@skrr-ai/cli 0.1.81 → 0.1.82

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.js

@@ -148,7 +148,40 @@ export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // engine) must keep it to detect they already run as the workload uid. Not
     // a secret — it authorizes nothing without the matching real uid.
     'SKRR_WORKLOAD_UID',
+    // OSK-13254 — "this process descends from a skrrd agent/tool spawn". It only
+    // ever REMOVES authority (a `skrr` that sees it borrows from the daemon and
+    // never reads or writes a stored CLI session), so it must survive every later
+    // re-sanitization: a Bash tool that runs `skrr code`, whose engine runs `skrr`,
+    // is still the agent's process. See `DAEMON_CHILD_ENV` below.
+    'SKRR_DAEMON_CHILD',
 ]);
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+export const DAEMON_CHILD_ENV = 'SKRR_DAEMON_CHILD';
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+export function isDaemonChildEnv(env) {
+    return Boolean(env[DAEMON_CHILD_ENV]?.trim());
+}
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.11",
+  "version": "0.4.12",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {