@bitkyc08/opencodex 2.78.0 → 2.79.0

package/src/claude/intercept/local-ca-windows.ts

@@ -0,0 +1,73 @@
+/** Strict local-CA policy layered on the shared Windows ACL hardener. */
+import { resolveTrustedWindowsPowerShellExe } from "../../lib/windows-elevation";
+import { resolveCurrentWindowsPrincipal, WINDOWS_PRINCIPAL_LOOKUP_TIMEOUT_MS } from "../../lib/windows-user-principal";
+import type { IcaclsResult } from "../../lib/windows-secret-acl";
+
+type AclRunner = (path: string, timeoutMs: number) => IcaclsResult;
+const MAX_ACL_BYTES = 64 * 1024;
+const SID = /^S-1-(?:\d+-)+\d+$/i;
+
+function nativeAclRunner(path: string, timeoutMs: number): IcaclsResult {
+  // Encode the path as data, not PowerShell syntax. SID-form rules avoid localized account names.
+  // .NET only: Get-Acl/ConvertTo-Json/ForEach-Object are module-autoloaded cmdlets, and
+  // autoload resolves them through the per-profile module analysis cache. With a fresh or
+  // redirected LOCALAPPDATA that rebuild scans every PSModulePath module and can exceed the
+  // inspection budget (hosted Windows runners: 30 s timeouts during `ocx start`); it also lets
+  // a module earlier on PSModulePath shadow the cmdlet. SIDs, ints and booleans need no escaping;
+  // the JSON quote is [char]34 so the -Command argument carries no double quotes to re-parse.
+  const encodedPath = Buffer.from(path, "utf8").toString("base64");
+  const script = [
+    "$ErrorActionPreference='Stop'",
+    `$p=[Text.Encoding]::UTF8.GetString([Convert]::FromBase64String('${encodedPath}'))`,
+    "$s=[System.Security.Principal.SecurityIdentifier]",
+    "$q=[char]34",
+    "$c=[System.Security.AccessControl.AccessControlSections]'Owner,Access'",
+    "if([System.IO.Directory]::Exists($p)){$a=[System.Security.AccessControl.DirectorySecurity]::new($p,$c)}else{$a=[System.Security.AccessControl.FileSecurity]::new($p,$c)}",
+    "$r=foreach($x in $a.GetAccessRules($true,$true,$s)){'{'+$q+'sid'+$q+':'+$q+$x.IdentityReference.Value+$q+','+$q+'type'+$q+':'+[int]$x.AccessControlType+','+$q+'rights'+$q+':'+[long]$x.FileSystemRights+'}'}",
+    "$o='{'+$q+'owner'+$q+':'+$q+$a.GetOwner($s).Value+$q+','+$q+'protected'+$q+':'+$(if($a.AreAccessRulesProtected){'true'}else{'false'})+','+$q+'rules'+$q+':['+(@($r) -join ',')+']}'",
+    "[Console]::Out.Write($o)",
+    "[Console]::Out.Flush()",
+  ].join(";");
+  const result = Bun.spawnSync([resolveTrustedWindowsPowerShellExe(), "-NoLogo", "-NoProfile", "-NonInteractive", "-Command", script], {
+    stdin: "ignore", stdout: "pipe", stderr: "ignore", timeout: timeoutMs, windowsHide: true,
+  });
+  return { success: result.success, exitCode: result.exitCode, timedOut: result.exitedDueToTimeout ?? false, stdout: result.stdout.toString("utf8") };
+}
+
+let aclRunner: AclRunner = nativeAclRunner;
+/** Native-result fault injection; production always uses the trusted bounded runner. */
+export function setLocalCaWindowsAclRunnerForTests(next: AclRunner | null): void {
+  aclRunner = next ?? nativeAclRunner;
+}
+
+export function assertLocalCaWindowsAcl(path: string, inspection: "owner" | "private" | "inherited" = "private"): void {
+  try {
+    const deadline = Date.now() + WINDOWS_PRINCIPAL_LOOKUP_TIMEOUT_MS;
+    const current = resolveCurrentWindowsPrincipal(deadline - Date.now()).replace(/^\*/, "").toUpperCase();
+    if (!SID.test(current)) throw new Error("invalid effective SID");
+    const remaining = deadline - Date.now();
+    if (remaining <= 0) throw new Error("ACL inspection deadline");
+    const result = aclRunner(path, remaining);
+    if (!result.success || result.timedOut || result.exitCode !== 0 || Buffer.byteLength(result.stdout) > MAX_ACL_BYTES) throw new Error("ACL inspection failed");
+    const acl: unknown = JSON.parse(result.stdout.replace(/^\uFEFF/, ""));
+    if (!acl || typeof acl !== "object" || !("owner" in acl) || !("protected" in acl) || !("rules" in acl)
+      || typeof acl.owner !== "string" || acl.owner.toUpperCase() !== current
+      || typeof acl.protected !== "boolean" || !Array.isArray(acl.rules)) throw new Error("unsafe ACL owner or shape");
+    // Newly created empty entries can inherit broad grants. Verify the owner
+    // before hardening, then require the complete private policy before use.
+    if (inspection === "owner") return;
+    if (inspection === "private" && !acl.protected) throw new Error("unprotected DACL");
+    const allowed = new Set([current, "S-1-5-18", "S-1-5-32-544"]);
+    if (acl.rules.length === 0) throw new Error("empty DACL");
+    for (const rule of acl.rules) {
+      if (!rule || typeof rule !== "object" || typeof rule.sid !== "string" || !SID.test(rule.sid)
+        || ![0, 1].includes(rule.type) || !Number.isSafeInteger(rule.rights) || rule.rights < 0 || rule.rights > 0xffffffff) throw new Error("ambiguous ACL rule");
+      // Reject every unexpected nonzero Allow ACE, including inherited and tamper-only grants.
+      // Deny ACEs confer no access. SYSTEM and built-in Administrators are the only exceptions.
+      if (rule.type === 0 && rule.rights !== 0 && !allowed.has(rule.sid.toUpperCase())) throw new Error("unexpected ACL principal");
+    }
+  } catch {
+    // Never expose path, raw ACL output, account names or native diagnostic text.
+    throw Object.assign(new Error("Local CA Windows owner/ACL inspection failed"), { code: "local_ca_path_unsafe" });
+  }
+}

