@skrr-ai/cli 0.1.80 → 0.1.82

package/dist/lib/ssh-ordered-bytes.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SshOrderedBytes = void 0;
+/** A bounded receiver for a retryable SSH byte stream. One frame may be
+ * outstanding. A lost acknowledgment may repeat that exact frame, never its
+ * bytes; an overlapping, changed, or skipped frame is a stream error. */
+class SshOrderedBytes {
+    nextOffset = 0;
+    last;
+    receive(offset, bytes, write) {
+        if (!Number.isSafeInteger(offset) || offset < 0 || bytes.length < 1 || bytes.length > 16 * 1024 ||
+            !Number.isSafeInteger(offset + bytes.length)) {
+            return Promise.reject(new Error('invalid SSH stream frame'));
+        }
+        if (this.last?.offset === offset) {
+            return this.last.bytes.equals(bytes)
+                ? this.last.written
+                : Promise.reject(new Error('changed SSH stream replay'));
+        }
+        if (offset !== this.nextOffset)
+            return Promise.reject(new Error('SSH stream offset mismatch'));
+        const retained = Buffer.from(bytes);
+        const written = Promise.resolve().then(() => write(retained)).then(() => {
+            this.nextOffset = offset + retained.length;
+            return this.nextOffset;
+        });
+        this.last = { offset, bytes: retained, written };
+        return written;
+    }
+}
+exports.SshOrderedBytes = SshOrderedBytes;

package/dist/lib/usd-micros.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Parse a user-typed USD amount ("5", "2.50") into integer micros.
+ *
+ * Integer arithmetic on the decimal STRING, never `Number(x) * 1e6`: binary
+ * floating point turns 0.29 into 289999.99… and a money path that truncates
+ * that charges a micro less — or, rounded the other way, a micro more.
+ * Returns null for anything that is not a positive amount with ≤ 2 decimals.
+ */
+export declare function usdToMicros(amount: string): number | null;

package/dist/lib/usd-micros.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.usdToMicros = usdToMicros;
+/**
+ * Parse a user-typed USD amount ("5", "2.50") into integer micros.
+ *
+ * Integer arithmetic on the decimal STRING, never `Number(x) * 1e6`: binary
+ * floating point turns 0.29 into 289999.99… and a money path that truncates
+ * that charges a micro less — or, rounded the other way, a micro more.
+ * Returns null for anything that is not a positive amount with ≤ 2 decimals.
+ */
+function usdToMicros(amount) {
+    const trimmed = amount.trim();
+    if (!/^\d+(\.\d{1,2})?$/.test(trimmed))
+        return null;
+    const [whole, frac = ''] = trimmed.split('.');
+    const cents = Number(whole) * 100 + Number(frac.padEnd(2, '0'));
+    if (!Number.isSafeInteger(cents) || cents <= 0)
+        return null;
+    return cents * 10_000;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialResolver.d.ts

@@ -13,8 +13,11 @@
  * Precedence (high → low):
  *
  *   1. flag         — `--token <jwt>` CLI flag (debugging)
- *   2. env-token    — `OVERSKY_TOKEN` env (CI / static; Phase I adds
- *                     server-side scope=ci validation)
+ *   2. env-token    — `OVERSKY_TOKEN` (CI / static). The CLI also reads
+ *                     `SKRR_TOKEN` via `envTokenNames`; `OVERSKY_TOKEN` wins
+ *                     when both are set, matching the CLI config overlay. A
+ *                     personal access token (`osk_pat_*`) is the credential
+ *                     CI should put here.
  *   3. auth-helper  — `OVERSKY_AUTH_HELPER` script output (rotating
  *                     creds — Vault, AWS SM, internal SSO proxy)
  *   4. fd-handoff   — `OVERSKY_AUTH_FD` parent→child IPC (Electron
@@ -64,6 +67,12 @@ export interface CredentialResolverOptions {
      * string to use that value directly.
      */
     envTokenOverride?: string | null;
+    /**
+     * Environment variables read by the env-token slot, in precedence order.
+     * Defaults to `['OVERSKY_TOKEN']`. The CLI passes
+     * `['OVERSKY_TOKEN', 'SKRR_TOKEN']` (OSK-13208).
+     */
+    envTokenNames?: readonly string[];
     /** Test/explicit override for `OVERSKY_AUTH_HELPER` env. Same semantics. */
     authHelperPathOverride?: string | null;
     /**
@@ -143,6 +152,8 @@ export interface AuthHelperSentinelInfo {
  *                  (POST /api/daemons/token), MUST NOT schedule refresh,
  *                  and on auth failure exits 75 with a CI-specific error
  *                  rather than writing needs-reauth.json.
+ *   - 'pat'      — personal access token (`osk_pat_*`, OSK-13208): a static
+ *                  bearer used AS the user by the CLI. Never refreshed.
  *   - 'install'  — short-lived web-minted JWT with `scope=daemon-install`.
  *                  The daemon exchanges it through the same /api/daemons/token
  *                  bootstrap path, persists only the returned daemon
@@ -157,9 +168,17 @@ export interface AuthHelperSentinelInfo {
  * The kill switch `OVERSKY_DISABLE_CI_TOKEN_RESOLVER=1` forces every token to
  * `'standard'` for triage purposes.
  */
-export type TokenKind = 'standard' | 'ci' | 'install';
+export type TokenKind = 'standard' | 'ci' | 'install' | 'pat';
 /** CI-token plaintext prefix; mirrors api/server/services/Auth/daemonCiTokens.js. */
 export declare const CI_TOKEN_PREFIX = "osk_ci_";
+/** Personal-access-token prefix; mirrors api/server/services/Auth/personalAccessTokens.js. */
+export declare const PERSONAL_ACCESS_TOKEN_PREFIX = "osk_pat_";
+/**
+ * True for a kind whose token is static by construction: never refreshed,
+ * never rotated into a store. Like `TokenKind` itself this selects a local
+ * code path and grants nothing.
+ */
+export declare function isStaticTokenKind(kind: TokenKind): boolean;
 /**
  * Classify a token by local shape. Pure function; safe to call on any string
  * (including `null`-coerced empty). Returns `'standard'` for empty input

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialResolver.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CredentialResolver = exports.AuthHelperUntrustedError = exports.AuthHelperUnavailableError = exports.CI_TOKEN_PREFIX = exports.CREDENTIAL_PRECEDENCE = void 0;
+exports.CredentialResolver = exports.AuthHelperUntrustedError = exports.AuthHelperUnavailableError = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.CREDENTIAL_PRECEDENCE = void 0;
+exports.isStaticTokenKind = isStaticTokenKind;
 exports.classifyTokenKind = classifyTokenKind;
 exports.__resetCredentialResolverForTest = __resetCredentialResolverForTest;
 exports.invalidateAuthHelperCache = invalidateAuthHelperCache;
@@ -19,8 +20,11 @@ exports.invalidateAuthHelperCache = invalidateAuthHelperCache;
  * Precedence (high → low):
  *
  *   1. flag         — `--token <jwt>` CLI flag (debugging)
- *   2. env-token    — `OVERSKY_TOKEN` env (CI / static; Phase I adds
- *                     server-side scope=ci validation)
+ *   2. env-token    — `OVERSKY_TOKEN` (CI / static). The CLI also reads
+ *                     `SKRR_TOKEN` via `envTokenNames`; `OVERSKY_TOKEN` wins
+ *                     when both are set, matching the CLI config overlay. A
+ *                     personal access token (`osk_pat_*`) is the credential
+ *                     CI should put here.
  *   3. auth-helper  — `OVERSKY_AUTH_HELPER` script output (rotating
  *                     creds — Vault, AWS SM, internal SSO proxy)
  *   4. fd-handoff   — `OVERSKY_AUTH_FD` parent→child IPC (Electron
@@ -68,6 +72,16 @@ exports.CREDENTIAL_PRECEDENCE = [
 ];
 /** CI-token plaintext prefix; mirrors api/server/services/Auth/daemonCiTokens.js. */
 exports.CI_TOKEN_PREFIX = 'osk_ci_';
+/** Personal-access-token prefix; mirrors api/server/services/Auth/personalAccessTokens.js. */
+exports.PERSONAL_ACCESS_TOKEN_PREFIX = 'osk_pat_';
+/**
+ * True for a kind whose token is static by construction: never refreshed,
+ * never rotated into a store. Like `TokenKind` itself this selects a local
+ * code path and grants nothing.
+ */
+function isStaticTokenKind(kind) {
+    return kind === 'ci' || kind === 'pat';
+}
 /**
  * Classify a token by local shape. Pure function; safe to call on any string
  * (including `null`-coerced empty). Returns `'standard'` for empty input
@@ -103,6 +117,8 @@ function classifyTokenKind(token) {
         return 'standard';
     if (token.startsWith(exports.CI_TOKEN_PREFIX))
         return 'ci';
+    if (token.startsWith(exports.PERSONAL_ACCESS_TOKEN_PREFIX))
+        return 'pat';
     const payload = (0, jwtUtils_js_1.decodeJwtPayload)(token);
     if (payload &&
         typeof payload === 'object' &&
@@ -260,8 +276,16 @@ class CredentialResolver {
         if (typeof this.opts.envTokenOverride === 'string') {
             return this.opts.envTokenOverride.length > 0 ? this.opts.envTokenOverride : null;
         }
-        const v = process.env.OVERSKY_TOKEN;
-        return typeof v === 'string' && v.length > 0 ? v : null;
+        // `OVERSKY_TOKEN` first (retained by decision, docs/product/skrr-env-inventory.md),
+        // then any renamed spelling the caller opted into (`SKRR_TOKEN` for the CLI,
+        // OSK-13208). The daemon does not opt in: a CI job that sets `SKRR_TOKEN`
+        // for `skrr` must not have a co-located `skrrd` silently adopt it.
+        for (const name of this.opts.envTokenNames ?? ['OVERSKY_TOKEN']) {
+            const v = process.env[name];
+            if (typeof v === 'string' && v.length > 0)
+                return v;
+        }
+        return null;
     }
     async tryResolveAuthHelper() {
         let helperPath;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -38,7 +38,13 @@ export declare function describeDeviceKeySplit(profile: string): {
  * Order:
  *   1. Try to load existing keypair from disk.
  *      - Success → state = active.
- *      - Missing files / corruption / decrypt failure → step 2.
+ *      - No key material at all (first install) → step 2.
+ *      - Key material present but unloadable (corruption, decrypt failure,
+ *        public/private mismatch) → disabled+unreadable_key and a
+ *        `recovery_required` event, UNLESS `recoverUnreadable` is set. Only
+ *        an explicit interactive login sets it, because that login proves and
+ *        re-pins the new key; replacing it on ordinary boot would sign the
+ *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -355,7 +355,13 @@ async function consolidateDeviceIdentity(profile) {
  * Order:
  *   1. Try to load existing keypair from disk.
  *      - Success → state = active.
- *      - Missing files / corruption / decrypt failure → step 2.
+ *      - No key material at all (first install) → step 2.
+ *      - Key material present but unloadable (corruption, decrypt failure,
+ *        public/private mismatch) → disabled+unreadable_key and a
+ *        `recovery_required` event, UNLESS `recoverUnreadable` is set. Only
+ *        an explicit interactive login sets it, because that login proves and
+ *        re-pins the new key; replacing it on ordinary boot would sign the
+ *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -16,7 +16,7 @@ export { classifyRefreshResponse, type RefreshResponseShape, type ClassifiedRefr
 export { refreshDaemonToken, revokeDaemonRefreshSession, withAuthLock, persistReauthState, needsReauthState, clearReauthState, installLockExitHandlers, __refreshDiagnostics, __resetUnknown401StreaksForTest, UNKNOWN_401_BUDGET, } from './refresh.js';
 export { createRefreshScheduler, type RefreshScheduler, type RefreshSchedulerOptions, } from './refreshScheduler.js';
 export { readAuthFromFd, __setFdReaderForTest, type FdAuthPayload } from './fdToken.js';
-export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverForTest, invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, AuthHelperUntrustedError, AuthHelperUnavailableError, type CredentialSource, type CredentialStoreMode, type CredentialResolverOptions, type ResolvedCredential, type TokenKind, type HelperTrustDecision, type AuthHelperBlockedInfo, type AuthHelperSentinelInfo, } from './credentialResolver.js';
+export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverForTest, invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, PERSONAL_ACCESS_TOKEN_PREFIX, isStaticTokenKind, AuthHelperUntrustedError, AuthHelperUnavailableError, type CredentialSource, type CredentialStoreMode, type CredentialResolverOptions, type ResolvedCredential, type TokenKind, type HelperTrustDecision, type AuthHelperBlockedInfo, type AuthHelperSentinelInfo, } from './credentialResolver.js';
 export { invokeAuthHelper, getDefaultHelperTtlMs, getLastAuthHelperFailureReason, __resetAuthHelperFailureReasonForTest, SENTINEL_TRIGGERING_FAILURES, type HelperResult, type InvokeAuthHelperOptions, type AuthHelperFailureReason, } from './authHelper.js';
 export { runHeadersHelper, invalidateHeadersHelperCache, type RunHeadersHelperOptions, } from './headers-helper.js';
 export { generateVerifier, challenge, generateState, safeEqual, verifyChallenge, type PkceChallengeMethod, } from './pkce.js';
@@ -35,7 +35,7 @@ export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest,
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, DAEMON_CHILD_ENV, isDaemonChildEnv, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
 export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -22,11 +22,11 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
-exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = void 0;
-exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = void 0;
-exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = void 0;
+exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.isStaticTokenKind = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
+exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
+exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
+exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -109,6 +109,8 @@ Object.defineProperty(exports, "__resetCredentialResolverForTest", { enumerable:
 Object.defineProperty(exports, "invalidateAuthHelperCache", { enumerable: true, get: function () { return credentialResolver_js_1.invalidateAuthHelperCache; } });
 Object.defineProperty(exports, "classifyTokenKind", { enumerable: true, get: function () { return credentialResolver_js_1.classifyTokenKind; } });
 Object.defineProperty(exports, "CI_TOKEN_PREFIX", { enumerable: true, get: function () { return credentialResolver_js_1.CI_TOKEN_PREFIX; } });
+Object.defineProperty(exports, "PERSONAL_ACCESS_TOKEN_PREFIX", { enumerable: true, get: function () { return credentialResolver_js_1.PERSONAL_ACCESS_TOKEN_PREFIX; } });
+Object.defineProperty(exports, "isStaticTokenKind", { enumerable: true, get: function () { return credentialResolver_js_1.isStaticTokenKind; } });
 // L6.1 / L6.3 — fail-closed errors thrown by the auth-helper slot.
 Object.defineProperty(exports, "AuthHelperUntrustedError", { enumerable: true, get: function () { return credentialResolver_js_1.AuthHelperUntrustedError; } });
 Object.defineProperty(exports, "AuthHelperUnavailableError", { enumerable: true, get: function () { return credentialResolver_js_1.AuthHelperUnavailableError; } });
@@ -344,6 +346,8 @@ Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get
 Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_NAME_TOKENS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_NAME_TOKENS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
+Object.defineProperty(exports, "DAEMON_CHILD_ENV", { enumerable: true, get: function () { return spawnEnv_js_1.DAEMON_CHILD_ENV; } });
+Object.defineProperty(exports, "isDaemonChildEnv", { enumerable: true, get: function () { return spawnEnv_js_1.isDaemonChildEnv; } });
 Object.defineProperty(exports, "LOOPBACK_NO_PROXY_HOSTS", { enumerable: true, get: function () { return spawnEnv_js_1.LOOPBACK_NO_PROXY_HOSTS; } });
 Object.defineProperty(exports, "envHasProxy", { enumerable: true, get: function () { return spawnEnv_js_1.envHasProxy; } });
 Object.defineProperty(exports, "withLoopbackNoProxy", { enumerable: true, get: function () { return spawnEnv_js_1.withLoopbackNoProxy; } });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -77,6 +77,31 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+export declare const DAEMON_CHILD_ENV = "SKRR_DAEMON_CHILD";
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+export declare function isDaemonChildEnv(env: Readonly<Record<string, string | undefined>>): boolean;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -40,7 +40,8 @@
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.LOOPBACK_NO_PROXY_HOSTS = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.isDaemonChildEnv = isDaemonChildEnv;
 exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 exports.envHasProxy = envHasProxy;
 exports.withLoopbackNoProxy = withLoopbackNoProxy;
@@ -154,7 +155,40 @@ exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // engine) must keep it to detect they already run as the workload uid. Not
     // a secret — it authorizes nothing without the matching real uid.
     'SKRR_WORKLOAD_UID',
+    // OSK-13254 — "this process descends from a skrrd agent/tool spawn". It only
+    // ever REMOVES authority (a `skrr` that sees it borrows from the daemon and
+    // never reads or writes a stored CLI session), so it must survive every later
+    // re-sanitization: a Bash tool that runs `skrr code`, whose engine runs `skrr`,
+    // is still the agent's process. See `DAEMON_CHILD_ENV` below.
+    'SKRR_DAEMON_CHILD',
 ]);
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+exports.DAEMON_CHILD_ENV = 'SKRR_DAEMON_CHILD';
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+function isDaemonChildEnv(env) {
+    return Boolean(env[exports.DAEMON_CHILD_ENV]?.trim());
+}
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialResolver.d.ts

@@ -13,8 +13,11 @@
  * Precedence (high → low):
  *
  *   1. flag         — `--token <jwt>` CLI flag (debugging)
- *   2. env-token    — `OVERSKY_TOKEN` env (CI / static; Phase I adds
- *                     server-side scope=ci validation)
+ *   2. env-token    — `OVERSKY_TOKEN` (CI / static). The CLI also reads
+ *                     `SKRR_TOKEN` via `envTokenNames`; `OVERSKY_TOKEN` wins
+ *                     when both are set, matching the CLI config overlay. A
+ *                     personal access token (`osk_pat_*`) is the credential
+ *                     CI should put here.
  *   3. auth-helper  — `OVERSKY_AUTH_HELPER` script output (rotating
  *                     creds — Vault, AWS SM, internal SSO proxy)
  *   4. fd-handoff   — `OVERSKY_AUTH_FD` parent→child IPC (Electron
@@ -64,6 +67,12 @@ export interface CredentialResolverOptions {
      * string to use that value directly.
      */
     envTokenOverride?: string | null;
+    /**
+     * Environment variables read by the env-token slot, in precedence order.
+     * Defaults to `['OVERSKY_TOKEN']`. The CLI passes
+     * `['OVERSKY_TOKEN', 'SKRR_TOKEN']` (OSK-13208).
+     */
+    envTokenNames?: readonly string[];
     /** Test/explicit override for `OVERSKY_AUTH_HELPER` env. Same semantics. */
     authHelperPathOverride?: string | null;
     /**
@@ -143,6 +152,8 @@ export interface AuthHelperSentinelInfo {
  *                  (POST /api/daemons/token), MUST NOT schedule refresh,
  *                  and on auth failure exits 75 with a CI-specific error
  *                  rather than writing needs-reauth.json.
+ *   - 'pat'      — personal access token (`osk_pat_*`, OSK-13208): a static
+ *                  bearer used AS the user by the CLI. Never refreshed.
  *   - 'install'  — short-lived web-minted JWT with `scope=daemon-install`.
  *                  The daemon exchanges it through the same /api/daemons/token
  *                  bootstrap path, persists only the returned daemon
@@ -157,9 +168,17 @@ export interface AuthHelperSentinelInfo {
  * The kill switch `OVERSKY_DISABLE_CI_TOKEN_RESOLVER=1` forces every token to
  * `'standard'` for triage purposes.
  */
-export type TokenKind = 'standard' | 'ci' | 'install';
+export type TokenKind = 'standard' | 'ci' | 'install' | 'pat';
 /** CI-token plaintext prefix; mirrors api/server/services/Auth/daemonCiTokens.js. */
 export declare const CI_TOKEN_PREFIX = "osk_ci_";
+/** Personal-access-token prefix; mirrors api/server/services/Auth/personalAccessTokens.js. */
+export declare const PERSONAL_ACCESS_TOKEN_PREFIX = "osk_pat_";
+/**
+ * True for a kind whose token is static by construction: never refreshed,
+ * never rotated into a store. Like `TokenKind` itself this selects a local
+ * code path and grants nothing.
+ */
+export declare function isStaticTokenKind(kind: TokenKind): boolean;
 /**
  * Classify a token by local shape. Pure function; safe to call on any string
  * (including `null`-coerced empty). Returns `'standard'` for empty input

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialResolver.js

@@ -13,8 +13,11 @@
  * Precedence (high → low):
  *
  *   1. flag         — `--token <jwt>` CLI flag (debugging)
- *   2. env-token    — `OVERSKY_TOKEN` env (CI / static; Phase I adds
- *                     server-side scope=ci validation)
+ *   2. env-token    — `OVERSKY_TOKEN` (CI / static). The CLI also reads
+ *                     `SKRR_TOKEN` via `envTokenNames`; `OVERSKY_TOKEN` wins
+ *                     when both are set, matching the CLI config overlay. A
+ *                     personal access token (`osk_pat_*`) is the credential
+ *                     CI should put here.
  *   3. auth-helper  — `OVERSKY_AUTH_HELPER` script output (rotating
  *                     creds — Vault, AWS SM, internal SSO proxy)
  *   4. fd-handoff   — `OVERSKY_AUTH_FD` parent→child IPC (Electron
@@ -62,6 +65,16 @@ export const CREDENTIAL_PRECEDENCE = [
 ];
 /** CI-token plaintext prefix; mirrors api/server/services/Auth/daemonCiTokens.js. */
 export const CI_TOKEN_PREFIX = 'osk_ci_';
+/** Personal-access-token prefix; mirrors api/server/services/Auth/personalAccessTokens.js. */
+export const PERSONAL_ACCESS_TOKEN_PREFIX = 'osk_pat_';
+/**
+ * True for a kind whose token is static by construction: never refreshed,
+ * never rotated into a store. Like `TokenKind` itself this selects a local
+ * code path and grants nothing.
+ */
+export function isStaticTokenKind(kind) {
+    return kind === 'ci' || kind === 'pat';
+}
 /**
  * Classify a token by local shape. Pure function; safe to call on any string
  * (including `null`-coerced empty). Returns `'standard'` for empty input
@@ -97,6 +110,8 @@ export function classifyTokenKind(token) {
         return 'standard';
     if (token.startsWith(CI_TOKEN_PREFIX))
         return 'ci';
+    if (token.startsWith(PERSONAL_ACCESS_TOKEN_PREFIX))
+        return 'pat';
     const payload = decodeJwtPayload(token);
     if (payload &&
         typeof payload === 'object' &&
@@ -252,8 +267,16 @@ export class CredentialResolver {
         if (typeof this.opts.envTokenOverride === 'string') {
             return this.opts.envTokenOverride.length > 0 ? this.opts.envTokenOverride : null;
         }
-        const v = process.env.OVERSKY_TOKEN;
-        return typeof v === 'string' && v.length > 0 ? v : null;
+        // `OVERSKY_TOKEN` first (retained by decision, docs/product/skrr-env-inventory.md),
+        // then any renamed spelling the caller opted into (`SKRR_TOKEN` for the CLI,
+        // OSK-13208). The daemon does not opt in: a CI job that sets `SKRR_TOKEN`
+        // for `skrr` must not have a co-located `skrrd` silently adopt it.
+        for (const name of this.opts.envTokenNames ?? ['OVERSKY_TOKEN']) {
+            const v = process.env[name];
+            if (typeof v === 'string' && v.length > 0)
+                return v;
+        }
+        return null;
     }
     async tryResolveAuthHelper() {
         let helperPath;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -38,7 +38,13 @@ export declare function describeDeviceKeySplit(profile: string): {
  * Order:
  *   1. Try to load existing keypair from disk.
  *      - Success → state = active.
- *      - Missing files / corruption / decrypt failure → step 2.
+ *      - No key material at all (first install) → step 2.
+ *      - Key material present but unloadable (corruption, decrypt failure,
+ *        public/private mismatch) → disabled+unreadable_key and a
+ *        `recovery_required` event, UNLESS `recoverUnreadable` is set. Only
+ *        an explicit interactive login sets it, because that login proves and
+ *        re-pins the new key; replacing it on ordinary boot would sign the
+ *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -335,7 +335,13 @@ async function consolidateDeviceIdentity(profile) {
  * Order:
  *   1. Try to load existing keypair from disk.
