@skrr-ai/cli 0.1.49 → 0.1.51

package/dist/lib/first-party-harness.js

@@ -576,16 +576,17 @@ function strippedProviderCredentialNames(env = process.env) {
  * under that name, rather than rely on inheritance.
  *
  * The layering, in full: sanitized parent → the user's own model credential (BYOK
- * only) → {@link engineOwnedEnv} → `extraEnv`.
+ * only) → {@link engineOwnedEnv} → the project policy (OSK-11958) → `extraEnv`.
  */
 function engineSpawnEnv(env, extraEnv, 
 // Required, not defaulted: the safe value differs per call and a parameter that
 // can be forgotten on a security boundary will be.
-mode) {
+mode, policyEnv = {}) {
     const spawnEnv = {
         ...(0, auth_core_1.sanitizeSpawnEnv)(env),
         ...(mode === 'managed' ? {} : inheritedProviderCredentials(env)),
         ...engineOwnedEnv(env),
+        ...policyEnv,
         ...extraEnv,
     };
     if (mode !== 'managed')
@@ -671,7 +672,7 @@ async function execEngine(args, env = process.env, options = {}) {
         const spawnArgs = options.finalizeArgs ? options.finalizeArgs([...args]) : args;
         // Read AFTER `prepare`, because that is when the hook knows what it acquired.
         const mode = options.credentialMode?.() ?? 'byok';
-        return await spawnEngine(bin, spawnArgs, env, extraEnv, mode, outcome);
+        return await spawnEngine(bin, spawnArgs, env, extraEnv, mode, outcome, options.policyEnv);
     }
     finally {
         // In a `finally` rather than on `exit`, so a spawn error and a Ctrl-C both
@@ -683,12 +684,12 @@ async function execEngine(args, env = process.env, options = {}) {
 function spawnEngine(bin, args, env, extraEnv, mode, 
 // Written into rather than returned, so the `finally` above can read it on
 // every path — including one where this promise rejects.
-outcome) {
+outcome, policyEnv) {
     return new Promise((resolve, reject) => {
         const isWinShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(bin);
         const child = (0, node_child_process_1.spawn)(bin, args, {
             stdio: 'inherit',
-            env: engineSpawnEnv(env, extraEnv, mode),
+            env: engineSpawnEnv(env, extraEnv, mode, policyEnv),
             ...(isWinShim ? { shell: true } : {}),
         });
         // `stdio: 'inherit'` puts the child in this process group, so Ctrl-C reaches

package/dist/lib/harnesses.d.ts

@@ -64,6 +64,16 @@ export interface Harness {
     version?: number;
     claudeEngine?: 'cli' | 'sdk';
     lastSeenAt?: string;
+    /** This harness's own stored permission-mode fallback, when set. */
+    defaultPermissionMode?: string | null;
+    /**
+     * The permission modes this harness can honour, and where the answer came
+     * from — sent by `GET /api/harnesses/:id` for a local row (OSK-12130).
+     */
+    permissionModes?: {
+        modes: string[];
+        source: 'daemon' | 'daemon_record' | 'static' | 'vocabulary' | string;
+    };
     /**
      * Registration metadata. A managed machine's rows carry `machineProduct` and
      * `machineLeaseId`, which is the only link from a lease to the harness rows its

package/dist/lib/hosted-machines.d.ts

@@ -124,13 +124,22 @@ export declare function hostedMachineStatus(session: HostedMachineSession | unde
 export declare function hostedMachineDisplayName(session: HostedMachineSession | undefined | null): string;
 export declare function hostedMachineRepoSummary(session: HostedMachineSession | undefined | null): string;
 export declare function hostedMachineErrorSummary(session: HostedMachineSession | undefined | null): string;
+/**
+ * Whether tenant code on this machine can read the daemon's credentials
+ * (OSK-11981). The server always sends a mode — a machine with no record is
+ * reported as `shared_uid` — so a missing field here means an older server,
+ * and is printed as unknown rather than as the reassuring answer.
+ */
+export declare function hostedMachineIsolationSummary(session: HostedMachineSession | undefined | null): string;
 /** Stable, user-facing snapshot for long provisioning waits. */
 export declare function hostedMachineProgressSummary(session: HostedMachineSession | undefined | null): string;
 export declare function isHostedMachineReady(session: HostedMachineSession | undefined | null): boolean;
 export declare function isHostedMachineTerminal(session: HostedMachineSession | undefined | null): boolean;
 export declare function parseDurationMs(value: string | undefined, flagName: string): number | undefined;
 export declare function sleep(ms: number): Promise<void>;
-export declare function formatHostedMachineApiError(err: unknown): string | null;
+export declare function formatHostedMachineApiError(err: unknown, context?: {
+    bin?: string;
+}): string | null;
 export declare function startHostedMachine(input: StartHostedMachineInput): Promise<HostedMachineResponse>;
 export declare function listHostedMachines(scope?: HostedMachineScope & {
     limit?: number;

package/dist/lib/hosted-machines.js

@@ -8,6 +8,7 @@ exports.hostedMachineStatus = hostedMachineStatus;
 exports.hostedMachineDisplayName = hostedMachineDisplayName;
 exports.hostedMachineRepoSummary = hostedMachineRepoSummary;
 exports.hostedMachineErrorSummary = hostedMachineErrorSummary;
+exports.hostedMachineIsolationSummary = hostedMachineIsolationSummary;
 exports.hostedMachineProgressSummary = hostedMachineProgressSummary;
 exports.isHostedMachineReady = isHostedMachineReady;
 exports.isHostedMachineTerminal = isHostedMachineTerminal;
@@ -26,6 +27,7 @@ exports.waitForHostedMachineReady = waitForHostedMachineReady;
 exports.offlineForLabel = offlineForLabel;
 const api_fetch_1 = require("./api-fetch");
 const edge_error_page_1 = require("./edge-error-page");
+const machine_spend_cap_1 = require("./machine-spend-cap");
 function curateHostedMachineList(response) {
     return {
         object: 'list',
@@ -107,6 +109,21 @@ function hostedMachineErrorSummary(session) {
         return error;
     return error.message || error.class || '';
 }
+/**
+ * Whether tenant code on this machine can read the daemon's credentials
+ * (OSK-11981). The server always sends a mode — a machine with no record is
+ * reported as `shared_uid` — so a missing field here means an older server,
+ * and is printed as unknown rather than as the reassuring answer.
+ */
+function hostedMachineIsolationSummary(session) {
+    const isolation = session?.identityIsolation;
+    if (!isolation?.mode)
+        return 'unknown (server did not report it)';
+    if (isolation.mode === 'daemon_workload_split') {
+        return `daemon credentials isolated from tenant code (contract ${isolation.contract || '?'})`;
+    }
+    return `shared uid — tenant code can read the daemon's credentials (${isolation.reason || 'unspecified'})`;
+}
 /** Stable, user-facing snapshot for long provisioning waits. */
 function hostedMachineProgressSummary(session) {
     const status = hostedMachineStatus(session);
@@ -142,7 +159,7 @@ function parseDurationMs(value, flagName) {
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
-function formatHostedMachineApiError(err) {
+function formatHostedMachineApiError(err, context = {}) {
     if (!(err instanceof api_fetch_1.ApiFetchError) || !err.body) {
         return null;
     }
@@ -155,13 +172,30 @@ function formatHostedMachineApiError(err) {
     if (edge) {
         return edge.message;
     }
+    let message;
     try {
         const parsed = JSON.parse(err.body);
-        return parsed.message || parsed.error || parsed.code || null;
+        message = parsed.message || parsed.error || parsed.code || null;
     }
     catch {
         return err.body.trim() || null;
     }
+    // A monthly-cap refusal carries its figures in `details`; print them, and say
+    // this is not the plan or the credits (OSK-11946). The dedicated CLI has done
+    // the figures since OSK-9552; the hosted one dropped them.
+    if (message && (0, machine_spend_cap_1.isMonthlyCapRefusal)(err.body)) {
+        const figures = (0, machine_spend_cap_1.describeMonthlyCapFigures)(err.body);
+        return [
+            message,
+            figures ? `${figures}.` : '',
+            machine_spend_cap_1.MONTHLY_CAP_IS_SEPARATE,
+            "Start with a higher --spending-limit-cents, or raise an existing machine's cap with " +
+                `\`${context.bin || 'skrr'} harnesses leases billing <lease-id> --spending-limit-cents <n>\`.`,
+        ]
+            .filter(Boolean)
+            .join(' ');
+    }
+    return message;
 }
 async function startHostedMachine(input) {
     return (0, api_fetch_1.apiFetch)('/api/agentic/sandbox-sessions', {

package/dist/lib/live-runtime-binary.d.ts

@@ -0,0 +1,40 @@
+export interface LiveProgram {
+    /** The executable the OS reports for the live pid. */
+    exec: string;
+    /** For an interpreter-launched daemon, the script it runs. */
+    script: string | null;
+}
+export interface LiveRuntimeDeps {
+    /** pid of the live daemon for `profile`, or null. */
+    livePid(profile: string): number | null;
+    /** The live pid's program, or null when the OS will not say. */
+    programOf(pid: number): LiveProgram | null;
+    realpath(p: string): string;
+    isExecutable(p: string): boolean;
+}
+export type StatusBinaryDecision = {
+    kind: 'same';
+    binary: string;
+} | {
+    kind: 'unknown';
+    binary: string;
+} | {
+    kind: 'forward-live';
+    binary: string;
+    pathBinary: string;
+} | {
+    kind: 'mismatch';
+    binary: string;
+    live: string;
+};
+/** The profile a forwarded argv names, `default` otherwise. */
+export declare function profileFromArgs(args: readonly string[]): string;
+/**
+ * Decide which binary renders `status`. Never throws: a probe that cannot
+ * answer leaves the PATH binary in place (`unknown`).
+ */
+export declare function decideStatusBinary(pathBinary: string, profile: string, deps: LiveRuntimeDeps): StatusBinaryDecision;
+/** One stderr line naming the binary that rendered status, when it is not obvious. */
+export declare function describeStatusBinary(decision: StatusBinaryDecision): string | null;
+export declare function scriptFromArgs(exec: string, args: string): string | null;
+export declare function defaultLiveRuntimeDeps(): LiveRuntimeDeps;

package/dist/lib/live-runtime-binary.js

@@ -0,0 +1,193 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.profileFromArgs = profileFromArgs;
+exports.decideStatusBinary = decideStatusBinary;
+exports.describeStatusBinary = describeStatusBinary;
+exports.scriptFromArgs = scriptFromArgs;
+exports.defaultLiveRuntimeDeps = defaultLiveRuntimeDeps;
+/**
+ * Which runtime binary is the LIVE daemon running, and is it the one
+ * `skrr daemon status` is about to forward to? (OSK-12102)
+ *
+ * `execRuntimeBinary` forwards to the first `skrrd` on PATH. That is right for
+ * lifecycle verbs, where PATH order is the person's choice of install. It is
+ * wrong for `status`, whose whole subject is the daemon that is running: with
+ * an old dev build early on PATH and the release daemon live, the header named
+ * `.../releases/0.8.62/skrrd` while the body was rendered by the dev build —
+ * its old layout, no per-category permission table — and nothing on screen
+ * said two binaries were involved.
+ *
+ * The live daemon's pid comes from its island bootstrap file (the same
+ * discovery the CLI's login broker uses); the program from the OS. When the
+ * live program is itself a runtime executable, status is forwarded to it.
+ * When it cannot be exec'd directly (a `node .../dist/index.js` dev daemon),
+ * status stays on the PATH binary and says so.
+ */
+const node_child_process_1 = require("node:child_process");
+const node_fs_1 = require("node:fs");
+const node_path_1 = __importDefault(require("node:path"));
+const daemonBroker_1 = require("./daemonBroker");
+const exec_runtime_binary_1 = require("./exec-runtime-binary");
+function safeRealpath(deps, p) {
+    try {
+        return deps.realpath(p);
+    }
+    catch {
+        return p;
+    }
+}
+function isRuntimeName(p) {
+    const base = node_path_1.default
+        .basename(p)
+        .toLowerCase()
+        .replace(/\.(exe|cmd)$/, '');
+    return exec_runtime_binary_1.RUNTIME_BINARY_NAMES.some((name) => base === name || base.startsWith(`${name}-`));
+}
+/** The profile a forwarded argv names, `default` otherwise. */
+function profileFromArgs(args) {
+    for (let i = 0; i < args.length; i += 1) {
+        const arg = args[i];
+        if (arg === '--')
+            break;
+        if (arg === '--profile' && args[i + 1] && !args[i + 1].startsWith('-'))
+            return args[i + 1];
+        if (arg.startsWith('--profile=') && arg.length > '--profile='.length) {
+            return arg.slice('--profile='.length);
+        }
+    }
+    return 'default';
+}
+/**
+ * Decide which binary renders `status`. Never throws: a probe that cannot
+ * answer leaves the PATH binary in place (`unknown`).
+ */
+function decideStatusBinary(pathBinary, profile, deps) {
+    let program = null;
+    try {
+        const pid = deps.livePid(profile);
+        program = pid ? deps.programOf(pid) : null;
+    }
+    catch {
+        program = null;
+    }
+    if (!program)
+        return { kind: 'unknown', binary: pathBinary };
+    const pathReal = safeRealpath(deps, pathBinary);
+    const execReal = safeRealpath(deps, program.exec);
+    const scriptReal = program.script ? safeRealpath(deps, program.script) : null;
+    if (pathReal === execReal || (scriptReal !== null && pathReal === scriptReal)) {
+        return { kind: 'same', binary: pathBinary };
+    }
+    // Only a runtime executable is forwarded to. A `node`/Electron-hosted daemon
+    // has an interpreter as its exec, and running the interpreter with status
+    // argv would be nonsense.
+    const directlyRunnable = program.script === null &&
+        (isRuntimeName(program.exec) || isRuntimeName(execReal)) &&
+        deps.isExecutable(program.exec);
+    if (directlyRunnable) {
+        return { kind: 'forward-live', binary: program.exec, pathBinary };
+    }
+    return { kind: 'mismatch', binary: pathBinary, live: program.script ?? program.exec };
+}
+/** One stderr line naming the binary that rendered status, when it is not obvious. */
+function describeStatusBinary(decision) {
+    switch (decision.kind) {
+        case 'forward-live':
+            return (`Rendered by the live daemon's binary ${decision.binary} ` +
+                `(the first skrrd on PATH is ${decision.pathBinary}, a different build).`);
+        case 'mismatch':
+            return (`Rendered by ${decision.binary}, the first skrrd on PATH — NOT the live daemon's ` +
+                `program (${decision.live}). This layout and these checks are that build's, not the live one's.`);
+        default:
+            return null;
+    }
+}
+function darwinProgramOf(pid) {
+    const out = (args) => (0, node_child_process_1.execFileSync)('ps', ['-p', String(pid), '-o', ...args], {
+        encoding: 'utf8',
+        timeout: 2_000,
+        stdio: ['ignore', 'pipe', 'ignore'],
+    }).trim();
+    const exec = out(['comm=']);
+    if (!exec || !node_path_1.default.isAbsolute(exec))
+        return null;
+    return { exec, script: scriptFromArgs(exec, out(['args='])) };
+}
+function linuxProgramOf(pid) {
+    const exec = (0, node_fs_1.readlinkSync)(`/proc/${pid}/exe`);
+    let script = null;
+    try {
+        const cmdline = (0, node_fs_1.readFileSync)(`/proc/${pid}/cmdline`, 'utf8');
+        script = scriptFromArgs(exec, cmdline.split('\0').filter(Boolean).join(' '));
+    }
+    catch {
+        script = null;
+    }
+    return { exec, script };
+}
+/**
+ * For an interpreter-hosted daemon (`node --import x.mjs /x/dist/index.js
+ * start …`), the script: the first argument after the exec that is neither an
+ * option nor the value of a module-loading option. `ps -o args=` is
+ * space-joined, so a path containing a space is not recovered — the result is
+ * only ever used for display and an equality check, where a miss degrades to
+ * the "mismatch" note rather than to a wrong forward.
+ */
+const INTERPRETER_VALUE_OPTIONS = new Set([
+    '-r',
+    '--require',
+    '--import',
+    '--loader',
+    '--experimental-loader',
+    '-e',
+    '--eval',
+]);
+function scriptFromArgs(exec, args) {
+    if (isRuntimeName(exec))
+        return null;
+    const rest = args.startsWith(exec) ? args.slice(exec.length) : args.replace(/^\S+/, '');
+    const tokens = rest.split(/\s+/).filter(Boolean);
+    for (let i = 0; i < tokens.length; i += 1) {
+        const token = tokens[i];
+        if (INTERPRETER_VALUE_OPTIONS.has(token)) {
+            i += 1;
+            continue;
+        }
+        if (token.startsWith('-'))
+            continue;
+        return token;
+    }
+    return null;
+}
+function defaultLiveRuntimeDeps() {
+    return {
+        livePid(profile) {
+            for (const candidate of (0, daemonBroker_1.resolveExactProfileBootstrapPaths)(profile)) {
+                const bootstrap = (0, daemonBroker_1.readBootstrap)(candidate);
+                if (typeof bootstrap?.pid === 'number' && bootstrap.pid > 0)
+                    return bootstrap.pid;
+            }
+            return null;
+        },
+        programOf(pid) {
+            if (process.platform === 'darwin')
+                return darwinProgramOf(pid);
+            if (process.platform === 'linux')
+                return linuxProgramOf(pid);
+            return null;
+        },
+        realpath: (p) => (0, node_fs_1.realpathSync)(p),
+        isExecutable(p) {
+            try {
+                (0, node_fs_1.accessSync)(p, node_fs_1.constants.X_OK);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}

package/dist/lib/login.d.ts

@@ -38,6 +38,29 @@ export interface CliLoginWithRefreshTokenOptions {
      */
     cliId: string;
 }
+/**
+ * What a shell with no terminal can do instead (OSK-12117). The refusal used to
+ * name only CI tokens, which is not a sign-in: an agent session asking for one
+ * could only hand the job to a person typing `! skrr login`.
+ */
+export declare const HEADLESS_LOGIN_HINT: string;
+/**
+ * The line printed when the daemon descriptor this CLI found is for another
+ * server (OSK-12117).
+ *
+ * It used to assert "the skrr background service on this computer is logged in
+ * to <url>" and recommend repointing the CLI there. What the CLI actually knows
+ * is narrower: ONE descriptor file it read names that server. That file can
+ * belong to another profile's daemon (observed: a localhost:3080 descriptor
+ * while this machine's default daemon was connected to skrr.ai), and in that
+ * case both the claim and the advice were wrong — the advice by moving a
+ * production CLI onto a development server. So say what was read, from where,
+ * and how to check the daemon itself.
+ */
+export declare function describeBrokerBaseUrlMismatch(failure: {
+    daemonServerUrl?: string;
+    descriptorPath?: string;
+}, serverUrl: string): string;
 /**
  * Top-level dispatcher. Picks PKCE localhost vs device-code per the
  * decision tree in the roadmap and persists the result.

package/dist/lib/login.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEADLESS_LOGIN_HINT = void 0;
+exports.describeBrokerBaseUrlMismatch = describeBrokerBaseUrlMismatch;
 exports.cliLogin = cliLogin;
 exports.cliLoginWithRefreshToken = cliLoginWithRefreshToken;
 /**
@@ -35,6 +37,33 @@ const device_code_1 = require("./device-code");
 const device_identity_1 = require("./device-identity");
 const oauthLogin_1 = require("./oauthLogin");
 const daemonBroker_1 = require("./daemonBroker");
+/**
+ * What a shell with no terminal can do instead (OSK-12117). The refusal used to
+ * name only CI tokens, which is not a sign-in: an agent session asking for one
+ * could only hand the job to a person typing `! skrr login`.
+ */
+exports.HEADLESS_LOGIN_HINT = '`skrr login --device-code` works without a terminal: it prints a URL and a code for a ' +
+    'person to approve in any browser, and finishes when they do. For CI, use ' +
+    '`skrr create-token` and set OVERSKY_TOKEN=osk_ci_...';
+/**
+ * The line printed when the daemon descriptor this CLI found is for another
+ * server (OSK-12117).
+ *
+ * It used to assert "the skrr background service on this computer is logged in
+ * to <url>" and recommend repointing the CLI there. What the CLI actually knows
+ * is narrower: ONE descriptor file it read names that server. That file can
+ * belong to another profile's daemon (observed: a localhost:3080 descriptor
+ * while this machine's default daemon was connected to skrr.ai), and in that
+ * case both the claim and the advice were wrong — the advice by moving a
+ * production CLI onto a development server. So say what was read, from where,
+ * and how to check the daemon itself.
+ */
+function describeBrokerBaseUrlMismatch(failure, serverUrl) {
+    const where = failure.descriptorPath ? ` (${failure.descriptorPath})` : '';
+    return (`  Skipped the daemon hand-off: the daemon descriptor found${where} is for ` +
+        `${failure.daemonServerUrl}, not ${serverUrl}. It may belong to a different profile's ` +
+        'daemon; `skrr daemon status` shows which server this profile’s daemon is on.');
+}
 /**
  * Top-level dispatcher. Picks PKCE localhost vs device-code per the
  * decision tree in the roadmap and persists the result.
@@ -83,6 +112,22 @@ async function cliLogin(opts = {}) {
             baseURL: serverUrl,
         });
         if (brokerResult.ok) {
+            if (brokerResult.brokered) {
+                // Broker-mode hand-off: the daemon served a short-lived access token
+                // from a family IT owns. Nothing credential-shaped is persisted here
+                // — the token lives for this process and the next `skrr` re-redeems
+                // over loopback. An explicit PKCE/device-code login further down
+                // still writes a real user-owned family, unchanged.
+                console.log('');
+                console.log("  This machine is signed in through the platform's managed hand-off.");
+                return {
+                    token: brokerResult.accessToken,
+                    ...(brokerResult.accessExpiresAt !== undefined
+                        ? { expiresAt: brokerResult.accessExpiresAt }
+                        : {}),
+                    flow: 'daemon-broker',
+                };
+            }
             console.log('');
             console.log('  Authorized via the skrr background service on this computer (no browser needed).');
             return {
@@ -132,25 +177,30 @@ async function cliLogin(opts = {}) {
         }
         if (brokerResult.reason === 'base_url_mismatch' && brokerResult.daemonServerUrl) {
             console.log('');
-            console.log(`  The skrr background service on this computer is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
-            console.log(`  Skipping the daemon-broker handoff. Run \`skrr login --base-url ${brokerResult.daemonServerUrl}\` to use the daemon instead.`);
+            console.log(describeBrokerBaseUrlMismatch(brokerResult, serverUrl));
         }
     }
-    if ((0, ssh_detect_1.isNonInteractive)()) {
-        throw new Error(brokerRateLimited
-            ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
-                'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
-                'retry shortly. For CI, use `skrr create-token` and set OVERSKY_TOKEN=osk_ci_...'
-            : 'skrr login requires an interactive terminal or an SSH session. ' +
-                'For CI, use `skrr create-token` and set OVERSKY_TOKEN=osk_ci_...');
-    }
     // --- Decision tree (first match wins) ---
+    //
+    // Device code BEFORE the terminal check (OSK-12117). It needs no terminal of
+    // its own: it prints a URL and a code, a person approves them in any browser,
+    // and this process polls until they do. That is the one way an agent session
+    // or any other shell without a TTY can finish a login, and the refusal below
+    // used to fire first — so `--device-code` was refused for lacking the very
+    // thing it does not use.
     if (opts.forceDeviceCode) {
         return runDeviceCode(serverUrl, cliId, 'user_requested', ssh);
     }
     if (envForce) {
         return runDeviceCode(serverUrl, cliId, 'env_force', ssh);
     }
+    if ((0, ssh_detect_1.isNonInteractive)()) {
+        throw new Error(brokerRateLimited
+            ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
+                'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
+                `retry shortly, or sign in now with ${exports.HEADLESS_LOGIN_HINT}`
+            : `skrr login opens a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`);
+    }
     if (ssh.detected) {
         // Device-code's "open this URL on your laptop" UX is the correct
         // move under SSH — the localhost callback would bind on the remote

package/dist/lib/machine-spend-cap.d.ts

@@ -0,0 +1,23 @@
+/**
+ * The figures behind a machine monthly-cap refusal, for every machine product.
+ *
+ * `RUNTIME_SPENDING_LIMIT_EXCEEDED` carries the cap, this month's spend and
+ * where the refused action would take it, as integer cents in `details`. The
+ * dedicated CLI learned to print them in OSK-9552; the hosted CLI kept printing
+ * the bare sentence, "Projected Hosted Machine usage would exceed the monthly
+ * cap." A person who had just watched `skrr balance show` report a large
+ * balance with overage on then read that as "you have money but we won't take
+ * it" (OSK-11946). The machine cap is a SEPARATE ceiling from the plan
+ * allowance and the credits, and overage does not raise it; without figures and
+ * that sentence nothing on the screen says so.
+ */
+export declare function formatCapCents(cents: number): string;
+/**
+ * `Cap $500.00; spent this month $12.22; this would bring it to $512.22`, or ''
+ * when the body is not a cap refusal or carries no figures.
+ */
+export declare function describeMonthlyCapFigures(body: string | undefined): string;
+/** Whether `body` is a machine monthly-cap refusal at all. */
+export declare function isMonthlyCapRefusal(body: string | undefined): boolean;
+/** The one sentence that says which ceiling this is — and which it is not. */
+export declare const MONTHLY_CAP_IS_SEPARATE = "This is the machine monthly cap, separate from your plan allowance and credits; overage does not raise it.";

package/dist/lib/machine-spend-cap.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * The figures behind a machine monthly-cap refusal, for every machine product.
+ *
+ * `RUNTIME_SPENDING_LIMIT_EXCEEDED` carries the cap, this month's spend and
+ * where the refused action would take it, as integer cents in `details`. The
+ * dedicated CLI learned to print them in OSK-9552; the hosted CLI kept printing
+ * the bare sentence, "Projected Hosted Machine usage would exceed the monthly
+ * cap." A person who had just watched `skrr balance show` report a large
+ * balance with overage on then read that as "you have money but we won't take
+ * it" (OSK-11946). The machine cap is a SEPARATE ceiling from the plan
+ * allowance and the credits, and overage does not raise it; without figures and
+ * that sentence nothing on the screen says so.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MONTHLY_CAP_IS_SEPARATE = void 0;
+exports.formatCapCents = formatCapCents;
+exports.describeMonthlyCapFigures = describeMonthlyCapFigures;
+exports.isMonthlyCapRefusal = isMonthlyCapRefusal;
+function formatCapCents(cents) {
+    const sign = cents < 0 ? '-' : '';
+    return `${sign}$${(Math.abs(cents) / 100).toFixed(2)}`;
+}
+/** The refusal's `code` and `details`, when the body is JSON; null otherwise. */
+function parseRefusal(body) {
+    if (!body)
+        return null;
+    try {
+        const parsed = JSON.parse(body);
+        const details = parsed?.details && typeof parsed.details === 'object' && !Array.isArray(parsed.details)
+            ? parsed.details
+            : undefined;
+        return { code: typeof parsed?.code === 'string' ? parsed.code : undefined, details };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * `Cap $500.00; spent this month $12.22; this would bring it to $512.22`, or ''
+ * when the body is not a cap refusal or carries no figures.
+ */
+function describeMonthlyCapFigures(body) {
+    const refusal = parseRefusal(body);
+    if (refusal?.code !== 'RUNTIME_SPENDING_LIMIT_EXCEEDED' || !refusal.details)
+        return '';
+    const details = refusal.details;
+    const cents = (key) => {
+        const value = details[key];
+        return typeof value === 'number' && Number.isFinite(value) ? value : null;
+    };
+    const limit = cents('limitCents');
+    const spent = cents('currentSpendCents');
+    const projected = cents('projectedCents');
+    return [
+        limit !== null ? `Cap ${formatCapCents(limit)}` : '',
+        spent !== null ? `spent this month ${formatCapCents(spent)}` : '',
+        projected !== null ? `this would bring it to ${formatCapCents(projected)}` : '',
+    ]
+        .filter(Boolean)
+        .join('; ');
+}
+/** Whether `body` is a machine monthly-cap refusal at all. */
+function isMonthlyCapRefusal(body) {
+    return parseRefusal(body)?.code === 'RUNTIME_SPENDING_LIMIT_EXCEEDED';
+}
+/** The one sentence that says which ceiling this is — and which it is not. */
+exports.MONTHLY_CAP_IS_SEPARATE = 'This is the machine monthly cap, separate from your plan allowance and credits; overage does not raise it.';

package/dist/lib/message-intent.js

@@ -11,6 +11,7 @@ exports.canonicalSlackChannelRequest = canonicalSlackChannelRequest;
 exports.canonicalSlackOwnerDmRequest = canonicalSlackOwnerDmRequest;
 exports.rejectAutonomousSlackTarget = rejectAutonomousSlackTarget;
 const auth_core_1 = require("@skrr-ai/auth-core");
+const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
 const api_fetch_1 = require("./api-fetch");
 const daemonBroker_1 = require("./daemonBroker");
 const runtime_context_1 = require("./runtime-context");
@@ -152,7 +153,8 @@ async function submitDaemonLoopbackMessageIntent({ context, request, env, bootst
     });
     try {
         const response = await Promise.race([
-            (fetchImpl || globalThis.fetch)(`http://${bootstrap.host}:${bootstrap.port}/v1/agent/message-intents`, {
+            // The daemon secret and session token stay on loopback (OSK-12134).
+            (fetchImpl || loopback_http_1.loopbackFetch)(`http://${bootstrap.host}:${bootstrap.port}/v1/agent/message-intents`, {
                 method: 'POST',
                 headers: {
                     Authorization: `Bearer ${bootstrap.secret}`,