@skrr-ai/cli 0.1.50 → 0.1.51

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -123,7 +123,21 @@ function atomicWrite0600(target, value) {
  * The event name passed in is the FULLY-QUALIFIED `cred_envelope.*` form
  * because daemon-side telemetry consumers (`event-log.ts`, dashboards,
  * spec assertions) key off the prefixed name. Do not strip the prefix.
+ *
+ * Identical failure warnings hit the logger only once per process.
+ * Telemetry still records every occurrence — the dedupe exists because a
+ * single unreadable envelope produced the same warning once per stored
+ * field (token, refresh token, expiry…), which read to users as three
+ * crashes rather than one stale credential (OSK-12074). The signature is
+ * event + kek identity + message, so a genuinely different failure mode
+ * still gets its own line.
  */
+const warnedSignatures = new Set();
+const MAX_WARNED_SIGNATURES = 64;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+export function __clearWarnDedupeForTest() {
+    warnedSignatures.clear();
+}
 function emit(eventName, success, metadata) {
     emitAuthTelemetry({
         timestamp: new Date().toISOString(),
@@ -132,7 +146,13 @@ function emit(eventName, success, metadata) {
         metadata: { event: eventName, ...metadata },
     });
     if (!success) {
-        getAuthLogger().warn(`[credEnvelope] ${eventName}`, metadata);
+        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}`;
+        if (!warnedSignatures.has(signature)) {
+            if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
+                warnedSignatures.clear();
+            warnedSignatures.add(signature);
+            getAuthLogger().warn(`[credEnvelope] ${eventName}`, metadata);
+        }
     }
 }
 // ---------------------------------------------------------------------------
@@ -745,6 +765,10 @@ export function maybeDecryptOnRead(stored) {
                 kekId: _state.kekId,
                 kekKind: _state.kekKind,
                 message: err?.message ?? 'unknown',
+                // The crypto error alone reads as a crash; the actionable truth is
+                // that this stored credential is unreadable by THIS binary (usually
+                // a signing-identity or profile drift) and re-login rebuilds it.
+                hint: 'stored credential is unreadable on this machine — signing in again rebuilds it',
             });
             return { plaintext: null, needsMigration: false };
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonToolApproval.d.ts

@@ -23,9 +23,14 @@
  *
  * What the daemon verifies is the binding, not the server's honesty: the
  * request already arrives over the daemon's authenticated server channel, so
- * the field IS the attestation. What the binding buys is that the model —
- * which authors `toolInput` — cannot mint an approval, and an approval for
- * one call cannot be replayed onto another.
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 export declare const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = "daemon_tool_attested_approval_v1";
@@ -89,12 +94,31 @@ export declare function mintAttestedToolApproval(args: {
     now?: number;
     ttlMs?: number;
 }): AttestedToolApproval;
+/**
+ * Why an attestation did not approve a call — logged by the daemon, never
+ * shown to the caller beyond "absent" vs "did not verify".
+ *  - `absent`    — no attestation arrived (the server did not ask anyone)
+ *  - `malformed` — not the v1 shape
+ *  - `expired`   — past `expiresAt`, or issued implausibly far in the future
+ *  - `window`    — the issuer claimed a validity window longer than
+ *                  `ATTESTED_TOOL_APPROVAL_TTL_MS` (or an empty/negative one)
+ *  - `binding`   — minted for a different call (toolUseId, tool, or input)
+ *  - `replayed`  — this exact approval was already spent on this daemon
+ *                  (the ledger is the verifier's caller's, see the daemon's
+ *                  `permissions/attestation-ledger.ts`)
+ */
+export type AttestedToolApprovalRefusalReason = 'absent' | 'malformed' | 'binding' | 'expired' | 'window' | 'replayed';
 export type AttestedToolApprovalVerdict = {
     ok: true;
 } | {
     ok: false;
-    reason: 'absent' | 'malformed' | 'binding' | 'expired';
+    reason: AttestedToolApprovalRefusalReason;
 };
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+export declare const ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS: number;
 /**
  * Daemon side: verify an attestation against the call it claims to approve.
  * Untrusted wire input — every field is checked, and any mismatch is a plain

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonToolApproval.js

@@ -24,9 +24,14 @@ import { createHash } from 'node:crypto';
  *
  * What the daemon verifies is the binding, not the server's honesty: the
  * request already arrives over the daemon's authenticated server channel, so
- * the field IS the attestation. What the binding buys is that the model —
- * which authors `toolInput` — cannot mint an approval, and an approval for
- * one call cannot be replayed onto another.
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 export const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = 'daemon_tool_attested_approval_v1';
@@ -129,6 +134,11 @@ export function mintAttestedToolApproval(args) {
         expiresAt: now + (args.ttlMs ?? ATTESTED_TOOL_APPROVAL_TTL_MS),
     };
 }
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+export const ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = 30 * 1000;
 /**
  * Daemon side: verify an attestation against the call it claims to approve.
  * Untrusted wire input — every field is checked, and any mismatch is a plain
@@ -152,9 +162,17 @@ export function verifyAttestedToolApproval(approval, call) {
         return { ok: false, reason: 'malformed' };
     }
     const now = call.now ?? Date.now();
-    if (a.expiresAt <= now || a.issuedAt > now + 30_000) {
+    if (a.expiresAt <= now || a.issuedAt > now + ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS) {
         return { ok: false, reason: 'expired' };
     }
+    // The TTL is the VERIFIER's bound, not the issuer's claim (OSK-12108): an
+    // attestation whose own window is longer than one approval may stay valid
+    // is refused whatever `expiresAt` says, so "answers one person about this
+    // call, moments ago" holds even against an issuer that set a year.
+    const window = a.expiresAt - a.issuedAt;
+    if (!(window > 0) || window > ATTESTED_TOOL_APPROVAL_TTL_MS) {
+        return { ok: false, reason: 'window' };
+    }
     if (a.toolUseId !== call.toolUseId ||
         a.toolName.toLowerCase() !== String(call.toolName).toLowerCase() ||
         a.inputSha256 !== canonicalToolInputDigest(call.toolInput)) {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -585,11 +585,49 @@ export async function enrollWithServer(opts) {
         //     Enrollment is the CLI's (JWT) job; the daemon holding an opaque
         //     token should not enroll. Guarded at the daemon call site, this is
         //     defense-in-depth for any other opaque caller.
-        //   • 409 already-enrolled — a concurrent binary won the enrollment race
-        //     for the shared keypair; idempotent, nothing to do.
+        //   • 409 ALREADY_ENROLLED with OUR thumbprint — a concurrent binary won
+        //     the enrollment race for this keypair; idempotent, nothing to do.
+        //
+        // A 409 is NOT benign when the row is pinned to a DIFFERENT key
+        // (OSK-12063). The server keeps one pin per (user, machine) row while
+        // every local profile has its own key, so a 409 can mean "every refresh
+        // this key signs will be refused with DEVICE_PROOF_THUMBPRINT_MISMATCH".
+        // The server names the pinned thumbprint (`enrolledThumbprint`) so the
+        // two cases can be told apart. An older server that omits it keeps the
+        // old reading, because there is nothing to compare. A 409
+        // ENROLLMENT_DUPLICATE_KEY — this key is pinned on another active row —
+        // is never benign either.
+        let conflictCode = null;
+        let enrolledThumbprint = null;
+        if (response.status === 409) {
+            try {
+                const parsed = JSON.parse(responseText);
+                conflictCode = typeof parsed.code === 'string' ? parsed.code : null;
+                enrolledThumbprint =
+                    typeof parsed.enrolledThumbprint === 'string' ? parsed.enrolledThumbprint : null;
+            }
+            catch {
+                /* non-JSON 409 — treat as the legacy benign race */
+            }
+        }
+        const pinnedToOtherKey = response.status === 409 &&
+            enrolledThumbprint !== null &&
+            enrolledThumbprint !== keypair.thumbprint;
+        const keyPinnedElsewhere = response.status === 409 && conflictCode === 'ENROLLMENT_DUPLICATE_KEY';
         const isBenignRejection = (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) ||
             (response.status === 403 && responseText.includes('OPAQUE_AUTH_REFUSED')) ||
-            response.status === 409;
+            (response.status === 409 && !pinnedToOtherKey && !keyPinnedElsewhere);
+        if (pinnedToOtherKey) {
+            emit('enrollment_key_mismatch', false, {
+                profile,
+                thumbprint: keypair.thumbprint,
+                enrolledThumbprint,
+                serverUrl,
+                message: 'this machine is registered with a different device key than this profile signs ' +
+                    'with; its refreshes will be refused. An interactive daemon login (skrrd login) ' +
+                    're-registers this key.',
+            }, { logLevel: 'warn' });
+        }
         if (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) {
             try {
                 atomicWrite0600(backoffPath, JSON.stringify({

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -29,11 +29,13 @@ export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, K
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export * from './firstPartyHarness.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -118,7 +118,12 @@ export {
 initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, 
 // Test seams — file path resolvers + state setters for spec files.
 __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
+// Hardware machine identity sent as `machineUuid` (IOPlatformUUID /
+// machine-id / MachineGuid). ONE implementation for daemon and CLI —
+// OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
+export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 // Stable per-machine UUIDv7 identity persisted at <configDir>/daemon.id.
+// NOT a `machineUuid` — see machineUuid.ts.
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 // Tier 1 #2 — daemon QR pairing primitives. Pure crypto + AAD framing,
 // shared between the daemon CLI orchestrator (`daemon/src/pair.ts`) and
@@ -140,7 +145,11 @@ export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, har
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+// OSK-12134 — the one proxy-free client for loopback HTTP. Bun's fetch (and
+// Node's under NODE_USE_ENV_PROXY) sends 127.0.0.1 requests to HTTP_PROXY,
+// credentials and all; every loopback caller goes through this instead.
+export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, } from './loopbackHttp.js';
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/loopbackHttp.d.ts

@@ -0,0 +1,32 @@
+/** Upper bound on a buffered response body. Loopback control-plane bodies are small. */
+export declare const LOOPBACK_DEFAULT_MAX_BODY_BYTES: number;
+/** Thrown (synchronously surfaced as a rejection) for a URL that is not loopback HTTP. */
+export declare class LoopbackTargetRefusedError extends Error {
+    readonly code = "LOOPBACK_TARGET_REFUSED";
+    constructor(message: string);
+}
+/** True for an IP literal in 127.0.0.0/8, `::1`, or an IPv4-mapped 127/8 address. */
+export declare function isLoopbackAddress(address: string): boolean;
+/** True for a host name or address this client accepts as "this machine". */
+export declare function isLoopbackHostname(hostname: string): boolean;
+/**
+ * Parse and validate a loopback HTTP URL. Throws {@link LoopbackTargetRefusedError}
+ * for anything that is not `http:` to a loopback host.
+ */
+export declare function assertLoopbackHttpUrl(input: string | URL): URL;
+/**
+ * `RequestInit`, so a `fetch` call site can switch to {@link loopbackFetch}
+ * unchanged. Only `method`, `headers`, `signal` and a string/bytes `body` are
+ * honoured; a stream, Blob or FormData body is rejected rather than guessed at.
+ */
+export interface LoopbackFetchInit extends RequestInit {
+    /** Cap on the buffered response body; exceeding it rejects. */
+    maxBodyBytes?: number;
+}
+/** A `fetch`-shaped signature, for callers that keep a `fetchImpl` seam. */
+export type LoopbackFetch = (input: string | URL, init?: LoopbackFetchInit) => Promise<Response>;
+/**
+ * `fetch` for a loopback URL, over `node:http`, never through a proxy.
+ * Refuses (rejects with {@link LoopbackTargetRefusedError}) any other target.
+ */
+export declare const loopbackFetch: LoopbackFetch;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/loopbackHttp.js

@@ -0,0 +1,257 @@
+/**
+ * OSK-12134 — the ONE HTTP client for talking to a process on this machine.
+ *
+ * ── Why this is not `fetch` ────────────────────────────────────────────────
+ *
+ * The compiled daemon runs on Bun, and Bun's `fetch` routes EVERY URL through
+ * `HTTP_PROXY` / `HTTPS_PROXY` unless `NO_PROXY` names it — a `127.0.0.1`
+ * target included. Node's `fetch` does the same once `NODE_USE_ENV_PROXY=1` is
+ * set (Node 22.21+/24). On a laptop with a local proxy exported in the shell
+ * (Clash, Surge, a corporate agent, …) every loopback call the daemon, a
+ * wrapper, or the CLI made with `fetch` was delivered to that proxy instead —
+ * WITH its credential: the daemon's local secret, the CLI-handoff descriptor
+ * secret, the wrapper fan-out bearer, the browser bridge token, the extension
+ * relay token. OSK-12087 found this on the `/health` probe and moved that one
+ * caller to `node:http`; this module is that fix made the only way to do it.
+ *
+ * `node:http` never consults proxy environment variables, on Node or on Bun, so
+ * a request made through it cannot be routed off the machine by environment.
+ *
+ * ── What it refuses ────────────────────────────────────────────────────────
+ *
+ * Only `http:` URLs whose host is a loopback name or address are accepted
+ * (`127.0.0.0/8`, `::1`, `localhost`). Anything else throws BEFORE a socket is
+ * opened: a caller that builds its URL from a descriptor or an environment
+ * variable must not be turned into an SSRF primitive by a hostile value, and a
+ * credential that is only meant for this machine must not be sent anywhere
+ * else. `localhost` is resolved through a lookup that rejects any non-loopback
+ * answer, so a rewritten hosts file cannot redirect it either.
+ *
+ * ── Shape ──────────────────────────────────────────────────────────────────
+ *
+ * `loopbackFetch` is a drop-in for the subset of `fetch` these callers use —
+ * method, headers, a string/bytes body, an `AbortSignal` — and returns a real
+ * `Response`, so existing callers (and their `fetchImpl` test seams) change one
+ * identifier. Transport failures reject with `TypeError('fetch failed')` whose
+ * `cause` carries the socket error (`ECONNREFUSED`, …), and aborts reject with
+ * the signal's reason, exactly as `fetch` does, so existing error handling keeps
+ * working. The response body is buffered (bounded by `maxBodyBytes`); nothing
+ * on loopback streams through this client.
+ */
+import dns from 'node:dns';
+import http from 'node:http';
+import net from 'node:net';
+/** Loopback host names this client will connect to, besides 127/8 and ::1 literals. */
+const LOOPBACK_NAMES = new Set(['localhost']);
+/** Upper bound on a buffered response body. Loopback control-plane bodies are small. */
+export const LOOPBACK_DEFAULT_MAX_BODY_BYTES = 16 * 1024 * 1024;
+/** Statuses a `Response` must be constructed with a null body for. */
+const NULL_BODY_STATUSES = new Set([101, 103, 204, 205, 304]);
+/** Thrown (synchronously surfaced as a rejection) for a URL that is not loopback HTTP. */
+export class LoopbackTargetRefusedError extends Error {
+    code = 'LOOPBACK_TARGET_REFUSED';
+    constructor(message) {
+        super(message);
+        this.name = 'LoopbackTargetRefusedError';
+    }
+}
+function stripBrackets(hostname) {
+    return hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;
+}
+/** True for an IP literal in 127.0.0.0/8, `::1`, or an IPv4-mapped 127/8 address. */
+export function isLoopbackAddress(address) {
+    const value = stripBrackets(address.trim().toLowerCase());
+    if (net.isIPv4(value))
+        return value.split('.')[0] === '127';
+    if (net.isIPv6(value)) {
+        if (value === '::1' || value === '0:0:0:0:0:0:0:1')
+            return true;
+        // IPv4-mapped (::ffff:127.0.0.1, which WHATWG URL normalizes to ::ffff:7f00:1).
+        if (value.startsWith('::ffff:')) {
+            const rest = value.slice('::ffff:'.length);
+            if (net.isIPv4(rest))
+                return isLoopbackAddress(rest);
+            const high = /^([0-9a-f]{1,4}):[0-9a-f]{1,4}$/.exec(rest);
+            return high ? parseInt(high[1], 16) >> 8 === 127 : false;
+        }
+        return false;
+    }
+    return false;
+}
+/** True for a host name or address this client accepts as "this machine". */
+export function isLoopbackHostname(hostname) {
+    const value = stripBrackets(hostname.trim().toLowerCase());
+    return LOOPBACK_NAMES.has(value) || isLoopbackAddress(value);
+}
+/**
+ * Parse and validate a loopback HTTP URL. Throws {@link LoopbackTargetRefusedError}
+ * for anything that is not `http:` to a loopback host.
+ */
+export function assertLoopbackHttpUrl(input) {
+    let url;
+    try {
+        url = new URL(String(input));
+    }
+    catch {
+        throw new LoopbackTargetRefusedError('Loopback request refused: not a valid URL.');
+    }
+    if (url.protocol !== 'http:') {
+        throw new LoopbackTargetRefusedError(`Loopback request refused: only http: is allowed on loopback (got ${url.protocol}).`);
+    }
+    if (!isLoopbackHostname(url.hostname)) {
+        throw new LoopbackTargetRefusedError(`Loopback request refused: ${url.hostname} is not a loopback host.`);
+    }
+    if (url.username || url.password) {
+        throw new LoopbackTargetRefusedError('Loopback request refused: URL must not carry userinfo.');
+    }
+    return url;
+}
+/** A `dns.lookup` that only ever answers with a loopback address. */
+const loopbackOnlyLookup = (hostname, options, callback) => {
+    dns.lookup(hostname, { ...options, all: true }, (err, addresses) => {
+        if (err) {
+            callback(err, '', 0);
+            return;
+        }
+        const list = (Array.isArray(addresses) ? addresses : []);
+        const loopback = list.filter((entry) => isLoopbackAddress(entry.address));
+        if (loopback.length === 0) {
+            const refused = Object.assign(new Error(`${hostname} did not resolve to a loopback address`), { code: 'LOOPBACK_TARGET_REFUSED' });
+            callback(refused, '', 0);
+            return;
+        }
+        if (options?.all) {
+            callback(null, loopback);
+            return;
+        }
+        callback(null, loopback[0].address, loopback[0].family);
+    });
+};
+function abortReason(signal) {
+    return signal.reason !== undefined
+        ? signal.reason
+        : new DOMException('This operation was aborted', 'AbortError');
+}
+function fetchFailed(cause) {
+    return new TypeError('fetch failed', { cause });
+}
+function toBodyBuffer(body) {
+    if (body === undefined || body === null)
+        return null;
+    if (typeof body === 'string')
+        return Buffer.from(body, 'utf8');
+    if (body instanceof ArrayBuffer)
+        return Buffer.from(body);
+    if (ArrayBuffer.isView(body))
+        return Buffer.from(body.buffer, body.byteOffset, body.byteLength);
+    throw new TypeError('loopbackFetch supports only string or byte bodies');
+}
+/**
+ * `fetch` for a loopback URL, over `node:http`, never through a proxy.
+ * Refuses (rejects with {@link LoopbackTargetRefusedError}) any other target.
