@skrr-ai/cli 0.1.49 → 0.1.51

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialSession.js

@@ -0,0 +1,66 @@
+/**
+ * credentialSession.ts — the shared credential-lifecycle kernel (policy half).
+ *
+ * A credential lifecycle is policy × mechanism. The policy — serve a cached
+ * token until its expiry-skew window, collapse concurrent acquires onto one
+ * in-flight operation, invalidate on a resource-side 401 — is identical for
+ * every surface and was being re-implemented per consumer (task token-broker,
+ * delegated-cli redemption, the human CLI refresh path). The mechanism —
+ * WHERE the durable secret lives and HOW a token is acquired — legitimately
+ * differs (in-memory daemon family vs file+envelope+lock vs loopback redeem)
+ * and stays behind the `acquire` seam.
+ *
+ * Deliberately thin: no persistence, no retry policy, no logging. Callers
+ * own their store and their error surfaces; this owns the cache/single-
+ * flight/invalidate invariants so they cannot drift between surfaces.
+ */
+const DEFAULT_SKEW_MS = 30_000;
+export function createCredentialSession(opts) {
+    const skewMs = opts.skewMs ?? DEFAULT_SKEW_MS;
+    const now = opts.now ?? Date.now;
+    let cached = null;
+    let inFlight = null;
+    let inFlightForced = false;
+    // Monotonic generation so a superseded in-flight acquire (a forceRefresh
+    // launched while a plain acquire was still running) cannot write its stale
+    // result back over the newer one.
+    let generation = 0;
+    const fresh = (t) => t.expiresAtMs == null || now() < t.expiresAtMs - skewMs;
+    const acquireShared = (force) => {
+        // A forced acquire must not join a non-forced in-flight one — that would
+        // serve the very credential a 401 just invalidated. A forced in-flight
+        // DOES satisfy non-forced waiters: it is already renewing.
+        if (inFlight && (inFlightForced || !force))
+            return inFlight;
+        const gen = ++generation;
+        const p = opts.acquire(force).then((t) => {
+            if (gen === generation)
+                cached = t;
+            return t;
+        });
+        inFlight = p;
+        inFlightForced = force;
+        // `then(cleanup, cleanup)` not `.finally(cleanup)`: finally propagates the
+        // rejection into a derived promise nobody awaits — an unhandledRejection.
+        const cleanup = () => {
+            if (inFlight === p) {
+                inFlight = null;
+                inFlightForced = false;
+            }
+        };
+        p.then(cleanup, cleanup);
+        return p;
+    };
+    return {
+        async getToken(forceRefresh = false) {
+            if (forceRefresh)
+                cached = null;
+            if (cached && fresh(cached))
+                return cached.accessToken;
+            return (await acquireShared(forceRefresh)).accessToken;
+        },
+        invalidate() {
+            cached = null;
+        },
+    };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonToolApproval.d.ts

@@ -0,0 +1,133 @@
+/**
+ * Server-attested tool approval (OSK-11975 follow-up to the `manual` mode
+ * refusal on `daemon:tool:request`).
+ *
+ * A daemon category in `manual` mode means "a PERSON approves each call". On
+ * the harness-session path the daemon asks through the permission bridge; on
+ * the daemon-tool path a cloud agent's call used to be refused outright,
+ * because the request carried no approval and there was no channel back to a
+ * person. The attested-approval protocol closes that gap without weakening
+ * the guarantee:
+ *
+ *   1. The daemon announces `daemon_tool_attested_approval_v1` and its
+ *      resolved per-category posture (`toolPermissionModes`) at register time.
+ *   2. Before proxying a call, the server reads the announced posture for the
+ *      tool's category. `manual` means it must ask first — through the same
+ *      permission surface (`canUseTool` → `permission:request`) an in-process
+ *      SDK turn would have used — and only then dispatch, carrying an
+ *      `attestedApproval` object on the request.
+ *   3. The daemon verifies the attestation's SHAPE and BINDING — it is bound
+ *      to this exact (toolUseId, toolName, toolInput digest) and expires
+ *      quickly — and allows the call. A missing or malformed attestation gets
+ *      the same named refusal as before.
+ *
+ * What the daemon verifies is the binding, not the server's honesty: the
+ * request already arrives over the daemon's authenticated server channel, so
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
+ */
+/** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
+export declare const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = "daemon_tool_attested_approval_v1";
+/**
+ * Announced by a daemon that honours `toolPosture: 'read_only'` on
+ * daemon:tool:request — the daemon-tool-path expression of the wire `plan`
+ * session mode: reads run, every mutating category is refused with a named
+ * reason. Carries INTENT like `browserPolicy: 'read_only'` — the daemon owns
+ * what read-only means, so the server cannot widen the fence by shipping a
+ * wider value.
+ */
+export declare const DAEMON_TOOL_READ_ONLY_CAPABILITY = "daemon_tool_read_only_v1";
+/**
+ * Tool categories the daemon recognizes for permission purposes. This is the
+ * wire vocabulary the daemon's announced `toolPermissionModes` is keyed on —
+ * shared so the server's pre-dispatch check and the daemon's own enforcement
+ * classify a tool name identically (a third map was exactly the drift this
+ * package exists to prevent).
+ */
+export type DaemonToolCategory = 'read' | 'write' | 'bash' | 'browser' | 'claude_session' | 'native_ui';
+export declare const DAEMON_TOOL_CATEGORIES: readonly DaemonToolCategory[];
+/** Map a tool name to its category. Unknown tools take the restrictive answer. */
+export declare function categoryForDaemonTool(toolName: string): DaemonToolCategory;
+/**
+ * The posture a daemon announces per category for the daemon-tool path:
+ *  - `auto`      — the call runs once guardrails pass; no attestation needed
+ *  - `manual`    — the call needs a person; the server must attach a fresh
+ *                  `attestedApproval` or the daemon refuses it
+ *  - `delegated` — the category's own policy decides per action (browser,
+ *                  native UI); asking up front would ask the wrong question
+ */
+export type DaemonToolPathPosture = 'auto' | 'manual' | 'delegated';
+export type DaemonToolPermissionModes = Readonly<Partial<Record<DaemonToolCategory, DaemonToolPathPosture>>>;
+/** The wire field values `toolPosture` accepts. Unknown values must be ignored. */
+export type DaemonToolPosture = 'read_only';
+/**
+ * How long an attestation stays valid. Short: it answers ONE person, about
+ * THIS call, moments ago — it is not a standing grant. The server asks and
+ * dispatches back-to-back, so the window only has to outlive publish latency.
+ */
+export declare const ATTESTED_TOOL_APPROVAL_TTL_MS: number;
+export interface AttestedToolApproval {
+    v: 1;
+    /** Binds the approval to this exact call — a different call gets nothing. */
+    toolUseId: string;
+    toolName: string;
+    /** SHA-256 of the canonical tool input (see `canonicalToolInputDigest`). */
+    inputSha256: string;
+    /** Who answered on the server's permission surface. */
+    decidedBy: 'user';
+    issuedAt: number;
+    expiresAt: number;
+}
+/** The digest both sides compute over `toolInput`. */
+export declare function canonicalToolInputDigest(toolInput: unknown): string;
+/** Server side: mint the attestation after a person approved THIS call. */
+export declare function mintAttestedToolApproval(args: {
+    toolUseId: string;
+    toolName: string;
+    toolInput: unknown;
+    now?: number;
+    ttlMs?: number;
+}): AttestedToolApproval;
+/**
+ * Why an attestation did not approve a call — logged by the daemon, never
+ * shown to the caller beyond "absent" vs "did not verify".
+ *  - `absent`    — no attestation arrived (the server did not ask anyone)
+ *  - `malformed` — not the v1 shape
+ *  - `expired`   — past `expiresAt`, or issued implausibly far in the future
+ *  - `window`    — the issuer claimed a validity window longer than
+ *                  `ATTESTED_TOOL_APPROVAL_TTL_MS` (or an empty/negative one)
+ *  - `binding`   — minted for a different call (toolUseId, tool, or input)
+ *  - `replayed`  — this exact approval was already spent on this daemon
+ *                  (the ledger is the verifier's caller's, see the daemon's
+ *                  `permissions/attestation-ledger.ts`)
+ */
+export type AttestedToolApprovalRefusalReason = 'absent' | 'malformed' | 'binding' | 'expired' | 'window' | 'replayed';
+export type AttestedToolApprovalVerdict = {
+    ok: true;
+} | {
+    ok: false;
+    reason: AttestedToolApprovalRefusalReason;
+};
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+export declare const ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS: number;
+/**
+ * Daemon side: verify an attestation against the call it claims to approve.
+ * Untrusted wire input — every field is checked, and any mismatch is a plain
+ * "no approval", never a partial credit. `reason` is for daemon logs; the
+ * refusal text stays generic so a probing caller learns nothing new.
+ */
+export declare function verifyAttestedToolApproval(approval: unknown, call: {
+    toolUseId: string;
+    toolName: string;
+    toolInput: unknown;
+    now?: number;
+}): AttestedToolApprovalVerdict;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonToolApproval.js

@@ -0,0 +1,182 @@
+import { createHash } from 'node:crypto';
+/**
+ * Server-attested tool approval (OSK-11975 follow-up to the `manual` mode
+ * refusal on `daemon:tool:request`).
+ *
+ * A daemon category in `manual` mode means "a PERSON approves each call". On
+ * the harness-session path the daemon asks through the permission bridge; on
+ * the daemon-tool path a cloud agent's call used to be refused outright,
+ * because the request carried no approval and there was no channel back to a
+ * person. The attested-approval protocol closes that gap without weakening
+ * the guarantee:
+ *
+ *   1. The daemon announces `daemon_tool_attested_approval_v1` and its
+ *      resolved per-category posture (`toolPermissionModes`) at register time.
+ *   2. Before proxying a call, the server reads the announced posture for the
+ *      tool's category. `manual` means it must ask first — through the same
+ *      permission surface (`canUseTool` → `permission:request`) an in-process
+ *      SDK turn would have used — and only then dispatch, carrying an
+ *      `attestedApproval` object on the request.
+ *   3. The daemon verifies the attestation's SHAPE and BINDING — it is bound
+ *      to this exact (toolUseId, toolName, toolInput digest) and expires
+ *      quickly — and allows the call. A missing or malformed attestation gets
+ *      the same named refusal as before.
+ *
+ * What the daemon verifies is the binding, not the server's honesty: the
+ * request already arrives over the daemon's authenticated server channel, so
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
+ */
+/** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
+export const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = 'daemon_tool_attested_approval_v1';
+/**
+ * Announced by a daemon that honours `toolPosture: 'read_only'` on
+ * daemon:tool:request — the daemon-tool-path expression of the wire `plan`
+ * session mode: reads run, every mutating category is refused with a named
+ * reason. Carries INTENT like `browserPolicy: 'read_only'` — the daemon owns
+ * what read-only means, so the server cannot widen the fence by shipping a
+ * wider value.
+ */
+export const DAEMON_TOOL_READ_ONLY_CAPABILITY = 'daemon_tool_read_only_v1';
+export const DAEMON_TOOL_CATEGORIES = [
+    'read',
+    'write',
+    'bash',
+    'browser',
+    'claude_session',
+    'native_ui',
+];
+/** Map a tool name to its category. Unknown tools take the restrictive answer. */
+export function categoryForDaemonTool(toolName) {
+    switch (String(toolName || '').toLowerCase()) {
+        case 'read':
+        case 'glob':
+        case 'grep':
+        case 'filetransferread':
+            return 'read';
+        case 'write':
+        case 'edit':
+        case 'multiedit':
+        case 'apply_patch':
+        case 'filetransferwrite':
+            return 'write';
+        // Reading or stopping a background command is part of running it.
+        case 'bash':
+        case 'taskoutput':
+        case 'taskstop':
+            return 'bash';
+        case 'browser':
+            return 'browser';
+        case 'native':
+            return 'native_ui';
+        case 'claude_session':
+        case 'claude-session':
+            return 'claude_session';
+        default:
+            return 'write';
+    }
+}
+// ---------------------------------------------------------------------------
+// Attested approval
+// ---------------------------------------------------------------------------
+/**
+ * How long an attestation stays valid. Short: it answers ONE person, about
+ * THIS call, moments ago — it is not a standing grant. The server asks and
+ * dispatches back-to-back, so the window only has to outlive publish latency.
+ */
+export const ATTESTED_TOOL_APPROVAL_TTL_MS = 60 * 1000;
+/**
+ * Deterministic serialization for the input digest: objects sort keys
+ * recursively, arrays keep order, non-JSON values normalize the way
+ * `JSON.stringify` would emit them (undefined/functions in objects drop, in
+ * arrays become null). Both runtimes must digest the SAME bytes — the server
+ * mints and the daemon verifies — so this lives here, once.
+ */
+function canonicalJson(value) {
+    if (value === null || typeof value !== 'object') {
+        if (value === undefined || typeof value === 'function' || typeof value === 'symbol') {
+            return 'null';
+        }
+        return JSON.stringify(value);
+    }
+    if (Array.isArray(value)) {
+        return `[${value.map((entry) => canonicalJson(entry)).join(',')}]`;
+    }
+    const record = value;
+    const keys = Object.keys(record).filter((key) => record[key] !== undefined &&
+        typeof record[key] !== 'function' &&
+        typeof record[key] !== 'symbol');
+    keys.sort();
+    return `{${keys.map((key) => `${JSON.stringify(key)}:${canonicalJson(record[key])}`).join(',')}}`;
+}
+/** The digest both sides compute over `toolInput`. */
+export function canonicalToolInputDigest(toolInput) {
+    return createHash('sha256')
+        .update(canonicalJson(toolInput ?? {}))
+        .digest('hex');
+}
+/** Server side: mint the attestation after a person approved THIS call. */
+export function mintAttestedToolApproval(args) {
+    const now = args.now ?? Date.now();
+    return {
+        v: 1,
+        toolUseId: args.toolUseId,
+        toolName: args.toolName,
+        inputSha256: canonicalToolInputDigest(args.toolInput),
+        decidedBy: 'user',
+        issuedAt: now,
+        expiresAt: now + (args.ttlMs ?? ATTESTED_TOOL_APPROVAL_TTL_MS),
+    };
+}
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+export const ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = 30 * 1000;
+/**
+ * Daemon side: verify an attestation against the call it claims to approve.
+ * Untrusted wire input — every field is checked, and any mismatch is a plain
+ * "no approval", never a partial credit. `reason` is for daemon logs; the
+ * refusal text stays generic so a probing caller learns nothing new.
+ */
+export function verifyAttestedToolApproval(approval, call) {
+    if (approval === undefined || approval === null)
+        return { ok: false, reason: 'absent' };
+    if (typeof approval !== 'object' || Array.isArray(approval)) {
+        return { ok: false, reason: 'malformed' };
+    }
+    const a = approval;
+    if (a.v !== 1 ||
+        typeof a.toolUseId !== 'string' ||
+        typeof a.toolName !== 'string' ||
+        typeof a.inputSha256 !== 'string' ||
+        a.decidedBy !== 'user' ||
+        typeof a.issuedAt !== 'number' ||
+        typeof a.expiresAt !== 'number') {
+        return { ok: false, reason: 'malformed' };
+    }
+    const now = call.now ?? Date.now();
+    if (a.expiresAt <= now || a.issuedAt > now + ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS) {
+        return { ok: false, reason: 'expired' };
+    }
+    // The TTL is the VERIFIER's bound, not the issuer's claim (OSK-12108): an
+    // attestation whose own window is longer than one approval may stay valid
+    // is refused whatever `expiresAt` says, so "answers one person about this
+    // call, moments ago" holds even against an issuer that set a year.
+    const window = a.expiresAt - a.issuedAt;
+    if (!(window > 0) || window > ATTESTED_TOOL_APPROVAL_TTL_MS) {
+        return { ok: false, reason: 'window' };
+    }
+    if (a.toolUseId !== call.toolUseId ||
+        a.toolName.toLowerCase() !== String(call.toolName).toLowerCase() ||
+        a.inputSha256 !== canonicalToolInputDigest(call.toolInput)) {
+        return { ok: false, reason: 'binding' };
+    }
+    return { ok: true };
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -585,11 +585,49 @@ export async function enrollWithServer(opts) {
         //     Enrollment is the CLI's (JWT) job; the daemon holding an opaque
         //     token should not enroll. Guarded at the daemon call site, this is
         //     defense-in-depth for any other opaque caller.
-        //   • 409 already-enrolled — a concurrent binary won the enrollment race
-        //     for the shared keypair; idempotent, nothing to do.
+        //   • 409 ALREADY_ENROLLED with OUR thumbprint — a concurrent binary won
+        //     the enrollment race for this keypair; idempotent, nothing to do.
+        //
+        // A 409 is NOT benign when the row is pinned to a DIFFERENT key
+        // (OSK-12063). The server keeps one pin per (user, machine) row while
+        // every local profile has its own key, so a 409 can mean "every refresh
+        // this key signs will be refused with DEVICE_PROOF_THUMBPRINT_MISMATCH".
+        // The server names the pinned thumbprint (`enrolledThumbprint`) so the
+        // two cases can be told apart. An older server that omits it keeps the
+        // old reading, because there is nothing to compare. A 409
+        // ENROLLMENT_DUPLICATE_KEY — this key is pinned on another active row —
+        // is never benign either.
+        let conflictCode = null;
+        let enrolledThumbprint = null;
+        if (response.status === 409) {
+            try {
+                const parsed = JSON.parse(responseText);
+                conflictCode = typeof parsed.code === 'string' ? parsed.code : null;
+                enrolledThumbprint =
+                    typeof parsed.enrolledThumbprint === 'string' ? parsed.enrolledThumbprint : null;
+            }
+            catch {
+                /* non-JSON 409 — treat as the legacy benign race */
+            }
+        }
+        const pinnedToOtherKey = response.status === 409 &&
+            enrolledThumbprint !== null &&
+            enrolledThumbprint !== keypair.thumbprint;
+        const keyPinnedElsewhere = response.status === 409 && conflictCode === 'ENROLLMENT_DUPLICATE_KEY';
         const isBenignRejection = (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) ||
             (response.status === 403 && responseText.includes('OPAQUE_AUTH_REFUSED')) ||
-            response.status === 409;
+            (response.status === 409 && !pinnedToOtherKey && !keyPinnedElsewhere);
+        if (pinnedToOtherKey) {
+            emit('enrollment_key_mismatch', false, {
+                profile,
+                thumbprint: keypair.thumbprint,
+                enrolledThumbprint,
+                serverUrl,
+                message: 'this machine is registered with a different device key than this profile signs ' +
+                    'with; its refreshes will be refused. An interactive daemon login (skrrd login) ' +
+                    're-registers this key.',
+            }, { logLevel: 'warn' });
+        }
         if (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) {
             try {
                 atomicWrite0600(backoffPath, JSON.stringify({

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -29,11 +29,13 @@ export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, K
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export * from './firstPartyHarness.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -118,7 +118,12 @@ export {
 initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, 
 // Test seams — file path resolvers + state setters for spec files.
 __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
+// Hardware machine identity sent as `machineUuid` (IOPlatformUUID /
+// machine-id / MachineGuid). ONE implementation for daemon and CLI —
+// OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
+export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 // Stable per-machine UUIDv7 identity persisted at <configDir>/daemon.id.
+// NOT a `machineUuid` — see machineUuid.ts.
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 // Tier 1 #2 — daemon QR pairing primitives. Pure crypto + AAD framing,
 // shared between the daemon CLI orchestrator (`daemon/src/pair.ts`) and
@@ -140,7 +145,11 @@ export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, har
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+// OSK-12134 — the one proxy-free client for loopback HTTP. Bun's fetch (and
+// Node's under NODE_USE_ENV_PROXY) sends 127.0.0.1 requests to HTTP_PROXY,
+// credentials and all; every loopback caller goes through this instead.
+export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, } from './loopbackHttp.js';
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/loopbackHttp.d.ts

@@ -0,0 +1,32 @@
+/** Upper bound on a buffered response body. Loopback control-plane bodies are small. */
+export declare const LOOPBACK_DEFAULT_MAX_BODY_BYTES: number;
+/** Thrown (synchronously surfaced as a rejection) for a URL that is not loopback HTTP. */
+export declare class LoopbackTargetRefusedError extends Error {
+    readonly code = "LOOPBACK_TARGET_REFUSED";
+    constructor(message: string);
+}
+/** True for an IP literal in 127.0.0.0/8, `::1`, or an IPv4-mapped 127/8 address. */
+export declare function isLoopbackAddress(address: string): boolean;
+/** True for a host name or address this client accepts as "this machine". */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Parse and validate a loopback HTTP URL. Throws {@link LoopbackTargetRefusedError}
+ * for anything that is not `http:` to a loopback host.
+ */
+export declare function assertLoopbackHttpUrl(input: string | URL): URL;
+/**
+ * `RequestInit`, so a `fetch` call site can switch to {@link loopbackFetch}
+ * unchanged. Only `method`, `headers`, `signal` and a string/bytes `body` are
+ * honoured; a stream, Blob or FormData body is rejected rather than guessed at.
+ */
+export interface LoopbackFetchInit extends RequestInit {
+    /** Cap on the buffered response body; exceeding it rejects. */
+    maxBodyBytes?: number;
+}
+/** A `fetch`-shaped signature, for callers that keep a `fetchImpl` seam. */
+export type LoopbackFetch = (input: string | URL, init?: LoopbackFetchInit) => Promise<Response>;
+/**
+ * `fetch` for a loopback URL, over `node:http`, never through a proxy.
+ * Refuses (rejects with {@link LoopbackTargetRefusedError}) any other target.
+ */
+export declare const loopbackFetch: LoopbackFetch;