@skrr-ai/cli 0.1.81 → 0.1.83

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/spawnEnv.js

@@ -40,7 +40,8 @@
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.LOOPBACK_NO_PROXY_HOSTS = exports.DAEMON_CHILD_ENV = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.isDaemonChildEnv = isDaemonChildEnv;
 exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 exports.envHasProxy = envHasProxy;
 exports.withLoopbackNoProxy = withLoopbackNoProxy;
@@ -154,7 +155,40 @@ exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // engine) must keep it to detect they already run as the workload uid. Not
     // a secret — it authorizes nothing without the matching real uid.
     'SKRR_WORKLOAD_UID',
+    // OSK-13254 — "this process descends from a skrrd agent/tool spawn". It only
+    // ever REMOVES authority (a `skrr` that sees it borrows from the daemon and
+    // never reads or writes a stored CLI session), so it must survive every later
+    // re-sanitization: a Bash tool that runs `skrr code`, whose engine runs `skrr`,
+    // is still the agent's process. See `DAEMON_CHILD_ENV` below.
+    'SKRR_DAEMON_CHILD',
 ]);
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+exports.DAEMON_CHILD_ENV = 'SKRR_DAEMON_CHILD';
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+function isDaemonChildEnv(env) {
+    return Boolean(env[exports.DAEMON_CHILD_ENV]?.trim());
+}
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -35,7 +35,7 @@ export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest,
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
 export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, harnessLoadsClaudeSkillsLayout, } from './harnessSkillLayout.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, DAEMON_CHILD_ENV, isDaemonChildEnv, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
 export { loopbackFetch, assertLoopbackHttpUrl, isLoopbackHostname, isLoopbackAddress, LoopbackTargetRefusedError, LOOPBACK_DEFAULT_MAX_BODY_BYTES, type LoopbackFetch, type LoopbackFetchInit, } from './loopbackHttp.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -149,7 +149,7 @@ export { HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT, claudeSkillsLayoutEvidence, har
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, DAEMON_CHILD_ENV, isDaemonChildEnv, LOOPBACK_NO_PROXY_HOSTS, envHasProxy, withLoopbackNoProxy, } from './spawnEnv.js';
 // OSK-12134 — the one proxy-free client for loopback HTTP. Bun's fetch (and
 // Node's under NODE_USE_ENV_PROXY) sends 127.0.0.1 requests to HTTP_PROXY,
 // credentials and all; every loopback caller goes through this instead.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.d.ts

@@ -77,6 +77,31 @@ export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
 export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific names to keep — the prefix sweeps are broad on purpose. */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+export declare const DAEMON_CHILD_ENV = "SKRR_DAEMON_CHILD";
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+export declare function isDaemonChildEnv(env: Readonly<Record<string, string | undefined>>): boolean;
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/spawnEnv.js

@@ -148,7 +148,40 @@ export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // engine) must keep it to detect they already run as the workload uid. Not
     // a secret — it authorizes nothing without the matching real uid.
     'SKRR_WORKLOAD_UID',
+    // OSK-13254 — "this process descends from a skrrd agent/tool spawn". It only
+    // ever REMOVES authority (a `skrr` that sees it borrows from the daemon and
+    // never reads or writes a stored CLI session), so it must survive every later
+    // re-sanitization: a Bash tool that runs `skrr code`, whose engine runs `skrr`,
+    // is still the agent's process. See `DAEMON_CHILD_ENV` below.
+    'SKRR_DAEMON_CHILD',
 ]);
+/**
+ * OSK-13254 — the marker the daemon stamps on every agent- or tool-driven child
+ * (`daemon/src/env-sanitize.ts`, `daemon/src/terminal/agent-terminal-env.ts`).
+ *
+ * A `skrr` that sees it is a borrower: it redeems short-lived tokens from the
+ * daemon's loopback broker, never adopts a CLI refresh session of its own, and
+ * never reads the person's stored one (`cli/src/lib/harness-context.ts`). A
+ * person's own terminal — including the web terminal, which is a human surface
+ * (`humanTerminalEnv`) — does not carry it.
+ *
+ * The marker can only take authority away, so a process that forges it hurts
+ * nobody but itself. On a laptop it is POLICY, not a boundary: a same-uid child
+ * that deletes it can do whatever the person's own shell can. Where a uid
+ * boundary exists (Dedicated Runtime, identity-split Hosted Machines), the
+ * guest descriptor already offers only the access-token mode, so a durable CLI
+ * family cannot be minted there whatever the environment says.
+ */
+export const DAEMON_CHILD_ENV = 'SKRR_DAEMON_CHILD';
+/**
+ * True when `env` carries the daemon-child marker with ANY non-empty value.
+ * Deliberately no "0 means off": the marker only narrows authority, so the
+ * one value that could switch it off is the one a request-carried environment
+ * would forge.
+ */
+export function isDaemonChildEnv(env) {
+    return Boolean(env[DAEMON_CHILD_ENV]?.trim());
+}
 /**
  * Build a sanitized snapshot of the parent's own env for a spawned
  * child, stripping credentials and library-injection vectors while

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.11",
+  "version": "0.4.12",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {