@skrr-ai/cli 0.1.50 → 0.1.51

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/loopbackHttp.js

@@ -0,0 +1,268 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loopbackFetch = exports.LoopbackTargetRefusedError = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = void 0;
+exports.isLoopbackAddress = isLoopbackAddress;
+exports.isLoopbackHostname = isLoopbackHostname;
+exports.assertLoopbackHttpUrl = assertLoopbackHttpUrl;
+/**
+ * OSK-12134 — the ONE HTTP client for talking to a process on this machine.
+ *
+ * ── Why this is not `fetch` ────────────────────────────────────────────────
+ *
+ * The compiled daemon runs on Bun, and Bun's `fetch` routes EVERY URL through
+ * `HTTP_PROXY` / `HTTPS_PROXY` unless `NO_PROXY` names it — a `127.0.0.1`
+ * target included. Node's `fetch` does the same once `NODE_USE_ENV_PROXY=1` is
+ * set (Node 22.21+/24). On a laptop with a local proxy exported in the shell
+ * (Clash, Surge, a corporate agent, …) every loopback call the daemon, a
+ * wrapper, or the CLI made with `fetch` was delivered to that proxy instead —
+ * WITH its credential: the daemon's local secret, the CLI-handoff descriptor
+ * secret, the wrapper fan-out bearer, the browser bridge token, the extension
+ * relay token. OSK-12087 found this on the `/health` probe and moved that one
+ * caller to `node:http`; this module is that fix made the only way to do it.
+ *
+ * `node:http` never consults proxy environment variables, on Node or on Bun, so
+ * a request made through it cannot be routed off the machine by environment.
+ *
+ * ── What it refuses ────────────────────────────────────────────────────────
+ *
+ * Only `http:` URLs whose host is a loopback name or address are accepted
+ * (`127.0.0.0/8`, `::1`, `localhost`). Anything else throws BEFORE a socket is
+ * opened: a caller that builds its URL from a descriptor or an environment
+ * variable must not be turned into an SSRF primitive by a hostile value, and a
+ * credential that is only meant for this machine must not be sent anywhere
+ * else. `localhost` is resolved through a lookup that rejects any non-loopback
+ * answer, so a rewritten hosts file cannot redirect it either.
+ *
+ * ── Shape ──────────────────────────────────────────────────────────────────
+ *
+ * `loopbackFetch` is a drop-in for the subset of `fetch` these callers use —
+ * method, headers, a string/bytes body, an `AbortSignal` — and returns a real
+ * `Response`, so existing callers (and their `fetchImpl` test seams) change one
+ * identifier. Transport failures reject with `TypeError('fetch failed')` whose
+ * `cause` carries the socket error (`ECONNREFUSED`, …), and aborts reject with
+ * the signal's reason, exactly as `fetch` does, so existing error handling keeps
+ * working. The response body is buffered (bounded by `maxBodyBytes`); nothing
+ * on loopback streams through this client.
+ */
+const node_dns_1 = __importDefault(require("node:dns"));
+const node_http_1 = __importDefault(require("node:http"));
+const node_net_1 = __importDefault(require("node:net"));
+/** Loopback host names this client will connect to, besides 127/8 and ::1 literals. */
+const LOOPBACK_NAMES = new Set(['localhost']);
+/** Upper bound on a buffered response body. Loopback control-plane bodies are small. */
+exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = 16 * 1024 * 1024;
+/** Statuses a `Response` must be constructed with a null body for. */
+const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
+/** Thrown (synchronously surfaced as a rejection) for a URL that is not loopback HTTP. */
+class LoopbackTargetRefusedError extends Error {
+    code = 'LOOPBACK_TARGET_REFUSED';
+    constructor(message) {
+        super(message);
+        this.name = 'LoopbackTargetRefusedError';
+    }
+}
+exports.LoopbackTargetRefusedError = LoopbackTargetRefusedError;
+function stripBrackets(hostname) {
+    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+}
+/** True for an IP literal in 127.0.0.0/8, `::1`, or an IPv4-mapped 127/8 address. */
+function isLoopbackAddress(address) {
+    const value = stripBrackets(address.trim().toLowerCase());
+    if (node_net_1.default.isIPv4(value))
+        return value.split('.')[0] === '127';
+    if (node_net_1.default.isIPv6(value)) {
+        if (value === '::1' || value === '0:0:0:0:0:0:0:1')
+            return true;
+        // IPv4-mapped (::ffff:127.0.0.1, which WHATWG URL normalizes to ::ffff:7f00:1).
