fs:read";
     readonly TOOLS_FS_WRITE: "daemon:tools:fs:write";
     readonly BROWSER_CDP: "daemon:browser:cdp";
+    readonly NATIVE_UI_CONTROL: "daemon:native-ui:control";
     readonly SESSION_REPLAY: "daemon:session:replay";
     readonly OFFLINE_QUEUE: "daemon:offline-queue";
 }>;
 export type DaemonScope = (typeof SCOPES)[keyof typeof SCOPES];
 /**
- * The six daemon scopes in canonical order. Frozen so consumers can
+ * The seven daemon scopes in canonical order. Frozen so consumers can
  * pass it directly to OAuth `scope` parameters without defensive
  * copies.
  */
@@ -64,7 +70,7 @@ export declare const VALID_DAEMON_SCOPE_SET: ReadonlySet<string>;
 export declare function isDaemonScope(s: unknown): s is DaemonScope;
 /**
  * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
- * to the six daemon scopes; lives on `OAuthClient.allowedScopes` for
+ * to the daemon scopes; lives on `OAuthClient.allowedScopes` for
  * the `oversky-cli` client. See the data-schemas canonical for the
  * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
  * grandfather sentinel `expandScopes(undefined)` would over-grant).

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonScopes.js

@@ -33,28 +33,34 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.OAUTH_CLI_SCOPE = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.isDaemonScope = isDaemonScope;
 /**
- * The canonical daemon scope vocabulary. Six strings, frozen.
+ * The canonical daemon scope vocabulary. Seven strings, append-only.
  *
  *   - `daemon:tools:bash`        — bash tool execution
  *   - `daemon:tools:fs:read`     — Read tool (file read)
  *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
  *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
+ *   - `daemon:native-ui:control` — native app GUI control via the helper
  *   - `daemon:session:replay`    — `daemon:session:replay` socket event
  *   - `daemon:offline-queue`     — daemon-initiated offline queue
  *
  * Order is the consent-screen render order: tools-first, I/O second,
  * control-flow last.
+ *
+ * `daemon:native-ui:control` is deliberately NOT folded into
+ * `daemon:tools:bash`: a token minted to run shell commands must not
+ * thereby be able to click around the user's desktop (OSK-11009).
  */
 exports.SCOPES = Object.freeze({
     TOOLS_BASH: 'daemon:tools:bash',
     TOOLS_FS_READ: 'daemon:tools:fs:read',
     TOOLS_FS_WRITE: 'daemon:tools:fs:write',
     BROWSER_CDP: 'daemon:browser:cdp',
+    NATIVE_UI_CONTROL: 'daemon:native-ui:control',
     SESSION_REPLAY: 'daemon:session:replay',
     OFFLINE_QUEUE: 'daemon:offline-queue',
 });
 /**
- * The six daemon scopes in canonical order. Frozen so consumers can
+ * The seven daemon scopes in canonical order. Frozen so consumers can
  * pass it directly to OAuth `scope` parameters without defensive
  * copies.
  */
@@ -63,6 +69,7 @@ exports.ALL_DAEMON_SCOPES = Object.freeze([
     exports.SCOPES.TOOLS_FS_READ,
     exports.SCOPES.TOOLS_FS_WRITE,
     exports.SCOPES.BROWSER_CDP,
+    exports.SCOPES.NATIVE_UI_CONTROL,
     exports.SCOPES.SESSION_REPLAY,
     exports.SCOPES.OFFLINE_QUEUE,
 ]);
@@ -76,7 +83,7 @@ function isDaemonScope(s) {
 }
 /**
  * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
- * to the six daemon scopes; lives on `OAuthClient.allowedScopes` for
+ * to the daemon scopes; lives on `OAuthClient.allowedScopes` for
  * the `oversky-cli` client. See the data-schemas canonical for the
  * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
  * grandfather sentinel `expandScopes(undefined)` would over-grant).

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -11,7 +11,7 @@ export { configureAuthCore, getAuthLogger, getAuthConfigDir, getAuthKillSwitches
 export { PermanentAuthFailure, TransientAuthFailure, type PermanentAuthReason, type ReauthState, type TokenPair, } from './types.js';
 export { decodeJwtExpiry, decodeJwtPayload } from './jwtUtils.js';
 export { isAuthExpiredSseEvent, handleMidStreamAuthExpiry, type ParsedSseLike, type AuthExpiredCallbacks, type HandleMidStreamAuthExpiryResult, } from './authExpiredDetector.js';
-export { formatReauthMessage, EXIT_NEEDS_REAUTH, type AuthFailureReason } from './messages.js';
+export { formatReauthMessage, reauthCommand, EXIT_NEEDS_REAUTH, type AuthFailureReason, } from './messages.js';
 export { classifyRefreshResponse, type RefreshResponseShape, type ClassifiedRefreshResult, type ClassifiedRefreshSuccess, type ClassifiedRefreshFailure, } from './refreshClassification.js';
 export { refreshDaemonToken, revokeDaemonRefreshSession, withAuthLock, persistReauthState, needsReauthState, clearReauthState, installLockExitHandlers, __refreshDiagnostics, __resetUnknown401StreaksForTest, UNKNOWN_401_BUDGET, } from './refresh.js';
 export { createRefreshScheduler, type RefreshScheduler, type RefreshSchedulerOptions, } from './refreshScheduler.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -22,11 +22,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
-exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
-exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = void 0;
+exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
+exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = void 0;
+exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
+exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -63,6 +63,7 @@ Object.defineProperty(exports, "handleMidStreamAuthExpiry", { enumerable: true,
 // Reauth messaging
 var messages_js_1 = require("./messages.js");
 Object.defineProperty(exports, "formatReauthMessage", { enumerable: true, get: function () { return messages_js_1.formatReauthMessage; } });
+Object.defineProperty(exports, "reauthCommand", { enumerable: true, get: function () { return messages_js_1.reauthCommand; } });
 Object.defineProperty(exports, "EXIT_NEEDS_REAUTH", { enumerable: true, get: function () { return messages_js_1.EXIT_NEEDS_REAUTH; } });
 // Pure HTTP→{Permanent, Transient, Success} response classification —
 // exposed so RN-side clients can apply the same mapping daemon uses.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/messages.d.ts

@@ -1,4 +1,20 @@
 export type AuthFailureReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'UNKNOWN_401' | 'UNKNOWN';
+/**
+ * The command that recovers this process from a re-auth latch.
+ *
+ * ONE function owns this, because the answer is printed twice in the same
+ * millisecond — once in the human block below and once on the machine-readable
+ * `[oversky-reauth]` line a log scraper pages on — and the two used to be
+ * written independently. They disagreed: the block said `skrrd login --device`
+ * while the error line said `skrr login`, naming a different binary and
+ * different flags for one action, so an operator reading either one did
+ * something the other did not describe (OSK-10224).
+ *
+ * The binary is whatever the consumer registered with
+ * `configureAuthCore({ binaryName })` — the binary the user actually typed —
+ * and `--device` is added only when there is no TTY to open a browser from.
+ */
+export declare function reauthCommand(): string;
 export declare function formatReauthMessage(reason: AuthFailureReason | string): string;
 /**
  * Exit code for "permanent auth failure during initial connect" — picked to