+ */
+export const loopbackFetch = (input, init = {}) => {
+    let url;
+    let payload;
+    try {
+        url = assertLoopbackHttpUrl(input);
+        payload = toBodyBuffer(init.body);
+    }
+    catch (err) {
+        return Promise.reject(err);
+    }
+    const signal = init.signal ?? undefined;
+    if (signal?.aborted)
+        return Promise.reject(abortReason(signal));
+    const maxBodyBytes = init.maxBodyBytes ?? LOOPBACK_DEFAULT_MAX_BODY_BYTES;
+    const method = (init.method ?? 'GET').toUpperCase();
+    const headers = {};
+    new Headers(init.headers ?? undefined).forEach((value, name) => {
+        headers[name] = value;
+    });
+    if (payload && headers['content-length'] === undefined) {
+        headers['content-length'] = String(payload.length);
+    }
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let req;
+        const onAbort = () => {
+            if (settled)
+                return;
+            settled = true;
+            req?.destroy();
+            reject(abortReason(signal));
+        };
+        const finish = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            signal?.removeEventListener('abort', onAbort);
+            fn();
+        };
+        signal?.addEventListener('abort', onAbort, { once: true });
+        try {
+            req = http.request({
+                protocol: 'http:',
+                host: stripBrackets(url.hostname),
+                port: url.port ? Number(url.port) : 80,
+                path: `${url.pathname}${url.search}`,
+                method,
+                headers,
+                // No pooled agent: a short-lived command must be able to exit as soon
+                // as it has its answer, and no socket outlives its request.
+                agent: false,
+                lookup: loopbackOnlyLookup,
+            }, (res) => {
+                const chunks = [];
+                let size = 0;
+                res.on('data', (chunk) => {
+                    size += chunk.length;
+                    if (size > maxBodyBytes) {
+                        res.destroy();
+                        finish(() => reject(fetchFailed(new Error(`response larger than ${maxBodyBytes} bytes`))));
+                        return;
+                    }
+                    chunks.push(chunk);
+                });
+                res.on('error', (err) => finish(() => reject(fetchFailed(err))));
+                res.on('aborted', () => finish(() => reject(fetchFailed(new Error('response aborted')))));
+                res.on('end', () => {
+                    finish(() => {
+                        const status = res.statusCode ?? 0;
+                        const responseHeaders = new Headers();
+                        for (const [name, value] of Object.entries(res.headers)) {
+                            if (value === undefined)
+                                continue;
+                            if (Array.isArray(value)) {
+                                for (const v of value)
+                                    responseHeaders.append(name, v);
+                            }
+                            else {
+                                responseHeaders.set(name, String(value));
+                            }
+                        }
+                        const body = NULL_BODY_STATUSES.has(status) ? null : Buffer.concat(chunks);
+                        try {
+                            resolve(new Response(body, {
+                                status,
+                                statusText: res.statusMessage ?? '',
+                                headers: responseHeaders,
+                            }));
+                        }
+                        catch (err) {
+                            reject(fetchFailed(err));
+                        }
+                    });
+                });
+            });
+            req.on('error', (err) => finish(() => reject(fetchFailed(err))));
+            if (payload)
+                req.write(payload);
+            req.end();
+        }
+        catch (err) {
+            finish(() => reject(fetchFailed(err)));
+        }
+    });
+};

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/machineId.d.ts

@@ -10,8 +10,8 @@
  * with a real UUIDv7 downstream.
  *
  * The caller may pass `machineUuidFallback` to override the default
- * hostname+platform fingerprint with a richer detector (e.g. the
- * daemon's `getMachineUuid()` from `registry.ts`).
+ * hostname+platform fingerprint with a richer detector (e.g.
+ * `getMachineUuid()` from `machineUuid.ts`).
  */
 export declare function ensureMachineDaemonId(machineUuidFallback?: () => string): string;
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/machineId.js

@@ -15,11 +15,13 @@
  *     directory survives), and a user whose machineUuid changes can
  *     still be re-anchored via the legacy-id list.
  *
- * Auth-core does NOT know about platform-level OS UUIDs (those still
- * live in `daemon/src/registry.ts::getMachineUuid()`). The fallback is
- * supplied by the consumer via the `machineUuidFallback` parameter so
- * a daemon can pass its richer detector while a CLI uses a hostname
- * fingerprint.
+ * This id is NOT the `machineUuid` the server keys Daemon rows on. That
+ * is the hardware id from `getMachineUuid()` (`machineUuid.ts`), and the
+ * two must never be substituted for each other on the wire: OSK-12063
+ * was the CLI sending this id as `machineUuid` on device-key enrollment,
+ * which matched no Daemon row and 404'd forever. The fallback used when
+ * this file cannot be persisted is supplied by the consumer via the
+ * `machineUuidFallback` parameter (the daemon passes `getMachineUuid`).
  */
 import crypto from 'node:crypto';
 import fs from 'node:fs';
@@ -100,9 +102,8 @@ function writeDaemonIdFile(target, id) {
  * SHA-256 of `os.hostname()` + `os.platform()` — better than just
  * hostname (includes platform) but worse than a true hardware UUID.
  *
- * The daemon overrides this with its richer detector
- * (`registry.ts::getMachineUuid()`) when available. The CLI today has
- * no native deps for OS UUIDs and so accepts this default.
+ * The daemon overrides this with the hardware detector
+ * (`getMachineUuid()`, `machineUuid.ts`).
  */
 function defaultMachineUuidFallback() {
     const host = os.hostname() || 'unknown-host';
@@ -121,8 +122,8 @@ function defaultMachineUuidFallback() {
  * with a real UUIDv7 downstream.
  *
  * The caller may pass `machineUuidFallback` to override the default
- * hostname+platform fingerprint with a richer detector (e.g. the
- * daemon's `getMachineUuid()` from `registry.ts`).
+ * hostname+platform fingerprint with a richer detector (e.g.
+ * `getMachineUuid()` from `machineUuid.ts`).
  */
 export function ensureMachineDaemonId(machineUuidFallback) {
     if (cachedStableDaemonId !== null)

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/machineUuid.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Daemon sources whose identity is ISSUED by the control plane rather than
+ * derived from the host: the provisioner mints the daemon id and machine uuid
+ * before the daemon exists, and every binary on the runtime must use exactly
+ * those values.
+ *
+ * `dedicated-runtime` is here because the server's generation fence parses the
+ * lease generation out of the machine uuid (`dedicated-runtime:<lease>:<gen>`).
+ * A guest that fell back to `/etc/machine-id` would register under a uuid the
+ * fence cannot read, and every dispatch to it would be refused.
+ */
+export declare const HOSTED_RUNTIME_MACHINE_SOURCES: ReadonlySet<string>;
+/**
+ * The control-plane-issued value of `name` (e.g. `OVERSKY_MACHINE_UUID`), or
+ * null when this process is not on a hosted runtime or the value is absent /
+ * malformed. Only honoured under a hosted `OVERSKY_DAEMON_SOURCE`, so a stray
+ * variable on a laptop cannot rename the machine.
+ */
+export declare function hostedRuntimeIdOverride(name: string, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Return a stable, machine-scoped UUID. Cached for the process lifetime.
+ *
+ * Callers should treat this as opaque: the format differs per platform
+ * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid).
+ * The guarantee is only: same machine -> same value across reboots, and the
+ * same value from every binary that calls this function.
+ *
+ * On a hosted runtime the control-plane-issued `OVERSKY_MACHINE_UUID` wins.
+ *
+ * Falls back to a deterministic hostname+username hash if the platform
+ * probe fails. This preserves server-side record continuity even on
+ * locked-down machines that refuse ioreg / registry access.
+ */
+export declare function getMachineUuid(): string;
+/** @internal test seam — forget the cached value so the next call re-probes. */
+export declare function __resetMachineUuidCacheForTest(): void;