@skrr-ai/auth-core 0.1.5 → 0.1.7

package/dist/cjs/index.d.ts

@@ -32,7 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';

package/dist/cjs/index.js

@@ -11,7 +11,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
 exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
+exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -289,6 +289,7 @@ Object.defineProperty(exports, "sanitizeSpawnEnv", { enumerable: true, get: func
 Object.defineProperty(exports, "SENSITIVE_ENV_VARS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_VARS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIXES; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_SUFFIXES", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_SUFFIXES; } });
+Object.defineProperty(exports, "SENSITIVE_ENV_NAME_TOKENS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_NAME_TOKENS; } });
 Object.defineProperty(exports, "SENSITIVE_ENV_PREFIX_EXCEPTIONS", { enumerable: true, get: function () { return spawnEnv_js_1.SENSITIVE_ENV_PREFIX_EXCEPTIONS; } });
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */

package/dist/cjs/kek/linux.js

@@ -64,7 +64,6 @@ exports.__resetKekCacheForTest = __resetKekCacheForTest;
  * cleaning up the corresponding Secret Service entry when finished.
  */
 const node_child_process_1 = require("node:child_process");
-const node_util_1 = require("node:util");
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_os_1 = __importDefault(require("node:os"));
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -104,7 +103,6 @@ const HKDF_INFO = Buffer.from('oversky-cred-kek-v1');
 /** Filesystem paths for Tier-3 IKM components. */
 const PATH_LOGINUID = '/proc/self/loginuid';
 const PATH_MACHINE_ID = '/etc/machine-id';
-const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
 let _execFileForTest = null;
 /**
  * @internal Test seam — inject a mock execFile for hermetic tests so the
@@ -118,23 +116,38 @@ function __setExecFileForTest(fn) {
     _secretToolProbeCache = undefined;
     _tierSelection = null;
 }
-/** Default execFile wrapper used when no test override is installed. */
-const defaultExec = async (file, args, options) => {
-    const result = await execFileAsync(file, args, {
-        encoding: 'utf-8',
-        ...(options ?? {}),
+/**
+ * Default execFile wrapper used when no test override is installed.
+ *
+ * `input` is WRITTEN to the child's stdin here, and stdin is always closed. The
+ * previous version forwarded `input` as an execFile option — but only the SYNC
+ * child_process functions honour `input`; async `execFile` ignores it. So
+ * `secret-tool store`, which reads the secret from stdin, got neither the secret
+ * nor EOF and waited forever: Tier-2 enrollment could not complete on any Linux
+ * desktop with a working Secret Service. Closing stdin also means no other call
+ * can block on a tool that unexpectedly reads it.
+ */
+const defaultExec = (file, args, options) => new Promise((resolve, reject) => {
+    const { input, ...execOptions } = options ?? {};
+    const child = (0, node_child_process_1.execFile)(file, args, { encoding: 'utf-8', ...execOptions }, (err, stdout, stderr) => {
+        // Defensive coercion — when callers override the encoding, output may
+        // surface as Buffer; normalize both shapes.
+        const out = typeof stdout === 'string' ? stdout : Buffer.from(stdout).toString('utf-8');
+        const errOut = typeof stderr === 'string' ? stderr : Buffer.from(stderr).toString('utf-8');
+        if (err) {
+            // Same shape promisify(execFile) produced, which the probe reads.
+            reject(Object.assign(err, { stdout: out, stderr: errOut }));
+            return;
+        }
+        resolve({ stdout: out, stderr: errOut });
     });
-    // Defensive coercion — when callers override the encoding, stdout may
-    // surface as Buffer/Uint8Array; the typeof guard keeps both shapes safe.
-    return {
-        stdout: typeof result.stdout === 'string'
-            ? result.stdout
-            : Buffer.from(result.stdout).toString('utf-8'),
-        stderr: typeof result.stderr === 'string'
-            ? result.stderr
-            : Buffer.from(result.stderr).toString('utf-8'),
-    };
-};
+    if (child.stdin) {
+        // A child that exits without reading stdin makes the write fail with EPIPE;
+        // the exit status is what reports that, not this stream.
+        child.stdin.on('error', () => undefined);
+        child.stdin.end(input ?? '');
+    }
+});
 function exec(file, args, options) {
     const impl = _execFileForTest ?? defaultExec;
     return impl(file, args, { encoding: 'utf-8', ...options });
@@ -166,6 +179,41 @@ function readFileTrimmed(path) {
 // ---------------------------------------------------------------------------
 /** `undefined` = not yet probed; `boolean` = cached probe outcome. */
 let _secretToolProbeCache;
+/**
+ * True when `secret-tool` never started, as opposed to starting and exiting
+ * non-zero.
+ *
+ * `execFile` reports the two differently: a process that ran and failed carries
+ * its numeric exit code, and a spawn that failed carries a STRING errno. Only
+ * `ENOENT` used to count as "missing", so every other spawn failure read as a
+ * working binary — and the probe then picked the libsecret tier, whose `store`
+ * cannot succeed either, which disables the credential envelope and makes the CLI
+ * refuse to persist any credential at all.
+ *
+ * The case that found it: a PATH entry the process may not search. execvp
+ * reports EACCES rather than ENOENT once it has met one, and a systemd unit that
+ * makes /snap inaccessible while PATH still lists /snap/bin (the Dedicated Runtime
+ * daemon sandbox did) turns every missing binary into EACCES.
+ */
+function secretToolDidNotRun(err) {
+    const { code, status } = err;
+    return (typeof code === 'string' && SECRET_TOOL_UNRUNNABLE.has(code)) || status === 127;
+}
+/**
+ * Spawn errnos that mean the binary cannot be executed from here, permanently
+ * for this process. Deliberately NOT every string errno: EAGAIN, EMFILE or ENOMEM
+ * are transient, and caching "absent" on one of those would move a machine whose
+ * libsecret works onto the machine-id tier for the rest of the process — where the
+ * existing wrapped key cannot be opened and would be re-enrolled over.
+ */
+const SECRET_TOOL_UNRUNNABLE = new Set([
+    'ENOENT',
+    'EACCES',
+    'ENOTDIR',
+    'ELOOP',
+    'ENOEXEC',
+    'EPERM',
+]);
 /**
  * Probe secret-tool availability. Two checks:
  *   1. `secret-tool --version` — ENOENT or exit 127 means binary missing.
@@ -183,9 +231,7 @@ async function probeSecretTool() {
         await exec('secret-tool', ['--version']);
     }
     catch (err) {
-        const code = err.code;
-        const status = err.status;
-        if (code === 'ENOENT' || status === 127) {
+        if (secretToolDidNotRun(err)) {
             _secretToolProbeCache = false;
             return false;
         }
@@ -199,6 +245,10 @@ async function probeSecretTool() {
         _secretToolProbeCache = true;
     }
     catch (err) {
+        if (secretToolDidNotRun(err)) {
+            _secretToolProbeCache = false;
+            return false;
+        }
         const stderr = err.stderr ?? '';
         const isTransportError = DBUS_TRANSPORT_ERRORS.some((s) => stderr.includes(s));
         if (isTransportError) {

package/dist/cjs/refreshClassification.js

@@ -22,8 +22,9 @@ Object.defineProperty(exports, "PermanentAuthFailure", { enumerable: true, get:
 Object.defineProperty(exports, "TransientAuthFailure", { enumerable: true, get: function () { return types_js_1.TransientAuthFailure; } });
 /**
  * Maps server-supplied error codes to the canonical PermanentAuthReason values
- * exported from types.ts. Only the four values present in PermanentAuthReason
- * are listed; anything else falls through to 'REFRESH_INVALID'.
+ * exported from types.ts. `REFRESH_MISSING` is a server protocol code rather
+ * than a user-facing reason; it maps to `REFRESH_INVALID` because an identical
+ * retry cannot gain the credential the server says was absent.
  */
 const PERMANENT_CODE_SET = new Set([
     'REFRESH_INVALID',
@@ -63,6 +64,12 @@ function classifyRefreshResponse(status, body) {
     }
     // 401 — auth failure; check for known permanent code
     if (status === 401) {
+        if (body?.code === 'REFRESH_MISSING') {
+            return {
+                kind: 'failure',
+                failure: new types_js_1.PermanentAuthFailure('REFRESH_INVALID', body.message ?? 'Refresh token missing'),
+            };
+        }
         const code = body?.code;
         if (code && PERMANENT_CODE_SET.has(code)) {
             return {

package/dist/cjs/spawnEnv.d.ts

@@ -65,6 +65,16 @@ export declare const SENSITIVE_ENV_PREFIXES: readonly string[];
  * per-request allow-list, never by ambient inheritance.
  */
 export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**

package/dist/cjs/spawnEnv.js

@@ -40,7 +40,7 @@
  * serve that case: a deny-list with a hole is not a deny-list.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
+exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = void 0;
 exports.sanitizeSpawnEnv = sanitizeSpawnEnv;
 /**
  * Env vars that must NEVER reach a spawned subprocess.
@@ -110,6 +110,16 @@ exports.SENSITIVE_ENV_SUFFIXES = [
     '_PASSWORD',
     '_CREDENTIALS',
 ];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+exports.SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
@@ -145,6 +155,12 @@ function sanitizeSpawnEnv(env) {
         if (!stripped && exports.SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
             stripped = true;
         }
+        if (!stripped) {
+            const segments = key.split('_');
+            if (exports.SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
+                stripped = true;
+            }
+        }
         if (stripped)
             continue;
         out[key] = value;

package/dist/esm/index.d.ts

@@ -32,7 +32,7 @@ export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithS
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';
 export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConfiguredAutoMode, type HarnessTrustTier, type CredentialDeliveryPolicy, type CredentialMode, } from './harnessTrust.js';
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';

package/dist/esm/index.js

@@ -135,7 +135,7 @@ export { HARNESS_TIERS, getHarnessTier, credentialPolicyForTier, tierPermitsConf
 // spawns the SAME engine and did not). `daemon/src/env-sanitize.ts` re-exports
 // these so its own importers are unchanged, and keeps `filterCustomEnv` — that
 // governs SERVER-PROVIDED env, which no other process is handed.
-export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
+export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE_ENV_SUFFIXES, SENSITIVE_ENV_NAME_TOKENS, SENSITIVE_ENV_PREFIX_EXCEPTIONS, } from './spawnEnv.js';
 /* Local-machine identity — the names this product leaves on a disk. Exported so
    the CLI, daemon and Desktop share one definition instead of 47 literals. */
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';

