@skrr-ai/cli 0.1.47 → 0.1.49

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseManifest.js

@@ -1,11 +1,12 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.MAX_SIGS = void 0;
+exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = void 0;
 exports.buildArtifactMessage = buildArtifactMessage;
 exports.buildManifestMessage = buildManifestMessage;
 exports.verifyArtifact = verifyArtifact;
 exports.verifyManifest = verifyManifest;
 exports.getDeltaFor = getDeltaFor;
+exports.isTrustedArtifactOrigin = isTrustedArtifactOrigin;
 /**
  * release-manifest.ts — signed daemon release manifest: types, canonical
  * signature messages, and offline ed25519 verification.
@@ -233,3 +234,67 @@ function getDeltaFor(artifact, fromVersion) {
     }
     return d;
 }
+// ---------------------------------------------------------------------------
+// Trusted artifact origins
+// ---------------------------------------------------------------------------
+/**
+ * Origins an artifact may be served from, beyond the feed base this run used.
+ *
+ * WHY A SET AND NOT THE ONE ORIGIN
+ * --------------------------------
+ * The pin used to require the artifact origin to EQUAL the feed base's
+ * origin. That is correct with one host and unsatisfiable with two, which the
+ * skrr rename creates:
+ *
+ *   - a shipped daemon/CLI has `updates.oversky.ai` compiled in, so a manifest
+ *     advertising skrr.ai artifacts is refused and it can never self-update
+ *     again — including to the build that would have fixed it;
+ *   - a new build shipping `updates.skrr.ai` refuses the SAME manifest for the
+ *     mirror-image reason.
+ *
+ * One manifest of absolute URLs therefore cannot serve both, and the update
+ * path is the one thing that must not break: a client that cannot update
+ * cannot be repaired remotely.
+ *
+ * Widening to a small, closed set of origins we publish keeps the property the
+ * pin exists for: with keys pinned the ed25519 signature already binds the
+ * URL, and this is defence-in-depth for when verification is disabled —
+ * stopping a manifest-integrity failure from redirecting a download to an
+ * ARBITRARY origin serving a hash-matching payload. An attacker gains nothing
+ * from a second origin that is also ours.
+ *
+ * Both entries are removed down to one when no shipped client uses the old
+ * host, per the add -> verify -> remove ordering.
+ */
+exports.TRUSTED_FEED_ORIGINS = [
+    'https://updates.oversky.ai',
+    'https://updates.skrr.ai',
+];
+/**
+ * True when `candidate` may serve an artifact for a feed rooted at `feedBase`.
+ *
+ * The feed base's own origin always passes, so an override
+ * (OVERSKY_DAEMON_UPDATE_FEED_BASE, a canary, a test server) keeps working
+ * without being listed here.
+ */
+function isTrustedArtifactOrigin(candidate, feedBase) {
+    let feedOrigin;
+    try {
+        feedOrigin = new URL(feedBase).origin;
+    }
+    catch {
+        return false;
+    }
+    // Callers hand over either a bare origin (the daemon's self-updater) or a
+    // full artifact URL (the CLI installer) — both spell the same check.
+    let candidateOrigin = candidate;
+    try {
+        candidateOrigin = new URL(candidate).origin;
+    }
+    catch {
+        /* not a URL — compare raw; it will not match anything */
+    }
+    if (candidateOrigin === feedOrigin)
+        return true;
+    return exports.TRUSTED_FEED_ORIGINS.includes(candidateOrigin);
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -75,7 +75,7 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
  * `SECRETARY` untouched.
  */
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -61,6 +61,9 @@ exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 exports.SENSITIVE_ENV_VARS = new Set([
     'CLAUDE_CODE_OAUTH_TOKEN',
     'OVERSKY_TOKEN',
+    // The renamed credential alias (cli/src/lib/config.ts honors both spellings).
+    // Same double coverage as OVERSKY_TOKEN — name AND the SKRR_ prefix below.
+    'SKRR_TOKEN',
     'AWS_ACCESS_KEY_ID',
     'AWS_SECRET_ACCESS_KEY',
     'AWS_SESSION_TOKEN',
@@ -91,7 +94,16 @@ exports.SENSITIVE_ENV_VARS = new Set([
     'LD_PRELOAD',
 ]);
 /** Variable name prefixes that should be stripped (catches families like AWS_*). */
-exports.SENSITIVE_ENV_PREFIXES = ['AWS_', 'OVERSKY_'];
+exports.SENSITIVE_ENV_PREFIXES = [
+    'AWS_',
+    'OVERSKY_',
+    // The renamed product namespace: SKRR_TOKEN, SKRR_REFRESH_TOKEN, the
+    // session-authority aliases (SKRR_SESSION_*, SKRR_BASE_URL), and the
+    // daemon's control-plane identity (SKRR_MACHINE_UUID, SKRR_LEASE_GENERATION)
+    // all carry authority a model-driven child must not inherit. Non-secret
+    // lane essentials live in SENSITIVE_ENV_PREFIX_EXCEPTIONS below.
+    'SKRR_',
+];
 /**
  * Credential-shaped suffixes are also forbidden. A fixed provider list is
  * never complete: a newly configured provider would otherwise leak its key
@@ -120,7 +132,7 @@ exports.SENSITIVE_ENV_SUFFIXES = [
  * `SECRETARY` untouched.
  */
 exports.SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
     // not a secret. Add more here if a tool legitimately needs an OVERSKY_ var.
@@ -130,6 +142,16 @@ exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // know they're inside a supervised daemon on Linux/Windows in addition
     // to macOS launchd. Not a secret.
     'OVERSKY_SUPERVISOR',
+    // A deployment URL, not a credential. The rename to SKRR_SERVER_URL was
+    // chosen precisely because it survives the sanitizer
+    // (daemon/src/dedicated-tenant-env.ts), so a spawned lane's `skrr` reaches
+    // the deployment this machine is registered with.
+    'SKRR_SERVER_URL',
+    // The Dedicated Runtime workload marker the exec wrapper stamps into every
+    // tenant lane; grandchildren spawned from a lane (e.g. `skrr code` → the
+    // engine) must keep it to detect they already run as the workload uid. Not
+    // a secret — it authorizes nothing without the matching real uid.
+    'SKRR_WORKLOAD_UID',
 ]);
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonScopes.d.ts

@@ -29,29 +29,35 @@
  * never rename in place.
  */
 /**
- * The canonical daemon scope vocabulary. Six strings, frozen.
+ * The canonical daemon scope vocabulary. Seven strings, append-only.
  *
  *   - `daemon:tools:bash`        — bash tool execution
  *   - `daemon:tools:fs:read`     — Read tool (file read)
  *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
  *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
+ *   - `daemon:native-ui:control` — native app GUI control via the helper
  *   - `daemon:session:replay`    — `daemon:session:replay` socket event
  *   - `daemon:offline-queue`     — daemon-initiated offline queue
  *
  * Order is the consent-screen render order: tools-first, I/O second,
  * control-flow last.
+ *
+ * `daemon:native-ui:control` is deliberately NOT folded into
+ * `daemon:tools:bash`: a token minted to run shell commands must not
+ * thereby be able to click around the user's desktop (OSK-11009).
  */
 export declare const SCOPES: Readonly<{
     readonly TOOLS_BASH: "daemon:tools:bash";
     readonly TOOLS_FS_READ: "daemon:tools:fs:read";
     readonly TOOLS_FS_WRITE: "daemon:tools:fs:write";
     readonly BROWSER_CDP: "daemon:browser:cdp";
+    readonly NATIVE_UI_CONTROL: "daemon:native-ui:control";
     readonly SESSION_REPLAY: "daemon:session:replay";
     readonly OFFLINE_QUEUE: "daemon:offline-queue";
 }>;
 export type DaemonScope = (typeof SCOPES)[keyof typeof SCOPES];
 /**
- * The six daemon scopes in canonical order. Frozen so consumers can
+ * The seven daemon scopes in canonical order. Frozen so consumers can
  * pass it directly to OAuth `scope` parameters without defensive
  * copies.
  */
@@ -64,7 +70,7 @@ export declare const VALID_DAEMON_SCOPE_SET: ReadonlySet<string>;
 export declare function isDaemonScope(s: unknown): s is DaemonScope;
 /**
  * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
- * to the six daemon scopes; lives on `OAuthClient.allowedScopes` for
+ * to the daemon scopes; lives on `OAuthClient.allowedScopes` for
  * the `oversky-cli` client. See the data-schemas canonical for the
  * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
  * grandfather sentinel `expandScopes(undefined)` would over-grant).

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonScopes.js

@@ -29,28 +29,34 @@
  * never rename in place.
  */
 /**
- * The canonical daemon scope vocabulary. Six strings, frozen.
+ * The canonical daemon scope vocabulary. Seven strings, append-only.
  *
  *   - `daemon:tools:bash`        — bash tool execution
  *   - `daemon:tools:fs:read`     — Read tool (file read)
  *   - `daemon:tools:fs:write`    — Write + Edit tools (file mutation)
  *   - `daemon:browser:cdp`       — browser automation via CDP (reserved)
+ *   - `daemon:native-ui:control` — native app GUI control via the helper
  *   - `daemon:session:replay`    — `daemon:session:replay` socket event
  *   - `daemon:offline-queue`     — daemon-initiated offline queue
  *
  * Order is the consent-screen render order: tools-first, I/O second,
  * control-flow last.
+ *
+ * `daemon:native-ui:control` is deliberately NOT folded into
+ * `daemon:tools:bash`: a token minted to run shell commands must not
+ * thereby be able to click around the user's desktop (OSK-11009).
  */
 export const SCOPES = Object.freeze({
     TOOLS_BASH: 'daemon:tools:bash',
     TOOLS_FS_READ: 'daemon:tools:fs:read',
     TOOLS_FS_WRITE: 'daemon:tools:fs:write',
     BROWSER_CDP: 'daemon:browser:cdp',
+    NATIVE_UI_CONTROL: 'daemon:native-ui:control',
     SESSION_REPLAY: 'daemon:session:replay',
     OFFLINE_QUEUE: 'daemon:offline-queue',
 });
 /**
- * The six daemon scopes in canonical order. Frozen so consumers can
+ * The seven daemon scopes in canonical order. Frozen so consumers can
  * pass it directly to OAuth `scope` parameters without defensive
  * copies.
  */
@@ -59,6 +65,7 @@ export const ALL_DAEMON_SCOPES = Object.freeze([
     SCOPES.TOOLS_FS_READ,
     SCOPES.TOOLS_FS_WRITE,
     SCOPES.BROWSER_CDP,
+    SCOPES.NATIVE_UI_CONTROL,
     SCOPES.SESSION_REPLAY,
     SCOPES.OFFLINE_QUEUE,
 ]);
@@ -72,7 +79,7 @@ export function isDaemonScope(s) {
 }
 /**
  * `cli` — REST-only sign-in grant for first-party CLI clients. Peer
- * to the six daemon scopes; lives on `OAuthClient.allowedScopes` for
+ * to the daemon scopes; lives on `OAuthClient.allowedScopes` for
  * the `oversky-cli` client. See the data-schemas canonical for the
  * full reasoning behind keeping this OUT of `ALL_DAEMON_SCOPES` (the
  * grandfather sentinel `expandScopes(undefined)` would over-grant).

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.d.ts

@@ -223,7 +223,7 @@ export declare function firstPartyHarnessManifestFile(provider?: string): string
  * The update feed ORIGIN. Not a product name, and not moved by this identity:
  * a feed host sits inside signed manifests (naming map §2 "Update feed").
  */
-export declare const FIRST_PARTY_HARNESS_FEED_ORIGIN = "https://updates.oversky.ai";
+export declare const FIRST_PARTY_HARNESS_FEED_ORIGIN = "https://updates.skrr.ai";
 /** Object-key prefix for one spelling's feed, e.g. `skrr-code/`. */
 export declare function firstPartyHarnessFeedPrefix(provider?: string): string;
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/firstPartyHarness.js

@@ -304,7 +304,7 @@ export function firstPartyHarnessManifestFile(provider = FIRST_PARTY_HARNESS.pro
  * The update feed ORIGIN. Not a product name, and not moved by this identity:
  * a feed host sits inside signed manifests (naming map §2 "Update feed").
  */
-export const FIRST_PARTY_HARNESS_FEED_ORIGIN = 'https://updates.oversky.ai';
+export const FIRST_PARTY_HARNESS_FEED_ORIGIN = 'https://updates.skrr.ai';
 /** Object-key prefix for one spelling's feed, e.g. `skrr-code/`. */
 export function firstPartyHarnessFeedPrefix(provider = FIRST_PARTY_HARNESS.provider) {
     return `${provider}/`;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -11,7 +11,7 @@ export { configureAuthCore, getAuthLogger, getAuthConfigDir, getAuthKillSwitches
 export { PermanentAuthFailure, TransientAuthFailure, type PermanentAuthReason, type ReauthState, type TokenPair, } from './types.js';
 export { decodeJwtExpiry, decodeJwtPayload } from './jwtUtils.js';
 export { isAuthExpiredSseEvent, handleMidStreamAuthExpiry, type ParsedSseLike, type AuthExpiredCallbacks, type HandleMidStreamAuthExpiryResult, } from './authExpiredDetector.js';
-export { formatReauthMessage, EXIT_NEEDS_REAUTH, type AuthFailureReason } from './messages.js';
+export { formatReauthMessage, reauthCommand, EXIT_NEEDS_REAUTH, type AuthFailureReason, } from './messages.js';
 export { classifyRefreshResponse, type RefreshResponseShape, type ClassifiedRefreshResult, type ClassifiedRefreshSuccess, type ClassifiedRefreshFailure, } from './refreshClassification.js';
 export { refreshDaemonToken, revokeDaemonRefreshSession, withAuthLock, persistReauthState, needsReauthState, clearReauthState, installLockExitHandlers, __refreshDiagnostics, __resetUnknown401StreaksForTest, UNKNOWN_401_BUDGET, } from './refresh.js';
 export { createRefreshScheduler, type RefreshScheduler, type RefreshSchedulerOptions, } from './refreshScheduler.js';
@@ -40,6 +40,6 @@ export * from './firstPartyHarness.js';
 export { FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX, FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX, firstPartyHarnessBinDir, firstPartyHarnessHomeDir, firstPartyHarnessInstalledBinaryPath, linkFirstPartyHarnessAliases, migrateFirstPartyHarnessHome, type FirstPartyHarnessHomeFs, type FirstPartyHarnessHomeMigration, } from './firstPartyHarnessHome.js';
 export { DEFAULT_FIRST_PARTY_HARNESS_CHANNEL, FIRST_PARTY_HARNESS_CHANNELS, firstPartyHarnessChannelPrefix, firstPartyHarnessFeedBase, firstPartyHarnessFeedCandidates, isFirstPartyHarnessChannel, resolveChannelManifestUrl, resolveFirstPartyHarnessChannel, type FirstPartyHarnessChannel, type FirstPartyHarnessFeedCandidate, } from './firstPartyHarnessChannels.js';
 export { OVERSKY_RELEASE_PUBLIC_KEYS, type ReleaseKey } from './releaseKeys.js';
-export { MAX_SIGS, buildArtifactMessage, buildManifestMessage, getDeltaFor, verifyArtifact, verifyManifest, type DaemonVersionManifest, type DeltaDescriptor, type ManifestSignature, type PlatformArtifact, type VerifyResult, } from './releaseManifest.js';
+export { MAX_SIGS, TRUSTED_FEED_ORIGINS, buildArtifactMessage, buildManifestMessage, getDeltaFor, isTrustedArtifactOrigin, verifyArtifact, verifyManifest, type DaemonVersionManifest, type DeltaDescriptor, type ManifestSignature, type PlatformArtifact, type VerifyResult, } from './releaseManifest.js';
 export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';
 export { PROFILES_SEGMENT, SUPERSEDED_MARKER_SUFFIX, SUPERSEDED_COPY_SUFFIX, profileStateDir, legacyProfileStateDir, resolveProfileStateDir, resolveProfileStateFile, profileStateFileLocations, profileStateFilePathsToClear, consolidateProfileState, type ResolvedProfileStateDir, type ConsolidationSpec, type ConsolidationStatus, type ConsolidationOutcome, } from './profileStateDir.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -23,7 +23,7 @@ export { decodeJwtExpiry, decodeJwtPayload } from './jwtUtils.js';
 // header.
 export { isAuthExpiredSseEvent, handleMidStreamAuthExpiry, } from './authExpiredDetector.js';
 // Reauth messaging
-export { formatReauthMessage, EXIT_NEEDS_REAUTH } from './messages.js';
+export { formatReauthMessage, reauthCommand, EXIT_NEEDS_REAUTH, } from './messages.js';
 // Pure HTTP→{Permanent, Transient, Success} response classification —
 // exposed so RN-side clients can apply the same mapping daemon uses.
 export { classifyRefreshResponse, } from './refreshClassification.js';
@@ -161,7 +161,7 @@ export { DEFAULT_FIRST_PARTY_HARNESS_CHANNEL, FIRST_PARTY_HARNESS_CHANNELS, firs
 // same manifest against the same root. See releaseManifest.ts for why a mirror
 // would be the wrong shape here.
 export { OVERSKY_RELEASE_PUBLIC_KEYS } from './releaseKeys.js';
-export { MAX_SIGS, buildArtifactMessage, buildManifestMessage, getDeltaFor, verifyArtifact, verifyManifest, } from './releaseManifest.js';
+export { MAX_SIGS, TRUSTED_FEED_ORIGINS, buildArtifactMessage, buildManifestMessage, getDeltaFor, isTrustedArtifactOrigin, verifyArtifact, verifyManifest, } from './releaseManifest.js';
 // The one definition of the skrr root, shared by `skrr` and `skrrd`. See the
 // module for why re-deriving it kept producing divergences.
 export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/messages.d.ts

@@ -1,4 +1,20 @@
 export type AuthFailureReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'UNKNOWN_401' | 'UNKNOWN';
+/**
+ * The command that recovers this process from a re-auth latch.
+ *
+ * ONE function owns this, because the answer is printed twice in the same
+ * millisecond — once in the human block below and once on the machine-readable
+ * `[oversky-reauth]` line a log scraper pages on — and the two used to be
+ * written independently. They disagreed: the block said `skrrd login --device`
+ * while the error line said `skrr login`, naming a different binary and
+ * different flags for one action, so an operator reading either one did
+ * something the other did not describe (OSK-10224).
+ *
+ * The binary is whatever the consumer registered with
+ * `configureAuthCore({ binaryName })` — the binary the user actually typed —
+ * and `--device` is added only when there is no TTY to open a browser from.
+ */
+export declare function reauthCommand(): string;
 export declare function formatReauthMessage(reason: AuthFailureReason | string): string;
 /**
  * Exit code for "permanent auth failure during initial connect" — picked to

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/messages.js

@@ -17,17 +17,33 @@ const REASON_HUMAN = {
     UNKNOWN_401: 'skrr needs you to sign in again.',
     UNKNOWN: 'skrr needs you to sign in again.',
 };
+/**
+ * The command that recovers this process from a re-auth latch.
+ *
+ * ONE function owns this, because the answer is printed twice in the same
+ * millisecond — once in the human block below and once on the machine-readable
+ * `[oversky-reauth]` line a log scraper pages on — and the two used to be
+ * written independently. They disagreed: the block said `skrrd login --device`
+ * while the error line said `skrr login`, naming a different binary and
+ * different flags for one action, so an operator reading either one did
+ * something the other did not describe (OSK-10224).
+ *
+ * The binary is whatever the consumer registered with
+ * `configureAuthCore({ binaryName })` — the binary the user actually typed —
+ * and `--device` is added only when there is no TTY to open a browser from.
+ */
+export function reauthCommand() {
+    const bin = getAuthBinaryName();
+    return process.stdout.isTTY ? `${bin} login` : `${bin} login --device`;
+}
 export function formatReauthMessage(reason) {
     const norm = REASON_HUMAN[reason] || REASON_HUMAN.UNKNOWN;
-    const isHeadless = !process.stdout.isTTY;
-    const bin = getAuthBinaryName();
-    const cmd = isHeadless ? `${bin} login --device` : `${bin} login`;
     return [
         '',
         'skrr cannot connect — re-authentication required.',
         `  Reason: ${norm}`,
         '',
-        `  To continue, run:  ${cmd}`,
+        `  To continue, run:  ${reauthCommand()}`,
         '',
     ].join('\n');
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/releaseManifest.d.ts

@@ -159,3 +159,41 @@ export declare function verifyManifest(manifest: DaemonVersionManifest, keys?: r
  * against the signed `artifact.sha256`, not from this metadata).
  */
 export declare function getDeltaFor(artifact: PlatformArtifact, fromVersion: string): DeltaDescriptor | null;
+/**
+ * Origins an artifact may be served from, beyond the feed base this run used.
+ *
+ * WHY A SET AND NOT THE ONE ORIGIN
+ * --------------------------------
+ * The pin used to require the artifact origin to EQUAL the feed base's
+ * origin. That is correct with one host and unsatisfiable with two, which the
+ * skrr rename creates:
+ *
+ *   - a shipped daemon/CLI has `updates.oversky.ai` compiled in, so a manifest
+ *     advertising skrr.ai artifacts is refused and it can never self-update
+ *     again — including to the build that would have fixed it;
+ *   - a new build shipping `updates.skrr.ai` refuses the SAME manifest for the
+ *     mirror-image reason.
+ *
+ * One manifest of absolute URLs therefore cannot serve both, and the update
+ * path is the one thing that must not break: a client that cannot update
+ * cannot be repaired remotely.
+ *
+ * Widening to a small, closed set of origins we publish keeps the property the
+ * pin exists for: with keys pinned the ed25519 signature already binds the
+ * URL, and this is defence-in-depth for when verification is disabled —
+ * stopping a manifest-integrity failure from redirecting a download to an
+ * ARBITRARY origin serving a hash-matching payload. An attacker gains nothing
+ * from a second origin that is also ours.
+ *
+ * Both entries are removed down to one when no shipped client uses the old
+ * host, per the add -> verify -> remove ordering.
+ */
+export declare const TRUSTED_FEED_ORIGINS: readonly string[];
+/**
+ * True when `candidate` may serve an artifact for a feed rooted at `feedBase`.
+ *
+ * The feed base's own origin always passes, so an override
+ * (OVERSKY_DAEMON_UPDATE_FEED_BASE, a canary, a test server) keeps working
+ * without being listed here.
+ */
+export declare function isTrustedArtifactOrigin(candidate: string, feedBase: string): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/releaseManifest.js

@@ -225,3 +225,67 @@ export function getDeltaFor(artifact, fromVersion) {
     }
     return d;
 }
+// ---------------------------------------------------------------------------
+// Trusted artifact origins
+// ---------------------------------------------------------------------------
+/**
+ * Origins an artifact may be served from, beyond the feed base this run used.
+ *
+ * WHY A SET AND NOT THE ONE ORIGIN
+ * --------------------------------
+ * The pin used to require the artifact origin to EQUAL the feed base's
+ * origin. That is correct with one host and unsatisfiable with two, which the
+ * skrr rename creates:
+ *
+ *   - a shipped daemon/CLI has `updates.oversky.ai` compiled in, so a manifest
+ *     advertising skrr.ai artifacts is refused and it can never self-update
+ *     again — including to the build that would have fixed it;
+ *   - a new build shipping `updates.skrr.ai` refuses the SAME manifest for the
+ *     mirror-image reason.
+ *
+ * One manifest of absolute URLs therefore cannot serve both, and the update
+ * path is the one thing that must not break: a client that cannot update
+ * cannot be repaired remotely.
+ *
+ * Widening to a small, closed set of origins we publish keeps the property the
+ * pin exists for: with keys pinned the ed25519 signature already binds the
+ * URL, and this is defence-in-depth for when verification is disabled —
+ * stopping a manifest-integrity failure from redirecting a download to an
+ * ARBITRARY origin serving a hash-matching payload. An attacker gains nothing
+ * from a second origin that is also ours.
+ *
+ * Both entries are removed down to one when no shipped client uses the old
+ * host, per the add -> verify -> remove ordering.
+ */
+export const TRUSTED_FEED_ORIGINS = [
+    'https://updates.oversky.ai',
+    'https://updates.skrr.ai',
+];
+/**
+ * True when `candidate` may serve an artifact for a feed rooted at `feedBase`.
+ *
+ * The feed base's own origin always passes, so an override
+ * (OVERSKY_DAEMON_UPDATE_FEED_BASE, a canary, a test server) keeps working
+ * without being listed here.
+ */
+export function isTrustedArtifactOrigin(candidate, feedBase) {
+    let feedOrigin;
+    try {
+        feedOrigin = new URL(feedBase).origin;
+    }
+    catch {
+        return false;
+    }
+    // Callers hand over either a bare origin (the daemon's self-updater) or a
+    // full artifact URL (the CLI installer) — both spell the same check.
+    let candidateOrigin = candidate;
+    try {
+        candidateOrigin = new URL(candidate).origin;
+    }
+    catch {
+        /* not a URL — compare raw; it will not match anything */
+    }
+    if (candidateOrigin === feedOrigin)
+        return true;
+    return TRUSTED_FEED_ORIGINS.includes(candidateOrigin);
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.d.ts

@@ -75,7 +75,7 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
  * `SECRETARY` untouched.
  */
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.js

@@ -57,6 +57,9 @@
 export const SENSITIVE_ENV_VARS = new Set([
     'CLAUDE_CODE_OAUTH_TOKEN',
     'OVERSKY_TOKEN',
+    // The renamed credential alias (cli/src/lib/config.ts honors both spellings).
+    // Same double coverage as OVERSKY_TOKEN — name AND the SKRR_ prefix below.
+    'SKRR_TOKEN',
     'AWS_ACCESS_KEY_ID',
     'AWS_SECRET_ACCESS_KEY',
     'AWS_SESSION_TOKEN',
@@ -87,7 +90,16 @@ export const SENSITIVE_ENV_VARS = new Set([
     'LD_PRELOAD',
 ]);
 /** Variable name prefixes that should be stripped (catches families like AWS_*). */
-export const SENSITIVE_ENV_PREFIXES = ['AWS_', 'OVERSKY_'];
+export const SENSITIVE_ENV_PREFIXES = [
+    'AWS_',
+    'OVERSKY_',
+    // The renamed product namespace: SKRR_TOKEN, SKRR_REFRESH_TOKEN, the
+    // session-authority aliases (SKRR_SESSION_*, SKRR_BASE_URL), and the
+    // daemon's control-plane identity (SKRR_MACHINE_UUID, SKRR_LEASE_GENERATION)
+    // all carry authority a model-driven child must not inherit. Non-secret
+    // lane essentials live in SENSITIVE_ENV_PREFIX_EXCEPTIONS below.
+    'SKRR_',
+];
 /**
  * Credential-shaped suffixes are also forbidden. A fixed provider list is
  * never complete: a newly configured provider would otherwise leak its key
@@ -116,7 +128,7 @@ export const SENSITIVE_ENV_SUFFIXES = [
  * `SECRETARY` untouched.
  */
 export const SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
-/** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
+/** Specific names to keep — the prefix sweeps are broad on purpose. */
 export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
     // not a secret. Add more here if a tool legitimately needs an OVERSKY_ var.
@@ -126,6 +138,16 @@ export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // know they're inside a supervised daemon on Linux/Windows in addition
     // to macOS launchd. Not a secret.
     'OVERSKY_SUPERVISOR',
+    // A deployment URL, not a credential. The rename to SKRR_SERVER_URL was
+    // chosen precisely because it survives the sanitizer
+    // (daemon/src/dedicated-tenant-env.ts), so a spawned lane's `skrr` reaches
+    // the deployment this machine is registered with.
+    'SKRR_SERVER_URL',
+    // The Dedicated Runtime workload marker the exec wrapper stamps into every
+    // tenant lane; grandchildren spawned from a lane (e.g. `skrr code` → the
+    // engine) must keep it to detect they already run as the workload uid. Not
+    // a secret — it authorizes nothing without the matching real uid.
+    'SKRR_WORKLOAD_UID',
 ]);
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {