@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineId.js

@@ -23,11 +23,13 @@ exports.__resetCachedDaemonIdForTest = __resetCachedDaemonIdForTest;
  *     directory survives), and a user whose machineUuid changes can
  *     still be re-anchored via the legacy-id list.
  *
- * Auth-core does NOT know about platform-level OS UUIDs (those still
- * live in `daemon/src/registry.ts::getMachineUuid()`). The fallback is
- * supplied by the consumer via the `machineUuidFallback` parameter so
- * a daemon can pass its richer detector while a CLI uses a hostname
- * fingerprint.
+ * This id is NOT the `machineUuid` the server keys Daemon rows on. That
+ * is the hardware id from `getMachineUuid()` (`machineUuid.ts`), and the
+ * two must never be substituted for each other on the wire: OSK-12063
+ * was the CLI sending this id as `machineUuid` on device-key enrollment,
+ * which matched no Daemon row and 404'd forever. The fallback used when
+ * this file cannot be persisted is supplied by the consumer via the
+ * `machineUuidFallback` parameter (the daemon passes `getMachineUuid`).
  */
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -108,9 +110,8 @@ function writeDaemonIdFile(target, id) {
  * SHA-256 of `os.hostname()` + `os.platform()` — better than just
  * hostname (includes platform) but worse than a true hardware UUID.
  *
- * The daemon overrides this with its richer detector
- * (`registry.ts::getMachineUuid()`) when available. The CLI today has
- * no native deps for OS UUIDs and so accepts this default.
+ * The daemon overrides this with the hardware detector
+ * (`getMachineUuid()`, `machineUuid.ts`).
  */
 function defaultMachineUuidFallback() {
     const host = node_os_1.default.hostname() || 'unknown-host';
@@ -129,8 +130,8 @@ function defaultMachineUuidFallback() {
  * with a real UUIDv7 downstream.
  *
  * The caller may pass `machineUuidFallback` to override the default
- * hostname+platform fingerprint with a richer detector (e.g. the
- * daemon's `getMachineUuid()` from `registry.ts`).
+ * hostname+platform fingerprint with a richer detector (e.g.
+ * `getMachineUuid()` from `machineUuid.ts`).
  */
 function ensureMachineDaemonId(machineUuidFallback) {
     if (cachedStableDaemonId !== null)

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Daemon sources whose identity is ISSUED by the control plane rather than
+ * derived from the host: the provisioner mints the daemon id and machine uuid
+ * before the daemon exists, and every binary on the runtime must use exactly
+ * those values.
+ *
+ * `dedicated-runtime` is here because the server's generation fence parses the
+ * lease generation out of the machine uuid (`dedicated-runtime:<lease>:<gen>`).
+ * A guest that fell back to `/etc/machine-id` would register under a uuid the
+ * fence cannot read, and every dispatch to it would be refused.
+ */
+export declare const HOSTED_RUNTIME_MACHINE_SOURCES: ReadonlySet<string>;
+/**
+ * The control-plane-issued value of `name` (e.g. `OVERSKY_MACHINE_UUID`), or
+ * null when this process is not on a hosted runtime or the value is absent /
+ * malformed. Only honoured under a hosted `OVERSKY_DAEMON_SOURCE`, so a stray
+ * variable on a laptop cannot rename the machine.
+ */
+export declare function hostedRuntimeIdOverride(name: string, env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Return a stable, machine-scoped UUID. Cached for the process lifetime.
+ *
+ * Callers should treat this as opaque: the format differs per platform
+ * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid).
+ * The guarantee is only: same machine -> same value across reboots, and the
+ * same value from every binary that calls this function.
+ *
+ * On a hosted runtime the control-plane-issued `OVERSKY_MACHINE_UUID` wins.
+ *
+ * Falls back to a deterministic hostname+username hash if the platform
+ * probe fails. This preserves server-side record continuity even on
+ * locked-down machines that refuse ioreg / registry access.
+ */
+export declare function getMachineUuid(): string;
+/** @internal test seam — forget the cached value so the next call re-probes. */
+export declare function __resetMachineUuidCacheForTest(): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.js

@@ -0,0 +1,156 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HOSTED_RUNTIME_MACHINE_SOURCES = void 0;
+exports.hostedRuntimeIdOverride = hostedRuntimeIdOverride;
+exports.getMachineUuid = getMachineUuid;
+exports.__resetMachineUuidCacheForTest = __resetMachineUuidCacheForTest;
+/**
+ * machineUuid.ts — the ONE hardware machine identity sent to the server as
+ * `machineUuid`, shared by the daemon and the CLI.
+ *
+ * Server Daemon rows are keyed on this value (daemon register, device-key
+ * enrollment, token mint, pairing), so every binary on one machine must
+ * compute it identically. Until OSK-12063 the CLI sent its own UUIDv7 from
+ * `~/.skrr/daemon.id` (`ensureMachineDaemonId()`, a DIFFERENT identity) as
+ * `machineUuid` on device-key enrollment while the daemon sent the hardware
+ * UUID computed here, so every CLI enrollment matched no Daemon row, got
+ * 404 DAEMON_NOT_FOUND and backed off forever. Two implementations of one
+ * identity can only agree by being edited together; this file is the one
+ * implementation, and `daemon/src/registry-lite.ts` re-exports it.
+ *
+ * Deliberately dependency-free (node builtins only) and exposed as the
+ * `@skrr-ai/auth-core/machine-uuid` subpath: the packaged desktop imports the
+ * daemon's `registry-lite.js` directly, and loading the full auth-core index
+ * there would drag in the credential stack for a one-function need.
+ *
+ * Not to be confused with `ensureMachineDaemonId()` (`machineId.ts`), the
+ * minted per-home-dir UUIDv7 that anchors the daemon's `stableDaemonId`. That
+ * one survives an OS reinstall; this one survives a home-dir wipe. They are
+ * different facts and neither may stand in for the other on the wire.
+ */
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_os_1 = __importDefault(require("node:os"));
+const node_child_process_1 = require("node:child_process");
+/**
+ * Daemon sources whose identity is ISSUED by the control plane rather than
+ * derived from the host: the provisioner mints the daemon id and machine uuid
+ * before the daemon exists, and every binary on the runtime must use exactly
+ * those values.
+ *
+ * `dedicated-runtime` is here because the server's generation fence parses the
+ * lease generation out of the machine uuid (`dedicated-runtime:<lease>:<gen>`).
+ * A guest that fell back to `/etc/machine-id` would register under a uuid the
+ * fence cannot read, and every dispatch to it would be refused.
+ */
+exports.HOSTED_RUNTIME_MACHINE_SOURCES = new Set([
+    'hosted-machine',
+    'cloud-coding',
+    'dedicated-runtime',
+]);
+const HOSTED_RUNTIME_ID_RE = /^[A-Za-z0-9_.:-]{1,160}$/;
+/**
+ * The control-plane-issued value of `name` (e.g. `OVERSKY_MACHINE_UUID`), or
+ * null when this process is not on a hosted runtime or the value is absent /
+ * malformed. Only honoured under a hosted `OVERSKY_DAEMON_SOURCE`, so a stray
+ * variable on a laptop cannot rename the machine.
+ */
+function hostedRuntimeIdOverride(name, env = process.env) {
+    if (!exports.HOSTED_RUNTIME_MACHINE_SOURCES.has(env.OVERSKY_DAEMON_SOURCE ?? '')) {
+        return null;
+    }
+    const value = env[name]?.trim();
+    if (!value || !HOSTED_RUNTIME_ID_RE.test(value))
+        return null;
+    return value;
+}
+let cachedMachineUuid = null;
+function readMachineUuidDarwin() {
+    try {
+        const out = (0, node_child_process_1.execFileSync)('ioreg', ['-rd1', '-c', 'IOPlatformExpertDevice'], {
+            encoding: 'utf-8',
+            timeout: 2_000,
+            stdio: ['ignore', 'pipe', 'ignore'],
+        });
+        const match = out.match(/IOPlatformUUID"?\s*=\s*"?([0-9A-F-]{36})/i);
+        return match ? match[1].toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}
+function readMachineUuidLinux() {
+    for (const p of ['/etc/machine-id', '/var/lib/dbus/machine-id']) {
+        try {
+            const raw = node_fs_1.default.readFileSync(p, 'utf-8').trim();
+            if (raw)
+                return raw.toLowerCase();
+        }
+        catch {
+            // Try the next candidate.
+        }
+    }
+    return null;
+}
+function readMachineUuidWindows() {
+    try {
+        const out = (0, node_child_process_1.execFileSync)('reg', ['query', 'HKLM\\SOFTWARE\\Microsoft\\Cryptography', '/v', 'MachineGuid'], { encoding: 'utf-8', timeout: 2_000, stdio: ['ignore', 'pipe', 'ignore'] });
+        const match = out.match(/MachineGuid\s+REG_SZ\s+([0-9A-Fa-f-]{36})/);
+        return match ? match[1].toLowerCase() : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Return a stable, machine-scoped UUID. Cached for the process lifetime.
+ *
+ * Callers should treat this as opaque: the format differs per platform
+ * (macOS IOPlatformUUID, Linux systemd machine-id, Windows MachineGuid).
+ * The guarantee is only: same machine -> same value across reboots, and the
+ * same value from every binary that calls this function.
+ *
+ * On a hosted runtime the control-plane-issued `OVERSKY_MACHINE_UUID` wins.
+ *
+ * Falls back to a deterministic hostname+username hash if the platform
+ * probe fails. This preserves server-side record continuity even on
+ * locked-down machines that refuse ioreg / registry access.
+ */
+function getMachineUuid() {
+    const hostedMachineUuid = hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID');
+    if (hostedMachineUuid)
+        return hostedMachineUuid;
+    if (cachedMachineUuid !== null)
+        return cachedMachineUuid;
+    let detected = null;
+    switch (process.platform) {
+        case 'darwin':
+            detected = readMachineUuidDarwin();
+            break;
+        case 'linux':
+            detected = readMachineUuidLinux();
+            break;
+        case 'win32':
+            detected = readMachineUuidWindows();
+            break;
+    }
+    if (detected) {
+        cachedMachineUuid = detected;
+        return detected;
+    }
+    const fallback = 'fallback-' +
+        node_crypto_1.default
+            .createHash('sha256')
+            .update(`${node_os_1.default.hostname()}:${node_os_1.default.userInfo().username}`)
+            .digest('hex')
+            .slice(0, 32);
+    cachedMachineUuid = fallback;
+    return fallback;
+}
+/** @internal test seam — forget the cached value so the next call re-probes. */
+function __resetMachineUuidCacheForTest() {
+    cachedMachineUuid = null;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refresh.d.ts

@@ -274,6 +274,14 @@ export declare function persistReauthState(state: ReauthState): void;
 export declare function needsReauthState(): {
     needed: boolean;
     reason?: string;
+    /**
+     * The server's own words for the refusal (`Refresh token bound to a different
+     * daemon`). The code alone collapses several distinct causes into one
+     * (`REFRESH_INVALID` is also "not recognized" and "issued without a
+     * daemonId"), and a surface that names only the code cannot tell the reader
+     * which one they hit (OSK-12116).
+     */
+    message?: string;
     since?: number;
 };
 export declare function clearReauthState(): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refresh.js

@@ -969,7 +969,14 @@ function needsReauthState() {
             return { needed: false };
         const raw = node_fs_1.default.readFileSync(flagPath, 'utf-8');
         const state = JSON.parse(raw);
-        return { needed: true, reason: state.code, since: state.at };
+        return {
+            needed: true,
+            reason: state.code,
+            ...(typeof state.message === 'string' && state.message.length > 0
+                ? { message: state.message }
+                : {}),
+            since: state.at,
+        };
     }
     catch {
         return { needed: false };

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -84,3 +84,25 @@ export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
  * etc.) so legitimate tools keep working.
  */
 export declare function sanitizeSpawnEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+/**
+ * OSK-12134 — loopback names a spawned child must reach directly, never through
+ * a proxy. A harness talks to this machine constantly: the daemon's local
+ * bridges (browser, delegated CLI, message intents), the inference broker, and
+ * the engine's own loopback services (skrr Code's `session/new` reaches a local
+ * directory service and failed with "service failure" behind a shell proxy).
+ */
+export declare const LOOPBACK_NO_PROXY_HOSTS: readonly string[];
+/** True when `env` names a proxy some client in the child might honour. */
+export declare function envHasProxy(env: Readonly<Record<string, string | undefined>>): boolean;
+/**
+ * Return `env` with the loopback hosts appended to BOTH `NO_PROXY` and
+ * `no_proxy`, when (and only when) it names a proxy. Tools disagree on which
+ * spelling they read and whether they fall back to the other, so an unset
+ * spelling is seeded from the other one before the hosts are appended —
+ * seeding only the hosts would silently drop every existing exemption for a
+ * tool that prefers the unset spelling. Existing entries keep their order.
+ *
+ * Exported for a parent that layers a proxy onto the child's env AFTER
+ * {@link sanitizeSpawnEnv}: call it again on the final map.
+ */
+export declare function withLoopbackNoProxy<T extends Record<string, string | undefined>>(env: T): T;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -40,8 +40,10 @@
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
 exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
+exports.envHasProxy = envHasProxy;
+exports.withLoopbackNoProxy = withLoopbackNoProxy;
 /**
  * Env vars that must NEVER reach a spawned subprocess.
  *
@@ -187,5 +189,62 @@ function sanitizeSpawnEnv(env) {
             continue;
         out[key] = value;
     }
-    return out;
+    return withLoopbackNoProxy(out);
+}
+/**
+ * OSK-12134 — loopback names a spawned child must reach directly, never through
+ * a proxy. A harness talks to this machine constantly: the daemon's local
+ * bridges (browser, delegated CLI, message intents), the inference broker, and
+ * the engine's own loopback services (skrr Code's `session/new` reaches a local
+ * directory service and failed with "service failure" behind a shell proxy).
+ */
+exports.LOOPBACK_NO_PROXY_HOSTS = ['127.0.0.1', 'localhost', '::1'];
+const PROXY_ENV_VARS = [
+    'HTTP_PROXY',
+    'http_proxy',
+    'HTTPS_PROXY',
+    'https_proxy',
+    'ALL_PROXY',
+    'all_proxy',
+];
+/** True when `env` names a proxy some client in the child might honour. */
+function envHasProxy(env) {
+    return PROXY_ENV_VARS.some((name) => typeof env[name] === 'string' && env[name].trim() !== '');
+}
+function appendNoProxyHosts(list, hosts) {
+    const entries = list
+        .split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter(Boolean);
+    // `*` already exempts everything, and some clients honour it only as the
+    // entire value, so appending to it would break them.
+    if (entries.includes('*'))
+        return list;
+    const missing = hosts.filter((host) => !entries.includes(host));
+    if (missing.length === 0)
+        return list;
+    const kept = list.replace(/[\s,]+$/, '');
+    return kept ? `${kept},${missing.join(',')}` : missing.join(',');
+}
+/**
+ * Return `env` with the loopback hosts appended to BOTH `NO_PROXY` and
+ * `no_proxy`, when (and only when) it names a proxy. Tools disagree on which
+ * spelling they read and whether they fall back to the other, so an unset
+ * spelling is seeded from the other one before the hosts are appended —
+ * seeding only the hosts would silently drop every existing exemption for a
+ * tool that prefers the unset spelling. Existing entries keep their order.
+ *
+ * Exported for a parent that layers a proxy onto the child's env AFTER
+ * {@link sanitizeSpawnEnv}: call it again on the final map.
+ */
+function withLoopbackNoProxy(env) {
+    if (!envHasProxy(env))
+        return env;
+    const upper = env.NO_PROXY?.trim() ? env.NO_PROXY : undefined;
+    const lower = env.no_proxy?.trim() ? env.no_proxy : undefined;
+    return {
+        ...env,
+        NO_PROXY: appendNoProxyHosts(upper ?? lower ?? '', exports.LOOPBACK_NO_PROXY_HOSTS),
+        no_proxy: appendNoProxyHosts(lower ?? upper ?? '', exports.LOOPBACK_NO_PROXY_HOSTS),
+    };
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.d.ts

@@ -21,6 +21,8 @@ type DisabledReason = 'kek_unavailable' | 'init_failed' | 'platform_unsupported'
 export declare function __setStateForTest(next: CredEnvelopeState): CredEnvelopeState;
 /** @internal Test seam — read state for assertions. */
 export declare function __getStateForTest(): CredEnvelopeState;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+export declare function __clearWarnDedupeForTest(): void;
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -123,7 +123,21 @@ function atomicWrite0600(target, value) {
  * The event name passed in is the FULLY-QUALIFIED `cred_envelope.*` form
  * because daemon-side telemetry consumers (`event-log.ts`, dashboards,
  * spec assertions) key off the prefixed name. Do not strip the prefix.
+ *
+ * Identical failure warnings hit the logger only once per process.
+ * Telemetry still records every occurrence — the dedupe exists because a
+ * single unreadable envelope produced the same warning once per stored
+ * field (token, refresh token, expiry…), which read to users as three
+ * crashes rather than one stale credential (OSK-12074). The signature is
+ * event + kek identity + message, so a genuinely different failure mode
+ * still gets its own line.
  */
+const warnedSignatures = new Set();
+const MAX_WARNED_SIGNATURES = 64;
+/** @internal Test seam — each spec owns its warn-dedupe horizon. */
+export function __clearWarnDedupeForTest() {
+    warnedSignatures.clear();
+}
 function emit(eventName, success, metadata) {
     emitAuthTelemetry({
         timestamp: new Date().toISOString(),
@@ -132,7 +146,13 @@ function emit(eventName, success, metadata) {
         metadata: { event: eventName, ...metadata },
     });
     if (!success) {
-        getAuthLogger().warn(`[credEnvelope] ${eventName}`, metadata);
+        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}`;
+        if (!warnedSignatures.has(signature)) {
+            if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
+                warnedSignatures.clear();
+            warnedSignatures.add(signature);
+            getAuthLogger().warn(`[credEnvelope] ${eventName}`, metadata);
+        }
     }
 }
 // ---------------------------------------------------------------------------
@@ -745,6 +765,10 @@ export function maybeDecryptOnRead(stored) {
                 kekId: _state.kekId,
                 kekKind: _state.kekKind,
                 message: err?.message ?? 'unknown',
+                // The crypto error alone reads as a crash; the actionable truth is
+                // that this stored credential is unreadable by THIS binary (usually
+                // a signing-identity or profile drift) and re-login rebuilds it.
+                hint: 'stored credential is unreadable on this machine — signing in again rebuilds it',
             });
             return { plaintext: null, needsMigration: false };
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonToolApproval.d.ts

@@ -23,9 +23,14 @@
  *
  * What the daemon verifies is the binding, not the server's honesty: the
  * request already arrives over the daemon's authenticated server channel, so
- * the field IS the attestation. What the binding buys is that the model —
- * which authors `toolInput` — cannot mint an approval, and an approval for
- * one call cannot be replayed onto another.
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 export declare const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = "daemon_tool_attested_approval_v1";
@@ -89,12 +94,31 @@ export declare function mintAttestedToolApproval(args: {
     now?: number;
     ttlMs?: number;
 }): AttestedToolApproval;
+/**
+ * Why an attestation did not approve a call — logged by the daemon, never
+ * shown to the caller beyond "absent" vs "did not verify".
+ *  - `absent`    — no attestation arrived (the server did not ask anyone)
+ *  - `malformed` — not the v1 shape
+ *  - `expired`   — past `expiresAt`, or issued implausibly far in the future
+ *  - `window`    — the issuer claimed a validity window longer than
+ *                  `ATTESTED_TOOL_APPROVAL_TTL_MS` (or an empty/negative one)
+ *  - `binding`   — minted for a different call (toolUseId, tool, or input)
+ *  - `replayed`  — this exact approval was already spent on this daemon
+ *                  (the ledger is the verifier's caller's, see the daemon's
+ *                  `permissions/attestation-ledger.ts`)
+ */
+export type AttestedToolApprovalRefusalReason = 'absent' | 'malformed' | 'binding' | 'expired' | 'window' | 'replayed';
 export type AttestedToolApprovalVerdict = {
     ok: true;
 } | {
     ok: false;
-    reason: 'absent' | 'malformed' | 'binding' | 'expired';
+    reason: AttestedToolApprovalRefusalReason;
 };
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+export declare const ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS: number;
 /**
  * Daemon side: verify an attestation against the call it claims to approve.
  * Untrusted wire input — every field is checked, and any mismatch is a plain

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonToolApproval.js

@@ -24,9 +24,14 @@ import { createHash } from 'node:crypto';
  *
  * What the daemon verifies is the binding, not the server's honesty: the
  * request already arrives over the daemon's authenticated server channel, so
- * the field IS the attestation. What the binding buys is that the model —
- * which authors `toolInput` — cannot mint an approval, and an approval for
- * one call cannot be replayed onto another.
+ * the field IS the attestation — it is unsigned, and `decidedBy` is a literal.
+ * What the binding buys is that the model — which authors `toolInput` —
+ * cannot mint an approval, and an approval for one call cannot be replayed
+ * onto another. The verifier also bounds the validity window itself (never
+ * trusting the issuer's `expiresAt` beyond `ATTESTED_TOOL_APPROVAL_TTL_MS`),
+ * and the daemon spends each approval once: a second delivery of the same
+ * attestation inside its window is refused as `replayed`. That ledger lives
+ * in daemon memory, so a daemon restart inside the (≤60s) window forgets it.
  */
 /** Announced by a daemon that honours `attestedApproval` on daemon:tool:request. */
 export const DAEMON_TOOL_ATTESTED_APPROVAL_CAPABILITY = 'daemon_tool_attested_approval_v1';
@@ -129,6 +134,11 @@ export function mintAttestedToolApproval(args) {
         expiresAt: now + (args.ttlMs ?? ATTESTED_TOOL_APPROVAL_TTL_MS),
     };
 }
+/**
+ * Clock skew tolerated on `issuedAt`: a server clock slightly ahead of the
+ * daemon's must not refuse a fresh approval.
+ */
+export const ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS = 30 * 1000;
 /**
  * Daemon side: verify an attestation against the call it claims to approve.
  * Untrusted wire input — every field is checked, and any mismatch is a plain
@@ -152,9 +162,17 @@ export function verifyAttestedToolApproval(approval, call) {
         return { ok: false, reason: 'malformed' };
     }
     const now = call.now ?? Date.now();
-    if (a.expiresAt <= now || a.issuedAt > now + 30_000) {
+    if (a.expiresAt <= now || a.issuedAt > now + ATTESTED_TOOL_APPROVAL_CLOCK_SKEW_MS) {
         return { ok: false, reason: 'expired' };
     }
+    // The TTL is the VERIFIER's bound, not the issuer's claim (OSK-12108): an
+    // attestation whose own window is longer than one approval may stay valid
+    // is refused whatever `expiresAt` says, so "answers one person about this
+    // call, moments ago" holds even against an issuer that set a year.
+    const window = a.expiresAt - a.issuedAt;
+    if (!(window > 0) || window > ATTESTED_TOOL_APPROVAL_TTL_MS) {
+        return { ok: false, reason: 'window' };
+    }
     if (a.toolUseId !== call.toolUseId ||
         a.toolName.toLowerCase() !== String(call.toolName).toLowerCase() ||
         a.inputSha256 !== canonicalToolInputDigest(call.toolInput)) {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -585,11 +585,49 @@ export async function enrollWithServer(opts) {
         //     Enrollment is the CLI's (JWT) job; the daemon holding an opaque
         //     token should not enroll. Guarded at the daemon call site, this is
         //     defense-in-depth for any other opaque caller.