package/src/claude/intercept/local-ca.ts

@@ -1,7 +1,6 @@
 import { createHash, generateKeyPairSync, createPrivateKey, createPublicKey, sign, X509Certificate, type KeyObject } from "node:crypto";
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
-import { withClientLifecycleSync } from "../../client/lifecycle-lock";
+import { withLocalCaPublication, type LocalCaFiles } from "./local-ca-files";
 
 /**
  * Local certificate authority for the Claude intercept listener.
@@ -307,7 +306,6 @@ export function issueLocalInterceptLeaf(ca: LocalInterceptCa, hosts: readonly st
 
 export const CLAUDE_INTERCEPT_STATE_DIR = "claude-intercept";
 export const CLAUDE_INTERCEPT_CA_CERT_FILE = "ca.pem";
-const CA_KEY_FILE = "ca.key";
 
 export function claudeInterceptStateDir(configDir: string): string {
   return join(configDir, CLAUDE_INTERCEPT_STATE_DIR);
@@ -318,50 +316,40 @@ export function claudeInterceptCaCertPath(configDir: string): string {
   return join(claudeInterceptStateDir(configDir), CLAUDE_INTERCEPT_CA_CERT_FILE);
 }
 
-function writeFileAtomic(path: string, contents: string, mode: number): void {
-  const tmp = `${path}.${process.pid}.tmp`;
-  writeFileSync(tmp, contents, { mode });
-  try { chmodSync(tmp, mode); } catch { /* best-effort on platforms without POSIX modes */ }
-  renameSync(tmp, path);
-}
-
-function loadPersistedCa(dir: string, accept?: (cert: X509Certificate) => boolean): LocalInterceptCa | null {
-  const certPath = join(dir, CLAUDE_INTERCEPT_CA_CERT_FILE);
-  const keyPath = join(dir, CA_KEY_FILE);
-  if (!existsSync(certPath) || !existsSync(keyPath)) return null;
+function loadPersistedCa(files: LocalCaFiles, accept?: (cert: X509Certificate) => boolean): LocalInterceptCa | null {
+  // Filesystem safety and access errors must escape; only benign PEM corruption regenerates.
+  const pair = files.readPair();
+  if (!pair) return null;
+  const { certPem, keyPem } = pair;
   try {
-    const certPem = readFileSync(certPath, "utf8");
-    const keyPem = readFileSync(keyPath, "utf8");
     const privateKey = createPrivateKey(keyPem);
     const publicKey = createPublicKey(keyPem);
     const certificate = new X509Certificate(certPem);
     if (!certificate.ca || !certificate.checkPrivateKey(privateKey) || !certificate.verify(publicKey)
       || (accept && !accept(certificate))) return null;
     return { certPem, keyPem, publicKey, privateKey };
-  } catch { // no-excuse-ok: catch -- an unreadable or corrupt authority is regenerated below.
+  } catch { // no-excuse-ok: catch -- malformed PEM in validated owner-controlled files is regenerated below.
     return null;
   }
 }
 
-/** Persist an authority under its own lease, replacing unreadable or rejected pairs. */
+/** Persist an authority under its own lease, replacing corrupt or rejected safe pairs. */
 export function ensurePersistedAuthority(
   dir: string,
   options: AuthorityOptions,
   lockName = "ca-publication.sqlite",
   accept?: (cert: X509Certificate) => boolean,
 ): LocalInterceptCa {
-  mkdirSync(dir, { recursive: true, mode: 0o700 });
   // A separate SQLite namespace binds exclusion to the explicit CA directory.
   // The OS releases it on crash; a contending caller fails before touching either
   // PEM. Readers also take the lease so they cannot observe half a publication.
-  return withClientLifecycleSync(() => {
-    const existing = loadPersistedCa(dir, accept);
+  return withLocalCaPublication(dir, lockName, files => {
+    const existing = loadPersistedCa(files, accept);
     if (existing) return existing;
     const ca = createCertificateAuthority(options);
-    writeFileAtomic(join(dir, CA_KEY_FILE), ca.keyPem, 0o600);
-    writeFileAtomic(join(dir, CLAUDE_INTERCEPT_CA_CERT_FILE), ca.certPem, 0o644);
+    files.writePair(ca);
     return ca;
-  }, { lockPath: join(dir, lockName) });
+  });
 }
 
 /** Preserve the original intercept CA path, name, permissions and extension set. */

package/src/claude/intercept/picker-ca-persistence.ts

@@ -0,0 +1,106 @@
+import { X509Certificate } from "node:crypto";
+import { constants, closeSync, fstatSync, lstatSync, openSync, readSync, realpathSync, rmSync, writeFileSync, type Stats } from "node:fs";
+import { join } from "node:path";
+import {
+  decodePickerCaCredential, openPickerCaCredential, pickerCaConfigId, readPickerCaCredential,
+  writePickerCaCredential, type PickerCaStore, type StoredPickerCa,
+} from "./picker-ca-store";
+
+const MAX_PUBLIC_STATE_BYTES = 64 * 1024;
+interface AuthorityMetadata { schema: 1; configId: string; fingerprint: string }
+interface Initialization extends AuthorityMetadata { predecessor: string | null }
+
+export function canonicalPickerConfigDir(configDir: string): string {
+  const canonical = realpathSync(configDir);
+  const stat = lstatSync(canonical);
+  if (!stat.isDirectory() || (process.platform !== "win32" && stat.uid !== process.getuid!())) {
+    throw new Error("picker_ca_config_unsafe");
+  }
+  return canonical;
+}
+
+/** Public records still cannot follow symlinks or accept oversized/malformed recovery data. */
+function readState(path: string, configId: string, initialization: boolean): Initialization | AuthorityMetadata | null {
+  let expected: Stats;
+  try { expected = lstatSync(path); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return null; throw new Error("picker_ca_metadata_unsafe"); }
+  if (expected.isSymbolicLink()) throw new Error("picker_ca_metadata_unsafe");
+  let fd: number;
+  try { fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK); }
+  catch (error) { if ((error as NodeJS.ErrnoException).code === "ENOENT") return null; throw new Error("picker_ca_metadata_unsafe"); }
+  try {
+    const stat = fstatSync(fd);
+    if (stat.dev !== expected.dev || stat.ino !== expected.ino) throw new Error("picker_ca_metadata_unsafe");
+    if (!stat.isFile() || stat.nlink !== 1 || stat.size > MAX_PUBLIC_STATE_BYTES
+      || (process.platform !== "win32" && stat.uid !== process.getuid!())) throw new Error();
+    const bytes = Buffer.alloc(MAX_PUBLIC_STATE_BYTES + 1);
+    let used = 0;
+    while (used < bytes.length) {
+      const count = readSync(fd, bytes, used, bytes.length - used, null);
+      if (count === 0) break;
+      used += count;
+    }
+    if (used > MAX_PUBLIC_STATE_BYTES) throw new Error();
+    const raw = bytes.subarray(0, used).toString("utf8");
+    const value = JSON.parse(raw);
+    const keys = initialization ? "configId,fingerprint,predecessor,schema" : "configId,fingerprint,schema";
+    if (value === null || typeof value !== "object" || Array.isArray(value)
+      || Object.keys(value).sort().join(",") !== keys || value.schema !== 1 || value.configId !== configId
+      || typeof value.fingerprint !== "string" || !/^[A-F0-9]{64}$/.test(value.fingerprint)
+      || (initialization && value.predecessor !== null && typeof value.predecessor !== "string")) throw new Error();
+    if (initialization && value.predecessor !== null
+      && new X509Certificate(value.predecessor).toString() !== value.predecessor) throw new Error();
+    return value;
+  } catch (error) {
+    if (error instanceof Error && error.message === "picker_ca_metadata_unsafe") throw error;
+    throw new Error("picker_ca_metadata_invalid");
+  }
+  finally { closeSync(fd); }
+}
+
+export interface PersistentPickerCaOptions {
+  configDir: string;
+  stateDir: string;
+  store?: PickerCaStore;
+  acceptsAuthority: (pem: string) => boolean;
+  create: () => StoredPickerCa;
+  /** Refuses a different live predecessor BEFORE the journal or credential can be written. */
+  predecessor: (ca: StoredPickerCa) => string | null;
+  publish: (ca: StoredPickerCa, predecessor: string | null) => void;
+  publishMetadata: (path: string, value: string) => void;
+}
+
+/** Caller holds the canonical picker CA lease throughout the store/publication transaction. */
+export function ensurePersistentPickerCa(options: PersistentPickerCaOptions): StoredPickerCa {
+  const configId = pickerCaConfigId(options.configDir);
+  const metadataPath = join(options.stateDir, "authority.json");
+  const journalPath = join(options.stateDir, "authority-init.json");
+  const metadata = readState(metadataPath, configId, false);
+  let journal = readState(journalPath, configId, true) as Initialization | null;
+  const entry = openPickerCaCredential(configId, options.store);
+  const raw = readPickerCaCredential(entry);
+  let ca: StoredPickerCa;
+  if (raw === null) {
+    if (metadata || journal) throw new Error("picker_ca_store_missing");
+    ca = options.create();
+    const predecessor = options.predecessor(ca);
+    journal = { schema: 1, configId, fingerprint: ca.fingerprint, predecessor };
+    // Exclusive evidence is durable before ANY credential mutation. Never erase it on failure.
+    writeFileSync(journalPath, JSON.stringify(journal) + "\n", { flag: "wx", mode: 0o600 });
+    writePickerCaCredential(entry, configId, ca);
+  } else {
+    ca = decodePickerCaCredential(raw, configId, options.acceptsAuthority);
+    if ((!metadata && !journal) || (metadata && metadata.fingerprint !== ca.fingerprint)
+      || (journal && journal.fingerprint !== ca.fingerprint)) throw new Error("picker_ca_metadata_mismatch");
+    const predecessor = options.predecessor(ca);
+    if (journal) {
+      // A crash may have published the new certificate already, but no different predecessor
+      // may be adopted under an existing journal. Public evidence must be exact and key-free.
+      if (predecessor !== null && predecessor !== journal.predecessor) throw new Error("picker_ca_metadata_mismatch");
+    } else if (predecessor !== null) throw new Error("picker_ca_metadata_mismatch");
+  }
+  options.publishMetadata(metadataPath, JSON.stringify({ schema: 1, configId, fingerprint: ca.fingerprint }) + "\n");
+  options.publish(ca, journal?.predecessor ?? null);
+  if (journal) rmSync(journalPath); // Last: store, metadata, certificate, owner, and cleanup evidence now exist.
+  return ca;
+}

package/src/claude/intercept/picker-ca-startup.ts

@@ -0,0 +1,16 @@
+import { ensurePickerCa, type PickerCa } from "./picker-ca";
+import { drainPendingPickerCaUntrust } from "./picker-ca-cleanup";
+import type { PickerCaStore } from "./picker-ca-store";
+import type { SecurityRunner } from "./picker-trust";
+
+/** Internal activation seam: finish legacy cleanup before a persistent issuer is usable. */
+export async function preparePersistentPickerAuthority(options: {
+  configDir: string; store?: PickerCaStore; security?: SecurityRunner; platform: NodeJS.Platform;
+}): Promise<PickerCa> {
+  if (options.platform !== "darwin") throw new Error("picker_ca_unsupported_platform");
+  const drain = () => drainPendingPickerCaUntrust(options.configDir, options.security, options.platform);
+  if (!await drain()) throw new Error("picker_ca_pending_untrust");
+  const ca = ensurePickerCa(options.configDir, { rotation: "startup", persistent: true, store: options.store });
+  if (!await drain()) throw new Error("picker_ca_pending_untrust");
+  return ca;
+}

package/src/claude/intercept/picker-ca-store.ts

@@ -0,0 +1,70 @@
+import { createHash, createPrivateKey, createPublicKey, X509Certificate } from "node:crypto";
+import { loadKeyringBinding } from "../../lib/keyring-native";
+import type { LocalInterceptCa } from "./local-ca";
+
+export const PICKER_CA_STORE_SERVICE = "opencodex.claude-desktop-picker.ca.v1";
+const MAX_PAYLOAD_BYTES = 16 * 1024;
+export interface PickerCaCredential {
+  getPassword(): string | null;
+  setPassword(value: string): void;
+}
+export type PickerCaStore = (service: string, account: string) => PickerCaCredential;
+export interface StoredPickerCa extends LocalInterceptCa { fingerprint: string }
+
+export function pickerCaConfigId(canonicalConfigDir: string): string {
+  return createHash("sha256").update(canonicalConfigDir).digest("hex");
+}
+
+function nativeStore(service: string, account: string): PickerCaCredential {
+  const { Entry } = loadKeyringBinding();
+  // The shared loader is deliberately binding-agnostic; this is the sync Entry contract.
+  return new Entry(service, account) as PickerCaCredential;
+}
+
+export function openPickerCaCredential(configId: string, store: PickerCaStore = nativeStore): PickerCaCredential {
+  try { return store(PICKER_CA_STORE_SERVICE, configId); }
+  catch { throw new Error("picker_ca_store_unavailable"); }
+}
+
+export function readPickerCaCredential(entry: PickerCaCredential): string | null {
+  try {
+    const value = entry.getPassword();
+    if (value === null) return null;
+    if (typeof value !== "string") throw new Error();
+    return value;
+  } catch { throw new Error("picker_ca_store_unavailable"); }
+}
+
+/** OS credential contents are an untrusted, bounded, exact-shape boundary. */
+export function decodePickerCaCredential(
+  raw: string, configId: string, acceptsAuthority: (pem: string) => boolean,
+): StoredPickerCa {
+  try {
+    if (Buffer.byteLength(raw) > MAX_PAYLOAD_BYTES) throw new Error();
+    const value = JSON.parse(raw);
+    if (value === null || typeof value !== "object" || Array.isArray(value)
+      || Object.keys(value).sort().join(",") !== "certPem,configId,fingerprint,keyPem,schema"
+      || value.schema !== 1 || value.configId !== configId
+      || typeof value.certPem !== "string" || typeof value.keyPem !== "string"
+      || typeof value.fingerprint !== "string" || !/^[A-F0-9]{64}$/.test(value.fingerprint)) throw new Error();
+    const cert = new X509Certificate(value.certPem);
+    const privateKey = createPrivateKey(value.keyPem);
+    const publicKey = createPublicKey(value.keyPem);
+    const now = Date.now();
+    if (cert.toString() !== value.certPem || !acceptsAuthority(value.certPem)
+      || !cert.ca || !cert.checkPrivateKey(privateKey) || !cert.verify(publicKey)
+      || privateKey.asymmetricKeyType !== "ec" || privateKey.asymmetricKeyDetails?.namedCurve !== "prime256v1"
+      || privateKey.export({ type: "pkcs8", format: "pem" }) !== value.keyPem
+      || !(Date.parse(cert.validFrom) <= now && now < Date.parse(cert.validTo))
+      || createHash("sha256").update(cert.raw).digest("hex").toUpperCase() !== value.fingerprint) throw new Error();
+    return { certPem: value.certPem, keyPem: value.keyPem, fingerprint: value.fingerprint, privateKey, publicKey };
+  } catch { throw new Error("picker_ca_store_invalid"); }
+}
+
+export function writePickerCaCredential(entry: PickerCaCredential, configId: string, ca: StoredPickerCa): void {
+  const raw = JSON.stringify({ schema: 1, configId, fingerprint: ca.fingerprint, certPem: ca.certPem, keyPem: ca.keyPem });
+  if (Buffer.byteLength(raw) > MAX_PAYLOAD_BYTES) throw new Error("picker_ca_store_invalid");
+  try { entry.setPassword(raw); }
+  catch { throw new Error("picker_ca_store_unavailable"); }
+  if (readPickerCaCredential(entry) !== raw) throw new Error("picker_ca_store_readback_failed");
+}

package/src/claude/intercept/picker-ca.ts

@@ -1,6 +1,8 @@
 import { createHash, randomUUID, X509Certificate } from "node:crypto";
 import { chmodSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
+import { canonicalPickerConfigDir, ensurePersistentPickerCa } from "./picker-ca-persistence";
+import type { PickerCaStore } from "./picker-ca-store";
 import { withClientLifecycleSync } from "../../client/lifecycle-lock";
 import {
   ALL_IP_ADDRESS_BASES,
@@ -405,29 +407,58 @@ export function acknowledgePendingPickerCaUntrust(
  * unconditional so a later failed rotation can never leave that key behind.
  */
 export function discardPickerCaKey(configDir: string): void {
+  try {
+    const stat = lstatSync(pickerStateDir(configDir));
+    if (!stat.isDirectory() || (process.platform !== "win32" && stat.uid !== process.getuid!())) {
+      throw new Error("picker_ca_directory_unsafe");
+    }
+  } catch (error) {
+    if (error !== null && typeof error === "object" && (error as { code?: unknown }).code === "ENOENT") return;
+    throw error;
+  }
   rmSync(join(pickerStateDir(configDir), "ca.key"), { force: true });
 }
 
