@skrr-ai/cli 0.1.81 → 0.1.82

package/dist/lib/daemonBroker.js

@@ -70,6 +70,9 @@ var __importStar = (this && this.__importStar) || (function () {
         return result;
     };
 })();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HOSTED_MACHINE_CLI_HANDOFF_DESCRIPTOR = exports.DEDICATED_RUNTIME_CLI_HANDOFF_DESCRIPTOR = void 0;
 exports.normalizeBaseUrl = normalizeBaseUrl;
@@ -89,16 +92,19 @@ exports.findBrokeredHandoffDescriptor = findBrokeredHandoffDescriptor;
 exports.maybeRetireStoredCliAuthFile = maybeRetireStoredCliAuthFile;
 exports.shouldBrokerBeforeStoredCredential = shouldBrokerBeforeStoredCredential;
 exports.attemptDaemonBrokerLoginAndPersist = attemptDaemonBrokerLoginAndPersist;
+exports.cliSessionAdoptionBlocker = cliSessionAdoptionBlocker;
 exports.maybeAutoBroker = maybeAutoBroker;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const os = __importStar(require("node:os"));
+const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
 const auth_core_1 = require("@skrr-ai/auth-core");
 const loopback_http_1 = require("@skrr-ai/auth-core/loopback-http");
 const cli_handoff_wire_1 = require("@skrr-ai/auth-core/cli-handoff-wire");
 const brokered_dpop_1 = require("./brokered-dpop");
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
+const harness_context_1 = require("./harness-context");
 const cli_identity_1 = require("./cli-identity");
 const daemonRestartWait_1 = require("./daemonRestartWait");
 const keychain_1 = require("./keychain");
@@ -562,8 +568,19 @@ async function brokerThrough(bootstrap, opts, sourcePath) {
     // would either break explicit login or be bypassed by anyone who calls it
     // the way login does. It is not a boundary, so it is not attempted. What the
     // CLI CAN guarantee is that its own automatic path never mints and persists
-    // a refresh family: when `access_token` is advertised, a failed redeem is
-    // the answer, and the daemon's outage is reported with its repair.
+    // a refresh family on a borrower's behalf: when `access_token` is advertised,
+    // a failed redeem is the answer, and the daemon's outage is reported with its
+    // repair.
+    //
+    // OSK-13254 narrowed "the automatic path" to mean a BORROWER. A person's
+    // first `skrr` on a profile with nothing stored now ADOPTS a CLI session of
+    // its own (`maybeAutoBroker` with `adopt`, `preferHandoffMode:
+    // 'refresh_family'`), because a sign-in that lived only as long as the daemon
+    // read as "signed out" every time the daemon restarted. What OSK-12018 was
+    // guarding against — an agent-originated implicit sign-in persisting a family
+    // — is now refused by name: a process the daemon started for an agent or tool
+    // carries `SKRR_DAEMON_CHILD` / `OVERSKY_AUTONOMOUS_SESSION`
+    // (`harness-context.ts`), sets `borrowOnly`, and `writeToBackend` refuses it.
     //
     // COMPATIBILITY WINDOW: a v1 descriptor (no `handoffModes`, so no
     // `access_token`) still takes the durable mint on the automatic path below,
@@ -578,7 +595,17 @@ async function brokerThrough(bootstrap, opts, sourcePath) {
     const offersAccessToken = (0, cli_handoff_wire_1.descriptorOffersAccessToken)(bootstrap);
     const offersRefreshFamily = modes.includes('refresh_family');
     const preferAccessToken = opts.preferHandoffMode === 'access_token';
-    if (offersAccessToken && (preferAccessToken || !offersRefreshFamily)) {
+    if (opts.borrowOnly && !offersAccessToken) {
+        return {
+            ok: false,
+            reason: 'unknown',
+            refusedBy: 'daemon',
+            code: 'HANDOFF_BORROW_UNAVAILABLE',
+            detail: 'The skrr background service on this computer is too old to lend this agent process a ' +
+                'short-lived token, and a process it started for an agent never stores a sign-in. Update skrrd.',
+        };
+    }
+    if (offersAccessToken && (preferAccessToken || opts.borrowOnly || !offersRefreshFamily)) {
         const redeem = await redeemCliHandoffToken(bootstrap, {
             forceRefresh: false,
             timeoutMs: opts.timeoutMs,
@@ -1150,6 +1177,16 @@ async function attemptDaemonBrokerLoginAndPersist(opts) {
     // Callers use the token in-memory for this process only.
     if (outcome.brokered)
         return outcome;
+    // Unreachable through `brokerThrough`, which never mints for a borrower;
+    // kept so a future route cannot persist on a borrower's behalf.
+    if (opts.borrowOnly) {
+        return {
+            ok: false,
+            reason: 'unknown',
+            code: 'HANDOFF_BORROW_UNAVAILABLE',
+            detail: 'A borrower was handed a durable credential; it was not stored.',
+        };
+    }
     const serverOrigin = normalizeBaseUrl(opts.baseURL);
     if (!serverOrigin) {
         throw new Error('Daemon-broker credential persistence requires a valid CLI baseURL.');
@@ -1199,6 +1236,123 @@ const AUTH_SELF_MANAGED_COMMANDS = new Set([
     'pair',
     'generate-recovery-code',
 ]);
+/**
+ * Why this invocation must borrow instead of adopting a CLI session of its
+ * own, or null when it may adopt (OSK-13254).
+ */
+function cliSessionAdoptionBlocker(cliConfig, env = process.env) {
+    if ((0, harness_context_1.isHarnessCliContext)(env))
+        return 'harness_context';
+    if (env.SKRR_NO_CLI_SESSION_ADOPTION === '1')
+        return 'opted_out';
+    // `skrr logout` said "this CLI is signed out". The daemon may still LEND
+    // tokens (logout says so), but a durable session does not reappear behind
+    // that statement; the next `skrr login` clears the flag.
+    if (cliConfig.adoptDaemonSession === false)
+        return 'signed_out';
+    return null;
+}
+/**
+ * Failures that mean no daemon answered (or answered for another server) —
+ * a second attempt on the token route cannot do better and would only wait
+ * out the restart window twice.
+ */
+function daemonDidNotAnswer(failure) {
+    switch (failure.reason) {
+        case 'no_bootstrap':
+        case 'stale_bootstrap':
+        case 'bootstrap_parse':
+        case 'base_url_mismatch':
+        case 'network':
+        case 'timeout':
+            return true;
+        default:
+            return false;
+    }
+}
+/** The adoption lock: one per config root and profile. */
+function adoptionLockPath(profile) {
+    const safe = profile.replace(/[^A-Za-z0-9._-]/g, '_') || 'default';
+    return path.join((0, config_1.configRoot)(), `cli-session-adopt.${safe}.lock`);
+}
+function storedAccessToken(baseURL) {
+    try {
+        return (0, auth_storage_1.readFromBackend)(baseURL).bundle?.token ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Adopt a CLI session through the local daemon (OSK-13254): the durable mint
+ * (`/v1/auth/cli-handoff` → `POST /api/daemons/cli-handoff`), persisted like a
+ * browser login, so that the next `skrr` reads it from the Keychain/file and
+ * renews it itself — the daemon restarting no longer reads as signed out.
+ *
+ * Serialized across processes. The confirm that follows a mint retires every
+ * OTHER live family of this cliId, so two concurrent adopters would each
+ * revoke the other's session mid-command. Under the lock a process that
+ * finds a session a sibling stored while it waited uses that one instead.
+ *
+ * Never worse than borrowing: if the lock cannot be taken in time, or the
+ * daemon answered but would not mint (rate limit, a server refusal, a
+ * broker-only descriptor), this borrows an access token for this process
+ * exactly as before.
+ */
+async function adoptCliSessionThroughDaemon(base, lockRetries) {
+    const profile = base.profile ?? 'default';
+    const baseURL = base.baseURL ?? '';
+    const borrow = () => attemptDaemonBrokerLoginAndPersist({
+        ...base,
+        preferHandoffMode: 'access_token',
+        borrowOnly: true,
+    });
+    // Adopt only from a live descriptor that can mint a family. One that
+    // cannot (the Dedicated guest's access-token-only shape), or none at all (a
+    // daemon that is down or restarting), has nothing to adopt: borrow without
+    // taking the lock, so concurrent commands never queue behind it and the
+    // borrow path's own restart wait and outage reporting apply unchanged.
+    const usable = listUsableBootstraps(base);
+    if (!usable.some(({ bootstrap }) => (0, cli_handoff_wire_1.advertisedHandoffModes)(bootstrap).includes('refresh_family'))) {
+        return { outcome: await borrow() };
+    }
+    const before = storedAccessToken(baseURL);
+    const lockPath = adoptionLockPath(profile);
+    let release = null;
+    try {
