@skrr-ai/cli 0.1.49 → 0.1.50

package/dist/lib/first-party-harness-project-trust.d.ts

@@ -0,0 +1,125 @@
+/**
+ * `skrr code` on a repository somebody else wrote (OSK-11958).
+ *
+ * ── What was wrong ──────────────────────────────────────────────────────────
+ *
+ * Bare `skrr code` and `skrr code run` forwarded straight to the engine, which
+ * then read the project's own configuration. Three things in there act on this
+ * machine, and the engine's own content-addressed trust gate (`skrr code trust`)
+ * covers only the first:
+ *
+ *   1. `plugin` / `mcp` keys in a project config file   — gated by the engine;
+ *   2. plugin and tool FILES auto-discovered under the project directory
+ *      (`<dir>/plugin/*.ts`, `<dir>/tool/*.ts`), and a dependency install run in
+ *      that directory                                     — NOT gated, measured
+ *      against the fork's `config.ts` / `plugin.ts` / `tool/registry.ts`;
+ *   3. `permission` and agent definitions, which LOOSEN what the agent may do
+ *      without asking — findLast wins in the engine's ruleset, so a project's
+ *      `"bash": "allow"` beats a default that asks.
+ *
+ * The daemon's managed path has always set `OPENCODE_DISABLE_PROJECT_CONFIG=1`.
+ * The CLI path set nothing. So opening a cloned repository with `skrr code` could
+ * run that repository's code, with no prompt.
+ *
+ * ── What this module decides ────────────────────────────────────────────────
+ *
+ * **Project configuration is off until the person trusts the project.** Trust is
+ * a record per project root (the git top level, else the directory), kept in
+ * `<config root>/code-trusted-projects.json`, or a one-shot `--trust-project`.
+ * The interactive TUI asks once, before it starts, and only when the project
+ * actually ships configuration; a repository with none is never asked about.
+ *
+ * Path-addressed rather than content-addressed on purpose: this is the coarse
+ * "is this my project?" question every editor asks (the engine's own gate stays
+ * content-addressed for the plugin/mcp keys inside a trusted project).
+ *
+ * **Disabling project config must not cost the repository's instructions.** The
+ * engine's switch also stops it reading `AGENTS.md` / `CLAUDE.md` from the
+ * project — text, not code — and a coding agent that ignores the repository's
+ * conventions is its own failure. So an untrusted run passes those files back by
+ * absolute path through `OPENCODE_CONFIG_CONTENT.instructions`, which the engine
+ * reads as plain files. Nothing executable travels that way.
+ *
+ * **The interactive TUI asks before bash, edits, and the web.** A person is at
+ * the terminal and the engine can prompt there, so the default is the one
+ * Claude Code ships: reads and searches run, changes and commands ask
+ * (`INTERACTIVE_PERMISSION_DEFAULT`). The engine answers "always" per session,
+ * so it costs one approval per kind of action, not one per call. `skrr code run`
+ * is headless — the engine auto-REJECTS every ask there — so it keeps the
+ * engine's own permission config; an `ask` default would make `run` unable to
+ * edit anything. A person's own `OPENCODE_PERMISSION` always wins, and
+ * `--engine-permissions` hands the decision back to the engine's config.
+ */
+/** Wrapper flags this module consumes; the engine never sees them. */
+export declare const TRUST_PROJECT_FLAG = "--trust-project";
+export declare const ENGINE_PERMISSIONS_FLAG = "--engine-permissions";
+/**
+ * The interactive default. Explicit keys after `*`, because the engine's ruleset
+ * is last-match-wins and merges this OVER the project's and the user's config:
+ * a key named here beats a looser value for the same key elsewhere.
+ */
+export declare const INTERACTIVE_PERMISSION_DEFAULT: Readonly<Record<string, unknown>>;
+/** The git top level containing `dir`, else `dir` itself. Never spawns git. */
+export declare function findProjectRoot(dir: string): string;
+/**
+ * Project configuration present between `cwd` and the project root — what the
+ * engine would load. Empty means there is nothing to decide about.
+ */
+export declare function findProjectConfig(cwd: string, root?: string, env?: NodeJS.ProcessEnv): string[];
+/**
+ * The project instruction files the engine would have read, by absolute path, so
+ * an untrusted run keeps them. Mirrors the engine: its own project directory's
+ * `AGENTS.md` at every level, plus the first of `AGENTS.md` / `CLAUDE.md` that
+ * exists anywhere between `cwd` and the root, at every level it exists.
+ */
+export declare function findProjectInstructions(cwd: string, root?: string): string[];
+export declare function trustRecordPath(env?: NodeJS.ProcessEnv): string;
+export declare function isProjectTrusted(root: string, env?: NodeJS.ProcessEnv): boolean;
+export declare function trustProject(root: string, env?: NodeJS.ProcessEnv): string;
+export declare function takeProjectPolicyFlags(passthrough: readonly string[]): {
+    trustProject: boolean;
+    enginePermissions: boolean;
+    engineArgv: string[];
+};
+export type TrustAnswer = 'once' | 'always' | 'no';
+export interface ProjectPolicyInput {
+    /** Where the engine will run — the TUI's positional project dir, or the cwd. */
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    /** `tui` asks and applies the interactive permission default; `headless` does neither. */
+    mode: 'tui' | 'headless';
+    trustProject: boolean;
+    enginePermissions: boolean;
+    /** Present only when a person can answer (both stdin and stderr are TTYs). */
+    ask?: (question: {
+        root: string;
+        config: string[];
+    }) => Promise<TrustAnswer>;
+}
+export interface ProjectPolicy {
+    /** Env the engine receives, layered over the sanitized parent. */
+    env: Record<string, string>;
+    /** Lines for stderr — what was withheld and how to change it. */
+    notices: string[];
+    projectConfig: 'loaded' | 'disabled' | 'none';
+}
+export declare function resolveProjectPolicy(input: ProjectPolicyInput): Promise<ProjectPolicy>;
+/**
+ * Where the TUI will run, or null when the argv names an engine subcommand.
+ *
+ * The engine takes its subcommand FIRST (`skrr code trust --show`), and its TUI
+ * takes an optional project directory in that same position. So: nothing, a flag,
+ * or an existing directory first means the TUI; any other word is a subcommand,
+ * forwarded untouched — `trust` in particular must see the project config it
+ * exists to approve.
+ */
+export declare function tuiProjectDir(engineArgv: readonly string[], cwd: string): string | null;
+/**
+ * The in-terminal question, or undefined when nobody can answer it. Asked on
+ * stderr so a redirected stdout stays clean; anything but y/a is "no", including
+ * an empty line and a closed stdin.
+ */
+export declare function ttyTrustAsker(streams?: {
+    input: NodeJS.ReadStream;
+    output: NodeJS.WriteStream;
+}): ProjectPolicyInput['ask'];

package/dist/lib/first-party-harness-project-trust.js

@@ -0,0 +1,364 @@
+"use strict";
+/**
+ * `skrr code` on a repository somebody else wrote (OSK-11958).
+ *
+ * ── What was wrong ──────────────────────────────────────────────────────────
+ *
+ * Bare `skrr code` and `skrr code run` forwarded straight to the engine, which
+ * then read the project's own configuration. Three things in there act on this
+ * machine, and the engine's own content-addressed trust gate (`skrr code trust`)
+ * covers only the first:
+ *
+ *   1. `plugin` / `mcp` keys in a project config file   — gated by the engine;
+ *   2. plugin and tool FILES auto-discovered under the project directory
+ *      (`<dir>/plugin/*.ts`, `<dir>/tool/*.ts`), and a dependency install run in
+ *      that directory                                     — NOT gated, measured
+ *      against the fork's `config.ts` / `plugin.ts` / `tool/registry.ts`;
+ *   3. `permission` and agent definitions, which LOOSEN what the agent may do
+ *      without asking — findLast wins in the engine's ruleset, so a project's
+ *      `"bash": "allow"` beats a default that asks.
+ *
+ * The daemon's managed path has always set `OPENCODE_DISABLE_PROJECT_CONFIG=1`.
+ * The CLI path set nothing. So opening a cloned repository with `skrr code` could
+ * run that repository's code, with no prompt.
+ *
+ * ── What this module decides ────────────────────────────────────────────────
+ *
+ * **Project configuration is off until the person trusts the project.** Trust is
+ * a record per project root (the git top level, else the directory), kept in
+ * `<config root>/code-trusted-projects.json`, or a one-shot `--trust-project`.
+ * The interactive TUI asks once, before it starts, and only when the project
+ * actually ships configuration; a repository with none is never asked about.
+ *
+ * Path-addressed rather than content-addressed on purpose: this is the coarse
+ * "is this my project?" question every editor asks (the engine's own gate stays
+ * content-addressed for the plugin/mcp keys inside a trusted project).
+ *
+ * **Disabling project config must not cost the repository's instructions.** The
+ * engine's switch also stops it reading `AGENTS.md` / `CLAUDE.md` from the
+ * project — text, not code — and a coding agent that ignores the repository's
+ * conventions is its own failure. So an untrusted run passes those files back by
+ * absolute path through `OPENCODE_CONFIG_CONTENT.instructions`, which the engine
+ * reads as plain files. Nothing executable travels that way.
+ *
+ * **The interactive TUI asks before bash, edits, and the web.** A person is at
+ * the terminal and the engine can prompt there, so the default is the one
+ * Claude Code ships: reads and searches run, changes and commands ask
+ * (`INTERACTIVE_PERMISSION_DEFAULT`). The engine answers "always" per session,
+ * so it costs one approval per kind of action, not one per call. `skrr code run`
+ * is headless — the engine auto-REJECTS every ask there — so it keeps the
+ * engine's own permission config; an `ask` default would make `run` unable to
+ * edit anything. A person's own `OPENCODE_PERMISSION` always wins, and
+ * `--engine-permissions` hands the decision back to the engine's config.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERACTIVE_PERMISSION_DEFAULT = exports.ENGINE_PERMISSIONS_FLAG = exports.TRUST_PROJECT_FLAG = void 0;
+exports.findProjectRoot = findProjectRoot;
+exports.findProjectConfig = findProjectConfig;
+exports.findProjectInstructions = findProjectInstructions;
+exports.trustRecordPath = trustRecordPath;
+exports.isProjectTrusted = isProjectTrusted;
+exports.trustProject = trustProject;
+exports.takeProjectPolicyFlags = takeProjectPolicyFlags;
+exports.resolveProjectPolicy = resolveProjectPolicy;
+exports.tuiProjectDir = tuiProjectDir;
+exports.ttyTrustAsker = ttyTrustAsker;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_readline_1 = __importDefault(require("node:readline"));
+const auth_core_1 = require("@skrr-ai/auth-core");
+/** Wrapper flags this module consumes; the engine never sees them. */
+exports.TRUST_PROJECT_FLAG = '--trust-project';
+exports.ENGINE_PERMISSIONS_FLAG = '--engine-permissions';
+// The upstream engine's variable names, which the fork still reads.
+const DISABLE_PROJECT_CONFIG_ENV = 'OPENCODE_DISABLE_PROJECT_CONFIG'; // brand-leak-ok:compat  upstream env var name
+const PERMISSION_ENV = 'OPENCODE_PERMISSION'; // brand-leak-ok:compat  upstream env var name
+const CONFIG_CONTENT_ENV = 'OPENCODE_CONFIG_CONTENT'; // brand-leak-ok:compat  upstream env var name
+/**
+ * The upstream project namespace, which the engine reads ONLY when its
+ * compatibility switch is on — otherwise a repository with an upstream config
+ * directory would be asked about a file the engine never opens.
+ */
+const UPSTREAM_APP_NAME = 'opencode'; // brand-leak-ok:compat  upstream project dir / config basename
+function upstreamCompatOn(env) {
+    const value = (0, auth_core_1.readFirstPartyHarnessEngineEnv)(env, 'compatOpencode').value?.trim().toLowerCase();
+    return value === '1' || value === 'true';
+}
+/**
+ * The interactive default. Explicit keys after `*`, because the engine's ruleset
+ * is last-match-wins and merges this OVER the project's and the user's config:
+ * a key named here beats a looser value for the same key elsewhere.
+ */
+exports.INTERACTIVE_PERMISSION_DEFAULT = Object.freeze({
+    '*': 'ask',
+    read: { '*': 'allow', '*.env': 'ask', '*.env.*': 'ask', '*.env.example': 'allow' },
+    glob: 'allow',
+    grep: 'allow',
+    list: 'allow',
+    lsp: 'allow',
+    todowrite: 'allow',
+    question: 'allow',
+    skill: 'allow',
+    task: 'allow',
+    edit: 'ask',
+    bash: 'ask',
+    webfetch: 'ask',
+    websearch: 'ask',
+    external_directory: 'ask',
+});
+/** Every project-config location the engine reads, current namespace first. */
+function projectConfigNames(env) {
+    const upstream = upstreamCompatOn(env) ? [UPSTREAM_APP_NAME] : [];
+    const appNames = [
+        auth_core_1.FIRST_PARTY_HARNESS_ENGINE.appName,
+        ...auth_core_1.FIRST_PARTY_HARNESS_ENGINE.legacyAppNames,
+        ...upstream,
+    ];
+    return {
+        dirs: [
+            auth_core_1.FIRST_PARTY_HARNESS_ENGINE.projectDirectory,
+            ...auth_core_1.FIRST_PARTY_HARNESS_ENGINE.legacyProjectDirectories,
+            ...upstream.map((name) => `.${name}`),
+        ],
+        files: appNames.flatMap((name) => [`${name}.json`, `${name}.jsonc`]),
+    };
+}
+/** The git top level containing `dir`, else `dir` itself. Never spawns git. */
+function findProjectRoot(dir) {
+    let current = node_path_1.default.resolve(dir);
+    for (;;) {
+        if (node_fs_1.default.existsSync(node_path_1.default.join(current, '.git')))
+            return current;
+        const parent = node_path_1.default.dirname(current);
+        if (parent === current)
+            return node_path_1.default.resolve(dir);
+        current = parent;
+    }
+}
+/** The directories from `start` up to and including `root`. */
+function ancestry(start, root) {
+    const out = [];
+    let current = node_path_1.default.resolve(start);
+    const stop = node_path_1.default.resolve(root);
+    for (;;) {
+        out.push(current);
+        if (current === stop)
+            break;
+        const parent = node_path_1.default.dirname(current);
+        if (parent === current)
+            break;
+        current = parent;
+    }
+    return out;
+}
+/**
+ * Project configuration present between `cwd` and the project root — what the
+ * engine would load. Empty means there is nothing to decide about.
+ */
+function findProjectConfig(cwd, root = findProjectRoot(cwd), env = process.env) {
+    const { dirs, files } = projectConfigNames(env);
+    const found = [];
+    for (const dir of ancestry(cwd, root)) {
+        for (const name of [...dirs, ...files]) {
+            const candidate = node_path_1.default.join(dir, name);
+            if (node_fs_1.default.existsSync(candidate))
+                found.push(candidate);
+        }
+    }
+    return found;
+}
+/**
+ * The project instruction files the engine would have read, by absolute path, so
+ * an untrusted run keeps them. Mirrors the engine: its own project directory's
+ * `AGENTS.md` at every level, plus the first of `AGENTS.md` / `CLAUDE.md` that
+ * exists anywhere between `cwd` and the root, at every level it exists.
+ */
+function findProjectInstructions(cwd, root = findProjectRoot(cwd)) {
+    const levels = ancestry(cwd, root);
+    const own = [
+        auth_core_1.FIRST_PARTY_HARNESS_ENGINE.projectDirectory,
+        ...auth_core_1.FIRST_PARTY_HARNESS_ENGINE.legacyProjectDirectories,
+    ];
+    const found = [];
+    for (const dir of levels) {
+        // Current project directory first; a legacy one only where it is absent.
+        const hit = own.map((d) => node_path_1.default.join(dir, d, 'AGENTS.md')).find((f) => node_fs_1.default.existsSync(f));
+        if (hit)
+            found.push(hit);
+    }
+    for (const family of ['AGENTS.md', 'CLAUDE.md']) {
+        const matches = levels.map((dir) => node_path_1.default.join(dir, family)).filter((f) => node_fs_1.default.existsSync(f));
+        if (matches.length > 0) {
+            found.push(...matches);
+            break;
+        }
+    }
+    return found;
+}
+function trustRecordPath(env = process.env) {
+    return node_path_1.default.join((0, auth_core_1.resolveConfigRoot)(env), 'code-trusted-projects.json');
+}
+function realRoot(root) {
+    try {
+        return node_fs_1.default.realpathSync(root);
+    }
+    catch {
+        return node_path_1.default.resolve(root);
+    }
+}
+function readTrustFile(file) {
+    try {
+        const parsed = JSON.parse(node_fs_1.default.readFileSync(file, 'utf8'));
+        if (parsed && parsed.version === 1 && parsed.projects && typeof parsed.projects === 'object') {
+            return { version: 1, projects: parsed.projects };
+        }
+    }
+    catch {
+        /* absent or unreadable: nothing is trusted, which is the safe reading */
+    }
+    return { version: 1, projects: {} };
+}
+function isProjectTrusted(root, env = process.env) {
+    return Boolean(readTrustFile(trustRecordPath(env)).projects[realRoot(root)]);
+}
+function trustProject(root, env = process.env) {
+    const file = trustRecordPath(env);
+    const record = readTrustFile(file);
+    record.projects[realRoot(root)] = { trustedAt: new Date().toISOString() };
+    node_fs_1.default.mkdirSync(node_path_1.default.dirname(file), { recursive: true, mode: 0o700 });
+    const tmp = `${file}.${process.pid}.tmp`;
+    node_fs_1.default.writeFileSync(tmp, `${JSON.stringify(record, null, 2)}\n`, { mode: 0o600 });
+    node_fs_1.default.renameSync(tmp, file);
+    return file;
+}
+// ── Flags ──────────────────────────────────────────────────────────────────
+function takeProjectPolicyFlags(passthrough) {
+    let trust = false;
+    let enginePermissions = false;
+    const engineArgv = [];
+    for (const token of passthrough) {
+        if (token === exports.TRUST_PROJECT_FLAG)
+            trust = true;
+        else if (token === exports.ENGINE_PERMISSIONS_FLAG)
+            enginePermissions = true;
+        else
+            engineArgv.push(token);
+    }
+    return { trustProject: trust, enginePermissions, engineArgv };
+}
+function mergeConfigContent(existing, instructions) {
+    let base = {};
+    if (existing && existing.trim() !== '') {
+        try {
+            const parsed = JSON.parse(existing);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+                return null;
+            base = parsed;
+        }
+        catch {
+            // The person's own value is not JSON we can extend; leave it exactly as is.
+            return null;
+        }
+    }
+    const prior = Array.isArray(base.instructions) ? base.instructions : [];
+    const merged = [...prior, ...instructions.filter((file) => !prior.includes(file))];
+    return JSON.stringify({ ...base, instructions: merged });
+}
+function relativeList(root, files) {
+    return files.map((file) => node_path_1.default.relative(root, file) || '.').join(', ');
+}
+async function resolveProjectPolicy(input) {
+    const env = {};
+    const notices = [];
+    if (input.mode === 'tui' && !input.enginePermissions && !input.env[PERMISSION_ENV]) {
+        env[PERMISSION_ENV] = JSON.stringify(exports.INTERACTIVE_PERMISSION_DEFAULT);
+    }
+    const root = findProjectRoot(input.cwd);
+    const config = findProjectConfig(input.cwd, root, input.env);
+    if (config.length === 0)
+        return { env, notices, projectConfig: 'none' };
+    let trusted = input.trustProject || isProjectTrusted(root, input.env);
+    if (!trusted && input.mode === 'tui' && input.ask) {
+        const answer = await input.ask({ root, config });
+        if (answer === 'always') {
+            const file = trustProject(root, input.env);
+            notices.push(`Trusted ${root} for skrr code (recorded in ${file}).`);
+        }
+        trusted = answer !== 'no';
+    }
+    if (trusted)
+        return { env, notices, projectConfig: 'loaded' };
+    env[DISABLE_PROJECT_CONFIG_ENV] = '1';
+    const instructions = findProjectInstructions(input.cwd, root);
+    if (instructions.length > 0) {
+        const content = mergeConfigContent(input.env[CONFIG_CONTENT_ENV], instructions);
+        if (content)
+            env[CONFIG_CONTENT_ENV] = content;
+    }
+    notices.push(`Project configuration in ${root} was not loaded (${relativeList(root, config)}): it can run ` +
+        `code on this machine and change what the agent may do without asking. ` +
+        (instructions.length > 0 ? 'Its instructions files were still read. ' : '') +
+        `To load it, pass ${exports.TRUST_PROJECT_FLAG} once, or answer "always" when \`skrr code\` asks.`);
+    return { env, notices, projectConfig: 'disabled' };
+}
+/**
+ * Where the TUI will run, or null when the argv names an engine subcommand.
+ *
+ * The engine takes its subcommand FIRST (`skrr code trust --show`), and its TUI
+ * takes an optional project directory in that same position. So: nothing, a flag,
+ * or an existing directory first means the TUI; any other word is a subcommand,
+ * forwarded untouched — `trust` in particular must see the project config it
+ * exists to approve.
+ */
+function tuiProjectDir(engineArgv, cwd) {
+    const first = engineArgv[0];
+    if (first === undefined || first.startsWith('-'))
+        return cwd;
+    const candidate = node_path_1.default.resolve(cwd, first);
+    try {
+        if (node_fs_1.default.statSync(candidate).isDirectory())
+            return candidate;
+    }
+    catch {
+        /* not a directory: a subcommand */
+    }
+    return null;
+}
+/**
+ * The in-terminal question, or undefined when nobody can answer it. Asked on
+ * stderr so a redirected stdout stays clean; anything but y/a is "no", including
+ * an empty line and a closed stdin.
+ */
+function ttyTrustAsker(streams = {
+    input: process.stdin,
+    output: process.stderr,
+}) {
+    if (!streams.input.isTTY || !streams.output.isTTY)
+        return undefined;
+    return ({ root, config }) => new Promise((resolve) => {
+        const rl = node_readline_1.default.createInterface({ input: streams.input, output: streams.output });
+        let settled = false;
+        const finish = (answer) => {
+            if (settled)
+                return;
+            settled = true;
+            rl.close();
+            resolve(answer);
+        };
+        rl.on('close', () => finish('no'));
+        rl.question(`\nThis project ships its own agent configuration: ${relativeList(root, config)}\n` +
+            'Project configuration can run code on this machine (plugins, custom tools, MCP\n' +
+            'servers) and change what the agent may do without asking.\n' +
+            `Load it?  [y] this time   [a] always for ${root}   [N] no  `, (reply) => {
+            const value = reply.trim().toLowerCase();
+            finish(value === 'a' || value === 'always'
+                ? 'always'
+                : value === 'y' || value === 'yes'
+                    ? 'once'
+                    : 'no');
+        });
+    });
+}

package/dist/lib/first-party-harness.d.ts

@@ -264,6 +264,13 @@ export interface EngineSpawnOptions {
      * never spawned, `cleanup` still runs, and the error reaches the caller.
      */
     prepare?: () => Promise<Record<string, string>>;
+    /**
+     * OSK-11958 — the project policy's env (`first-party-harness-project-trust.ts`):
+     * whether the project's own config loads, and the interactive permission
+     * default. Layered over the engine-owned env and UNDER `prepare`'s, so a managed
+     * session's relay values still win.
+     */
+    policyEnv?: Record<string, string>;
     /** Always run, on every exit path. Tear down anything `prepare` created. */
     cleanup?: (outcome: EngineExitOutcome) => Promise<void>;
     /**
@@ -367,9 +374,9 @@ export declare function strippedProviderCredentialNames(env?: NodeJS.ProcessEnv)
  * under that name, rather than rely on inheritance.
  *
  * The layering, in full: sanitized parent → the user's own model credential (BYOK
- * only) → {@link engineOwnedEnv} → `extraEnv`.
+ * only) → {@link engineOwnedEnv} → the project policy (OSK-11958) → `extraEnv`.
  */
-export declare function engineSpawnEnv(env: NodeJS.ProcessEnv, extraEnv: Record<string, string>, mode: 'managed' | 'byok'): NodeJS.ProcessEnv;
+export declare function engineSpawnEnv(env: NodeJS.ProcessEnv, extraEnv: Record<string, string>, mode: 'managed' | 'byok', policyEnv?: Record<string, string>): NodeJS.ProcessEnv;
 /**
  * Settings the platform reads under NEUTRAL names, handed to the engine under the
  * engine's OWN names.

package/dist/lib/first-party-harness.js

@@ -576,16 +576,17 @@ function strippedProviderCredentialNames(env = process.env) {
  * under that name, rather than rely on inheritance.
  *
  * The layering, in full: sanitized parent → the user's own model credential (BYOK
- * only) → {@link engineOwnedEnv} → `extraEnv`.
+ * only) → {@link engineOwnedEnv} → the project policy (OSK-11958) → `extraEnv`.
  */
 function engineSpawnEnv(env, extraEnv, 
 // Required, not defaulted: the safe value differs per call and a parameter that
 // can be forgotten on a security boundary will be.
-mode) {
+mode, policyEnv = {}) {
     const spawnEnv = {
         ...(0, auth_core_1.sanitizeSpawnEnv)(env),
         ...(mode === 'managed' ? {} : inheritedProviderCredentials(env)),
         ...engineOwnedEnv(env),
+        ...policyEnv,
         ...extraEnv,
     };
     if (mode !== 'managed')
@@ -671,7 +672,7 @@ async function execEngine(args, env = process.env, options = {}) {
         const spawnArgs = options.finalizeArgs ? options.finalizeArgs([...args]) : args;
         // Read AFTER `prepare`, because that is when the hook knows what it acquired.
         const mode = options.credentialMode?.() ?? 'byok';
-        return await spawnEngine(bin, spawnArgs, env, extraEnv, mode, outcome);
+        return await spawnEngine(bin, spawnArgs, env, extraEnv, mode, outcome, options.policyEnv);
     }
     finally {
         // In a `finally` rather than on `exit`, so a spawn error and a Ctrl-C both
@@ -683,12 +684,12 @@ async function execEngine(args, env = process.env, options = {}) {
 function spawnEngine(bin, args, env, extraEnv, mode, 
 // Written into rather than returned, so the `finally` above can read it on
 // every path — including one where this promise rejects.
-outcome) {
+outcome, policyEnv) {
     return new Promise((resolve, reject) => {
         const isWinShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(bin);
         const child = (0, node_child_process_1.spawn)(bin, args, {
             stdio: 'inherit',
-            env: engineSpawnEnv(env, extraEnv, mode),
+            env: engineSpawnEnv(env, extraEnv, mode, policyEnv),
             ...(isWinShim ? { shell: true } : {}),
         });
         // `stdio: 'inherit'` puts the child in this process group, so Ctrl-C reaches

package/dist/lib/hosted-machines.d.ts

@@ -124,13 +124,22 @@ export declare function hostedMachineStatus(session: HostedMachineSession | unde
 export declare function hostedMachineDisplayName(session: HostedMachineSession | undefined | null): string;
 export declare function hostedMachineRepoSummary(session: HostedMachineSession | undefined | null): string;
 export declare function hostedMachineErrorSummary(session: HostedMachineSession | undefined | null): string;
+/**
+ * Whether tenant code on this machine can read the daemon's credentials
+ * (OSK-11981). The server always sends a mode — a machine with no record is
+ * reported as `shared_uid` — so a missing field here means an older server,
+ * and is printed as unknown rather than as the reassuring answer.
+ */
+export declare function hostedMachineIsolationSummary(session: HostedMachineSession | undefined | null): string;
 /** Stable, user-facing snapshot for long provisioning waits. */
 export declare function hostedMachineProgressSummary(session: HostedMachineSession | undefined | null): string;
 export declare function isHostedMachineReady(session: HostedMachineSession | undefined | null): boolean;
 export declare function isHostedMachineTerminal(session: HostedMachineSession | undefined | null): boolean;
 export declare function parseDurationMs(value: string | undefined, flagName: string): number | undefined;
 export declare function sleep(ms: number): Promise<void>;
-export declare function formatHostedMachineApiError(err: unknown): string | null;
+export declare function formatHostedMachineApiError(err: unknown, context?: {
+    bin?: string;
+}): string | null;
 export declare function startHostedMachine(input: StartHostedMachineInput): Promise<HostedMachineResponse>;
 export declare function listHostedMachines(scope?: HostedMachineScope & {
     limit?: number;

package/dist/lib/hosted-machines.js

@@ -8,6 +8,7 @@ exports.hostedMachineStatus = hostedMachineStatus;
 exports.hostedMachineDisplayName = hostedMachineDisplayName;
 exports.hostedMachineRepoSummary = hostedMachineRepoSummary;
 exports.hostedMachineErrorSummary = hostedMachineErrorSummary;
+exports.hostedMachineIsolationSummary = hostedMachineIsolationSummary;
 exports.hostedMachineProgressSummary = hostedMachineProgressSummary;
 exports.isHostedMachineReady = isHostedMachineReady;
 exports.isHostedMachineTerminal = isHostedMachineTerminal;
@@ -26,6 +27,7 @@ exports.waitForHostedMachineReady = waitForHostedMachineReady;
 exports.offlineForLabel = offlineForLabel;
 const api_fetch_1 = require("./api-fetch");
 const edge_error_page_1 = require("./edge-error-page");
+const machine_spend_cap_1 = require("./machine-spend-cap");
 function curateHostedMachineList(response) {
     return {
         object: 'list',
@@ -107,6 +109,21 @@ function hostedMachineErrorSummary(session) {
         return error;
     return error.message || error.class || '';
 }
+/**
+ * Whether tenant code on this machine can read the daemon's credentials
+ * (OSK-11981). The server always sends a mode — a machine with no record is
+ * reported as `shared_uid` — so a missing field here means an older server,
+ * and is printed as unknown rather than as the reassuring answer.
+ */
+function hostedMachineIsolationSummary(session) {
+    const isolation = session?.identityIsolation;
+    if (!isolation?.mode)
+        return 'unknown (server did not report it)';
+    if (isolation.mode === 'daemon_workload_split') {
+        return `daemon credentials isolated from tenant code (contract ${isolation.contract || '?'})`;
+    }
+    return `shared uid — tenant code can read the daemon's credentials (${isolation.reason || 'unspecified'})`;
+}
 /** Stable, user-facing snapshot for long provisioning waits. */
 function hostedMachineProgressSummary(session) {
     const status = hostedMachineStatus(session);
@@ -142,7 +159,7 @@ function parseDurationMs(value, flagName) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function formatHostedMachineApiError(err) {
+function formatHostedMachineApiError(err, context = {}) {
     if (!(err instanceof api_fetch_1.ApiFetchError) || !err.body) {
         return null;
     }
@@ -155,13 +172,30 @@ function formatHostedMachineApiError(err) {
     if (edge) {
         return edge.message;
     }
+    let message;
     try {
         const parsed = JSON.parse(err.body);
-        return parsed.message || parsed.error || parsed.code || null;
+        message = parsed.message || parsed.error || parsed.code || null;
     }
     catch {
         return err.body.trim() || null;
     }
+    // A monthly-cap refusal carries its figures in `details`; print them, and say
+    // this is not the plan or the credits (OSK-11946). The dedicated CLI has done
+    // the figures since OSK-9552; the hosted one dropped them.
+    if (message && (0, machine_spend_cap_1.isMonthlyCapRefusal)(err.body)) {
+        const figures = (0, machine_spend_cap_1.describeMonthlyCapFigures)(err.body);
+        return [
+            message,
+            figures ? `${figures}.` : '',
+            machine_spend_cap_1.MONTHLY_CAP_IS_SEPARATE,
+            "Start with a higher --spending-limit-cents, or raise an existing machine's cap with " +
+                `\`${context.bin || 'skrr'} harnesses leases billing <lease-id> --spending-limit-cents <n>\`.`,
+        ]
+            .filter(Boolean)
+            .join(' ');
+    }
+    return message;
 }
 async function startHostedMachine(input) {
     return (0, api_fetch_1.apiFetch)('/api/agentic/sandbox-sessions', {