package/dist/esm/kek/linux.js

@@ -54,7 +54,6 @@
  * cleaning up the corresponding Secret Service entry when finished.
  */
 import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
 import crypto from 'node:crypto';
 import os from 'node:os';
 import fs from 'node:fs';
@@ -94,7 +93,6 @@ const HKDF_INFO = Buffer.from('oversky-cred-kek-v1');
 /** Filesystem paths for Tier-3 IKM components. */
 const PATH_LOGINUID = '/proc/self/loginuid';
 const PATH_MACHINE_ID = '/etc/machine-id';
-const execFileAsync = promisify(execFile);
 let _execFileForTest = null;
 /**
  * @internal Test seam — inject a mock execFile for hermetic tests so the
@@ -108,23 +106,38 @@ export function __setExecFileForTest(fn) {
     _secretToolProbeCache = undefined;
     _tierSelection = null;
 }
-/** Default execFile wrapper used when no test override is installed. */
-const defaultExec = async (file, args, options) => {
-    const result = await execFileAsync(file, args, {
-        encoding: 'utf-8',
-        ...(options ?? {}),
+/**
+ * Default execFile wrapper used when no test override is installed.
+ *
+ * `input` is WRITTEN to the child's stdin here, and stdin is always closed. The
+ * previous version forwarded `input` as an execFile option — but only the SYNC
+ * child_process functions honour `input`; async `execFile` ignores it. So
+ * `secret-tool store`, which reads the secret from stdin, got neither the secret
+ * nor EOF and waited forever: Tier-2 enrollment could not complete on any Linux
+ * desktop with a working Secret Service. Closing stdin also means no other call
+ * can block on a tool that unexpectedly reads it.
+ */
+const defaultExec = (file, args, options) => new Promise((resolve, reject) => {
+    const { input, ...execOptions } = options ?? {};
+    const child = execFile(file, args, { encoding: 'utf-8', ...execOptions }, (err, stdout, stderr) => {
+        // Defensive coercion — when callers override the encoding, output may
+        // surface as Buffer; normalize both shapes.
+        const out = typeof stdout === 'string' ? stdout : Buffer.from(stdout).toString('utf-8');
+        const errOut = typeof stderr === 'string' ? stderr : Buffer.from(stderr).toString('utf-8');
+        if (err) {
+            // Same shape promisify(execFile) produced, which the probe reads.
+            reject(Object.assign(err, { stdout: out, stderr: errOut }));
+            return;
+        }
+        resolve({ stdout: out, stderr: errOut });
     });
-    // Defensive coercion — when callers override the encoding, stdout may
-    // surface as Buffer/Uint8Array; the typeof guard keeps both shapes safe.
-    return {
-        stdout: typeof result.stdout === 'string'
-            ? result.stdout
-            : Buffer.from(result.stdout).toString('utf-8'),
-        stderr: typeof result.stderr === 'string'
-            ? result.stderr
-            : Buffer.from(result.stderr).toString('utf-8'),
-    };
-};
+    if (child.stdin) {
+        // A child that exits without reading stdin makes the write fail with EPIPE;
+        // the exit status is what reports that, not this stream.
+        child.stdin.on('error', () => undefined);
+        child.stdin.end(input ?? '');
+    }
+});
 function exec(file, args, options) {
     const impl = _execFileForTest ?? defaultExec;
     return impl(file, args, { encoding: 'utf-8', ...options });
@@ -156,6 +169,41 @@ function readFileTrimmed(path) {
 // ---------------------------------------------------------------------------
 /** `undefined` = not yet probed; `boolean` = cached probe outcome. */
 let _secretToolProbeCache;
+/**
+ * True when `secret-tool` never started, as opposed to starting and exiting
+ * non-zero.
+ *
+ * `execFile` reports the two differently: a process that ran and failed carries
+ * its numeric exit code, and a spawn that failed carries a STRING errno. Only
+ * `ENOENT` used to count as "missing", so every other spawn failure read as a
+ * working binary — and the probe then picked the libsecret tier, whose `store`
+ * cannot succeed either, which disables the credential envelope and makes the CLI
+ * refuse to persist any credential at all.
+ *
+ * The case that found it: a PATH entry the process may not search. execvp
+ * reports EACCES rather than ENOENT once it has met one, and a systemd unit that
+ * makes /snap inaccessible while PATH still lists /snap/bin (the Dedicated Runtime
+ * daemon sandbox did) turns every missing binary into EACCES.
+ */
+function secretToolDidNotRun(err) {
+    const { code, status } = err;
+    return (typeof code === 'string' && SECRET_TOOL_UNRUNNABLE.has(code)) || status === 127;
+}
+/**
+ * Spawn errnos that mean the binary cannot be executed from here, permanently
+ * for this process. Deliberately NOT every string errno: EAGAIN, EMFILE or ENOMEM
+ * are transient, and caching "absent" on one of those would move a machine whose
+ * libsecret works onto the machine-id tier for the rest of the process — where the
+ * existing wrapped key cannot be opened and would be re-enrolled over.
+ */
+const SECRET_TOOL_UNRUNNABLE = new Set([
+    'ENOENT',
+    'EACCES',
+    'ENOTDIR',
+    'ELOOP',
+    'ENOEXEC',
+    'EPERM',
+]);
 /**
  * Probe secret-tool availability. Two checks:
  *   1. `secret-tool --version` — ENOENT or exit 127 means binary missing.
@@ -173,9 +221,7 @@ async function probeSecretTool() {
         await exec('secret-tool', ['--version']);
     }
     catch (err) {
-        const code = err.code;
-        const status = err.status;
-        if (code === 'ENOENT' || status === 127) {
+        if (secretToolDidNotRun(err)) {
             _secretToolProbeCache = false;
             return false;
         }
@@ -189,6 +235,10 @@ async function probeSecretTool() {
         _secretToolProbeCache = true;
     }
     catch (err) {
+        if (secretToolDidNotRun(err)) {
+            _secretToolProbeCache = false;
+            return false;
+        }
         const stderr = err.stderr ?? '';
         const isTransportError = DBUS_TRANSPORT_ERRORS.some((s) => stderr.includes(s));
         if (isTransportError) {

package/dist/esm/refreshClassification.js

@@ -23,8 +23,9 @@ import { PermanentAuthFailure, TransientAuthFailure } from './types.js';
 export { PermanentAuthFailure, TransientAuthFailure };
 /**
  * Maps server-supplied error codes to the canonical PermanentAuthReason values
- * exported from types.ts. Only the four values present in PermanentAuthReason
- * are listed; anything else falls through to 'REFRESH_INVALID'.
+ * exported from types.ts. `REFRESH_MISSING` is a server protocol code rather
+ * than a user-facing reason; it maps to `REFRESH_INVALID` because an identical
+ * retry cannot gain the credential the server says was absent.
  */
 const PERMANENT_CODE_SET = new Set([
     'REFRESH_INVALID',
@@ -64,6 +65,12 @@ export function classifyRefreshResponse(status, body) {
     }
     // 401 — auth failure; check for known permanent code
     if (status === 401) {
+        if (body?.code === 'REFRESH_MISSING') {
+            return {
+                kind: 'failure',
+                failure: new PermanentAuthFailure('REFRESH_INVALID', body.message ?? 'Refresh token missing'),
+            };
+        }
         const code = body?.code;
         if (code && PERMANENT_CODE_SET.has(code)) {
             return {

package/dist/esm/spawnEnv.d.ts

@@ -65,6 +65,16 @@ export declare const SENSITIVE_ENV_PREFIXES: readonly string[];
  * per-request allow-list, never by ambient inheritance.
  */
 export declare const SENSITIVE_ENV_SUFFIXES: readonly string[];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export declare const SENSITIVE_ENV_NAME_TOKENS: readonly string[];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export declare const SENSITIVE_ENV_PREFIX_EXCEPTIONS: ReadonlySet<string>;
 /**

package/dist/esm/spawnEnv.js

@@ -106,6 +106,16 @@ export const SENSITIVE_ENV_SUFFIXES = [
     '_PASSWORD',
     '_CREDENTIALS',
 ];
+/**
+ * Credential-shaped name TOKENS: an underscore-delimited segment anywhere in
+ * the name, not only at its end. Rotation slots put the qualifier AFTER the
+ * credential word — `SKRR_EDGE_ORIGIN_SECRET_SECONDARY`,
+ * `SCHEDULER_SIGNING_SECRET_PREVIOUS` — which every suffix above misses, so a
+ * second copy of a live secret would ride into a harness while the first was
+ * stripped. Whole-segment matching keeps `SECRETS_MANAGER_REGION` and
+ * `SECRETARY` untouched.
+ */
+export const SENSITIVE_ENV_NAME_TOKENS = ['SECRET'];
 /** Specific OVERSKY_ vars to keep (the prefix sweep is broad on purpose). */
 export const SENSITIVE_ENV_PREFIX_EXCEPTIONS = new Set([
     // Headless flag is read by spawned tools to know they're inside the daemon —
@@ -141,6 +151,12 @@ export function sanitizeSpawnEnv(env) {
         if (!stripped && SENSITIVE_ENV_SUFFIXES.some((suffix) => key.endsWith(suffix))) {
             stripped = true;
         }
+        if (!stripped) {
+            const segments = key.split('_');
+            if (SENSITIVE_ENV_NAME_TOKENS.some((token) => segments.includes(token))) {
+                stripped = true;
+            }
+        }
         if (stripped)
             continue;
         out[key] = value;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.1.5",
+  "version": "0.1.7",
   "description": "Shared auth substrate (token store, refresh, scheduler, fd handoff) for the OverSky daemon and CLI.",
   "type": "module",
   "main": "dist/cjs/index.js",
@@ -37,6 +37,7 @@
   ],
   "scripts": {
     "build": "npm run clean && npm run build:esm && npm run build:cjs && node scripts/finalize-cjs.cjs",
+    "build:dev": "npm run build:esm && npm run build:cjs && node scripts/finalize-cjs.cjs",
     "build:esm": "tsc -p tsconfig.json",
     "build:cjs": "tsc -p tsconfig.cjs.json",
     "clean": "rimraf dist",