+        fs.mkdirSync(path.dirname(lockPath), { recursive: true, mode: 0o700 });
+        if (!fs.existsSync(lockPath))
+            fs.writeFileSync(lockPath, '', { mode: 0o600 });
+        release = await proper_lockfile_1.default.lock(lockPath, {
+            // Longer than one mint (20s loopback + 10s confirm), so a holder that
+            // is still working is never judged stale.
+            stale: 60_000,
+            retries: { retries: lockRetries, minTimeout: 250, maxTimeout: 1_000, factor: 1.5 },
+        });
+    }
+    catch {
+        // Could not serialize: do not race a sibling's mint. Borrow.
+        return { outcome: await borrow() };
+    }
+    let durable;
+    try {
+        const now = storedAccessToken(baseURL);
+        if (now && now !== before)
+            return { adoptedBySibling: true };
+        durable = await attemptDaemonBrokerLoginAndPersist({
+            ...base,
+            preferHandoffMode: 'refresh_family',
+        });
+    }
+    finally {
+        await release().catch(() => undefined);
+    }
+    if (durable.ok || daemonDidNotAnswer(durable))
+        return { outcome: durable };
+    // The daemon answered but would not mint a family. The token route is a
+    // different door with different limits; take it for this process.
+    return { outcome: await borrow() };
+}
 /**
  * Auto-broker pre-flight for `BaseCommand.init()`. When the credential
  * resolver returns no token, this attempts a silent daemon broker so
@@ -1244,21 +1398,43 @@ async function maybeAutoBroker(opts) {
     // confirm cannot retire another profile's session. Persisted by the caller on
     // success so the rotation row stays bound across processes.
     const { cliId, updatedConfig } = (0, cli_identity_1.planLoginCliId)(opts.cliConfig);
-    const outcome = await attemptDaemonBrokerLoginAndPersist({
+    const base = {
         cliId,
         baseURL: opts.cliConfig.baseURL,
-        // Auto-broker prefers the brokered access-token mode when the descriptor
-        // advertises it: nothing credential-shaped is persisted, and the next
-        // `skrr` process simply re-redeems over loopback. The legacy refresh-
-        // family mint remains the fallback for v1 descriptors and the redeem
-        // path for explicit `skrr login`.
-        preferHandoffMode: 'access_token',
         profile: opts.profile ?? (0, keychain_1.getActiveProfile)(),
         ...(opts.bootstrapPathOverride ? { bootstrapPathOverride: opts.bootstrapPathOverride } : {}),
+    };
+    const harness = (0, harness_context_1.isHarnessCliContext)();
+    // OSK-13254 — a person's first `skrr` on a machine whose daemon is signed in
+    // ADOPTS a CLI session of its own: a separate cli-scope family, minted by the
+    // daemon's hand-off and stored like a browser login, so later commands do
+    // not depend on the daemon being up. Everything else borrows a short-lived
+    // token for this process, which is what the automatic path always did
+    // (OSK-12018): a process the daemon started for an agent or tool, a 401
+    // recovery, a profile signed out with `skrr logout`, and the opt-out.
+    if (opts.adopt && !cliSessionAdoptionBlocker(opts.cliConfig)) {
+        const adopted = await adoptCliSessionThroughDaemon(base, opts.adoptionLockRetries ?? 40);
+        if (adopted.adoptedBySibling)
+            return { triggered: true, adoptedBySibling: true };
+        const outcome = adopted.outcome;
+        return {
+            triggered: true,
+            outcome,
+            ...(updatedConfig && outcome.ok ? { updatedConfig } : {}),
+        };
+    }
+    const outcome = await attemptDaemonBrokerLoginAndPersist({
+        ...base,
+        // Borrow: the access-token mode, held in memory for this process; the next
+        // `skrr` re-redeems over loopback. A v1 descriptor still takes the durable
+        // mint here (the compatibility window in `brokerThrough`), except for a
+        // harness-context process, which never stores a sign-in.
+        preferHandoffMode: 'access_token',
+        ...(harness ? { borrowOnly: true } : {}),
     });
     return {
         triggered: true,
         outcome,
-        ...(updatedConfig && outcome.ok ? { updatedConfig } : {}),
+        ...(updatedConfig && outcome.ok && !harness ? { updatedConfig } : {}),
     };
 }

package/dist/lib/daemonBrokerRefusal.d.ts

@@ -96,3 +96,17 @@ export declare function describeGuestDaemonUnavailable(failure: DaemonBrokerFail
  * nothing waited for): "Not signed in" is then the true sentence.
  */
 export declare function describeLocalDaemonUnavailable(failure: DaemonBrokerFailure, bin?: string): BrokerRefusalDescription | null;
+/**
+ * The one description of a laptop or guest broker failure for every surface
+ * that has no separate guest probe of its own: a daemon that answered and
+ * refused (`describeBrokerRefusal`), else a daemon whose descriptor is on disk
+ * but which did not answer — down, crashed or mid-restart
+ * (`describeLocalDaemonUnavailable`).
+ *
+ * `requireAuth` composed these two by hand; `skrr login`'s progress line and
+ * headless refusal, and the mid-command 401 paths, consulted only the first,
+ * so a daemon that was restarting read there as "no daemon at all" — the
+ * generic browser refusal, or a bare "Run `skrr login`" (OSK-13099). Returns
+ * null only when there is genuinely nothing to say about a daemon.
+ */
+export declare function describeBrokerFailure(failure: DaemonBrokerFailure, bin?: string): BrokerRefusalDescription | null;

package/dist/lib/daemonBrokerRefusal.js

@@ -4,6 +4,7 @@ exports.isAnsweredBrokerRefusal = isAnsweredBrokerRefusal;
 exports.describeBrokerRefusal = describeBrokerRefusal;
 exports.describeGuestDaemonUnavailable = describeGuestDaemonUnavailable;
 exports.describeLocalDaemonUnavailable = describeLocalDaemonUnavailable;
+exports.describeBrokerFailure = describeBrokerFailure;
 /**
  * True when a daemon ANSWERED the hand-off and refused it — as opposed to no
  * daemon being there to ask (`no_bootstrap`, a stale descriptor nobody listens
@@ -261,7 +262,7 @@ function describeLocalDaemonUnavailable(failure, bin = 'skrr') {
     if (!headline)
         return null;
     const remedy = 'You are not signed out: your sign-in is held by that service, which normally restarts on its own. ' +
-        `Retry in a moment. \`${bin} daemon status\` and \`${bin} daemon logs\` show the service's side, ` +
+        `Retry in a few seconds, or start it with \`${bin} daemon start\` if it stays down. \`${bin} daemon status\` and \`${bin} daemon logs\` show the service's side, ` +
         `and \`${bin} login\` signs this CLI in without it.`;
     return {
         headline: `${headline}${waited}`,
@@ -289,3 +290,19 @@ function describeLocalDaemonUnavailable(failure, bin = 'skrr') {
         },
     };
 }
+/**
+ * The one description of a laptop or guest broker failure for every surface
+ * that has no separate guest probe of its own: a daemon that answered and
+ * refused (`describeBrokerRefusal`), else a daemon whose descriptor is on disk
+ * but which did not answer — down, crashed or mid-restart
+ * (`describeLocalDaemonUnavailable`).
+ *
+ * `requireAuth` composed these two by hand; `skrr login`'s progress line and
+ * headless refusal, and the mid-command 401 paths, consulted only the first,
+ * so a daemon that was restarting read there as "no daemon at all" — the
+ * generic browser refusal, or a bare "Run `skrr login`" (OSK-13099). Returns
+ * null only when there is genuinely nothing to say about a daemon.
+ */
+function describeBrokerFailure(failure, bin = 'skrr') {
+    return describeBrokerRefusal(failure, bin) ?? describeLocalDaemonUnavailable(failure, bin);
+}

package/dist/lib/harness-context.d.ts

@@ -0,0 +1,8 @@
+export declare function isHarnessCliContext(env?: Readonly<Record<string, string | undefined>>): boolean;
+/** Thrown by `writeToBackend` when a harness-context process tries to persist. */
+export declare class HarnessCredentialPersistRefused extends Error {
+    readonly code = "HARNESS_CONTEXT_PERSIST_REFUSED";
+    constructor();
+}
+/** The commands a harness-context process may not run (they own the stored session). */
+export declare const HARNESS_REFUSED_AUTH_COMMANDS: ReadonlySet<string>;

package/dist/lib/harness-context.js

@@ -0,0 +1,55 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.HARNESS_REFUSED_AUTH_COMMANDS = exports.HarnessCredentialPersistRefused = void 0;
+exports.isHarnessCliContext = isHarnessCliContext;
+/**
+ * harness-context.ts — is this `skrr` running for an agent the daemon started?
+ * (OSK-13254)
+ *
+ * A person's `skrr` may adopt a CLI refresh session of its own through the
+ * local daemon's hand-off, so that signing in survives the daemon restarting
+ * (`daemonBroker.ts`, `maybeAutoBroker`). A `skrr` the daemon spawned for an
+ * agent or a tool must not: it borrows short-lived tokens from the daemon for
+ * each process, and never reads, writes, rotates or revokes the person's
+ * stored CLI session.
+ *
+ * Two daemon-set markers say so, and either is enough:
+ *
+ *   - `OVERSKY_AUTONOMOUS_SESSION=1` — a harness session (`session-wrapper.ts`,
+ *     `api-local-session-client.ts`). Such a process already never reaches the
+ *     stored-credential chain (`BaseCommand.init` returns early on it); it is
+ *     listed here so every guard below answers the same question.
+ *   - `SKRR_DAEMON_CHILD` — every other agent/tool child: one-shot Bash,
+ *     background Bash, agent terminals, harness backends
+ *     (`daemon/src/env-sanitize.ts`, `agent-terminal-env.ts`). It survives the
+ *     shared sanitizer, so grandchildren keep it.
+ *
+ * What this is and is not, stated so nobody leans on it harder than it holds:
+ * on a laptop the daemon, the agent and the person share one uid, so this is
+ * POLICY — a child that deletes the marker can do what the person's shell can.
+ * Where a uid boundary exists (Dedicated Runtime, identity-split Hosted
+ * Machines) the guest descriptor offers only the access-token mode, so a
+ * durable family cannot be minted there whatever the environment says. This
+ * is the same scope invariant I1 has today
+ * (`docs/architecture/managed-inference-execution-shapes-2026-08-12.md` §15).
+ */
+const auth_core_1 = require("@skrr-ai/auth-core");
+function isHarnessCliContext(env = process.env) {
+    return env.OVERSKY_AUTONOMOUS_SESSION === '1' || (0, auth_core_1.isDaemonChildEnv)(env);
+}
+/** Thrown by `writeToBackend` when a harness-context process tries to persist. */
+class HarnessCredentialPersistRefused extends Error {
+    code = 'HARNESS_CONTEXT_PERSIST_REFUSED';
+    constructor() {
+        super('Refusing to store a skrr sign-in from a process the skrr background service started for an ' +
+            'agent or tool. skrr here borrows short-lived tokens from the service; sign in from your own terminal.');
+        this.name = 'HarnessCredentialPersistRefused';
+    }
+}
+exports.HarnessCredentialPersistRefused = HarnessCredentialPersistRefused;
+/** The commands a harness-context process may not run (they own the stored session). */
+exports.HARNESS_REFUSED_AUTH_COMMANDS = new Set([
+    'login',
+    'logout',
+    'pair',
+]);

package/dist/lib/login.js

@@ -202,7 +202,10 @@ async function cliLogin(opts = {}) {
         // The daemon answered and refused. Say so before whatever comes next —
         // a browser that opens with no stated cause, or a refusal about terminals
         // that says nothing about the daemon, both hid the real reason.
-        brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerRefusal)(brokerResult);
+        // A daemon whose descriptor is on disk but which did not answer (down or
+        // mid-restart) is described too: without it a headless `skrr login` during
+        // a restart said only that this shell has no terminal (OSK-13099).
+        brokerRefusal = (0, daemonBrokerRefusal_1.describeBrokerFailure)(brokerResult);
         if (brokerRefusal && !(0, ssh_detect_1.isNonInteractive)()) {
             console.log('');
             console.log(`  Asked the local skrr service for a session first. ${brokerRefusal.headline}`);

package/dist/lib/refresh.js

@@ -30,6 +30,7 @@ const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
 const credential_resolver_1 = require("./credential-resolver");
 const device_identity_1 = require("./device-identity");
+const harness_context_1 = require("./harness-context");
 exports.CLI_REFRESH_EARLY_MS = 5 * 60 * 1000;
 /**
  * Stable origin header so the server's benign-grace matcher can identify
@@ -96,6 +97,9 @@ function canMutatePersistedCredential(credential, bareMode) {
         return false;
     if ((0, auth_core_1.isStaticTokenKind)(credential.kind))
         return false;
+    // A borrower never rotates the person's stored family (OSK-13254).
+    if ((0, harness_context_1.isHarnessCliContext)())
+        return false;
     // These sources are operator-owned or generated on demand. Never rotate
     // them into the local keychain/file store behind the operator's back.
     return credential.source === 'keychain' || credential.source === 'file';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -35,7 +35,7 @@ export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest,
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, DAEMON_CHILD_ENV, isDaemonChildEnv, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
 export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -25,8 +25,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.isStaticTokenKind = exports.PERSONAL_ACCESS_TOKEN_PREFIX = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = void 0;
 exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceKeySplit = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.splitKeyConvergencePolicy = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDpopProof = exports.normalizeDpopHtu = exports.isJwkThumbprint = exports.isAth = exports.createDpopKey = exports.accessTokenHash = exports.DPOP_PROOF_VERIFY_UNAVAILABLE = exports.DPOP_PROOF_TYP = exports.DPOP_PROOF_REQUIRED = exports.DPOP_PROOF_INVALID = exports.DPOP_MAX_AGE_SECONDS = exports.DPOP_HEADER = exports.verifyDeviceProof = exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = void 0;
-exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = void 0;
+exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.isDaemonChildEnv = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -346,6 +346,8 @@ Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get
 Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_NAME_TOKENS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_NAME_TOKENS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
+Object.defineProperty(exports, "DAEMON_CHILD_ENV", { enumerable: true, get: function () { return spawnEnv_js_1.DAEMON_CHILD_ENV; } });
+Object.defineProperty(exports, "isDaemonChildEnv", { enumerable: true, get: function () { return spawnEnv_js_1.isDaemonChildEnv; } });
 Object.defineProperty(exports, "LOOPBACK_NO_PROXY_HOSTS", { enumerable: true, get: function () { return spawnEnv_js_1.LOOPBACK_NO_PROXY_HOSTS; } });
 Object.defineProperty(exports, "envHasProxy", { enumerable: true, get: function () { return spawnEnv_js_1.envHasProxy; } });
 Object.defineProperty(exports, "withLoopbackNoProxy", { enumerable: true, get: function () { return spawnEnv_js_1.withLoopbackNoProxy; } });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.d.ts

@@ -77,6 +77,31 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+export declare const DAEMON_CHILD_ENV = "SKRR_DAEMON_CHILD";
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+export declare function isDaemonChildEnv(env: Readonly<Record<string, string | undefined>>): boolean;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -40,7 +40,8 @@
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.LOOPBACK_NO_PROXY_HOSTS = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.isDaemonChildEnv = isDaemonChildEnv;
 exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 exports.envHasProxy = envHasProxy;
 exports.withLoopbackNoProxy = withLoopbackNoProxy;
@@ -154,7 +155,40 @@ exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // engine) must keep it to detect they already run as the workload uid. Not
     // a secret — it authorizes nothing without the matching real uid.
     'SKRR_WORKLOAD_UID',
+    // OSK-13254 — "this process descends from a skrrd agent/tool spawn". It only
+    // ever REMOVES authority (a `skrr` that sees it borrows from the daemon and
+    // never reads or writes a stored CLI session), so it must survive every later
+    // re-sanitization: a Bash tool that runs `skrr code`, whose engine runs `skrr`,
+    // is still the agent's process. See `DAEMON_CHILD_ENV` below.
+    'SKRR_DAEMON_CHILD',
 ]);
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+exports.DAEMON_CHILD_ENV = 'SKRR_DAEMON_CHILD';
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+function isDaemonChildEnv(env) {
+    return Boolean(env[exports.DAEMON_CHILD_ENV]?.trim());
+}
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -35,7 +35,7 @@ export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest,
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, DAEMON_CHILD_ENV, isDaemonChildEnv, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
 export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -149,7 +149,7 @@ export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, har
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, DAEMON_CHILD_ENV, isDaemonChildEnv, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
 // OSK-12134 — the one proxy-free client for loopback HTTP. Bun's fetch (and
 // Node's under NODE_USE_ENV_PROXY) sends 127.0.0.1 requests to HTTP_PROXY,
 // credentials and all; every loopback caller goes through this instead.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.d.ts

@@ -77,6 +77,31 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+export declare const DAEMON_CHILD_ENV = "SKRR_DAEMON_CHILD";
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+export declare function isDaemonChildEnv(env: Readonly<Record<string, string | undefined>>): boolean;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while