+        if (value.startsWith('::ffff:')) {
+            const rest = value.slice('::ffff:'.length);
+            if (node_net_1.default.isIPv4(rest))
+                return isLoopbackAddress(rest);
+            const high = /^([0-9a-f]{1,4}):[0-9a-f]{1,4}$/.exec(rest);
+            return high ? parseInt(high[1], 16) >> 8 === 127 : false;
+        }
+        return false;
+    }
+    return false;
+}
+/** True for a host name or address this client accepts as "this machine". */
+function isLoopbackHostname(hostname) {
+    const value = stripBrackets(hostname.trim().toLowerCase());
+    return LOOPBACK_NAMES.has(value) || isLoopbackAddress(value);
+}
+/**
+ * Parse and validate a loopback HTTP URL. Throws {@link LoopbackTargetRefusedError}
+ * for anything that is not `http:` to a loopback host.
+ */
+function assertLoopbackHttpUrl(input) {
+    let url;
+    try {
+        url = new URL(String(input));
+    }
+    catch {
+        throw new LoopbackTargetRefusedError('Loopback request refused: not a valid URL.');
+    }
+    if (url.protocol !== 'http:') {
+        throw new LoopbackTargetRefusedError(`Loopback request refused: only http: is allowed on loopback (got ${url.protocol}).`);
+    }
+    if (!isLoopbackHostname(url.hostname)) {
+        throw new LoopbackTargetRefusedError(`Loopback request refused: ${url.hostname} is not a loopback host.`);
+    }
+    if (url.username || url.password) {
+        throw new LoopbackTargetRefusedError('Loopback request refused: URL must not carry userinfo.');
+    }
+    return url;
+}
+/** A `dns.lookup` that only ever answers with a loopback address. */
+const loopbackOnlyLookup = (hostname, options, callback) => {
+    node_dns_1.default.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+        if (err) {
+            callback(err, '', 0);
+            return;
+        }
+        const list = (Array.isArray(addresses) ? addresses : []);
+        const loopback = list.filter((entry) => isLoopbackAddress(entry.address));
+        if (loopback.length === 0) {
+            const refused = Object.assign(new Error(`${hostname} did not resolve to a loopback address`), { code: 'LOOPBACK_TARGET_REFUSED' });
+            callback(refused, '', 0);
+            return;
+        }
+        if (options?.all) {
+            callback(null, loopback);
+            return;
+        }
+        callback(null, loopback[0].address, loopback[0].family);
+    });
+};
+function abortReason(signal) {
+    return signal.reason !== undefined
+        ? signal.reason
+        : new DOMException('This operation was aborted', 'AbortError');
+}
+function fetchFailed(cause) {
+    return new TypeError('fetch failed', { cause });
+}
+function toBodyBuffer(body) {
+    if (body === undefined || body === null)
+        return null;
+    if (typeof body === 'string')
+        return Buffer.from(body, 'utf8');
+    if (body instanceof ArrayBuffer)
+        return Buffer.from(body);
+    if (ArrayBuffer.isView(body))
+        return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+    throw new TypeError('loopbackFetch supports only string or byte bodies');
+}
+/**
+ * `fetch` for a loopback URL, over `node:http`, never through a proxy.
+ * Refuses (rejects with {@link LoopbackTargetRefusedError}) any other target.
