@skrr-ai/cli 0.1.109 → 0.1.110

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/machineUuid.js

@@ -218,7 +218,7 @@ function readPersistedChoice(file, hardware, profile, requireProfile = false) {
         return null;
     }
 }
-function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
+function persistChoice(dir, file, hardware, machineUuid, reason, profile, evidence) {
     try {
         fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
         const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
@@ -228,6 +228,12 @@ function persistChoice(dir, file, hardware, machineUuid, reason, profile) {
             machineUuid,
             profile,
             reason,
+            // WHICH file made a profile "already hold credentials". The reason alone
+            // says a profile shares the default's machine row; this says what put it
+            // there, which is the difference between "an older Skrr set it up" and
+            // "its first credential was written before anything chose its identity".
+            // Additive: a reader that predates it ignores the field.
+            ...(evidence && evidence.length > 0 ? { evidence: [...evidence] } : {}),
             decidedAt: new Date().toISOString(),
         };
         fs.writeFileSync(tmp, `${JSON.stringify(body)}\n`, { mode: 0o600 });
@@ -267,7 +273,7 @@ function resolveProfileMachineUuid(profile, hardware) {
             persistChoice(dir, file, hardware, chosen, 'restored_profile', profile);
     }
     if (!chosen) {
-        const preExisting = PRE_EXISTING_PROFILE_EVIDENCE.some((name) => {
+        const evidence = PRE_EXISTING_PROFILE_EVIDENCE.filter((name) => {
             try {
                 return fs.existsSync(path.join(dir, name));
             }
@@ -275,8 +281,9 @@ function resolveProfileMachineUuid(profile, hardware) {
                 return false;
             }
         });
+        const preExisting = evidence.length > 0;
         chosen = preExisting ? hardware : qualifyMachineUuid(hardware, profile);
-        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile);
+        persistChoice(dir, file, hardware, chosen, preExisting ? 'pre_existing_profile' : 'new_profile', profile, evidence);
     }
     preserveRecoveryChoice(profile, hardware, chosen);
     profileChoiceCache.set(cacheKey, chosen);
@@ -296,14 +303,129 @@ function resolveProfileMachineUuid(profile, hardware) {
  * profile that already held credentials; see the block above.
  */
 export function getMachineUuid() {
+    return getMachineUuidForProfile(activeMachineProfile);
+}
+/**
+ * The `machineUuid` a process running as `profile` sends, WITHOUT changing which
+ * profile this process runs as.
+ *
+ * The CLI needs the answer for the profile it is about to hand a credential to,
+ * and asks the daemon binary what IT will send (`accept-handoff --print-id`).
+ * Two programs that compute one identity can only be known to agree by
+ * comparing them, and a daemon that predates per-profile identities does not
+ * agree: it sends the hardware value whatever the profile's
+ * `machine-identity.json` says, so a credential minted for what it reports
+ * registers the profile on the default machine's row (the OSK-13845 failure, now
+ * reached through version skew rather than through the rule). The comparison
+ * needs this: the expected value for the TARGET profile, which is not
+ * necessarily the one this process is running as.
+ *
+ * Decides and persists the profile's identity if nothing has yet — the same
+ * side effect `getMachineUuid()` has, for the same reason.
+ */
+export function getMachineUuidForProfile(profile) {
     const hardware = getHardwareMachineUuid();
     // A hosted runtime's identity is ISSUED and fenced by the control plane.
     if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID'))
         return hardware;
-    const profile = activeMachineProfile;
-    if (!profile || profile === DEFAULT_PROFILE_NAME)
+    const name = typeof profile === 'string' ? profile.trim() : '';
+    if (!name || name === DEFAULT_PROFILE_NAME)
         return hardware;
-    return resolveProfileMachineUuid(profile, hardware);
+    return resolveProfileMachineUuid(name, hardware);
+}
+function readRecordedChoice(profile) {
+    try {