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/messages.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EXIT_NEEDS_REAUTH = void 0;
+exports.reauthCommand = reauthCommand;
 exports.formatReauthMessage = formatReauthMessage;
 /**
  * User-facing messages for auth state transitions.
@@ -21,17 +22,33 @@ const REASON_HUMAN = {
     UNKNOWN_401: 'skrr needs you to sign in again.',
     UNKNOWN: 'skrr needs you to sign in again.',
 };
+/**
+ * The command that recovers this process from a re-auth latch.
+ *
+ * ONE function owns this, because the answer is printed twice in the same
+ * millisecond — once in the human block below and once on the machine-readable
+ * `[oversky-reauth]` line a log scraper pages on — and the two used to be
+ * written independently. They disagreed: the block said `skrrd login --device`
+ * while the error line said `skrr login`, naming a different binary and
+ * different flags for one action, so an operator reading either one did
+ * something the other did not describe (OSK-10224).
+ *
+ * The binary is whatever the consumer registered with
+ * `configureAuthCore({ binaryName })` — the binary the user actually typed —
+ * and `--device` is added only when there is no TTY to open a browser from.
+ */
+function reauthCommand() {
+    const bin = (0, runtime_js_1.getAuthBinaryName)();
+    return process.stdout.isTTY ? `${bin} login` : `${bin} login --device`;
+}
 function formatReauthMessage(reason) {
     const norm = REASON_HUMAN[reason] || REASON_HUMAN.UNKNOWN;
-    const isHeadless = !process.stdout.isTTY;
-    const bin = (0, runtime_js_1.getAuthBinaryName)();
-    const cmd = isHeadless ? `${bin} login --device` : `${bin} login`;
     return [
         '',
         'skrr cannot connect — re-authentication required.',
         `  Reason: ${norm}`,
         '',
-        `  To continue, run:  ${cmd}`,
+        `  To continue, run:  ${reauthCommand()}`,
         '',
     ].join('\n');
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -75,7 +75,7 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
  * `SECRETARY` untouched.
  */
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -61,6 +61,9 @@ exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 exports.SENSITIVE_ENV_VARS = new Set([
     'CLAUDE_CODE_OAUTH_TOKEN',
     'OVERSKY_TOKEN',
+    // The renamed credential alias (cli/src/lib/config.ts honors both spellings).
+    // Same double coverage as OVERSKY_TOKEN — name AND the SKRR_ prefix below.
+    'SKRR_TOKEN',
     'AWS_ACCESS_KEY_ID',
     'AWS_SECRET_ACCESS_KEY',
     'AWS_SESSION_TOKEN',
@@ -91,7 +94,16 @@ exports.SENSITIVE_ENV_VARS = new Set([
     'LD_PRELOAD',
 ]);
 /** Variable name prefixes that should be stripped (catches families like AWS_*). */
-exports.SENSITIVE_ENV_PREFIXES = ['AWS_', 'OVERSKY_'];
+exports.SENSITIVE_ENV_PREFIXES = [
+    'AWS_',
+    'OVERSKY_',
+    // The renamed product namespace: SKRR_TOKEN, SKRR_REFRESH_TOKEN, the
+    // session-authority aliases (SKRR_SESSION_*, SKRR_BASE_URL), and the
+    // daemon's control-plane identity (SKRR_MACHINE_UUID, SKRR_LEASE_GENERATION)
+    // all carry authority a model-driven child must not inherit. Non-secret
+    // lane essentials live in SENSITIVE_ENV_PREFIX_EXCEPTIONS below.
+    'SKRR_',
+];
 /**
  * Credential-shaped suffixes are also forbidden. A fixed provider list is
  * never complete: a newly configured provider would otherwise leak its key
@@ -120,7 +132,7 @@ exports.SENSITIVE_ENV_SUFFIXES = [
  * `SECRETARY` untouched.
  */
 exports.SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
     // not a secret. Add more here if a tool legitimately needs an OVERSKY_ var.
@@ -130,6 +142,16 @@ exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // know they're inside a supervised daemon on Linux/Windows in addition
     // to macOS launchd. Not a secret.
     'OVERSKY_SUPERVISOR',
+    // A deployment URL, not a credential. The rename to SKRR_SERVER_URL was
+    // chosen precisely because it survives the sanitizer
+    // (daemon/src/dedicated-tenant-env.ts), so a spawned lane's `skrr` reaches
+    // the deployment this machine is registered with.
+    'SKRR_SERVER_URL',
+    // The Dedicated Runtime workload marker the exec wrapper stamps into every
+    // tenant lane; grandchildren spawned from a lane (e.g. `skrr code` → the
+    // engine) must keep it to detect they already run as the workload uid. Not
+    // a secret — it authorizes nothing without the matching real uid.
+    'SKRR_WORKLOAD_UID',
 ]);
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonScopes.d.ts

@@ -29,29 +29,35 @@
  * never rename in place.
  */
 /**
- * The canonical daemon scope vocabulary. Six strings, frozen.
+ * The canonical daemon scope vocabulary. Seven strings, append-only.
  *
  *   - `daemon:tools:bash`        — bash tool execution
  *   - `daemon:tools:fs:read`     — Read tool (file read)
  *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
  *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
+ *   - `daemon:native-ui:control` — native app GUI control via the helper
  *   - `daemon:session:replay`    — `daemon:session:replay` socket event
  *   - `daemon:offline-queue`     — daemon-initiated offline queue
  *
  * Order is the consent-screen render order: tools-first, I/O second,
  * control-flow last.
+ *
+ * `daemon:native-ui:control` is deliberately NOT folded into
+ * `daemon:tools:bash`: a token minted to run shell commands must not
+ * thereby be able to click around the user's desktop (OSK-11009).
  */
 export declare const SCOPES: Readonly<{
     readonly TOOLS_BASH: "daemon:tools:bash";
     readonly TOOLS_FS_READ: "daemon:tools:fs:read";
     readonly TOOLS_FS_WRITE: "daemon:tools:fs:write";
     readonly BROWSER_CDP: "daemon:browser:cdp";
+    readonly NATIVE_UI_CONTROL: "daemon:native-ui:control";
     readonly SESSION_REPLAY: "daemon:session:replay";
     readonly OFFLINE_QUEUE: "daemon:offline-queue";
 }>;
 export type DaemonScope = (typeof SCOPES)[keyof typeof SCOPES];
 /**
- * The six daemon scopes in canonical order. Frozen so consumers can
+ * The seven daemon scopes in canonical order. Frozen so consumers can
  * pass it directly to OAuth `scope` parameters without defensive
  * copies.
  */
@@ -64,7 +70,7 @@ export declare const VALID_DAEMON_SCOPE_SET: ReadonlySet<string>;
 export declare function isDaemonScope(s: unknown): s is DaemonScope;
 /**
  * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
- * to the six daemon scopes; lives on `OAuthClient.allowedScopes` for
+ * to the daemon scopes; lives on `OAuthClient.allowedScopes` for
  * the `oversky-cli` client. See the data-schemas canonical for the
  * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
  * grandfather sentinel `expandScopes(undefined)` would over-grant).