+ */
+const loopbackFetch = (input, init = {}) => {
+    let url;
+    let payload;
+    try {
+        url = assertLoopbackHttpUrl(input);
+        payload = toBodyBuffer(init.body);
+    }
+    catch (err) {
+        return Promise.reject(err);
+    }
+    const signal = init.signal ?? undefined;
+    if (signal?.aborted)
+        return Promise.reject(abortReason(signal));
+    const maxBodyBytes = init.maxBodyBytes ?? exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES;
+    const method = (init.method ?? 'GET').toUpperCase();
+    const headers = {};
+    new Headers(init.headers ?? undefined).forEach((value, name) => {
+        headers[name] = value;
+    });
+    if (payload && headers['content-length'] === undefined) {
+        headers['content-length'] = String(payload.length);
+    }
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let req;
+        const onAbort = () => {
+            if (settled)
+                return;
+            settled = true;
+            req?.destroy();
+            reject(abortReason(signal));
+        };
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener('abort', onAbort);
+            fn();
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        try {
+            req = node_http_1.default.request({
+                protocol: 'http:',
+                host: stripBrackets(url.hostname),
+                port: url.port ? Number(url.port) : 80,
+                path: `${url.pathname}${url.search}`,
+                method,
+                headers,
+                // No pooled agent: a short-lived command must be able to exit as soon
+                // as it has its answer, and no socket outlives its request.
+                agent: false,
+                lookup: loopbackOnlyLookup,
+            }, (res) => {
+                const chunks = [];
+                let size = 0;
+                res.on('data', (chunk) => {
+                    size += chunk.length;
+                    if (size > maxBodyBytes) {
+                        res.destroy();
+                        finish(() => reject(fetchFailed(new Error(`response larger than ${maxBodyBytes} bytes`))));
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                res.on('error', (err) => finish(() => reject(fetchFailed(err))));
+                res.on('aborted', () => finish(() => reject(fetchFailed(new Error('response aborted')))));
+                res.on('end', () => {
+                    finish(() => {
+                        const status = res.statusCode ?? 0;
+                        const responseHeaders = new Headers();
+                        for (const [name, value] of Object.entries(res.headers)) {
+                            if (value === undefined)
+                                continue;
+                            if (Array.isArray(value)) {
+                                for (const v of value)
+                                    responseHeaders.append(name, v);
+                            }
+                            else {
+                                responseHeaders.set(name, String(value));
+                            }
+                        }
+                        const body = NULL_BODY_STATUSES.has(status) ? null : Buffer.concat(chunks);
+                        try {
+                            resolve(new Response(body, {
+                                status,
+                                statusText: res.statusMessage ?? '',
+                                headers: responseHeaders,
+                            }));
+                        }
+                        catch (err) {
+                            reject(fetchFailed(err));
+                        }
+                    });
+                });
+            });
+            req.on('error', (err) => finish(() => reject(fetchFailed(err))));
+            if (payload)
+                req.write(payload);
+            req.end();
+        }
+        catch (err) {
+            finish(() => reject(fetchFailed(err)));
+        }
+    });
+};
+exports.loopbackFetch = loopbackFetch;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineId.d.ts

@@ -10,8 +10,8 @@
  * with a real UUIDv7 downstream.
  *
  * The caller may pass `machineUuidFallback` to override the default
- * hostname+platform fingerprint with a richer detector (e.g. the
- * daemon's `getMachineUuid()` from `registry.ts`).
+ * hostname+platform fingerprint with a richer detector (e.g.
+ * `getMachineUuid()` from `machineUuid.ts`).
  */
 export declare function ensureMachineDaemonId(machineUuidFallback?: () => string): string;
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineId.js

@@ -23,11 +23,13 @@ exports.__resetCachedDaemonIdForTest = __resetCachedDaemonIdForTest;
  *     directory survives), and a user whose machineUuid changes can
  *     still be re-anchored via the legacy-id list.
  *
- * Auth-core does NOT know about platform-level OS UUIDs (those still
- * live in `daemon/src/registry.ts::getMachineUuid()`). The fallback is
- * supplied by the consumer via the `machineUuidFallback` parameter so
- * a daemon can pass its richer detector while a CLI uses a hostname
- * fingerprint.
+ * This id is NOT the `machineUuid` the server keys Daemon rows on. That
+ * is the hardware id from `getMachineUuid()` (`machineUuid.ts`), and the
+ * two must never be substituted for each other on the wire: OSK-12063
+ * was the CLI sending this id as `machineUuid` on device-key enrollment,
+ * which matched no Daemon row and 404'd forever. The fallback used when
+ * this file cannot be persisted is supplied by the consumer via the
+ * `machineUuidFallback` parameter (the daemon passes `getMachineUuid`).
  */
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -108,9 +110,8 @@ function writeDaemonIdFile(target, id) {
  * SHA-256 of `os.hostname()` + `os.platform()` — better than just
  * hostname (includes platform) but worse than a true hardware UUID.
  *
- * The daemon overrides this with its richer detector
- * (`registry.ts::getMachineUuid()`) when available. The CLI today has
- * no native deps for OS UUIDs and so accepts this default.
+ * The daemon overrides this with the hardware detector
+ * (`getMachineUuid()`, `machineUuid.ts`).
  */
 function defaultMachineUuidFallback() {
     const host = node_os_1.default.hostname() || 'unknown-host';
@@ -129,8 +130,8 @@ function defaultMachineUuidFallback() {
  * with a real UUIDv7 downstream.
  *
  * The caller may pass `machineUuidFallback` to override the default
- * hostname+platform fingerprint with a richer detector (e.g. the
- * daemon's `getMachineUuid()` from `registry.ts`).
+ * hostname+platform fingerprint with a richer detector (e.g.
+ * `getMachineUuid()` from `machineUuid.ts`).
  */
 function ensureMachineDaemonId(machineUuidFallback) {
     if (cachedStableDaemonId !== null)

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Daemon sources whose identity is ISSUED by the control plane rather than
+ * derived from the host: the provisioner mints the daemon id and machine uuid
+ * before the daemon exists, and every binary on the runtime must use exactly
+ * those values.
+ *
+ * `dedicated-runtime` is here because the server's generation fence parses the
+ * lease generation out of the machine uuid (`dedicated-runtime:<lease>:<gen>`).
+ * A guest that fell back to `/etc/machine-id` would register under a uuid the
+ * fence cannot read, and every dispatch to it would be refused.
+ */
+export declare const HOSTED_RUNTIME_MACHINE_SOURCES: ReadonlySet<string>;
+/**
+ * The control-plane-issued value of `name` (e.g. `OVERSKY_MACHINE_UUID`), or
+ * null when this process is not on a hosted runtime or the value is absent /
+ * malformed. Only honoured under a hosted `OVERSKY_DAEMON_SOURCE`, so a stray
+ * variable on a laptop cannot rename the machine.
+ */
+export declare function hostedRuntimeIdOverride(name: string, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Return a stable, machine-scoped UUID. Cached for the process lifetime.
+ *
+ * Callers should treat this as opaque: the format differs per platform
+ * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid).
+ * The guarantee is only: same machine -> same value across reboots, and the
+ * same value from every binary that calls this function.
+ *
+ * On a hosted runtime the control-plane-issued `OVERSKY_MACHINE_UUID` wins.
+ *
+ * Falls back to a deterministic hostname+username hash if the platform
+ * probe fails. This preserves server-side record continuity even on
+ * locked-down machines that refuse ioreg / registry access.
+ */
+export declare function getMachineUuid(): string;
+/** @internal test seam — forget the cached value so the next call re-probes. */
+export declare function __resetMachineUuidCacheForTest(): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.js

@@ -0,0 +1,156 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOSTED_RUNTIME_MACHINE_SOURCES = void 0;
+exports.hostedRuntimeIdOverride = hostedRuntimeIdOverride;
+exports.getMachineUuid = getMachineUuid;
+exports.__resetMachineUuidCacheForTest = __resetMachineUuidCacheForTest;
+/**
+ * machineUuid.ts — the ONE hardware machine identity sent to the server as
+ * `machineUuid`, shared by the daemon and the CLI.
+ *
+ * Server Daemon rows are keyed on this value (daemon register, device-key
+ * enrollment, token mint, pairing), so every binary on one machine must
+ * compute it identically. Until OSK-12063 the CLI sent its own UUIDv7 from
+ * `~/.skrr/daemon.id` (`ensureMachineDaemonId()`, a DIFFERENT identity) as
+ * `machineUuid` on device-key enrollment while the daemon sent the hardware
+ * UUID computed here, so every CLI enrollment matched no Daemon row, got
+ * 404 DAEMON_NOT_FOUND and backed off forever. Two implementations of one
+ * identity can only agree by being edited together; this file is the one
+ * implementation, and `daemon/src/registry-lite.ts` re-exports it.
+ *
+ * Deliberately dependency-free (node builtins only) and exposed as the
+ * `@skrr-ai/auth-core/machine-uuid` subpath: the packaged desktop imports the
+ * daemon's `registry-lite.js` directly, and loading the full auth-core index
+ * there would drag in the credential stack for a one-function need.
+ *
+ * Not to be confused with `ensureMachineDaemonId()` (`machineId.ts`), the
+ * minted per-home-dir UUIDv7 that anchors the daemon's `stableDaemonId`. That
+ * one survives an OS reinstall; this one survives a home-dir wipe. They are
+ * different facts and neither may stand in for the other on the wire.
+ */
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_child_process_1 = require("node:child_process");
+/**
+ * Daemon sources whose identity is ISSUED by the control plane rather than
+ * derived from the host: the provisioner mints the daemon id and machine uuid
+ * before the daemon exists, and every binary on the runtime must use exactly
+ * those values.
+ *
+ * `dedicated-runtime` is here because the server's generation fence parses the
+ * lease generation out of the machine uuid (`dedicated-runtime:<lease>:<gen>`).
+ * A guest that fell back to `/etc/machine-id` would register under a uuid the
+ * fence cannot read, and every dispatch to it would be refused.
+ */
+exports.HOSTED_RUNTIME_MACHINE_SOURCES = new Set([
+    'hosted-machine',
+    'cloud-coding',
+    'dedicated-runtime',
+]);
+const HOSTED_RUNTIME_ID_RE = /^[A-Za-z0-9_.:-]{1,160}$/;
+/**
+ * The control-plane-issued value of `name` (e.g. `OVERSKY_MACHINE_UUID`), or
+ * null when this process is not on a hosted runtime or the value is absent /
+ * malformed. Only honoured under a hosted `OVERSKY_DAEMON_SOURCE`, so a stray
+ * variable on a laptop cannot rename the machine.
+ */
+function hostedRuntimeIdOverride(name, env = process.env) {
+    if (!exports.HOSTED_RUNTIME_MACHINE_SOURCES.has(env.OVERSKY_DAEMON_SOURCE ?? '')) {
+        return null;
+    }
+    const value = env[name]?.trim();
+    if (!value || !HOSTED_RUNTIME_ID_RE.test(value))
+        return null;
+    return value;
+}
+let cachedMachineUuid = null;
+function readMachineUuidDarwin() {
+    try {
+        const out = (0, node_child_process_1.execFileSync)('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], {
+            encoding: 'utf-8',
+            timeout: 2_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const match = out.match(/IOPlatformUUID"?\s*=\s*"?([0-9A-F-]{36})/i);
+        return match ? match[1].toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readMachineUuidLinux() {
+    for (const p of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+        try {
+            const raw = node_fs_1.default.readFileSync(p, 'utf-8').trim();
+            if (raw)
+                return raw.toLowerCase();
+        }
+        catch {
+            // Try the next candidate.
+        }
+    }
+    return null;
+}
+function readMachineUuidWindows() {
+    try {
+        const out = (0, node_child_process_1.execFileSync)('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid'], { encoding: 'utf-8', timeout: 2_000, stdio: ['ignore', 'pipe', 'ignore'] });
+        const match = out.match(/MachineGuid\s+REG_SZ\s+([0-9A-Fa-f-]{36})/);
+        return match ? match[1].toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Return a stable, machine-scoped UUID. Cached for the process lifetime.
+ *
+ * Callers should treat this as opaque: the format differs per platform
+ * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid).
+ * The guarantee is only: same machine -> same value across reboots, and the
+ * same value from every binary that calls this function.
+ *
+ * On a hosted runtime the control-plane-issued `OVERSKY_MACHINE_UUID` wins.
+ *
+ * Falls back to a deterministic hostname+username hash if the platform
+ * probe fails. This preserves server-side record continuity even on
+ * locked-down machines that refuse ioreg / registry access.
+ */
+function getMachineUuid() {
+    const hostedMachineUuid = hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID');
+    if (hostedMachineUuid)
+        return hostedMachineUuid;
+    if (cachedMachineUuid !== null)
+        return cachedMachineUuid;
+    let detected = null;
+    switch (process.platform) {
+        case 'darwin':
+            detected = readMachineUuidDarwin();
+            break;
+        case 'linux':
+            detected = readMachineUuidLinux();
+            break;
+        case 'win32':
+            detected = readMachineUuidWindows();
+            break;
+    }
+    if (detected) {
+        cachedMachineUuid = detected;
+        return detected;
+    }
+    const fallback = 'fallback-' +
+        node_crypto_1.default
+            .createHash('sha256')
+            .update(`${node_os_1.default.hostname()}:${node_os_1.default.userInfo().username}`)
+            .digest('hex')
+            .slice(0, 32);
+    cachedMachineUuid = fallback;
+    return fallback;
+}
+/** @internal test seam — forget the cached value so the next call re-probes. */
+function __resetMachineUuidCacheForTest() {
+    cachedMachineUuid = null;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refresh.d.ts

@@ -274,6 +274,14 @@ export declare function persistReauthState(state: ReauthState): void;
 export declare function needsReauthState(): {
     needed: boolean;
     reason?: string;
+    /**
+     * The server's own words for the refusal (`Refresh token bound to a different
+     * daemon`). The code alone collapses several distinct causes into one
+     * (`REFRESH_INVALID` is also "not recognized" and "issued without a
+     * daemonId"), and a surface that names only the code cannot tell the reader
+     * which one they hit (OSK-12116).
+     */
+    message?: string;
     since?: number;
 };
 export declare function clearReauthState(): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refresh.js

@@ -969,7 +969,14 @@ function needsReauthState() {
             return { needed: false };
         const raw = node_fs_1.default.readFileSync(flagPath, 'utf-8');
         const state = JSON.parse(raw);
-        return { needed: true, reason: state.code, since: state.at };
+        return {
+            needed: true,
+            reason: state.code,
+            ...(typeof state.message === 'string' && state.message.length > 0
+                ? { message: state.message }
+                : {}),
+            since: state.at,
+        };
     }
     catch {
         return { needed: false };

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -84,3 +84,25 @@ export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
  * etc.) so legitimate tools keep working.
  */
 export declare function sanitizeSpawnEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * OSK-12134 — loopback names a spawned child must reach directly, never through
+ * a proxy. A harness talks to this machine constantly: the daemon's local
+ * bridges (browser, delegated CLI, message intents), the inference broker, and
+ * the engine's own loopback services (skrr Code's `session/new` reaches a local
+ * directory service and failed with "service failure" behind a shell proxy).
+ */
+export declare const LOOPBACK_NO_PROXY_HOSTS: readonly string[];
+/** True when `env` names a proxy some client in the child might honour. */
+export declare function envHasProxy(env: Readonly<Record<string, string | undefined>>): boolean;
+/**
+ * Return `env` with the loopback hosts appended to BOTH `NO_PROXY` and
+ * `no_proxy`, when (and only when) it names a proxy. Tools disagree on which
+ * spelling they read and whether they fall back to the other, so an unset
+ * spelling is seeded from the other one before the hosts are appended —
+ * seeding only the hosts would silently drop every existing exemption for a
+ * tool that prefers the unset spelling. Existing entries keep their order.
+ *
+ * Exported for a parent that layers a proxy onto the child's env AFTER
+ * {@link sanitizeSpawnEnv}: call it again on the final map.
+ */
+export declare function withLoopbackNoProxy<T extends Record<string, string | undefined>>(env: T): T;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -40,8 +40,10 @@
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
 exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
+exports.envHasProxy = envHasProxy;
+exports.withLoopbackNoProxy = withLoopbackNoProxy;
 /**
  * Env vars that must NEVER reach a spawned subprocess.
  *
@@ -187,5 +189,62 @@ function sanitizeSpawnEnv(env) {
             continue;
         out[key] = value;
     }
-    return out;
+    return withLoopbackNoProxy(out);
+}
+/**
+ * OSK-12134 — loopback names a spawned child must reach directly, never through
+ * a proxy. A harness talks to this machine constantly: the daemon's local
+ * bridges (browser, delegated CLI, message intents), the inference broker, and
+ * the engine's own loopback services (skrr Code's `session/new` reaches a local
+ * directory service and failed with "service failure" behind a shell proxy).
+ */
+exports.LOOPBACK_NO_PROXY_HOSTS = ['127.0.0.1', 'localhost', '::1'];
+const PROXY_ENV_VARS = [
+    'HTTP_PROXY',
+    'http_proxy',
+    'HTTPS_PROXY',
+    'https_proxy',
+    'ALL_PROXY',
+    'all_proxy',
+];
+/** True when `env` names a proxy some client in the child might honour. */
+function envHasProxy(env) {
+    return PROXY_ENV_VARS.some((name) => typeof env[name] === 'string' && env[name].trim() !== '');
+}
+function appendNoProxyHosts(list, hosts) {
+    const entries = list
+        .split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter(Boolean);
+    // `*` already exempts everything, and some clients honour it only as the
+    // entire value, so appending to it would break them.
+    if (entries.includes('*'))
+        return list;
+    const missing = hosts.filter((host) => !entries.includes(host));
+    if (missing.length === 0)
+        return list;
+    const kept = list.replace(/[\s,]+$/, '');
+    return kept ? `${kept},${missing.join(',')}` : missing.join(',');
+}
+/**
+ * Return `env` with the loopback hosts appended to BOTH `NO_PROXY` and
+ * `no_proxy`, when (and only when) it names a proxy. Tools disagree on which
+ * spelling they read and whether they fall back to the other, so an unset
+ * spelling is seeded from the other one before the hosts are appended —
+ * seeding only the hosts would silently drop every existing exemption for a
+ * tool that prefers the unset spelling. Existing entries keep their order.
+ *
+ * Exported for a parent that layers a proxy onto the child's env AFTER
+ * {@link sanitizeSpawnEnv}: call it again on the final map.
+ */
+function withLoopbackNoProxy(env) {
+    if (!envHasProxy(env))
+        return env;
+    const upper = env.NO_PROXY?.trim() ? env.NO_PROXY : undefined;
+    const lower = env.no_proxy?.trim() ? env.no_proxy : undefined;
+    return {
+        ...env,
+        NO_PROXY: appendNoProxyHosts(upper ?? lower ?? '', exports.LOOPBACK_NO_PROXY_HOSTS),
+        no_proxy: appendNoProxyHosts(lower ?? upper ?? '', exports.LOOPBACK_NO_PROXY_HOSTS),
+    };
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.d.ts

@@ -21,6 +21,8 @@ type DisabledReason = 'kek_unavailable' | 'init_failed' | 'platform_unsupported'
 export declare function __setStateForTest(next: CredEnvelopeState): CredEnvelopeState;
 /** @internal Test seam — read state for assertions. */
 export declare function __getStateForTest(): CredEnvelopeState;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+export declare function __clearWarnDedupeForTest(): void;
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.