+        const file = path.join(resolveConfigRoot(), 'profiles', profile, MACHINE_IDENTITY_FILENAME);
+        const parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        const reason = parsed.reason === 'new_profile' ||
+            parsed.reason === 'pre_existing_profile' ||
+            parsed.reason === 'restored_profile'
+            ? parsed.reason
+            : null;
+        return {
+            reason,
+            evidence: Array.isArray(parsed.evidence)
+                ? parsed.evidence.filter((e) => typeof e === 'string')
+                : [],
+            decidedAt: typeof parsed.decidedAt === 'string' ? parsed.decidedAt : null,
+        };
+    }
+    catch {
+        return { reason: null, evidence: [], decidedAt: null };
+    }
+}
+/**
+ * Which machine this process registers as, and WHY — the question a person has
+ * when two profiles turn up on one machine page and the logs say nothing.
+ *
+ * A read, not a decision: it reports the identity `getMachineUuid()` settled on
+ * (settling it if nothing has, exactly as any caller would) and the record that
+ * explains it. It never changes what a profile registers as.
+ */
+export function describeMachineIdentity() {
+    const hardware = getHardwareMachineUuid();
+    const machineUuid = getMachineUuid();
+    const active = activeMachineProfile;
+    const profile = active && active !== DEFAULT_PROFILE_NAME ? active : null;
+    const base = { profile, machineUuid, hardware };
+    if (hostedRuntimeIdOverride('OVERSKY_MACHINE_UUID')) {
+        return {
+            ...base,
+            sharesDefaultMachine: false,
+            reason: 'hosted_runtime',
+            evidence: [],
+            decidedAt: null,
+            sentence: 'This runtime is hosted; its machine identity was issued by the control plane.',
+        };
+    }
+    if (!profile) {
+        return {
+            ...base,
+            sharesDefaultMachine: false,
+            reason: 'default_profile',
+            evidence: [],
+            decidedAt: null,
+            sentence: "The default profile uses this computer's own machine identity.",
+        };
+    }
+    const recorded = readRecordedChoice(profile);
+    const sharesDefaultMachine = machineUuid === hardware;
+    const reason = recorded.reason ?? 'unrecorded';
+    const decided = recorded.decidedAt ? ` (decided ${recorded.decidedAt})` : '';
+    const held = recorded.evidence.length > 0 ? ` (${recorded.evidence.join(', ')})` : '';
+    let sentence;
+    if (reason === 'new_profile') {
+        sentence =
+            `Profile '${profile}' has its own machine identity: it held no credentials when that ` +
+                `identity was first chosen${decided}.`;
+    }
+    else if (reason === 'pre_existing_profile') {
+        sentence =
+            `Profile '${profile}' shares this computer's default machine identity: it already held ` +
+                `credentials${held} when its identity was first chosen${decided}, and the server ties ` +
+                'those credentials to that identity, so changing it would sign the profile out.';
+    }
+    else if (reason === 'restored_profile') {
+        sentence = sharesDefaultMachine
+            ? `Profile '${profile}' shares this computer's default machine identity, restored from the ` +
+                `copy kept outside the profile after its state was removed${decided}.`
+            : `Profile '${profile}' has its own machine identity, restored from the copy kept outside ` +
+                `the profile after its state was removed${decided}.`;
+    }
+    else {
+        sentence = sharesDefaultMachine
+            ? `Profile '${profile}' uses this computer's default machine identity; the record of why ` +
+                'could not be read.'
+            : `Profile '${profile}' has its own machine identity; the record of why could not be read.`;
+    }
+    return {
+        ...base,
+        sharesDefaultMachine,
+        reason,
+        evidence: recorded.evidence,
+        decidedAt: recorded.decidedAt,
+        sentence,
+    };
 }
 /** @internal test seam — forget the cached value so the next call re-probes. */
 export function __resetMachineUuidCacheForTest() {

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.26",
+  "version": "0.4.27",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {