@skrr-ai/cli 0.1.11 → 0.1.13

package/dist/lib/daemon-setup.js

@@ -0,0 +1,103 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.offerDaemonSetup = offerDaemonSetup;
+/**
+ * daemon-setup.ts — offer to set this machine up, at the moment we can.
+ *
+ * ## Why login and not `npm install`
+ *
+ * The obvious way to remove a step is a `postinstall` that installs the daemon
+ * when the CLI is installed. It cannot work, and the reason is specific rather
+ * than aesthetic: installing the daemon BINDS it to a deployment and profile,
+ * taken from the CLI's session (`bindToCliSession`, OSK-279 — a daemon on a
+ * different deployment than its CLI is the failure that binding exists to
+ * prevent). At `npm install` time there is no session.
+ *
+ * It would not even fail loudly. With no config on disk `loadConfig()` returns
+ * DEFAULT_CONFIG, whose baseURL is the DEV deployment — so a postinstall would
+ * quietly bind the machine to dev, and the first `skrr login` against
+ * production would produce exactly the split. That is the default path on a
+ * clean machine, not an edge case.
+ *
+ * Login is the first moment the answer exists. It is also where the credential
+ * handoff already runs, so this is not a new path through the program; it is
+ * the branch where that path used to give up.
+ *
+ * ## Why it asks
+ *
+ * Signing in and "run a process on this machine that can execute bash, read and
+ * write files, and drive a browser" are not the same size of decision. Doing
+ * the second as a silent consequence of the first is the class of surprise this
+ * whole area has been removing. So: asked when there is someone to ask, skipped
+ * with an instruction when there is not, and never on the opt-out.
+ */
+const prompt_1 = require("./prompt");
+const daemon_binding_1 = require("./daemon-binding");
+const exec_oversky_1 = require("./exec-oversky");
+const daemon_installer_1 = require("./daemon-installer");
+const ssh_detect_1 = require("./ssh-detect");
+/**
+ * Ask, then install. Returns without touching anything when there is nobody to
+ * ask or the operator has opted out.
+ */
+async function offerDaemonSetup(opts = {}) {
+    const env = opts.env ?? process.env;
+    const log = opts.log ?? ((line) => console.log(line));
+    // The same switch that turns the credential handoff off. An operator who has
+    // said "do not touch my daemon" has not asked a narrower question, and a
+    // second variable for the same intent is a second thing to remember.
+    if (env.OVERSKY_SKIP_DAEMON_HANDOFF === '1' || env.SKRR_SKIP_DAEMON_HANDOFF === '1') {
+        return { status: 'skipped', detail: 'skipped by OVERSKY_SKIP_DAEMON_HANDOFF' };
+    }
+    const interactive = opts.interactive ?? !(0, ssh_detect_1.isNonInteractive)();
+    if (!interactive) {
+        // A prompt with no terminal hangs forever, which is worse than the extra
+        // step. Say which command does it instead.
+        return {
+            status: 'skipped',
+            detail: 'no terminal to ask — run `skrr daemon install` to set this machine up',
+        };
+    }
+    const confirmImpl = opts.confirmImpl ?? prompt_1.confirm;
+    log('');
+    log('  This machine has no skrr runtime. It is what lets your agents work here —');
+    log('  running commands, editing files, and driving a browser on this machine.');
+    const yes = await confirmImpl('  Set it up now?', false);
+    if (!yes) {
+        return {
+            status: 'declined',
+            detail: 'run `skrr daemon install` when you want it',
+        };
+    }
+    // Fetch the signed binary only when there is none. When the binary is already
+    // present and only the service is missing, this step is skipped entirely —
+    // downloading over a working runtime is not what "set it up" asked for.
+    const binaryPresent = opts.binaryPresent ?? Boolean((0, exec_oversky_1.findOverskyBinary)());
+    if (!binaryPresent) {
+        log('  Fetching the signed release...');
+        const fetched = await (0, daemon_installer_1.installDaemon)({ env });
+        if (!fetched.ok) {
+            return { status: 'failed', detail: fetched.error };
+        }
+        log(`  Installed skrrd ${fetched.version} (${fetched.platformKey})`);
+    }
+    // Register the OS service, bound to the deployment and profile of the session
+    // that just authenticated — which is the whole reason this runs here and not
+    // at install time.
+    try {
+        const code = await (0, exec_oversky_1.execOversky)(['install', ...(0, daemon_binding_1.bindToCliSession)([])]);
+        if (code !== 0) {
+            return { status: 'failed', detail: `\`skrrd install\` exited ${code}` };
+        }
+    }
+    catch (err) {
+        if (err.message === 'oversky-not-installed') {
+            return {
+                status: 'failed',
+                detail: 'the runtime vanished between fetching and installing it',
+            };
+        }
+        return { status: 'failed', detail: err.message };
+    }
+    return { status: 'installed', detail: 'this machine is set up' };
+}

package/dist/lib/daemonHandoff.d.ts

@@ -32,6 +32,15 @@
 export interface DaemonHandoffOutcome {
     status: 'delivered' | 'skipped' | 'failed';
     detail: string;
+    /**
+     * Why it skipped, for a caller that must act on the difference.
+     *
+     * `detail` is a sentence for a human and is expected to be reworded; the
+     * caller deciding whether to OFFER TO INSTALL a daemon cannot key off that.
+     * The two absent cases are separated because they need different work — one
+     * needs a binary fetched, the other only needs the service registered.
+     */
+    reason?: 'opted-out' | 'brokered' | 'no-binary' | 'unsupported-daemon' | 'no-service';
 }
 export declare function handOffToLocalDaemon(env?: NodeJS.ProcessEnv, opts?: {
     loginFlow?: string;

package/dist/lib/daemonHandoff.js

@@ -173,7 +173,11 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
     // deliberately running a daemon against a different deployment than their CLI is
     // doing a legitimate thing, and this must not overrule it.
     if (env.OVERSKY_SKIP_DAEMON_HANDOFF === '1' || env.SKRR_SKIP_DAEMON_HANDOFF === '1') {
-        return { status: 'skipped', detail: 'skipped by OVERSKY_SKIP_DAEMON_HANDOFF' };
+        return {
+            status: 'skipped',
+            reason: 'opted-out',
+            detail: 'skipped by OVERSKY_SKIP_DAEMON_HANDOFF',
+        };
     }
     // The daemon brokered this login, which means it just used its OWN credential
     // against this server and that credential works. There is nothing to fix.
@@ -186,12 +190,13 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
     if (opts.loginFlow === 'daemon-broker') {
         return {
             status: 'skipped',
+            reason: 'brokered',
             detail: 'the local daemon brokered this login, so it already has a working credential',
         };
     }
     const binary = (0, exec_oversky_1.findOverskyBinary)();
     if (!binary) {
-        return { status: 'skipped', detail: 'no local daemon installed' };
+        return { status: 'skipped', reason: 'no-binary', detail: 'no local daemon installed' };
     }
     // An older daemon has no `accept-handoff`, and spawning it would fail with
     // commander's "unknown command" rather than anything a reader could act on. A
@@ -201,6 +206,7 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
     if (supported === false) {
         return {
             status: 'skipped',
+            reason: 'unsupported-daemon',
             detail: 'the installed daemon predates `accept-handoff`; run `skrr daemon login` once',
         };
     }
@@ -233,6 +239,7 @@ async function handOffToLocalDaemon(env = process.env, opts = {}) {
     if (idSource === 'cwd') {
         return {
             status: 'skipped',
+            reason: 'no-service',
             detail: 'no daemon service is installed on this machine',
         };
     }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -36,4 +36,6 @@ export { sanitizeSpawnEnv, SENSITIVE_ENV_VARS, SENSITIVE_ENV_PREFIXES, SENSITIVE
 export { CONFIG_DIR_NAME, LEGACY_CONFIG_DIR_NAMES, NATIVE_ID_PREFIX, LEGACY_NATIVE_ID_PREFIXES, DEFAULT_BINARY_NAME, } from './localIdentity.js';
 export { findLegacyLocalState, describeLegacyState, type LegacyStateFinding, type LegacyStateReport, } from './legacyStatePreflight.js';
 export { DEFAULT_SKY_CODE_CHANNEL, DEFAULT_SKY_CODE_FEED_BASE, SKY_CODE_CHANNELS, SKY_CODE_CHANNEL_ENV, SKY_CODE_MANIFEST_FILE, isSkyCodeChannel, resolveChannelManifestUrl, resolveSkyCodeChannel, skyCodeChannelPrefix, skyCodeFeedBase, SKY_CODE_FEED_BASE_ENV, type SkyCodeChannel, } from './skyCodeChannels.js';
+export { OVERSKY_RELEASE_PUBLIC_KEYS, type ReleaseKey } from './releaseKeys.js';
+export { MAX_SIGS, buildArtifactMessage, buildManifestMessage, getDeltaFor, verifyArtifact, verifyManifest, type DaemonVersionManifest, type DeltaDescriptor, type ManifestSignature, type PlatformArtifact, type VerifyResult, } from './releaseManifest.js';
 export { resolveConfigRoot, configRootPath, isConfigRootOverridden } from './configRoot.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -11,7 +11,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.challenge = exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.tokenHash = exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = void 0;
 exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = void 0;
-exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
+exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.SKY_CODE_FEED_BASE_ENV = exports.skyCodeFeedBase = exports.skyCodeChannelPrefix = exports.resolveSkyCodeChannel = exports.resolveChannelManifestUrl = exports.isSkyCodeChannel = exports.SKY_CODE_MANIFEST_FILE = exports.SKY_CODE_CHANNEL_ENV = exports.SKY_CODE_CHANNELS = exports.DEFAULT_SKY_CODE_FEED_BASE = exports.DEFAULT_SKY_CODE_CHANNEL = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -315,6 +315,20 @@ Object.defineProperty(exports, "resolveSkyCodeChannel", { enumerable: true, get:
 Object.defineProperty(exports, "skyCodeChannelPrefix", { enumerable: true, get: function () { return skyCodeChannels_js_1.skyCodeChannelPrefix; } });
 Object.defineProperty(exports, "skyCodeFeedBase", { enumerable: true, get: function () { return skyCodeChannels_js_1.skyCodeFeedBase; } });
 Object.defineProperty(exports, "SKY_CODE_FEED_BASE_ENV", { enumerable: true, get: function () { return skyCodeChannels_js_1.SKY_CODE_FEED_BASE_ENV; } });
+// Daemon release trust: the pinned ed25519 keys and the canonical signature
+// messages. Shared because BOTH the daemon (self-update) and the CLI
+// (`skrr daemon install`, which runs when there is no daemon to ask) verify the
+// same manifest against the same root. See releaseManifest.ts for why a mirror
+// would be the wrong shape here.
+var releaseKeys_js_1 = require("./releaseKeys.js");
+Object.defineProperty(exports, "OVERSKY_RELEASE_PUBLIC_KEYS", { enumerable: true, get: function () { return releaseKeys_js_1.OVERSKY_RELEASE_PUBLIC_KEYS; } });
+var releaseManifest_js_1 = require("./releaseManifest.js");
+Object.defineProperty(exports, "MAX_SIGS", { enumerable: true, get: function () { return releaseManifest_js_1.MAX_SIGS; } });
+Object.defineProperty(exports, "buildArtifactMessage", { enumerable: true, get: function () { return releaseManifest_js_1.buildArtifactMessage; } });
+Object.defineProperty(exports, "buildManifestMessage", { enumerable: true, get: function () { return releaseManifest_js_1.buildManifestMessage; } });
+Object.defineProperty(exports, "getDeltaFor", { enumerable: true, get: function () { return releaseManifest_js_1.getDeltaFor; } });
+Object.defineProperty(exports, "verifyArtifact", { enumerable: true, get: function () { return releaseManifest_js_1.verifyArtifact; } });
+Object.defineProperty(exports, "verifyManifest", { enumerable: true, get: function () { return releaseManifest_js_1.verifyManifest; } });
 // The one definition of the skrr root, shared by `skrr` and `skrrd`. See the
 // module for why re-deriving it kept producing divergences.
 var configRoot_js_1 = require("./configRoot.js");

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseKeys.d.ts

@@ -0,0 +1,87 @@
+/**
+ * releaseKeys.ts — ed25519 public keys pinned into the daemon binary AND the
+ * CLI that installs it.
+ *
+ * These are the trust anchors the self-updater (`update.ts`) uses to verify
+ * the signed release manifest (`daemon/latest/daemon-version.json`) and the
+ * downloaded binary artifact OFFLINE, before swapping its own binary. The
+ * matching PRIVATE half lives ONLY in CI as the Secrets Manager secret
+ * `OVERSKY_RELEASE_SIGNING_KEY` (ed25519, base64 PKCS8) — it is never checked
+ * into the repo and never shipped in the binary.
+ *
+ * CURRENT STATE: a key is pinned (`daemon-2026-07`, provisioned 2026-07-13), so
+ * self-update signature verification is FAIL-CLOSED — an unsigned or
+ * badly-signed manifest or binary aborts the update.
+ *
+ * READ THE NEXT PARAGRAPH BEFORE EMPTYING THIS ARRAY.
+ *
+ * The empty array is not a safe default; it is a DISABLED SECURITY CONTROL.
+ * With no key pinned, `update.ts` logs a warning and proceeds on TLS + SHA256
+ * only — and the SHA256 comes from the same manifest fetched over the same
+ * channel, so it defends against corruption in transit, not against a
+ * compromised or spoofed update feed. That posture (mirrored from the desktop
+ * `MANIFEST_PUBLIC_KEY=''` default) existed because the keypair had not been
+ * minted yet. It has been minted. Removing the last entry below silently
+ * re-disables offline verification on every daemon that ships the change, and
+ * nothing in the build fails to tell you.
+ *
+ * To add a key (rotation, or re-provisioning after a compromise) run
+ * `node scripts/generate-release-keypair.mjs`. It mints the ed25519 keypair,
+ * prints the ready-to-paste `{ keyId, publicKeySpkiB64 }` line for the array
+ * below, and prints the commands to store the PRIVATE half in the GitHub
+ * secret `OVERSKY_RELEASE_SIGNING_KEY` + AWS Secrets Manager. Never commit the
+ * private half; the CI signer reads `OVERSKY_RELEASE_SIGNING_KEY` and MUST
+ * import `buildArtifactMessage` / `buildManifestMessage` from
+ * `release-manifest.ts` rather than reimplementing them, so signer and verifier
+ * can never drift. Add the *next* key alongside the current one BEFORE
+ * rotating, so an in-flight rotation verifies against either — the full
+ * procedure is the rotation runbook on the array below.
+ */
+export interface ReleaseKey {
+    /** Human-readable key identifier, e.g. `daemon-2026-07`. Mirrors manifest `keyId`. */
+    keyId: string;
+    /** base64-encoded DER-SPKI ed25519 public key. */
+    publicKeySpkiB64: string;
+}
+/**
+ * Pinned release-signing public keys, newest first. Verification tries each
+ * key in turn (key rotation: keep current + next together during a rotation
+ * window). Non-empty → fail-closed, which is the state today. Empty →
+ * verification DISABLED with only a logged warning; see the file header before
+ * ever letting this array become empty.
+ *
+ * ZERO-DOWNTIME KEY-ROTATION RUNBOOK (config-only, no code change):
+ *   1. Mint the next keypair: `node scripts/generate-release-keypair.mjs --force`.
+ *   2. Pin its public half ABOVE the current key in the array below, and ship
+ *      that daemon build so the fleet trusts BOTH keys.
+ *   3. Store the new private half as the GH Actions secret
+ *      OVERSKY_RELEASE_SIGNING_KEY_NEXT (+ optional OVERSKY_RELEASE_KEY_ID_NEXT
+ *      label) — the signer then DUAL-SIGNS every release, emitting the additive
+ *      v2 `sigs[]` envelope (scalar `sig` stays = the current/primary key so
+ *      daemons that haven't picked up step 2 yet still verify).
+ *   4. Cut one release during the overlap window; it verifies for daemons
+ *      pinning the old key, the new key, or both (see release-manifest.test.ts
+ *      "ROTATION headroom").
+ *   5. Once the new-key build has saturated the fleet: promote NEXT→primary
+ *      (rename the secret to OVERSKY_RELEASE_SIGNING_KEY), drop the old key from
+ *      the array, and remove OVERSKY_RELEASE_SIGNING_KEY_NEXT. No downtime, and
+ *      no further code change — the multi-sig machinery is already shipped.
+ */
+/**
+ * NOT ROTATED FOR THE skrr RENAME. Owner decision, 2026-08-31.
+ *
+ * A rename is not a compromise. Custody is already established (GH Actions
+ * secret `OVERSKY_RELEASE_SIGNING_KEY` + AWS Secrets Manager), the keyId
+ * `daemon-2026-07` is a date, not a brand, and no user ever sees any of it.
+ *
+ * The rotation procedure documented above is shipped and correct — it just has
+ * nothing to do here. Running it would cost a fleet-saturation window (step 5)
+ * and buy nothing, and the window is exactly when a self-update path is most
+ * fragile. Rotate on a compromise or an expiry, not on a rename.
+ *
+ * The signed message prefix (`oversky-daemon-manifest`) stays for the same
+ * reason: it lives inside the signed bytes, so changing it breaks verification
+ * between old and new peers with zero user-visible benefit — the same call made
+ * for `X-Oversky-Origin`.
+ */
+export declare const OVERSKY_RELEASE_PUBLIC_KEYS: ReleaseKey[];

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseKeys.js

@@ -0,0 +1,94 @@
+"use strict";
+/**
+ * releaseKeys.ts — ed25519 public keys pinned into the daemon binary AND the
+ * CLI that installs it.
+ *
+ * These are the trust anchors the self-updater (`update.ts`) uses to verify
+ * the signed release manifest (`daemon/latest/daemon-version.json`) and the
+ * downloaded binary artifact OFFLINE, before swapping its own binary. The
+ * matching PRIVATE half lives ONLY in CI as the Secrets Manager secret
+ * `OVERSKY_RELEASE_SIGNING_KEY` (ed25519, base64 PKCS8) — it is never checked
+ * into the repo and never shipped in the binary.
+ *
+ * CURRENT STATE: a key is pinned (`daemon-2026-07`, provisioned 2026-07-13), so
+ * self-update signature verification is FAIL-CLOSED — an unsigned or
+ * badly-signed manifest or binary aborts the update.
+ *
+ * READ THE NEXT PARAGRAPH BEFORE EMPTYING THIS ARRAY.
+ *
+ * The empty array is not a safe default; it is a DISABLED SECURITY CONTROL.
+ * With no key pinned, `update.ts` logs a warning and proceeds on TLS + SHA256
+ * only — and the SHA256 comes from the same manifest fetched over the same
+ * channel, so it defends against corruption in transit, not against a
+ * compromised or spoofed update feed. That posture (mirrored from the desktop
+ * `MANIFEST_PUBLIC_KEY=''` default) existed because the keypair had not been
+ * minted yet. It has been minted. Removing the last entry below silently
+ * re-disables offline verification on every daemon that ships the change, and
+ * nothing in the build fails to tell you.
+ *
+ * To add a key (rotation, or re-provisioning after a compromise) run
+ * `node scripts/generate-release-keypair.mjs`. It mints the ed25519 keypair,
+ * prints the ready-to-paste `{ keyId, publicKeySpkiB64 }` line for the array
+ * below, and prints the commands to store the PRIVATE half in the GitHub
+ * secret `OVERSKY_RELEASE_SIGNING_KEY` + AWS Secrets Manager. Never commit the
+ * private half; the CI signer reads `OVERSKY_RELEASE_SIGNING_KEY` and MUST
+ * import `buildArtifactMessage` / `buildManifestMessage` from
+ * `release-manifest.ts` rather than reimplementing them, so signer and verifier
+ * can never drift. Add the *next* key alongside the current one BEFORE
+ * rotating, so an in-flight rotation verifies against either — the full
+ * procedure is the rotation runbook on the array below.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OVERSKY_RELEASE_PUBLIC_KEYS = void 0;
+/**
+ * Pinned release-signing public keys, newest first. Verification tries each
+ * key in turn (key rotation: keep current + next together during a rotation
+ * window). Non-empty → fail-closed, which is the state today. Empty →
+ * verification DISABLED with only a logged warning; see the file header before
+ * ever letting this array become empty.
+ *
+ * ZERO-DOWNTIME KEY-ROTATION RUNBOOK (config-only, no code change):
+ *   1. Mint the next keypair: `node scripts/generate-release-keypair.mjs --force`.
+ *   2. Pin its public half ABOVE the current key in the array below, and ship
+ *      that daemon build so the fleet trusts BOTH keys.
+ *   3. Store the new private half as the GH Actions secret
+ *      OVERSKY_RELEASE_SIGNING_KEY_NEXT (+ optional OVERSKY_RELEASE_KEY_ID_NEXT
+ *      label) — the signer then DUAL-SIGNS every release, emitting the additive
+ *      v2 `sigs[]` envelope (scalar `sig` stays = the current/primary key so
+ *      daemons that haven't picked up step 2 yet still verify).
+ *   4. Cut one release during the overlap window; it verifies for daemons
+ *      pinning the old key, the new key, or both (see release-manifest.test.ts
+ *      "ROTATION headroom").
+ *   5. Once the new-key build has saturated the fleet: promote NEXT→primary
+ *      (rename the secret to OVERSKY_RELEASE_SIGNING_KEY), drop the old key from
+ *      the array, and remove OVERSKY_RELEASE_SIGNING_KEY_NEXT. No downtime, and
+ *      no further code change — the multi-sig machinery is already shipped.
+ */
+/**
+ * NOT ROTATED FOR THE skrr RENAME. Owner decision, 2026-08-31.
+ *
+ * A rename is not a compromise. Custody is already established (GH Actions
+ * secret `OVERSKY_RELEASE_SIGNING_KEY` + AWS Secrets Manager), the keyId
+ * `daemon-2026-07` is a date, not a brand, and no user ever sees any of it.
+ *
+ * The rotation procedure documented above is shipped and correct — it just has
+ * nothing to do here. Running it would cost a fleet-saturation window (step 5)
+ * and buy nothing, and the window is exactly when a self-update path is most
+ * fragile. Rotate on a compromise or an expiry, not on a rename.
+ *
+ * The signed message prefix (`oversky-daemon-manifest`) stays for the same
+ * reason: it lives inside the signed bytes, so changing it breaks verification
+ * between old and new peers with zero user-visible benefit — the same call made
+ * for `X-Oversky-Origin`.
+ */
+exports.OVERSKY_RELEASE_PUBLIC_KEYS = [
+    // ── NEXT key goes ABOVE this line during a rotation (newest first). ──
+    // Provisioned 2026-07-13. Private half: GH Actions secret
+    // OVERSKY_RELEASE_SIGNING_KEY + AWS Secrets Manager
+    // (us-east-1: oversky/daemon/release-signing-key). Self-update signature
+    // verification is now FAIL-CLOSED.
+    {
+        keyId: 'daemon-2026-07',
+        publicKeySpkiB64: 'MCowBQYDK2VwAyEA7ArbRnkbRW354XZ4MNS1MRLCwrTFauQzsw4GP27mMfI=',
+    },
+];

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/releaseManifest.d.ts

@@ -0,0 +1,161 @@
+import { type ReleaseKey } from './releaseKeys.js';
+export type { ReleaseKey } from './releaseKeys.js';
+/**
+ * One entry in a v2 multi-signature envelope. `sig` is a base64 ed25519
+ * signature over the EXACT SAME bytes as the v1 scalar `sig` (buildArtifact/
+ * ManifestMessage) — v2 is an envelope change, not a wire-format change. The
+ * `keyId` is an ADVISORY label only: verification trial-verifies every sig
+ * against every pinned key and NEVER consults keyId, so a mislabeled keyId can
+ * neither grant nor withhold trust (this structurally defeats keyId
+ * substitution). It exists for operator diagnostics ("which key signed this?").
+ */
+export interface ManifestSignature {
+    keyId: string;
+    /** base64 ed25519 signature over the same bytes as the v1 `sig`. */
+    sig: string;
+}
+/**
+ * v-delta (optional): a differential-update patch that transforms a specific
+ * PRIOR version's binary into this release's binary — a brotli-compressed
+ * fossil delta. UNSIGNED, exactly like `keyId`/`size`/`sigs` (NOT part of
+ * buildArtifactMessage/buildManifestMessage), so it never changes the signed
+ * bytes and #782's envelope invariant holds. Trust comes SOLELY from verifying
+ * the RECONSTRUCTED binary against the signed `sha256` + ed25519 gates: a
+ * tampered/garbage delta yields a non-matching binary and the daemon falls back
+ * to the full signed download. `sha256` here is TRANSPORT integrity of the patch
+ * file only — NEVER an install gate.
+ */
+export interface DeltaDescriptor {
+    /** Absolute public URL of the brotli-compressed fossil delta patch. */
+    url: string;
+    /** Lowercase hex sha256 of the patch file — transport integrity, not trust. */
+    sha256: string;
+    /** Size of the patch file in bytes. */
+    size: number;
+}
+/** One downloadable, immutable binary for a single `<platform>-<arch>` target. */
+export interface PlatformArtifact {
+    /** Bare filename, e.g. `oversky-darwin-arm64`. */
+    file: string;
+    /** Absolute public URL under the CloudFront feed. */
+    url: string;
+    /** Lowercase hex sha256 of the binary bytes. */
+    sha256: string;
+    /** Size in bytes. */
+    size: number;
+    /** base64 ed25519 signature over buildArtifactMessage(...) — the PRIMARY key. */
+    sig: string;
+    /**
+     * v2 (optional): EVERY signature (primary + rotation key) over the same
+     * bytes as `sig`. Emitted ONLY during a key-rotation window (>1 signing key);
+     * absent in steady single-key state, so a normal manifest is byte-identical
+     * to v1. When present it is the authoritative set — see verifyWithKeysMulti.
+     */
+    sigs?: ManifestSignature[];
+    /**
+     * v-delta (optional, UNSIGNED): differential-update patches keyed by the
+     * from-version they apply to (e.g. `"0.8.0"`). Absent in steady state. See
+     * DeltaDescriptor — the reconstructed binary is verified against `sha256`
+     * above, so deltas add NO trust surface.
+     */
+    deltas?: Record<string, DeltaDescriptor>;
+}
+/**
+ * The signed release manifest. `platforms` is keyed by `<platform>-<arch>`
+ * (e.g. `darwin-arm64`, `linux-x64`). The top-level `sig` covers
+ * buildManifestMessage(manifest-without-sig).
+ */
+export interface DaemonVersionManifest<TPolicy = unknown> {
+    schemaVersion: number;
+    version: string;
+    minimum: string;
+    forceUpdate: boolean;
+    keyId: string;
+    platforms: Record<string, PlatformArtifact>;
+    /**
+     * base64 ed25519 signature over buildManifestMessage(this-without-sig) — the
+     * PRIMARY key. Kept populated even in v2 so an OLD (v1-only) daemon still
+     * verifies against the key the lagging fleet trusts.
+     */
+    sig: string;
+    /**
+     * v2 (optional): EVERY manifest signature (primary + rotation key). Emitted
+     * ONLY during a rotation window; when present it is authoritative — see
+     * verifyWithKeysMulti. `schemaVersion` stays a reader hint (unsigned, inert);
+     * v2 is detected by `Array.isArray(sigs)`, not by the version number.
+     */
+    sigs?: ManifestSignature[];
+    /**
+     * Independently signed release decision envelope. It is intentionally not
+     * part of the v1 manifest message so existing daemons can ignore it; newer
+     * daemons verify this nested signature before honouring compatibility or
+     * rollout controls.
+     */
+    policy?: TPolicy;
+}
+/**
+ * Canonical bytes signed for a single platform artifact. Newline-joined, fixed
+ * field order, `v1` tag. `sha256` is lowercased so the message is stable
+ * regardless of the hex casing the caller supplies.
+ */
+export declare function buildArtifactMessage(a: {
+    platform: string;
+    version: string;
+    sha256: string;
+    url: string;
+}): string;
+/**
+ * Canonical bytes signed for the whole manifest (excluding the top-level
+ * `sig`). Platform keys are sorted so the message is independent of JSON key
+ * order; each contributes `<platform>=<sha256-lower>`. `forceUpdate` is
+ * serialized strictly (`String(forceUpdate === true)` → `"true"`/`"false"`).
+ */
+export declare function buildManifestMessage(m: {
+    version: string;
+    minimum: string;
+    forceUpdate: boolean;
+    platforms: Record<string, {
+        sha256: string;
+    }>;
+}): string;
+/**
+ * Discriminated verification result:
+ *  - `{ ok: true }`         — signature verified against a pinned key.
+ *  - `{ ok: false, reason }` — keys are present but nothing verified (FAIL-CLOSED).
+ *  - `{ disabled: true }`   — no keys pinned; verification is intentionally off.
+ */
+export type VerifyResult = {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+} | {
+    disabled: true;
+};
+/**
+ * Upper bound on signatures we will trial-verify per artifact/manifest. A
+ * rotation window needs at most 2–3 (current + next). `sigs[]` is NOT part of
+ * the signed bytes, so an attacker can pad it; this cap bounds the verify work
+ * they can force to O(MAX_SIGS × pinnedKeys) — a few hundred microseconds even
+ * at the cap. A valid signature placed beyond the cap is treated as absent.
+ */
+export declare const MAX_SIGS = 8;
+/**
+ * Verify a single platform artifact's `sig` over buildArtifactMessage(...).
+ * `platform` is the `<platform>-<arch>` key; `version` is the manifest version
+ * the artifact belongs to. Defaults to the baked-in pinned keys.
+ */
+export declare function verifyArtifact(platform: string, version: string, artifact: PlatformArtifact, keys?: readonly ReleaseKey[]): VerifyResult;
+/**
+ * Verify the manifest's top-level `sig` over buildManifestMessage(this).
+ * Defaults to the baked-in pinned keys.
+ */
+export declare function verifyManifest(manifest: DaemonVersionManifest, keys?: readonly ReleaseKey[]): VerifyResult;
+/**
+ * Look up a delta patch that transforms `fromVersion`'s binary into this
+ * artifact's binary. Returns null when none is advertised or the descriptor is
+ * malformed — the caller then does a full download. PURE; validates shape only
+ * (the delta is UNSIGNED, so trust comes from verifying the RECONSTRUCTED binary
+ * against the signed `artifact.sha256`, not from this metadata).
+ */
+export declare function getDeltaFor(artifact: PlatformArtifact, fromVersion: string): DeltaDescriptor | null;