-        //   • 409 already-enrolled — a concurrent binary won the enrollment race
-        //     for the shared keypair; idempotent, nothing to do.
+        //   • 409 ALREADY_ENROLLED with OUR thumbprint — a concurrent binary won
+        //     the enrollment race for this keypair; idempotent, nothing to do.
+        //
+        // A 409 is NOT benign when the row is pinned to a DIFFERENT key
+        // (OSK-12063). The server keeps one pin per (user, machine) row while
+        // every local profile has its own key, so a 409 can mean "every refresh
+        // this key signs will be refused with DEVICE_PROOF_THUMBPRINT_MISMATCH".
+        // The server names the pinned thumbprint (`enrolledThumbprint`) so the
+        // two cases can be told apart. An older server that omits it keeps the
+        // old reading, because there is nothing to compare. A 409
+        // ENROLLMENT_DUPLICATE_KEY — this key is pinned on another active row —
+        // is never benign either.
+        let conflictCode = null;
+        let enrolledThumbprint = null;
+        if (response.status === 409) {
+            try {
+                const parsed = JSON.parse(responseText);
+                conflictCode = typeof parsed.code === 'string' ? parsed.code : null;
+                enrolledThumbprint =
+                    typeof parsed.enrolledThumbprint === 'string' ? parsed.enrolledThumbprint : null;
+            }
+            catch {
+                /* non-JSON 409 — treat as the legacy benign race */
+            }
+        }
+        const pinnedToOtherKey = response.status === 409 &&
+            enrolledThumbprint !== null &&
+            enrolledThumbprint !== keypair.thumbprint;
+        const keyPinnedElsewhere = response.status === 409 && conflictCode === 'ENROLLMENT_DUPLICATE_KEY';
         const isBenignRejection = (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) ||
             (response.status === 403 && responseText.includes('OPAQUE_AUTH_REFUSED')) ||
-            response.status === 409;
+            (response.status === 409 && !pinnedToOtherKey && !keyPinnedElsewhere);
+        if (pinnedToOtherKey) {
+            emit('enrollment_key_mismatch', false, {
+                profile,
+                thumbprint: keypair.thumbprint,
+                enrolledThumbprint,
+                serverUrl,
+                message: 'this machine is registered with a different device key than this profile signs ' +
+                    'with; its refreshes will be refused. An interactive daemon login (skrrd login) ' +
+                    're-registers this key.',
+            }, { logLevel: 'warn' });
+        }
         if (response.status === 404 && responseText.includes('DAEMON_NOT_FOUND')) {
             try {
                 atomicWrite0600(backoffPath, JSON.stringify({

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -29,11 +29,13 @@ export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, K
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export * from './firstPartyHarness.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -118,7 +118,12 @@ export {
 initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, 
 // Test seams — file path resolvers + state setters for spec files.
 __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
+// Hardware machine identity sent as `machineUuid` (IOPlatformUUID /
+// machine-id / MachineGuid). ONE implementation for daemon and CLI —
+// OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.
+export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 // Stable per-machine UUIDv7 identity persisted at <configDir>/daemon.id.
+// NOT a `machineUuid` — see machineUuid.ts.
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 // Tier 1 #2 — daemon QR pairing primitives. Pure crypto + AAD framing,
 // shared between the daemon CLI orchestrator (`daemon/src/pair.ts`) and
@@ -140,7 +145,11 @@ export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, har
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+// OSK-12134 — the one proxy-free client for loopback HTTP. Bun's fetch (and
+// Node's under NODE_USE_ENV_PROXY) sends 127.0.0.1 requests to HTTP_PROXY,
+// credentials and all; every loopback caller goes through this instead.
+export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, } from './loopbackHttp.js';
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';