-export function ensurePickerCa(configDir: string, options: { rotation?: "startup" } = {}): PickerCa {
+export function ensurePickerCa(configDir: string, options: { rotation?: "startup"; persistent?: boolean; store?: PickerCaStore } = {}): PickerCa {
+  mkdirSync(configDir, { recursive: true, mode: 0o700 });
+  configDir = canonicalPickerConfigDir(configDir);
   const dir = pickerStateDir(configDir);
-  // The signing key must never survive this process: another process under the same user could
-  // otherwise steal it and later take over the predictable loopback proxy. Drop a key left (or
-  // restored) by an older release on every call, including cache hits.
+  // Persistent startup stores the signing key in the OS credential store; plain calls keep an
+  // in-process authority. Both paths remove legacy plaintext ca.key files, including cache hits.
   discardPickerCaKey(configDir);
   const cached = processAuthorities.get(dir);
-  const pickerCa = cached ?? (() => {
+  const create = () => cached ?? (() => {
     const ca = createCertificateAuthority({ commonName: PICKER_CA_COMMON_NAME, permittedDnsNames: [PICKER_HOST] });
     return { ...ca, fingerprint: pickerCaFingerprints(ca.certPem).sha256 };
   })();
   mkdirSync(dir, { recursive: true, mode: 0o700 });
-  lockedPickerCa(configDir, () => {
+  const pickerCa = lockedPickerCa(configDir, () => {
     if (readPendingPickerCaUntrust(configDir)) throw new Error("picker_ca_pending_untrust");
+    if (options.persistent) {
+      return ensurePersistentPickerCa({
+        configDir, stateDir: dir, store: options.store, acceptsAuthority: acceptsPickerAuthority, create,
+        predecessor: ca => {
+          const published = publishedPickerCa(configDir);
+          if (published === ca.certPem || published === null) return null;
+          if (livePublishedOwner(configDir, published)) throw new Error("picker_ca_live_owner");
+          const outgoing = publicCertificate(published);
+          if (outgoing && options.rotation !== "startup") throw new Error("picker_ca_rotation_requires_startup");
+          return outgoing?.certPem ?? null;
+        },
+        publishMetadata: publishPem,
+        publish: (ca, predecessor) => {
+          if (predecessor) writePendingPickerCaUntrust(configDir, publicCertificate(predecessor)!);
+          publishAuthority(configDir, ca);
+        },
+      });
+    }
+    const pickerCa = create();
     const published = publishedPickerCa(configDir);
     if (published === pickerCa.certPem) {
       // The signing key is still in this process. A missing/stale owner file must not let a
       // second process rotate this live authority after an otherwise harmless cached ensure.
       if (!currentProcessOwnsPublishedCa(configDir, pickerCa)) publishOwner(configDir, pickerCa);
-      return;
+      return pickerCa;
     }
     if (published !== null && livePublishedOwner(configDir, published)) {
       throw new Error("picker_ca_live_owner");
@@ -438,14 +469,17 @@ export function ensurePickerCa(configDir: string, options: { rotation?: "startup
       writePendingPickerCaUntrust(configDir, outgoing);
     }
     publishAuthority(configDir, pickerCa);
+    return pickerCa;
   });
-  if (!cached) processAuthorities.set(dir, pickerCa);
+  if (!cached || options.persistent) processAuthorities.set(dir, pickerCa);
   return pickerCa;
 }
 
 /** Fingerprint of this process's authority only — null until ensurePickerCa has run. */
 export function publishedPickerCaSha256(configDir: string): string | null {
-  const cached = processAuthorities.get(pickerStateDir(configDir));
+  let canonical: string;
+  try { canonical = canonicalPickerConfigDir(configDir); } catch { return null; }
+  const cached = processAuthorities.get(pickerStateDir(canonical));
   return cached ? pickerCaFingerprints(cached.certPem).sha256 : null;
 }
 

package/src/claude/intercept/picker-runtime.ts

@@ -19,6 +19,8 @@ import type { ClaudeDesktopMode } from "../desktop-first-party";
 import type { TunnelDecision } from "./connect-proxy";
 import type { PemKeyPair } from "./local-ca";
 import { PICKER_HOST, ensurePickerCa, issuePickerLeaf, pickerCaFingerprints, pickerLeafCertPath, pickerStateDir, type PickerCa } from "./picker-ca";
+import { preparePersistentPickerAuthority } from "./picker-ca-startup";
+import type { PickerCaStore } from "./picker-ca-store";
 import { startPickerListener, type PickerListenerHandle } from "./picker-listener";
 import { createPickerModelSnapshot, type PickerModelSnapshot, type PickerRouteInput } from "./picker-models";
 import { inspectPickerTrust, type PickerTrustState, type SecurityRunner } from "./picker-trust";
@@ -81,6 +83,8 @@ export interface CreatePickerRuntimeOptions {
   isBusy?: () => boolean;
   configDir: string;
   loadRoutes: () => Promise<PickerRouteInput>;
+  /** Production opt-in; pure/direct runtime callers remain ephemeral. */
+  persistentAuthority?: { store?: PickerCaStore };
   security?: SecurityRunner;
   platform?: NodeJS.Platform;
   now?: () => number;
@@ -161,9 +165,11 @@ export function createPickerRuntime(options: CreatePickerRuntimeOptions): Picker
     if (pending) void pending.then(handle => handle.close()).catch(() => {});
   }
 
-  function ensureMaterial(): { ca: PickerCa; leaf: PemKeyPair; sha1: string } {
+  async function ensureMaterial(): Promise<{ ca: PickerCa; leaf: PemKeyPair; sha1: string }> {
     if (!ca || !leaf || !caSha1) {
-      ca = ensurePickerCa(options.configDir);
+      ca = options.persistentAuthority
+        ? await preparePersistentPickerAuthority({ configDir: options.configDir, store: options.persistentAuthority.store, security: options.security, platform })
+        : ensurePickerCa(options.configDir);
       leaf = issuePickerLeaf(ca, options.configDir);
       caSha1 = pickerCaFingerprints(ca.certPem).sha1;
     }
@@ -176,7 +182,7 @@ export function createPickerRuntime(options: CreatePickerRuntimeOptions): Picker
   }
 
   async function inspectTrust(force: boolean): Promise<PickerTrustState> {
-    const { sha1 } = ensureMaterial();
+    const { sha1 } = await ensureMaterial();
     if (!force && trustFor === sha1 && now() - trustCheckedAt < trustTtlMs) return trust;
     trust = await inspectPickerTrust(pickerLeafCertPath(options.configDir), sha1, options.security, platform);
     trustFor = sha1;
@@ -186,7 +192,8 @@ export function createPickerRuntime(options: CreatePickerRuntimeOptions): Picker
 
   /** CA, leaf, snapshot and listener. Resolves false when a disarm overtook it. */
   async function startPieces(gen: number): Promise<boolean> {
-    const material = ensureMaterial();
+    const material = await ensureMaterial();
+    if (gen !== generation || latched || stopped) return false;
     ensureSnapshot().refreshIfStale(PICKER_MODELS_MAX_AGE_MS);
     if (!listenerPromise) {
       const current = startListener({
@@ -266,6 +273,9 @@ export function createPickerRuntime(options: CreatePickerRuntimeOptions): Picker
       });
     },
     async refreshTrust() {
+      // A dormant production picker has no authority to inspect. Status/off must not initialize
+      // credentials; an already initialized issuer still gets authoritative OS trust inspection.
+      if (options.persistentAuthority && ca === null) return trust;
       return inspectTrust(true);
     },
     async refresh() {

package/src/claude/intercept/runtime.ts

@@ -8,10 +8,11 @@ import { createCliCatalogProvider } from "./cli-picker";
 import { CLAUDE_INTERCEPT_HOSTS, isBrowserConnect, startConnectProxy, type ConnectProxyHandle } from "./connect-proxy";
 import { startClaudeInterceptListener } from "./listener";
 import { claudeInterceptCaCertPath, ensureLocalInterceptCaForStartup, issueLocalInterceptLeaf } from "./local-ca";
-import { discardPickerCaKey, ensurePickerCa } from "./picker-ca";
-import { drainPendingPickerCaUntrust } from "./picker-ca-cleanup";
+import { discardPickerCaKey } from "./picker-ca";
+import { preparePersistentPickerAuthority } from "./picker-ca-startup";
+import type { PickerCaStore } from "./picker-ca-store";
 import type { PickerRouteInput } from "./picker-models";
-import { createPickerRuntime, type CreatePickerRuntimeOptions, type PickerRuntime } from "./picker-runtime";
+import { createPickerRuntime, pickerDesired, type CreatePickerRuntimeOptions, type PickerRuntime } from "./picker-runtime";
 import type { SecurityRunner } from "./picker-trust";
 import { ensureClaudeInterceptProxyToken, readClaudeInterceptProxyToken } from "./proxy-auth";
 import { buildClaudeInterceptEnv, migrateClaudeInterceptSettings } from "./settings";
@@ -31,6 +32,15 @@ import { buildClaudeInterceptEnv, migrateClaudeInterceptSettings } from "./setti
  * tunnels may be terminated by the picker runtime (src/claude/intercept/picker-runtime.ts).
  */
 
+const PICKER_AUTHORITY_ERROR_CODES = new Set([
+  "picker_ca_store_unavailable", "picker_ca_store_missing", "picker_ca_store_invalid",
+  "picker_ca_store_readback_failed", "picker_ca_metadata_mismatch", "picker_ca_metadata_unsafe",
+  "picker_ca_metadata_invalid", "picker_ca_live_owner", "picker_ca_pending_untrust",
+  "picker_ca_pending_untrust_invalid", "picker_ca_pending_untrust_unsafe", "picker_ca_pending_untrust_changed",
+  "picker_ca_config_unsafe", "picker_ca_directory_unsafe", "picker_ca_rotation_requires_startup",
+  "picker_ca_unsupported_platform",
+]);
+
 export const CLAUDE_INTERCEPT_PORT_OFFSET = 100;
 
 export function claudeInterceptEnabled(config: Pick<OcxConfig, "claudeCode" | "runtimeRole">): boolean {
@@ -135,6 +145,7 @@ export interface StartClaudeInterceptOptions<T> {
   /** Test seam: bind real CONNECT handlers on kernel-assigned ports without probe-and-release races. */
   startProxy?: typeof startConnectProxy;
   /** Test seams: the macOS `security` runner and platform for the picker runtime and controller. */
+  pickerCaStore?: PickerCaStore;
   pickerSecurity?: SecurityRunner;
   pickerPlatform?: NodeJS.Platform;
 }
@@ -200,10 +211,8 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
   let pickerReason: ClaudeInterceptState["pickerReason"] = null;
   let pickerFailurePort: number | undefined;
   try {
-    if (options.loadPickerRoutes) {
-      // A picker authority is process-scoped, and older releases persisted an exportable ca.key
-      // next to the published certificate. Drop that key before anything else: a cleanup failure
-      // below must never leave a signing key on disk that outlives this process.
+    if (options.loadPickerRoutes && (options.pickerPlatform ?? process.platform) === "darwin") {
+      // Remove any legacy plaintext key before inspecting or activating picker state.
       discardPickerCaKey(configDir);
       const { inspectDesktopPickerProfile } = await import("../desktop-picker-profile");
       // The applied profile row is durable evidence of the user's picker selection. Rotation keeps
@@ -217,22 +226,23 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
       const pickerProfileApplied = pickerProfile.kind === "applied";
       let pickerBlocked = false;
       try {
-        // A prior process may have died after publishing the journal but before cleanup. Finish
-        // that entry before rotation can replace it, then drain the newly queued predecessor.
-        const drain = () => drainPendingPickerCaUntrust(configDir, options.pickerSecurity, options.pickerPlatform);
-        if (!await drain()) pickerBlocked = true;
-        if (!pickerBlocked) {
-          ensurePickerCa(configDir, { rotation: "startup" });
-          if (!await drain()) pickerBlocked = true;
+        const { observeClaudeDesktopMode, resolveClaudeDesktopMode } = await import("../desktop-first-party");
+        const fresh = options.config;
+        const platform = options.pickerPlatform ?? process.platform;
+        if (pickerProfileApplied || pickerDesired(fresh, resolveClaudeDesktopMode(fresh, observeClaudeDesktopMode(fresh)), platform)) {
+          await preparePersistentPickerAuthority({ configDir, store: options.pickerCaStore, security: options.pickerSecurity, platform });
         }
       } catch (error) {
         pickerBlocked = true;
         pickerReason = "failed";
-        console.warn(`⚠ Claude Desktop picker CA cleanup deferred: ${error instanceof Error ? error.message : String(error)}`);
+        // Native and filesystem errors may include private contents or paths. Emit only an exact
+        // application-owned code; arbitrary diagnostic text never crosses this boundary.
+        const code = error instanceof Error && PICKER_AUTHORITY_ERROR_CODES.has(error.message) ? error.message : null;
+        console.warn(code === "picker_ca_pending_untrust"
+          ? "⚠ Claude Desktop picker disabled: the previous certificate could not be untrusted"
+          : `⚠ Claude Desktop picker disabled: picker authority unavailable${code ? ` (${code})` : ""}`);
       }
       if (pickerBlocked) {
-        pickerReason = "failed";
-        console.warn("⚠ Claude Desktop picker disabled: the previous certificate could not be untrusted");
         if (pickerProfile.kind === "applied") {
           // Keep Desktop's actual pinned egress alive without ever constructing a TLS terminator.
           const port = Number(new URL(pickerProfile.proxyUrl).port);
@@ -253,6 +263,7 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
       picker = pickerBlocked ? null : (options.createPicker ?? createPickerRuntime)({
         config: options.config,
         configDir,
+        persistentAuthority: { store: options.pickerCaStore },
         loadRoutes: options.loadPickerRoutes,
         // The controller's lock: while it is held, periodic refreshes never arm.
         isBusy: () => controller?.busy() ?? false,
@@ -312,17 +323,15 @@ export async function startClaudeIntercept<T>(options: StartClaudeInterceptOptio
           persistPreference,
           proxyPort: () => (pickerProxyLive && boundProxy ? boundProxy.port : null),
           configDir,
+          persistentAuthority: { store: options.pickerCaStore },
           ...(options.pickerSecurity ? { security: options.pickerSecurity } : {}),
           ...(options.pickerPlatform ? { platform: options.pickerPlatform } : {}),
         });
         await picker.start();
-        // The rotated authority still needs the user's consent in the login keychain — a decline
-        // reports trust_pending, and the picker stays a blind tunnel until trust is granted. When
-        // Desktop was pinned to the picker before the restart, the regular enable flow re-trusts
-        // the new authority and rewrites the profile row in place, so a restart does not silently
-        // turn the picker off.
+        // Restore inspects the retained identity without installing trust. Explicit enable/trust
+        // owns consent when trust was revoked or legacy migration introduced a new authority.
         if (pickerProfileApplied && controller) {
-          void controller.enable({ persist: false, context: "server" })
+          void controller.enable({ persist: false, context: "server", allowTrustPrompt: false })
             .catch(error => console.warn(`⚠ Claude Desktop picker restore failed: ${error instanceof Error ? error.message : String(error)}`));
         }
       }