@skrr-ai/cli 0.1.50 → 0.1.51

package/dist/lib/login.d.ts

@@ -38,6 +38,29 @@ export interface CliLoginWithRefreshTokenOptions {
      */
     cliId: string;
 }
+/**
+ * What a shell with no terminal can do instead (OSK-12117). The refusal used to
+ * name only CI tokens, which is not a sign-in: an agent session asking for one
+ * could only hand the job to a person typing `! skrr login`.
+ */
+export declare const HEADLESS_LOGIN_HINT: string;
+/**
+ * The line printed when the daemon descriptor this CLI found is for another
+ * server (OSK-12117).
+ *
+ * It used to assert "the skrr background service on this computer is logged in
+ * to <url>" and recommend repointing the CLI there. What the CLI actually knows
+ * is narrower: ONE descriptor file it read names that server. That file can
+ * belong to another profile's daemon (observed: a localhost:3080 descriptor
+ * while this machine's default daemon was connected to skrr.ai), and in that
+ * case both the claim and the advice were wrong — the advice by moving a
+ * production CLI onto a development server. So say what was read, from where,
+ * and how to check the daemon itself.
+ */
+export declare function describeBrokerBaseUrlMismatch(failure: {
+    daemonServerUrl?: string;
+    descriptorPath?: string;
+}, serverUrl: string): string;
 /**
  * Top-level dispatcher. Picks PKCE localhost vs device-code per the
  * decision tree in the roadmap and persists the result.

package/dist/lib/login.js

@@ -1,5 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.HEADLESS_LOGIN_HINT = void 0;
+exports.describeBrokerBaseUrlMismatch = describeBrokerBaseUrlMismatch;
 exports.cliLogin = cliLogin;
 exports.cliLoginWithRefreshToken = cliLoginWithRefreshToken;
 /**
@@ -35,6 +37,33 @@ const device_code_1 = require("./device-code");
 const device_identity_1 = require("./device-identity");
 const oauthLogin_1 = require("./oauthLogin");
 const daemonBroker_1 = require("./daemonBroker");
+/**
+ * What a shell with no terminal can do instead (OSK-12117). The refusal used to
+ * name only CI tokens, which is not a sign-in: an agent session asking for one
+ * could only hand the job to a person typing `! skrr login`.
+ */
+exports.HEADLESS_LOGIN_HINT = '`skrr login --device-code` works without a terminal: it prints a URL and a code for a ' +
+    'person to approve in any browser, and finishes when they do. For CI, use ' +
+    '`skrr create-token` and set OVERSKY_TOKEN=osk_ci_...';
+/**
+ * The line printed when the daemon descriptor this CLI found is for another
+ * server (OSK-12117).
+ *
+ * It used to assert "the skrr background service on this computer is logged in
+ * to <url>" and recommend repointing the CLI there. What the CLI actually knows
+ * is narrower: ONE descriptor file it read names that server. That file can
+ * belong to another profile's daemon (observed: a localhost:3080 descriptor
+ * while this machine's default daemon was connected to skrr.ai), and in that
+ * case both the claim and the advice were wrong — the advice by moving a
+ * production CLI onto a development server. So say what was read, from where,
+ * and how to check the daemon itself.
+ */
+function describeBrokerBaseUrlMismatch(failure, serverUrl) {
+    const where = failure.descriptorPath ? ` (${failure.descriptorPath})` : '';
+    return (`  Skipped the daemon hand-off: the daemon descriptor found${where} is for ` +
+        `${failure.daemonServerUrl}, not ${serverUrl}. It may belong to a different profile's ` +
+        'daemon; `skrr daemon status` shows which server this profile’s daemon is on.');
+}
 /**
  * Top-level dispatcher. Picks PKCE localhost vs device-code per the
  * decision tree in the roadmap and persists the result.
@@ -148,25 +177,30 @@ async function cliLogin(opts = {}) {
         }
         if (brokerResult.reason === 'base_url_mismatch' && brokerResult.daemonServerUrl) {
             console.log('');
-            console.log(`  The skrr background service on this computer is logged in to ${brokerResult.daemonServerUrl}, but skrr is configured for ${serverUrl}.`);
-            console.log(`  Skipping the daemon-broker handoff. Run \`skrr login --base-url ${brokerResult.daemonServerUrl}\` to use the daemon instead.`);
+            console.log(describeBrokerBaseUrlMismatch(brokerResult, serverUrl));
         }
     }
-    if ((0, ssh_detect_1.isNonInteractive)()) {
-        throw new Error(brokerRateLimited
-            ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
-                'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
-                'retry shortly. For CI, use `skrr create-token` and set OVERSKY_TOKEN=osk_ci_...'
-            : 'skrr login requires an interactive terminal or an SSH session. ' +
-                'For CI, use `skrr create-token` and set OVERSKY_TOKEN=osk_ci_...');
-    }
     // --- Decision tree (first match wins) ---
+    //
+    // Device code BEFORE the terminal check (OSK-12117). It needs no terminal of
+    // its own: it prints a URL and a code, a person approves them in any browser,
+    // and this process polls until they do. That is the one way an agent session
+    // or any other shell without a TTY can finish a login, and the refusal below
+    // used to fire first — so `--device-code` was refused for lacking the very
+    // thing it does not use.
     if (opts.forceDeviceCode) {
         return runDeviceCode(serverUrl, cliId, 'user_requested', ssh);
     }
     if (envForce) {
         return runDeviceCode(serverUrl, cliId, 'env_force', ssh);
     }
+    if ((0, ssh_detect_1.isNonInteractive)()) {
+        throw new Error(brokerRateLimited
+            ? 'The skrr background service on this computer is being rate-limited while brokering logins, and this ' +
+                'shell cannot run the browser flow instead. The limit is per 15-minute window — ' +
+                `retry shortly, or sign in now with ${exports.HEADLESS_LOGIN_HINT}`
+            : `skrr login opens a browser, and this shell has no terminal to run it from. ${exports.HEADLESS_LOGIN_HINT}`);
+    }
     if (ssh.detected) {
         // Device-code's "open this URL on your laptop" UX is the correct
         // move under SSH — the localhost callback would bind on the remote

package/dist/lib/message-intent.js

@@ -11,6 +11,7 @@ exports.canonicalSlackChannelRequest = canonicalSlackChannelRequest;
 exports.canonicalSlackOwnerDmRequest = canonicalSlackOwnerDmRequest;
 exports.rejectAutonomousSlackTarget = rejectAutonomousSlackTarget;
 const auth_core_1 = require("@skrr-ai/auth-core");
+const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
 const api_fetch_1 = require("./api-fetch");
 const daemonBroker_1 = require("./daemonBroker");
 const runtime_context_1 = require("./runtime-context");
@@ -152,7 +153,8 @@ async function submitDaemonLoopbackMessageIntent({ context, request, env, bootst
     });
     try {
         const response = await Promise.race([
-            (fetchImpl || globalThis.fetch)(`http://${bootstrap.host}:${bootstrap.port}/v1/agent/message-intents`, {
+            // The daemon secret and session token stay on loopback (OSK-12134).
+            (fetchImpl || loopback_http_1.loopbackFetch)(`http://${bootstrap.host}:${bootstrap.port}/v1/agent/message-intents`, {
                 method: 'POST',
                 headers: {
                     Authorization: `Bearer ${bootstrap.secret}`,

package/dist/lib/tasks.d.ts

@@ -8,6 +8,25 @@ import type { ParsedDeliverableCoordinate, ParsedExpectationSpec } from '@skrr-a
  */
 export declare function resolveTaskGoalFlag(value: string | undefined): string | null | undefined;
 export declare const TASK_GOAL_NOT_FOUND = "TASK_GOAL_NOT_FOUND";
+/**
+ * `--working-directory` on `tasks create` / `update` / `upsert`. `none`,
+ * `null` and `clear` mean "no per-task override": on update the PATCH sends
+ * `workingDirectory: null` ($unset → inherit the agent default), on create it
+ * stores as absent. The sentinel set mirrors `resolveTaskGoalFlag` — it is the
+ * spelling a user who knows `--goal none` reaches for.
+ * Undefined means the flag was not passed.
+ */
+export declare function workingDirectoryFromFlag(value: string | undefined): string | null | undefined;
+/**
+ * Validate a RESOLVED `workingDirectory` payload value (post-merge, so flag
+ * and `--from-json` inputs are checked identically). `null`/`undefined` are
+ * always fine — they mean "no override". A string must be absolute: the path
+ * is resolved on the daemon's filesystem, so a relative value can neither be
+ * verified here nor trusted there — it would fall back, silently, at run
+ * time. Failing here is the same contract as every other bad spec in this
+ * file: refuse before the write, never store a value that cannot take effect.
+ */
+export declare function workingDirectoryValidationError(value: unknown): string | null;
 /**
  * The refusal for a goal id that names no goal, in CLI terms.
  *
@@ -91,6 +110,7 @@ export type TaskCreateFlagValues = {
     estimate?: number;
     tag?: string[];
     'label-id'?: string[];
+    'working-directory'?: string;
     worktree?: boolean;
     'lifecycle-definition'?: string;
     'lifecycle-version'?: string;

package/dist/lib/tasks.js

@@ -2,6 +2,8 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.RECOGNIZED_TASK_VERDICTS = exports.DELIVERABLE_LIFECYCLE_VALUES = exports.EXPECT_FLAG_HELP = exports.TASK_WORK_EVENT_KINDS = exports.TASK_PRIORITIES = exports.TASK_GOAL_NOT_FOUND = void 0;
 exports.resolveTaskGoalFlag = resolveTaskGoalFlag;
+exports.workingDirectoryFromFlag = workingDirectoryFromFlag;
+exports.workingDirectoryValidationError = workingDirectoryValidationError;
 exports.describeTaskGoalNotFound = describeTaskGoalNotFound;
 exports.releasePinRepairGuard = releasePinRepairGuard;
 exports.taskUpdateMutationGuard = taskUpdateMutationGuard;
@@ -38,6 +40,7 @@ exports.verdictIsRecognized = verdictIsRecognized;
 const data_provider_1 = require("@skrr-ai/data-provider");
 const prompt_1 = require("./prompt");
 const projects_1 = require("./projects");
+const node_path_1 = require("node:path");
 /**
  * `--goal` on `tasks update`. `none`, `null` and `clear` detach the goal: PATCH
  * sends `goalId: null`. Anything else names a goal. `clear` is accepted because
@@ -54,6 +57,47 @@ function resolveTaskGoalFlag(value) {
     return v;
 }
 exports.TASK_GOAL_NOT_FOUND = 'TASK_GOAL_NOT_FOUND';
+/**
+ * `--working-directory` on `tasks create` / `update` / `upsert`. `none`,
+ * `null` and `clear` mean "no per-task override": on update the PATCH sends
+ * `workingDirectory: null` ($unset → inherit the agent default), on create it
+ * stores as absent. The sentinel set mirrors `resolveTaskGoalFlag` — it is the
+ * spelling a user who knows `--goal none` reaches for.
+ * Undefined means the flag was not passed.
+ */
+function workingDirectoryFromFlag(value) {
+    if (value === undefined)
+        return undefined;
+    const v = value.trim();
+    if (!v || ['none', 'null', 'clear'].includes(v.toLowerCase()))
+        return null;
+    return v;
+}
+/**
+ * Validate a RESOLVED `workingDirectory` payload value (post-merge, so flag
+ * and `--from-json` inputs are checked identically). `null`/`undefined` are
+ * always fine — they mean "no override". A string must be absolute: the path
+ * is resolved on the daemon's filesystem, so a relative value can neither be
+ * verified here nor trusted there — it would fall back, silently, at run
+ * time. Failing here is the same contract as every other bad spec in this
+ * file: refuse before the write, never store a value that cannot take effect.
+ */
+function workingDirectoryValidationError(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (typeof value !== 'string' || !value.trim()) {
+        return 'workingDirectory must be an absolute path string (or null for no override)';
+    }
+    if (value.length > 1024) {
+        return 'workingDirectory must be at most 1024 characters';
+    }
+    if (!(0, node_path_1.isAbsolute)(value.trim())) {
+        return (`workingDirectory must be an absolute path on the daemon's filesystem ` +
+            `(got '${value}'). ` +
+            'A relative path cannot be resolved there — pass the full path, or "none" to clear.');
+    }
+    return null;
+}
 /**
  * The refusal for a goal id that names no goal, in CLI terms.
  *
@@ -331,6 +375,8 @@ function buildTaskCreatePayload(body, flags = {}) {
         // is a Task→Task edge rather than a pointer at a chat message.
         spawnedByTaskId: flags['spawned-by'],
         spawnReason: flags['spawn-reason'],
+        // Per-task working-directory override; 'none' ⇒ null (no override).
+        workingDirectory: workingDirectoryFromFlag(flags['working-directory']),
         // Worktree isolation opt-in. --worktree ⇒ 'ephemeral', --no-worktree ⇒
         // 'shared', omitted ⇒ undefined (inherit space policy / global default).
         executionIsolation: executionIsolationFromWorktreeFlag(flags.worktree),
@@ -409,6 +455,9 @@ function validateTaskCreatePayload(payload) {
     if (payload.templateId !== undefined && !isBoundedString(payload.templateId, 1, 100)) {
         errors.push('templateId must be a non-empty string at most 100 characters');
     }
+    const workingDirectoryError = workingDirectoryValidationError(payload.workingDirectory);
+    if (workingDirectoryError)
+        errors.push(workingDirectoryError);
     if (payload.lifecycle !== undefined) {
         const binding = payload.lifecycle;
         if (!binding || typeof binding !== 'object' || Array.isArray(binding)) {
@@ -756,6 +805,11 @@ function createPatchFromCreatePayload(payload) {
         'executionMode',
         'tags',
         'labelIds',
+        // Per-task working-directory override — part of the same execution shape
+        // the create payload carries, and equally meaningful on the update leg of
+        // an upsert. Absent here, `upsert --working-directory` silently no-ops on
+        // an existing task.
+        'workingDirectory',
     ];
     for (const field of copyFields) {
         if (payload[field] !== undefined)

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.d.ts

@@ -21,6 +21,8 @@ type DisabledReason = 'kek_unavailable' | 'init_failed' | 'platform_unsupported'
 export declare function __setStateForTest(next: CredEnvelopeState): CredEnvelopeState;
 /** @internal Test seam — read state for assertions. */
 export declare function __getStateForTest(): CredEnvelopeState;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+export declare function __clearWarnDedupeForTest(): void;
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.__setStateForTest = __setStateForTest;
 exports.__getStateForTest = __getStateForTest;
+exports.__clearWarnDedupeForTest = __clearWarnDedupeForTest;
 exports.initCredEnvelope = initCredEnvelope;
 exports.resetCredEnvelope = resetCredEnvelope;
 exports.shutdownCredEnvelope = shutdownCredEnvelope;
@@ -141,7 +142,21 @@ function atomicWrite0600(target, value) {
  * The event name passed in is the FULLY-QUALIFIED `cred_envelope.*` form
  * because daemon-side telemetry consumers (`event-log.ts`, dashboards,
  * spec assertions) key off the prefixed name. Do not strip the prefix.
+ *
+ * Identical failure warnings hit the logger only once per process.
+ * Telemetry still records every occurrence — the dedupe exists because a
+ * single unreadable envelope produced the same warning once per stored
+ * field (token, refresh token, expiry…), which read to users as three
+ * crashes rather than one stale credential (OSK-12074). The signature is
+ * event + kek identity + message, so a genuinely different failure mode
+ * still gets its own line.
  */
+const warnedSignatures = new Set();
+const MAX_WARNED_SIGNATURES = 64;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+function __clearWarnDedupeForTest() {
+    warnedSignatures.clear();
+}
 function emit(eventName, success, metadata) {
     (0, runtime_js_1.emitAuthTelemetry)({
         timestamp: new Date().toISOString(),
@@ -150,7 +165,13 @@ function emit(eventName, success, metadata) {
         metadata: { event: eventName, ...metadata },
     });
     if (!success) {
-        (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] ${eventName}`, metadata);
+        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}`;
+        if (!warnedSignatures.has(signature)) {
+            if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
+                warnedSignatures.clear();
+            warnedSignatures.add(signature);
+            (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] ${eventName}`, metadata);
+        }
     }
 }
 // ---------------------------------------------------------------------------
@@ -763,6 +784,10 @@ function maybeDecryptOnRead(stored) {
                 kekId: _state.kekId,
                 kekKind: _state.kekKind,
                 message: err?.message ?? 'unknown',
+                // The crypto error alone reads as a crash; the actionable truth is
+                // that this stored credential is unreadable by THIS binary (usually
+                // a signing-identity or profile drift) and re-login rebuilds it.
+                hint: 'stored credential is unreadable on this machine — signing in again rebuilds it',
             });
             return { plaintext: null, needsMigration: false };
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonToolApproval.d.ts

@@ -23,9 +23,14 @@
  *
  * What the daemon verifies is the binding, not the server's honesty: the
  * request already arrives over the daemon's authenticated server channel, so
- * the field IS the attestation. What the binding buys is that the model —
- * which authors `toolInput` — cannot mint an approval, and an approval for
- * one call cannot be replayed onto another.
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 export declare const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = "daemon_tool_attested_approval_v1";
@@ -89,12 +94,31 @@ export declare function mintAttestedToolApproval(args: {
     now?: number;
     ttlMs?: number;
 }): AttestedToolApproval;
+/**
+ * Why an attestation did not approve a call — logged by the daemon, never
+ * shown to the caller beyond "absent" vs "did not verify".
+ *  - `absent`    — no attestation arrived (the server did not ask anyone)
+ *  - `malformed` — not the v1 shape
+ *  - `expired`   — past `expiresAt`, or issued implausibly far in the future
+ *  - `window`    — the issuer claimed a validity window longer than
+ *                  `ATTESTED_TOOL_APPROVAL_TTL_MS` (or an empty/negative one)
+ *  - `binding`   — minted for a different call (toolUseId, tool, or input)
+ *  - `replayed`  — this exact approval was already spent on this daemon
+ *                  (the ledger is the verifier's caller's, see the daemon's
+ *                  `permissions/attestation-ledger.ts`)
+ */
+export type AttestedToolApprovalRefusalReason = 'absent' | 'malformed' | 'binding' | 'expired' | 'window' | 'replayed';
 export type AttestedToolApprovalVerdict = {
     ok: true;
 } | {
     ok: false;
-    reason: 'absent' | 'malformed' | 'binding' | 'expired';
+    reason: AttestedToolApprovalRefusalReason;
 };
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+export declare const ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS: number;
 /**
  * Daemon side: verify an attestation against the call it claims to approve.
  * Untrusted wire input — every field is checked, and any mismatch is a plain

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/daemonToolApproval.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ATTESTED_TOOL_APPROVAL_TTL_MS = exports.DAEMON_TOOL_CATEGORIES = exports.DAEMON_TOOL_READ_ONLY_CAPABILITY = exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = void 0;
+exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = exports.ATTESTED_TOOL_APPROVAL_TTL_MS = exports.DAEMON_TOOL_CATEGORIES = exports.DAEMON_TOOL_READ_ONLY_CAPABILITY = exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = void 0;
 exports.categoryForDaemonTool = categoryForDaemonTool;
 exports.canonicalToolInputDigest = canonicalToolInputDigest;
 exports.mintAttestedToolApproval = mintAttestedToolApproval;
@@ -31,9 +31,14 @@ const node_crypto_1 = require("node:crypto");
  *
  * What the daemon verifies is the binding, not the server's honesty: the
  * request already arrives over the daemon's authenticated server channel, so
- * the field IS the attestation. What the binding buys is that the model —
- * which authors `toolInput` — cannot mint an approval, and an approval for
- * one call cannot be replayed onto another.
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 exports.DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = 'daemon_tool_attested_approval_v1';
@@ -136,6 +141,11 @@ function mintAttestedToolApproval(args) {
         expiresAt: now + (args.ttlMs ?? exports.ATTESTED_TOOL_APPROVAL_TTL_MS),
     };
 }
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = 30 * 1000;
 /**
  * Daemon side: verify an attestation against the call it claims to approve.
  * Untrusted wire input — every field is checked, and any mismatch is a plain
@@ -159,9 +169,17 @@ function verifyAttestedToolApproval(approval, call) {
         return { ok: false, reason: 'malformed' };
     }
     const now = call.now ?? Date.now();
-    if (a.expiresAt <= now || a.issuedAt > now + 30_000) {
+    if (a.expiresAt <= now || a.issuedAt > now + exports.ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS) {
         return { ok: false, reason: 'expired' };
     }
+    // The TTL is the VERIFIER's bound, not the issuer's claim (OSK-12108): an
+    // attestation whose own window is longer than one approval may stay valid
+    // is refused whatever `expiresAt` says, so "answers one person about this
+    // call, moments ago" holds even against an issuer that set a year.
+    const window = a.expiresAt - a.issuedAt;
+    if (!(window > 0) || window > exports.ATTESTED_TOOL_APPROVAL_TTL_MS) {
+        return { ok: false, reason: 'window' };
+    }
     if (a.toolUseId !== call.toolUseId ||
         a.toolName.toLowerCase() !== String(call.toolName).toLowerCase() ||
         a.inputSha256 !== canonicalToolInputDigest(call.toolInput)) {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -604,11 +604,49 @@ async function enrollWithServer(opts) {
         //     Enrollment is the CLI's (JWT) job; the daemon holding an opaque
         //     token should not enroll. Guarded at the daemon call site, this is
         //     defense-in-depth for any other opaque caller.
-        //   • 409 already-enrolled — a concurrent binary won the enrollment race
-        //     for the shared keypair; idempotent, nothing to do.
+        //   • 409 ALREADY_ENROLLED with OUR thumbprint — a concurrent binary won
+        //     the enrollment race for this keypair; idempotent, nothing to do.
+        //
+        // A 409 is NOT benign when the row is pinned to a DIFFERENT key
+        // (OSK-12063). The server keeps one pin per (user, machine) row while
+        // every local profile has its own key, so a 409 can mean "every refresh
+        // this key signs will be refused with DEVICE_PROOF_THUMBPRINT_MISMATCH".
+        // The server names the pinned thumbprint (`enrolledThumbprint`) so the
+        // two cases can be told apart. An older server that omits it keeps the
+        // old reading, because there is nothing to compare. A 409
+        // ENROLLMENT_DUPLICATE_KEY — this key is pinned on another active row —
+        // is never benign either.
+        let conflictCode = null;
+        let enrolledThumbprint = null;
+        if (response.status === 409) {
+            try {
+                const parsed = JSON.parse(responseText);
+                conflictCode = typeof parsed.code === 'string' ? parsed.code : null;
+                enrolledThumbprint =
+                    typeof parsed.enrolledThumbprint === 'string' ? parsed.enrolledThumbprint : null;
+            }
+            catch {
+                /* non-JSON 409 — treat as the legacy benign race */
+            }
+        }
+        const pinnedToOtherKey = response.status === 409 &&
+            enrolledThumbprint !== null &&
+            enrolledThumbprint !== keypair.thumbprint;
+        const keyPinnedElsewhere = response.status === 409 && conflictCode === 'ENROLLMENT_DUPLICATE_KEY';
         const isBenignRejection = (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) ||
             (response.status === 403 && responseText.includes('OPAQUE_AUTH_REFUSED')) ||
-            response.status === 409;
+            (response.status === 409 && !pinnedToOtherKey && !keyPinnedElsewhere);
+        if (pinnedToOtherKey) {
+            emit('enrollment_key_mismatch', false, {
+                profile,
+                thumbprint: keypair.thumbprint,
+                enrolledThumbprint,
+                serverUrl,
+                message: 'this machine is registered with a different device key than this profile signs ' +
+                    'with; its refreshes will be refused. An interactive daemon login (skrrd login) ' +
+                    're-registers this key.',
+            }, { logLevel: 'warn' });
+        }
         if (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) {
             try {
                 atomicWrite0600(backoffPath, JSON.stringify({

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -29,11 +29,13 @@ export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, K
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export * from './firstPartyHarness.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -24,9 +24,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = void 0;
-exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
-exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = void 0;
+exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
+exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -258,7 +258,16 @@ Object.defineProperty(exports, "__enrollmentMarkerPathForTest", { enumerable: tr
 Object.defineProperty(exports, "__enrollmentBackoffPathForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__enrollmentBackoffPathForTest; } });
 Object.defineProperty(exports, "__setDeviceIdentityStateForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__setStateForTest; } });
 Object.defineProperty(exports, "__getDeviceIdentityStateForTest", { enumerable: true, get: function () { return deviceIdentityBridge_js_1.__getStateForTest; } });
+// Hardware machine identity sent as `machineUuid` (IOPlatformUUID /
+// machine-id / MachineGuid). ONE implementation for daemon and CLI —
+// OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
+var machineUuid_js_1 = require("./machineUuid.js");
+Object.defineProperty(exports, "getMachineUuid", { enumerable: true, get: function () { return machineUuid_js_1.getMachineUuid; } });
+Object.defineProperty(exports, "hostedRuntimeIdOverride", { enumerable: true, get: function () { return machineUuid_js_1.hostedRuntimeIdOverride; } });
+Object.defineProperty(exports, "HOSTED_RUNTIME_MACHINE_SOURCES", { enumerable: true, get: function () { return machineUuid_js_1.HOSTED_RUNTIME_MACHINE_SOURCES; } });
+Object.defineProperty(exports, "__resetMachineUuidCacheForTest", { enumerable: true, get: function () { return machineUuid_js_1.__resetMachineUuidCacheForTest; } });
 // Stable per-machine UUIDv7 identity persisted at <configDir>/daemon.id.
+// NOT a `machineUuid` — see machineUuid.ts.
 var machineId_js_1 = require("./machineId.js");
 Object.defineProperty(exports, "ensureMachineDaemonId", { enumerable: true, get: function () { return machineId_js_1.ensureMachineDaemonId; } });
 Object.defineProperty(exports, "legacyDaemonUuids", { enumerable: true, get: function () { return machineId_js_1.legacyDaemonUuids; } });
@@ -316,6 +325,19 @@ Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get
 Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_NAME_TOKENS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_NAME_TOKENS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
+Object.defineProperty(exports, "LOOPBACK_NO_PROXY_HOSTS", { enumerable: true, get: function () { return spawnEnv_js_1.LOOPBACK_NO_PROXY_HOSTS; } });
+Object.defineProperty(exports, "envHasProxy", { enumerable: true, get: function () { return spawnEnv_js_1.envHasProxy; } });
+Object.defineProperty(exports, "withLoopbackNoProxy", { enumerable: true, get: function () { return spawnEnv_js_1.withLoopbackNoProxy; } });
+// OSK-12134 — the one proxy-free client for loopback HTTP. Bun's fetch (and
+// Node's under NODE_USE_ENV_PROXY) sends 127.0.0.1 requests to HTTP_PROXY,
+// credentials and all; every loopback caller goes through this instead.
+var loopbackHttp_js_1 = require("./loopbackHttp.js");
+Object.defineProperty(exports, "loopbackFetch", { enumerable: true, get: function () { return loopbackHttp_js_1.loopbackFetch; } });
+Object.defineProperty(exports, "assertLoopbackHttpUrl", { enumerable: true, get: function () { return loopbackHttp_js_1.assertLoopbackHttpUrl; } });
+Object.defineProperty(exports, "isLoopbackHostname", { enumerable: true, get: function () { return loopbackHttp_js_1.isLoopbackHostname; } });
+Object.defineProperty(exports, "isLoopbackAddress", { enumerable: true, get: function () { return loopbackHttp_js_1.isLoopbackAddress; } });
+Object.defineProperty(exports, "LoopbackTargetRefusedError", { enumerable: true, get: function () { return loopbackHttp_js_1.LoopbackTargetRefusedError; } });
+Object.defineProperty(exports, "LOOPBACK_DEFAULT_MAX_BODY_BYTES", { enumerable: true, get: function () { return loopbackHttp_js_1.LOOPBACK_DEFAULT_MAX_BODY_BYTES; } });
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */
 var localIdentity_js_1 = require("./localIdentity.js");

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/loopbackHttp.d.ts

@@ -0,0 +1,32 @@
+/** Upper bound on a buffered response body. Loopback control-plane bodies are small. */
+export declare const LOOPBACK_DEFAULT_MAX_BODY_BYTES: number;
+/** Thrown (synchronously surfaced as a rejection) for a URL that is not loopback HTTP. */
+export declare class LoopbackTargetRefusedError extends Error {
+    readonly code = "LOOPBACK_TARGET_REFUSED";
+    constructor(message: string);
+}
+/** True for an IP literal in 127.0.0.0/8, `::1`, or an IPv4-mapped 127/8 address. */
+export declare function isLoopbackAddress(address: string): boolean;
+/** True for a host name or address this client accepts as "this machine". */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Parse and validate a loopback HTTP URL. Throws {@link LoopbackTargetRefusedError}
+ * for anything that is not `http:` to a loopback host.
+ */
+export declare function assertLoopbackHttpUrl(input: string | URL): URL;
+/**
+ * `RequestInit`, so a `fetch` call site can switch to {@link loopbackFetch}
+ * unchanged. Only `method`, `headers`, `signal` and a string/bytes `body` are
+ * honoured; a stream, Blob or FormData body is rejected rather than guessed at.
+ */
+export interface LoopbackFetchInit extends RequestInit {
+    /** Cap on the buffered response body; exceeding it rejects. */
+    maxBodyBytes?: number;
+}
+/** A `fetch`-shaped signature, for callers that keep a `fetchImpl` seam. */
+export type LoopbackFetch = (input: string | URL, init?: LoopbackFetchInit) => Promise<Response>;
+/**
+ * `fetch` for a loopback URL, over `node:http`, never through a proxy.
+ * Refuses (rejects with {@link LoopbackTargetRefusedError}) any other target.
+ */
+export declare const loopbackFetch: LoopbackFetch;