@skrr-ai/cli 0.1.8

package/dist/node_modules/@skrr-ai/data-provider/package.json

@@ -0,0 +1,9 @@
+{
+  "name": "@skrr-ai/data-provider",
+  "version": "0.9.4",
+  "main": "index.js",
+  "dependencies": {
+    "@skrr-ai/auth-core": "^0.1.2"
+  },
+  "_vendoredBy": "cli/scripts/vendor-monorepo-deps.js"
+}

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/contract.d.ts

@@ -0,0 +1,212 @@
+/**
+ * model-proxy/contract.ts — single source of truth for the "subscription model
+ * proxy" feature (BYO-subscription inside a remote sandbox).
+ *
+ * ## Why this exists
+ *
+ * When an OverSky agent runs inside a cloud sandbox (E2B / Fargate) the model
+ * inference is driven by the bundled Claude Code Agent SDK. By default that SDK
+ * authenticates with a PLATFORM credential. To let a user spend their OWN Claude
+ * subscription WITHOUT placing a high-value personal OAuth token on multi-tenant
+ * cloud infra, we do NOT ship the credential into the sandbox. Instead:
+ *
+ *   1. The in-sandbox SDK is pointed at a LOOPBACK proxy via `ANTHROPIC_BASE_URL`
+ *      and given a per-session, revocable RELAY token via `ANTHROPIC_AUTH_TOKEN`.
+ *   2. The in-sandbox daemon's loopback server tunnels each model HTTP call up
+ *      the existing daemon↔backend Socket.IO channel as a `daemon:model-proxy:*`
+ *      stream.
+ *   3. The OverSky backend relays that stream to the USER'S OWN home daemon
+ *      (matched by userId; authorized by the relay token).
+ *   4. The home daemon — which physically holds `~/.claude` — injects the real
+ *      subscription bearer and re-issues the request to api.anthropic.com,
+ *      streaming the response back down the same path.
+ *
+ * The subscription credential therefore never leaves the user's machine; a
+ * sandbox compromise yields only a revocable relay token. See
+ * `docs/architecture/sandbox-subscription-model-proxy-2026-06-29.md`.
+ *
+ * This module holds the wire contract, the env-var names, and the upstream/OAuth
+ * configuration so the sandbox side, the backend relay, and the home daemon all
+ * agree on one shape. It has ZERO runtime dependencies on purpose.
+ */
+/**
+ * Env vars injected into the in-sandbox Agent SDK session (`buildSdkEnv`) when a
+ * session runs in BYO-subscription mode. We use `ANTHROPIC_AUTH_TOKEN` (Bearer)
+ * rather than `ANTHROPIC_API_KEY` so the SDK speaks OAuth-bearer to our loopback
+ * — the value is a per-session RELAY token, never the real subscription token.
+ */
+export declare const MODEL_PROXY_ENV: {
+    /** Points the SDK at the in-sandbox loopback proxy, e.g. `http://127.0.0.1:8788`. */
+    readonly baseUrl: "ANTHROPIC_BASE_URL";
+    /** Per-session relay bearer the SDK sends; validated by the loopback server. */
+    readonly authToken: "ANTHROPIC_AUTH_TOKEN";
+};
+/**
+ * Default Anthropic upstream. The home daemon re-issues `<base><path>`. Kept as
+ * an allowlist of one so a compromised relay cannot make the home daemon hit an
+ * arbitrary host (SSRF hardening — see `egress.ts`).
+ */
+export declare const ANTHROPIC_UPSTREAM_BASE = "https://api.anthropic.com";
+/**
+ * Claude Code OAuth client used to refresh a `claude login` subscription token.
+ *
+ * These are the well-known public Claude Code OAuth client values. They are
+ * configuration, not secrets, and are overridable per deployment.
+ *
+ * IMPORTANT (production gate): verify `tokenUrl` + `clientId` against the
+ * Claude Code version bundled in the home daemon before enabling refresh in
+ * production. A wrong value fails CLOSED (refresh throws), so the worst case is
+ * "subscription proxy unavailable", never a silent wrong-account charge.
+ */
+export declare const CLAUDE_OAUTH_DEFAULTS: {
+    readonly tokenUrl: "https://console.anthropic.com/v1/oauth/token";
+    readonly clientId: "9d1c250a-e61b-44d9-88ed-5944d1962f5e";
+};
+/**
+ * `anthropic-beta` value that flags an OAuth-subscription (vs API-key) request.
+ * Must be present on every outbound request the home daemon authorizes.
+ */
+export declare const ANTHROPIC_OAUTH_BETA = "oauth-2025-04-20";
+/** Default refresh skew: refresh an access token this long before it expires. */
+export declare const DEFAULT_REFRESH_SKEW_MS: number;
+/** Location of the `claude login` credential file, relative to the user's home. */
+export declare const CLAUDE_CREDENTIALS_RELATIVE_PATH: readonly [".claude", ".credentials.json"];
+/** Long-lived headless token env var (`claude setup-token`, sk-ant-oat01-…). */
+export declare const CLAUDE_SETUP_TOKEN_ENV = "CLAUDE_CODE_OAUTH_TOKEN";
+/**
+ * A resolved Claude subscription credential.
+ *  - `oauth`: a refreshable `claude login` bundle (has `refreshToken`/`expiresAt`).
+ *  - `setup-token`: a long-lived `claude setup-token` bearer (no refresh).
+ */
+export interface SubscriptionCredential {
+    kind: 'oauth' | 'setup-token';
+    accessToken: string;
+    refreshToken?: string;
+    /** Epoch ms when `accessToken` expires (oauth only). */
+    expiresAt?: number;
+    /** Where the credential was loaded from, for diagnostics (never the value). */
+    source: 'env' | 'credentials-file';
+}
+/**
+ * Socket.IO event names for the bidirectional model-proxy stream. Modeled on the
+ * existing `daemon:terminal:*` streaming pattern (connection.ts) so it rides the
+ * same transport + Redis bridge without a parallel mechanism.
+ *
+ * The request body is carried INLINE on REQUEST_BEGIN (the Agent SDK sends a
+ * complete request body; only the *response* is SSE-streamed), which keeps
+ * backend routing stateless — one event per upstream call carries everything
+ * needed to route it. CANCEL aborts an in-flight exchange whose response is
+ * still streaming.
+ *
+ * Direction is relative to the HOME daemon:
+ *   request (sandbox → backend → home):  REQUEST_BEGIN, CANCEL
+ *   response (home → backend → sandbox): RESPONSE_BEGIN, RESPONSE_CHUNK, RESPONSE_END
+ */
+export declare const MODEL_PROXY_EVENTS: {
+    readonly REQUEST_BEGIN: "daemon:model-proxy:request";
+    readonly CANCEL: "daemon:model-proxy:cancel";
+    readonly RESPONSE_BEGIN: "daemon:model-proxy:response";
+    readonly RESPONSE_CHUNK: "daemon:model-proxy:response:chunk";
+    readonly RESPONSE_END: "daemon:model-proxy:response:end";
+};
+/**
+ * Stateless backend routing breadcrumb. The backend broker stamps this onto the
+ * request going DOWN to the home daemon; the home daemon echoes it on every
+ * response event so the backend can route the response back to the originating
+ * sandbox daemon without holding per-exchange state. `userId` is always
+ * re-derived from the authenticated socket — never trusted from the wire — so a
+ * daemon can only ever route within its own user.
+ */
+export interface ModelProxyRoute {
+    userId: string;
+    sandboxDaemonId: string;
+}
+/** Subscription providers the model proxy can serve. */
+export declare const MODEL_PROXY_PROVIDERS: {
+    readonly CLAUDE: "claude";
+    readonly CODEX: "codex";
+};
+export type ModelProxyProviderName = (typeof MODEL_PROXY_PROVIDERS)[keyof typeof MODEL_PROXY_PROVIDERS];
+/**
+ * Per-provider env contract injected into the in-sandbox session so the inner
+ * CLI/SDK talks to the loopback with a relay token (never the real credential):
+ *   - Claude Code: `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` (OAuth bearer).
+ *   - Codex: `OPENAI_BASE_URL` + `OPENAI_API_KEY` (the loopback validates the
+ *     relay token; the home daemon swaps in the real ChatGPT/Codex auth).
+ */
+export declare const PROVIDER_PROXY_ENV: Record<ModelProxyProviderName, {
+    baseUrl: string;
+    authToken: string;
+}>;
+/** Opens a model-proxy exchange; carries the full request body inline. */
+export interface ModelProxyRequestBegin {
+    /** Correlation id for this exchange (one per upstream HTTP call). */
+    exchangeId: string;
+    /** Session the exchange belongs to — authorization + routing key. */
+    sessionId: string;
+    /** Relay token the in-sandbox SDK presented; re-validated at the backend. */
+    relayToken: string;
+    /** Which subscription to authorize with (default 'claude'). */
+    provider?: ModelProxyProviderName;
+    method: string;
+    /** Upstream path, e.g. `/v1/messages?beta=true`. */
+    path: string;
+    /** Inbound headers (the home daemon strips auth + injects the real bearer). */
+    headers: Record<string, string>;
+    /** Full request body, base64. Absent for bodiless requests. */
+    bodyBase64?: string;
+    /** Stamped by the backend when relaying down to the home daemon. */
+    route?: ModelProxyRoute;
+}
+/** Upstream response status + headers (sent once, before chunks). */
+export interface ModelProxyResponseBegin {
+    exchangeId: string;
+    status: number;
+    headers: Record<string, string>;
+    /** Echoed by the home daemon so the backend can route the response back. */
+    route?: ModelProxyRoute;
+}
+/** A chunk of the upstream response body (base64, e.g. an SSE frame). */
+export interface ModelProxyResponseChunk {
+    exchangeId: string;
+    dataBase64: string;
+    route?: ModelProxyRoute;
+}
+/** Terminates an exchange; `error` set iff the exchange failed. */
+export interface ModelProxyResponseEnd {
+    exchangeId: string;
+    error?: {
+        code: string;
+        message: string;
+    };
+    route?: ModelProxyRoute;
+}
+/** Cancels an in-flight exchange (client abort / session teardown). */
+export interface ModelProxyCancel {
+    exchangeId: string;
+    sessionId: string;
+    relayToken: string;
+    reason?: string;
+    route?: ModelProxyRoute;
+}
+/** Max inline request-body size (base64-decoded) accepted over the tunnel. */
+export declare const MODEL_PROXY_MAX_BODY_BYTES: number;
+/** Stable error codes surfaced across the proxy. */
+export declare const MODEL_PROXY_ERROR: {
+    readonly SUBSCRIPTION_NOT_FOUND: "subscription_not_found";
+    readonly SUBSCRIPTION_EXPIRED: "subscription_expired";
+    readonly REFRESH_FAILED: "refresh_failed";
+    readonly UPSTREAM_BLOCKED: "upstream_blocked";
+    readonly UPSTREAM_FAILED: "upstream_failed";
+    readonly UNAUTHORIZED: "unauthorized";
+    readonly CANCELLED: "cancelled";
+    readonly REQUEST_TOO_LARGE: "request_too_large";
+    /** Deterministic local request/policy denial; callers must not retry it. */
+    readonly REQUEST_REJECTED: "request_rejected";
+};
+export type ModelProxyErrorCode = (typeof MODEL_PROXY_ERROR)[keyof typeof MODEL_PROXY_ERROR];
+/** Typed error carrying a stable {@link ModelProxyErrorCode}. */
+export declare class ModelProxyError extends Error {
+    code: ModelProxyErrorCode;
+    constructor(code: ModelProxyErrorCode, message: string);
+}

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/contract.js

@@ -0,0 +1,150 @@
+"use strict";
+/**
+ * model-proxy/contract.ts — single source of truth for the "subscription model
+ * proxy" feature (BYO-subscription inside a remote sandbox).
+ *
+ * ## Why this exists
+ *
+ * When an OverSky agent runs inside a cloud sandbox (E2B / Fargate) the model
+ * inference is driven by the bundled Claude Code Agent SDK. By default that SDK
+ * authenticates with a PLATFORM credential. To let a user spend their OWN Claude
+ * subscription WITHOUT placing a high-value personal OAuth token on multi-tenant
+ * cloud infra, we do NOT ship the credential into the sandbox. Instead:
+ *
+ *   1. The in-sandbox SDK is pointed at a LOOPBACK proxy via `ANTHROPIC_BASE_URL`
+ *      and given a per-session, revocable RELAY token via `ANTHROPIC_AUTH_TOKEN`.
+ *   2. The in-sandbox daemon's loopback server tunnels each model HTTP call up
+ *      the existing daemon↔backend Socket.IO channel as a `daemon:model-proxy:*`
+ *      stream.
+ *   3. The OverSky backend relays that stream to the USER'S OWN home daemon
+ *      (matched by userId; authorized by the relay token).
+ *   4. The home daemon — which physically holds `~/.claude` — injects the real
+ *      subscription bearer and re-issues the request to api.anthropic.com,
+ *      streaming the response back down the same path.
+ *
+ * The subscription credential therefore never leaves the user's machine; a
+ * sandbox compromise yields only a revocable relay token. See
+ * `docs/architecture/sandbox-subscription-model-proxy-2026-06-29.md`.
+ *
+ * This module holds the wire contract, the env-var names, and the upstream/OAuth
+ * configuration so the sandbox side, the backend relay, and the home daemon all
+ * agree on one shape. It has ZERO runtime dependencies on purpose.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModelProxyError = exports.MODEL_PROXY_ERROR = exports.MODEL_PROXY_MAX_BODY_BYTES = exports.PROVIDER_PROXY_ENV = exports.MODEL_PROXY_PROVIDERS = exports.MODEL_PROXY_EVENTS = exports.CLAUDE_SETUP_TOKEN_ENV = exports.CLAUDE_CREDENTIALS_RELATIVE_PATH = exports.DEFAULT_REFRESH_SKEW_MS = exports.ANTHROPIC_OAUTH_BETA = exports.CLAUDE_OAUTH_DEFAULTS = exports.ANTHROPIC_UPSTREAM_BASE = exports.MODEL_PROXY_ENV = void 0;
+// ---------------------------------------------------------------------------
+// Environment contract (what the in-sandbox SDK reads)
+// ---------------------------------------------------------------------------
+/**
+ * Env vars injected into the in-sandbox Agent SDK session (`buildSdkEnv`) when a
+ * session runs in BYO-subscription mode. We use `ANTHROPIC_AUTH_TOKEN` (Bearer)
+ * rather than `ANTHROPIC_API_KEY` so the SDK speaks OAuth-bearer to our loopback
+ * — the value is a per-session RELAY token, never the real subscription token.
+ */
+exports.MODEL_PROXY_ENV = {
+    /** Points the SDK at the in-sandbox loopback proxy, e.g. `http://127.0.0.1:8788`. */
+    baseUrl: 'ANTHROPIC_BASE_URL',
+    /** Per-session relay bearer the SDK sends; validated by the loopback server. */
+    authToken: 'ANTHROPIC_AUTH_TOKEN',
+};
+// ---------------------------------------------------------------------------
+// Upstream + OAuth configuration (home-daemon side)
+// ---------------------------------------------------------------------------
+/**
+ * Default Anthropic upstream. The home daemon re-issues `<base><path>`. Kept as
+ * an allowlist of one so a compromised relay cannot make the home daemon hit an
+ * arbitrary host (SSRF hardening — see `egress.ts`).
+ */
+exports.ANTHROPIC_UPSTREAM_BASE = 'https://api.anthropic.com';
+/**
+ * Claude Code OAuth client used to refresh a `claude login` subscription token.
+ *
+ * These are the well-known public Claude Code OAuth client values. They are
+ * configuration, not secrets, and are overridable per deployment.
+ *
+ * IMPORTANT (production gate): verify `tokenUrl` + `clientId` against the
+ * Claude Code version bundled in the home daemon before enabling refresh in
+ * production. A wrong value fails CLOSED (refresh throws), so the worst case is
+ * "subscription proxy unavailable", never a silent wrong-account charge.
+ */
+exports.CLAUDE_OAUTH_DEFAULTS = {
+    tokenUrl: 'https://console.anthropic.com/v1/oauth/token',
+    clientId: '9d1c250a-e61b-44d9-88ed-5944d1962f5e',
+};
+/**
+ * `anthropic-beta` value that flags an OAuth-subscription (vs API-key) request.
+ * Must be present on every outbound request the home daemon authorizes.
+ */
+exports.ANTHROPIC_OAUTH_BETA = 'oauth-2025-04-20';
+/** Default refresh skew: refresh an access token this long before it expires. */
+exports.DEFAULT_REFRESH_SKEW_MS = 5 * 60 * 1000;
+/** Location of the `claude login` credential file, relative to the user's home. */
+exports.CLAUDE_CREDENTIALS_RELATIVE_PATH = ['.claude', '.credentials.json'];
+/** Long-lived headless token env var (`claude setup-token`, sk-ant-oat01-…). */
+exports.CLAUDE_SETUP_TOKEN_ENV = 'CLAUDE_CODE_OAUTH_TOKEN';
+// ---------------------------------------------------------------------------
+// Wire contract — the `daemon:model-proxy:*` stream
+// ---------------------------------------------------------------------------
+/**
+ * Socket.IO event names for the bidirectional model-proxy stream. Modeled on the
+ * existing `daemon:terminal:*` streaming pattern (connection.ts) so it rides the
+ * same transport + Redis bridge without a parallel mechanism.
+ *
+ * The request body is carried INLINE on REQUEST_BEGIN (the Agent SDK sends a
+ * complete request body; only the *response* is SSE-streamed), which keeps
+ * backend routing stateless — one event per upstream call carries everything
+ * needed to route it. CANCEL aborts an in-flight exchange whose response is
+ * still streaming.
+ *
+ * Direction is relative to the HOME daemon:
+ *   request (sandbox → backend → home):  REQUEST_BEGIN, CANCEL
+ *   response (home → backend → sandbox): RESPONSE_BEGIN, RESPONSE_CHUNK, RESPONSE_END
+ */
+exports.MODEL_PROXY_EVENTS = {
+    REQUEST_BEGIN: 'daemon:model-proxy:request',
+    CANCEL: 'daemon:model-proxy:cancel',
+    RESPONSE_BEGIN: 'daemon:model-proxy:response',
+    RESPONSE_CHUNK: 'daemon:model-proxy:response:chunk',
+    RESPONSE_END: 'daemon:model-proxy:response:end',
+};
+/** Subscription providers the model proxy can serve. */
+exports.MODEL_PROXY_PROVIDERS = {
+    CLAUDE: 'claude',
+    CODEX: 'codex',
+};
+/**
+ * Per-provider env contract injected into the in-sandbox session so the inner
+ * CLI/SDK talks to the loopback with a relay token (never the real credential):
+ *   - Claude Code: `ANTHROPIC_BASE_URL` + `ANTHROPIC_AUTH_TOKEN` (OAuth bearer).
+ *   - Codex: `OPENAI_BASE_URL` + `OPENAI_API_KEY` (the loopback validates the
+ *     relay token; the home daemon swaps in the real ChatGPT/Codex auth).
+ */
+exports.PROVIDER_PROXY_ENV = {
+    claude: { baseUrl: 'ANTHROPIC_BASE_URL', authToken: 'ANTHROPIC_AUTH_TOKEN' },
+    codex: { baseUrl: 'OPENAI_BASE_URL', authToken: 'OPENAI_API_KEY' },
+};
+/** Max inline request-body size (base64-decoded) accepted over the tunnel. */
+exports.MODEL_PROXY_MAX_BODY_BYTES = 8 * 1024 * 1024;
+/** Stable error codes surfaced across the proxy. */
+exports.MODEL_PROXY_ERROR = {
+    SUBSCRIPTION_NOT_FOUND: 'subscription_not_found',
+    SUBSCRIPTION_EXPIRED: 'subscription_expired',
+    REFRESH_FAILED: 'refresh_failed',
+    UPSTREAM_BLOCKED: 'upstream_blocked',
+    UPSTREAM_FAILED: 'upstream_failed',
+    UNAUTHORIZED: 'unauthorized',
+    CANCELLED: 'cancelled',
+    REQUEST_TOO_LARGE: 'request_too_large',
+    /** Deterministic local request/policy denial; callers must not retry it. */
+    REQUEST_REJECTED: 'request_rejected',
+};
+/** Typed error carrying a stable {@link ModelProxyErrorCode}. */
+class ModelProxyError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = 'ModelProxyError';
+        this.code = code;
+    }
+}
+exports.ModelProxyError = ModelProxyError;

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/index.d.ts

@@ -0,0 +1,57 @@
+/**
+ * OSK-3891 (ADR-102) — the loopback credential broker, as a shared package.
+ *
+ * ── The invariant this package exists to serve ─────────────────────────────
+ *
+ * **No cloud-reusable credential enters the harness process.** Not its
+ * environment, not its address space, not a file it can read. The harness gets a
+ * random secret bound to a Unix socket that dies with the session; the credential
+ * stays with the parent.
+ *
+ * ── Why it is a package and not a daemon module ────────────────────────────
+ *
+ * The 2026-08-08 token-plane document phrased that invariant as *"the Daemon is
+ * the sole local injection authority"*, which welded a correct requirement to one
+ * implementation. In a cloud-dispatched session the daemon IS the harness's
+ * parent; in a session a human starts with `sky code` the CLI is, and the daemon
+ * is a sibling background service. Requiring the daemon there makes a long-lived
+ * service a prerequisite for an interactive command.
+ *
+ * The requirement is about the harness PROCESS. So the broker lives here, where
+ * either parent can host it, and the server-side authorization is identical in
+ * both cases.
+ *
+ * ── Why NOT reimplement it in the CLI instead ──────────────────────────────
+ *
+ * The loopback server enforces the request envelope — model, route, dialect, byte
+ * ceiling, concurrency, rate — before anything leaves the machine. That
+ * enforcement IS the security value of the design. A second implementation would
+ * fork it, and the fork would drift silently because both halves would keep
+ * working.
+ *
+ * ── What the broker does and does not buy ──────────────────────────────────
+ *
+ * It reduces the blast radius of ACCIDENTAL disclosure: a crash dump, a verbose
+ * log, a repository plugin that prints `process.env`. That is the live risk,
+ * because a coding harness runs code authored by whoever wrote the repository it
+ * was pointed at.
+ *
+ * It is NOT a boundary against a MALICIOUS harness. Same UID means the child can
+ * read the parent's memory or simply ask for another session. Process confinement
+ * is a separate, unshipped control, and this package must not be described as
+ * providing it.
+ *
+ * (Its earlier stated rationale — that the daemon would otherwise hold a LiteLLM
+ * virtual key — is obsolete: current servers deliver an `agst_` session token and
+ * resolve the virtual key server-side. Recorded because an expired rationale does
+ * not fail loudly; it just invites someone to delete a still-needed control.)
+ *
+ * ── Dual build, deliberately ───────────────────────────────────────────────
+ *
+ * ESM and CJS are both emitted because the daemon is ESM and the CLI is CJS, and
+ * this package exists precisely so both can host the broker.
+ */
+export { INFERENCE_BROKER_ORIGIN, INFERENCE_BROKER_SOCKET_ENV, MANAGED_SESSION_ENV, MANAGED_PROMPT_CACHING_ENV, MANAGED_STATUS_PATH, type ManagedSessionStatus, buildManagedInferenceRelayCredential, startManagedInferenceBroker, isManagedInferenceModelScope, type GatewayCredential, type ManagedCapabilityRefresh, type ManagedCapabilityRefreshResult, type ManagedInferenceBrokerOptions, type ManagedInferenceBrokerSession, type ManagedInferenceInputTokenAccounting, type ManagedInferenceModelScope, type ManagedInferenceRequestEnvelope, type ManagedReasoningPolicy, } from './managed-inference-broker.js';
+export { minimumCapabilityWindowMs, scheduleRenewalDelay, startRenewalLoop, type CapabilityRefreshOutcome, type RenewalLoop, type RenewalLoopOptions, type RenewalOutcome, type RenewalStopReason, } from './managed-inference-renewal.js';
+export { ModelProxyLoopbackServer, type ModelProxyForwarder } from './loopback-server.js';
+export * from './contract.js';

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/index.js

@@ -0,0 +1,89 @@
+"use strict";
+/**
+ * OSK-3891 (ADR-102) — the loopback credential broker, as a shared package.
+ *
+ * ── The invariant this package exists to serve ─────────────────────────────
+ *
+ * **No cloud-reusable credential enters the harness process.** Not its
+ * environment, not its address space, not a file it can read. The harness gets a
+ * random secret bound to a Unix socket that dies with the session; the credential
+ * stays with the parent.
+ *
+ * ── Why it is a package and not a daemon module ────────────────────────────
+ *
+ * The 2026-08-08 token-plane document phrased that invariant as *"the Daemon is
+ * the sole local injection authority"*, which welded a correct requirement to one
+ * implementation. In a cloud-dispatched session the daemon IS the harness's
+ * parent; in a session a human starts with `sky code` the CLI is, and the daemon
+ * is a sibling background service. Requiring the daemon there makes a long-lived
+ * service a prerequisite for an interactive command.
+ *
+ * The requirement is about the harness PROCESS. So the broker lives here, where
+ * either parent can host it, and the server-side authorization is identical in
+ * both cases.
+ *
+ * ── Why NOT reimplement it in the CLI instead ──────────────────────────────
+ *
+ * The loopback server enforces the request envelope — model, route, dialect, byte
+ * ceiling, concurrency, rate — before anything leaves the machine. That
+ * enforcement IS the security value of the design. A second implementation would
+ * fork it, and the fork would drift silently because both halves would keep
+ * working.
+ *
+ * ── What the broker does and does not buy ──────────────────────────────────
+ *
+ * It reduces the blast radius of ACCIDENTAL disclosure: a crash dump, a verbose
+ * log, a repository plugin that prints `process.env`. That is the live risk,
+ * because a coding harness runs code authored by whoever wrote the repository it
+ * was pointed at.
+ *
+ * It is NOT a boundary against a MALICIOUS harness. Same UID means the child can
+ * read the parent's memory or simply ask for another session. Process confinement
+ * is a separate, unshipped control, and this package must not be described as
+ * providing it.
+ *
+ * (Its earlier stated rationale — that the daemon would otherwise hold a LiteLLM
+ * virtual key — is obsolete: current servers deliver an `agst_` session token and
+ * resolve the virtual key server-side. Recorded because an expired rationale does
+ * not fail loudly; it just invites someone to delete a still-needed control.)
+ *
+ * ── Dual build, deliberately ───────────────────────────────────────────────
+ *
+ * ESM and CJS are both emitted because the daemon is ESM and the CLI is CJS, and
+ * this package exists precisely so both can host the broker.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ModelProxyLoopbackServer = exports.startRenewalLoop = exports.scheduleRenewalDelay = exports.minimumCapabilityWindowMs = exports.isManagedInferenceModelScope = exports.startManagedInferenceBroker = exports.buildManagedInferenceRelayCredential = exports.MANAGED_STATUS_PATH = exports.MANAGED_PROMPT_CACHING_ENV = exports.MANAGED_SESSION_ENV = exports.INFERENCE_BROKER_SOCKET_ENV = exports.INFERENCE_BROKER_ORIGIN = void 0;
+var managed_inference_broker_js_1 = require("./managed-inference-broker.js");
+Object.defineProperty(exports, "INFERENCE_BROKER_ORIGIN", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_ORIGIN; } });
+Object.defineProperty(exports, "INFERENCE_BROKER_SOCKET_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.INFERENCE_BROKER_SOCKET_ENV; } });
+Object.defineProperty(exports, "MANAGED_SESSION_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_SESSION_ENV; } });
+Object.defineProperty(exports, "MANAGED_PROMPT_CACHING_ENV", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_PROMPT_CACHING_ENV; } });
+Object.defineProperty(exports, "MANAGED_STATUS_PATH", { enumerable: true, get: function () { return managed_inference_broker_js_1.MANAGED_STATUS_PATH; } });
+Object.defineProperty(exports, "buildManagedInferenceRelayCredential", { enumerable: true, get: function () { return managed_inference_broker_js_1.buildManagedInferenceRelayCredential; } });
+Object.defineProperty(exports, "startManagedInferenceBroker", { enumerable: true, get: function () { return managed_inference_broker_js_1.startManagedInferenceBroker; } });
+Object.defineProperty(exports, "isManagedInferenceModelScope", { enumerable: true, get: function () { return managed_inference_broker_js_1.isManagedInferenceModelScope; } });
+var managed_inference_renewal_js_1 = require("./managed-inference-renewal.js");
+Object.defineProperty(exports, "minimumCapabilityWindowMs", { enumerable: true, get: function () { return managed_inference_renewal_js_1.minimumCapabilityWindowMs; } });
+Object.defineProperty(exports, "scheduleRenewalDelay", { enumerable: true, get: function () { return managed_inference_renewal_js_1.scheduleRenewalDelay; } });
+Object.defineProperty(exports, "startRenewalLoop", { enumerable: true, get: function () { return managed_inference_renewal_js_1.startRenewalLoop; } });
+var loopback_server_js_1 = require("./loopback-server.js");
+Object.defineProperty(exports, "ModelProxyLoopbackServer", { enumerable: true, get: function () { return loopback_server_js_1.ModelProxyLoopbackServer; } });
+// Re-exported in full because `daemon/src/model-proxy/contract.ts` becomes a
+// pure re-export of this module: 23 daemon files import that path today, and
+// keeping it a re-export means none of them change.
+__exportStar(require("./contract.js"), exports);

package/dist/node_modules/@skrr-ai/inference-broker/dist/cjs/loopback-server.d.ts

@@ -0,0 +1,70 @@
+/**
+ * model-proxy/loopback-server.ts — in-sandbox loopback proxy.
+ *
+ * Runs inside the cloud sandbox. The Agent SDK is pointed here via
+ * `ANTHROPIC_BASE_URL=http://127.0.0.1:<port>` and authenticates with a
+ * per-session relay token via `ANTHROPIC_AUTH_TOKEN`. This server:
+ *   1. binds to 127.0.0.1 ONLY (never routable off-box),
+ *   2. constant-time validates the relay bearer the SDK presents,
+ *   3. forwards each request through an injected {@link ModelProxyForwarder}
+ *      (the Socket.IO tunnel up to the backend → home daemon),
+ *   4. streams the upstream response back to the SDK unchanged.
+ *
+ * The sandbox therefore never holds the real subscription credential and never
+ * needs egress to api.anthropic.com — only to the OverSky control plane.
+ */
+/** The sandbox-side transport seam: forwards one exchange up to the home daemon. */
+export interface ModelProxyForwarder {
+    forward(req: {
+        method: string;
+        path: string;
+        headers: Record<string, string>;
+        body: Uint8Array | null;
+    }, opts: {
+        signal: AbortSignal;
+    }): Promise<{
+        status: number;
+        headers: Record<string, string>;
+        body: AsyncIterable<Uint8Array>;
+    }>;
+}
+export interface LoopbackServerOptions {
+    /** Per-session relay token the SDK must present as `Authorization: Bearer …`. */
+    relayToken: string;
+    forwarder: ModelProxyForwarder;
+    /** Loopback host. Defaults to 127.0.0.1; never bind to 0.0.0.0. */
+    host?: string;
+    /** Fixed port, or 0 (default) for an ephemeral port. */
+    port?: number;
+    /** Private Unix-domain socket transport. Mutually exclusive with TCP host/port. */
+    socketPath?: string;
+    /** URL advertised to a client that uses `fetch(..., { unix: socketPath })`. */
+    advertisedBaseUrl?: string;
+    /** Bounded before buffering so a local child cannot exhaust daemon memory. */
+    maxBodyBytes?: number;
+    onError?: (err: Error) => void;
+}
+export declare class ModelProxyLoopbackServer {
+    private server;
+    /**
+     * `server.close()` only stops accepting new connections.  A managed lease
+     * must also stop requests which have already reached this relay: otherwise a
+     * cancelled session can keep an upstream stream alive until the provider
+     * happens to finish.  Track both transport sockets and forward abort signals
+     * so `stop()` is an authority revocation, not merely a listener shutdown.
+     */
+    private readonly activeSockets;
+    private readonly activeRequests;
+    private readonly opts;
+    private boundPort;
+    constructor(opts: LoopbackServerOptions);
+    /** Starts the server and returns the base URL to put in `ANTHROPIC_BASE_URL`. */
+    start(): Promise<{
+        baseUrl: string;
+        port: number;
+    }>;
+    stop(): Promise<void>;
+    baseUrl(): string;
+    private handle;
+    private authorize;
+}