  *      - Success → state = active.
- *      - Missing files / corruption / decrypt failure → step 2.
+ *      - No key material at all (first install) → step 2.
+ *      - Key material present but unloadable (corruption, decrypt failure,
+ *        public/private mismatch) → disabled+unreadable_key and a
+ *        `recovery_required` event, UNLESS `recoverUnreadable` is set. Only
+ *        an explicit interactive login sets it, because that login proves and
+ *        re-pins the new key; replacing it on ordinary boot would sign the
+ *        next refresh with a key the server never pinned.
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -16,7 +16,7 @@ export { classifyRefreshResponse, type RefreshResponseShape, type ClassifiedRefr
 export { refreshDaemonToken, revokeDaemonRefreshSession, withAuthLock, persistReauthState, needsReauthState, clearReauthState, installLockExitHandlers, __refreshDiagnostics, __resetUnknown401StreaksForTest, UNKNOWN_401_BUDGET, } from './refresh.js';
 export { createRefreshScheduler, type RefreshScheduler, type RefreshSchedulerOptions, } from './refreshScheduler.js';
 export { readAuthFromFd, __setFdReaderForTest, type FdAuthPayload } from './fdToken.js';
-export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverForTest, invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, AuthHelperUntrustedError, AuthHelperUnavailableError, type CredentialSource, type CredentialStoreMode, type CredentialResolverOptions, type ResolvedCredential, type TokenKind, type HelperTrustDecision, type AuthHelperBlockedInfo, type AuthHelperSentinelInfo, } from './credentialResolver.js';
+export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverForTest, invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, PERSONAL_ACCESS_TOKEN_PREFIX, isStaticTokenKind, AuthHelperUntrustedError, AuthHelperUnavailableError, type CredentialSource, type CredentialStoreMode, type CredentialResolverOptions, type ResolvedCredential, type TokenKind, type HelperTrustDecision, type AuthHelperBlockedInfo, type AuthHelperSentinelInfo, } from './credentialResolver.js';
 export { invokeAuthHelper, getDefaultHelperTtlMs, getLastAuthHelperFailureReason, __resetAuthHelperFailureReasonForTest, SENTINEL_TRIGGERING_FAILURES, type HelperResult, type InvokeAuthHelperOptions, type AuthHelperFailureReason, } from './authHelper.js';
 export { runHeadersHelper, invalidateHeadersHelperCache, type RunHeadersHelperOptions, } from './headers-helper.js';
 export { generateVerifier, challenge, generateState, safeEqual, verifyChallenge, type PkceChallengeMethod, } from './pkce.js';
@@ -35,7 +35,7 @@ export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest,
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, DAEMON_CHILD_ENV, isDaemonChildEnv, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
 export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -51,7 +51,7 @@ export { CredentialResolver, CREDENTIAL_PRECEDENCE, __resetCredentialResolverFor
 // H3-6 — public seam 401 handlers call to bust the helper cache so
 // the next resolve re-invokes OVERSKY_AUTH_HELPER immediately
 // instead of serving the stale cached token for up to its TTL.
-invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, 
+invalidateAuthHelperCache, classifyTokenKind, CI_TOKEN_PREFIX, PERSONAL_ACCESS_TOKEN_PREFIX, isStaticTokenKind, 
 // L6.1 / L6.3 — fail-closed errors thrown by the auth-helper slot.
 AuthHelperUntrustedError, AuthHelperUnavailableError, } from './credentialResolver.js';
 // Auth helper — invocation contract for OVERSKY_AUTH_HELPER
@@ -149,7 +149,7 @@ export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, har
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, DAEMON_CHILD_ENV, isDaemonChildEnv, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
 // OSK-12134 — the one proxy-free client for loopback HTTP. Bun's fetch (and
 // Node's under NODE_USE_ENV_PROXY) sends 127.0.0.1 requests to HTTP_PROXY,
 // credentials and all; every loopback caller goes through this instead.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.d.ts

@@ -77,6 +77,31 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+export declare const DAEMON_CHILD_ENV = "SKRR_DAEMON_CHILD";
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+export declare function isDaemonChildEnv(env: Readonly<Record<string, string | undefined>>): boolean;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while