@skrr-ai/cli 0.1.110 → 0.1.113

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/telemetryRedaction.d.ts

@@ -35,6 +35,13 @@
  * `api/server/services/HostedPreview/__tests__/telemetryRedaction.spec.js` mints credentials with the real minting
  * code and requires every one to come out as the marker, so a change to either side fails there.
  *
+ * HUMAN QR SIGN-IN. Its locator has no token prefix, so redact only the known
+ * `/api/auth/qr/requests/<locator>` path and `/auth/qr?request=<locator>` query
+ * (including percent-encoded nested URLs). Private protocol field names are
+ * redacted in serialized text and structured records, including numeric
+ * comparison codes. Ordinary request ids, operation names and error/metric
+ * categories remain usable. All existing preview-redaction sinks inherit it.
+ *
  * WHAT IT DOES NOT. A prefix that is itself percent-encoded (`%70vw_`) is not recognised: nothing in this
  * repository writes one, and a scan that decoded every string first would cost every sink on every record. A
  * credential cut off before its id is whole (`pinv_0123abc`) is an identifier, not yet the secret, and is left as it
@@ -50,6 +57,10 @@
  */
 /** What replaces a token. Fixed, so a trace can say a preview was involved but not which one. */
 export declare const PREVIEW_TOKEN_REDACTION: "pvw_[redacted]";
+/** QR locators have no identifying prefix, so match only their protocol locations. */
+export declare const QR_SIGN_IN_REDACTION: "[redacted]";
+/** Fields are protocol-specific; preserve ordinary request ids, error codes and metrics. */
+export declare function isQrSignInSecretField(key: string): boolean;
 /**
  * Replace every credential that travels in a URL with a marker: a Hosted Machine preview token with
  * {@link PREVIEW_TOKEN_REDACTION}, and a workspace invitation, platform invitation, member link or operator code with

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/telemetryRedaction.js

@@ -35,6 +35,13 @@
  * `api/server/services/HostedPreview/__tests__/telemetryRedaction.spec.js` mints credentials with the real minting
  * code and requires every one to come out as the marker, so a change to either side fails there.
  *
+ * HUMAN QR SIGN-IN. Its locator has no token prefix, so redact only the known
+ * `/api/auth/qr/requests/<locator>` path and `/auth/qr?request=<locator>` query
+ * (including percent-encoded nested URLs). Private protocol field names are
+ * redacted in serialized text and structured records, including numeric
+ * comparison codes. Ordinary request ids, operation names and error/metric
+ * categories remain usable. All existing preview-redaction sinks inherit it.
+ *
  * WHAT IT DOES NOT. A prefix that is itself percent-encoded (`%70vw_`) is not recognised: nothing in this
  * repository writes one, and a scan that decoded every string first would cost every sink on every record. A
  * credential cut off before its id is whole (`pinv_0123abc`) is an identifier, not yet the secret, and is left as it
@@ -82,14 +89,45 @@ const SIGNED_CREDENTIAL = new RegExp(`(wsi|pinv|usr|adm2)${UNDERSCORE}(?=[0-9a-f
  * `TOKEN_CHAR`, whose dot would swallow the full stop at the end of a sentence.
  */
 const LEGACY_OPERATOR_CODE = new RegExp(`(adm)${UNDERSCORE}(?=[A-Za-z0-9_-]{43}(?![A-Za-z0-9_-]))[A-Za-z0-9_-]{43}`, 'g');
-/** Cheap test before any of the expressions: a string with none of these cannot hold a credential. */
+/** QR locators have no identifying prefix, so match only their protocol locations. */
+export const QR_SIGN_IN_REDACTION = '[redacted]';
+const escapedLiteral = (value) => [...value].map((char) => {
+    const literal = char.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return `(?:${literal}|%(?:25)*${char.charCodeAt(0).toString(16)})`;
+}).join('');
+const QR_REQUEST_PATH = new RegExp(`(${escapedLiteral('/api/auth/qr/requests/')})${TOKEN_CHAR}+`, 'gi');
+const QR_LINK_QUERY = new RegExp(`(${escapedLiteral('/auth/qr?')})([^\\s"'<>#]*)`, 'gi');
+const QR_REQUEST_QUERY = new RegExp(`(^|${escapedLiteral('&')})(${escapedLiteral('request')}${escapedLiteral('=')})${TOKEN_CHAR}+`, 'gi');
+const QR_SECRET_FIELDS = new Set([
+    'statustoken', 'claimtoken', 'codeverifier', 'codechallenge', 'comparisoncode',
+]);
+/** Fields are protocol-specific; preserve ordinary request ids, error codes and metrics. */
+export function isQrSignInSecretField(key) {
+    const leaf = key.split('.').pop() || '';
+    return QR_SECRET_FIELDS.has(leaf.replace(/[_-]/g, '').toLowerCase());
+}
+const QR_SECRET_ASSIGNMENT = /((?:["']?)(?:statusToken|claimToken|codeVerifier|codeChallenge|comparisonCode|status_token|claim_token|code_verifier|code_challenge|comparison_code)(?:["']?)\s*[:=]\s*["']?)([A-Za-z0-9._~%+-]+)/gi;
+function redactQrSignInText(value) {
+    // Undici/Sentry may split url.query/query_string from its path. The QR's
+    // direction vocabulary identifies that standalone query without treating an
+    // ordinary application's `request` query key as a secret globally.
+    const standaloneQuery = /(?:^|[?&])direction=(?:mobile_approves_web|web_approves_mobile)(?:&|$)/.test(value)
+        ? value.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`) : value;
+    return standaloneQuery
+        .replace(QR_REQUEST_PATH, `$1${QR_SIGN_IN_REDACTION}`)
+        .replace(QR_LINK_QUERY, (_match, prefix, query) => prefix + query.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`))
+        .replace(QR_SECRET_ASSIGNMENT, `$1${QR_SIGN_IN_REDACTION}`);
+}
+/** Cheap test before the older prefix-based credential expressions. */
 const CREDENTIAL_HINTS = ['pvw', 'wsi', 'pinv', 'usr', 'adm'];
 const credentialMarker = (_match, prefix) => `${prefix}_[redacted]`;
 export function redactPreviewTokens(value) {
-    if (typeof value !== 'string' || !CREDENTIAL_HINTS.some((hint) => value.indexOf(hint) !== -1)) {
+    if (typeof value !== 'string')
         return value;
-    }
-    return value
+    const qrSafe = redactQrSignInText(value);
+    if (!CREDENTIAL_HINTS.some((hint) => qrSafe.indexOf(hint) !== -1))
+        return qrSafe;
+    return qrSafe
         .replace(PREVIEW_TOKEN, PREVIEW_TOKEN_REDACTION)
         .replace(SIGNED_CREDENTIAL, credentialMarker)
         .replace(LEGACY_OPERATOR_CODE, credentialMarker);
@@ -115,7 +153,7 @@ export function redactPreviewTokensDeep(root, limits = {}) {
         let visited = 0;
         let complete = true;
         const rewrite = (holder, key, current) => {
-            const next = redactPreviewTokens(current);
+            const next = isQrSignInSecretField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
             if (next === current) {
                 return;
             }
@@ -157,7 +195,7 @@ export function redactPreviewTokensDeep(root, limits = {}) {
                     complete = false;
                     continue;
                 }
-                if (typeof child === 'string') {
+                if (isQrSignInSecretField(key) || typeof child === 'string') {
                     rewrite(holder, key, child);
                 }
                 else if (child !== null && typeof child === 'object') {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/toolApprovalSignature.d.ts

@@ -0,0 +1,232 @@
+import { type KeyObject } from 'node:crypto';
+import { type AttestedToolApprovalRefusalReason } from './daemonToolApproval.js';
+/**
+ * Platform-signed tool approvals (OSK-16614) — attestation v2.
+ *
+ * v1 (`daemonToolApproval.ts`) is a plain JSON object whose authority is the
+ * channel it arrived on. That stops the MODEL approving itself, and nothing
+ * else: anything that can put a `daemon:tool:request` on the daemon's channel
+ * — a websocket or SSE layer bug, a relay, the Redis pub/sub bridge the
+ * request crosses, an injected event, a peer holding a stolen daemon session
+ * — can approve any `manual`-category call by writing the field.
+ *
+ * v2 is `{v: 2, payload, kid, sig}`: an Ed25519 signature by a platform
+ * approval key over the canonical JSON `payload`, which carries the v1 claims
+ * plus the `daemonId` and `sessionId` it was minted for. The daemon verifies
+ * it against a keyset it PINNED outside the approval decision (fetched over
+ * authenticated HTTPS, TOFU, per server origin) and that only changes through
+ * a keyset signed by a key it already trusts.
+ *
+ * What it stops: every writer to the channel that cannot reach the signing
+ * key. What it does NOT stop: a fully compromised API host with access to the
+ * key, or server code that mints without a person having answered — the key
+ * says "the platform says a person approved this call", not that one did.
+ * Only an approval signed by the approving person's own device closes that,
+ * and that is the long-term target this format is shaped for (a second key
+ * class in the same keyset), not something it claims today.
+ *
+ * Pure: node:crypto only, no schema library (auth-core is schema-free), no
+ * I/O. Where the keyset is stored and how it is fetched is the daemon's
+ * (`daemon/src/permissions/approval-keyset.ts`); where the private key lives
+ * is the server's (`api/server/utils/toolApprovalSigning.js`).
+ */
+/**
+ * Announced by a daemon that holds a pinned approval keyset and therefore
+ * verifies v2. The daemon announces it ONLY while pinned — positive
+ * withholding on its side too — and the server mints v2 only for a daemon
+ * that announced it, v1 otherwise.
+ */
+export declare const TOOL_APPROVAL_SIGNED_CAPABILITY = "tool_approval_signed_v1";
+/**
+ * One public approval key. Same encoding as the release keys
+ * (`releaseKeys.ts`): base64 DER-SPKI Ed25519.
+ */
+export interface ApprovalPublicKey {
+    kid: string;
+    publicKeySpkiB64: string;
+}
+export interface ApprovalSigner {
+    kid: string;
+    privateKey: KeyObject;
+}
+/** Derive the wire public key from a private (or public) Ed25519 KeyObject. */
+export declare function approvalPublicKeyFromKeyObject(kid: string, key: KeyObject): ApprovalPublicKey;
+/**
+ * The set of approval keys a daemon trusts for one server origin. `seq` only
+ * ever rises: a daemon refuses a keyset older than the one it pinned, so a
+ * retired (possibly compromised) key cannot be brought back by replaying the
+ * keyset that still listed it.
+ */
+export interface ApprovalKeyset {
+    v: 1;
+    seq: number;
+    keys: ApprovalPublicKey[];
+}
+/**
+ * What the server serves and the daemon pins. `keyset` is the canonical JSON
+ * TEXT of an `ApprovalKeyset`: signatures are over these exact bytes, so the
+ * verifier never has to re-serialize to check one. Each signature names the
+ * key that made it; a keyset is normally signed by every key it lists (that is
+ * what lets a daemon pinning only the old key accept the set that adds the new
+ * one), plus any offline root endorsements.
+ */
+export interface ApprovalKeysetDocument {
+    keyset: string;
+    signatures: Array<{
+        kid: string;
+        sig: string;
+    }>;
+}
+/** Canonical keyset text: keys sorted by kid, canonical JSON. */
+export declare function canonicalApprovalKeysetText(keyset: ApprovalKeyset): string;
+/**
+ * Server side: the document for a keyring. Every signer signs, and every
+ * signer's public key is listed. `endorsements` are signatures made OFFLINE
+ * over the same canonical text by a root key the daemon may have embedded
+ * (see `verifyApprovalKeysetDocument`'s `anchors`); the text is deterministic
+ * — no timestamp — precisely so an endorsement can be made ahead of time.
+ */
+export declare function buildApprovalKeysetDocument(args: {
+    seq: number;
+    signers: ApprovalSigner[];
+    endorsements?: Array<{
+        kid: string;
+        sig: string;
+    }>;
+}): ApprovalKeysetDocument;
+/** Sign keyset text with one key — for an offline root endorsement. */
+export declare function endorseApprovalKeysetText(keysetText: string, signer: ApprovalSigner): {
+    kid: string;
+    sig: string;
+};
+/** Parse and validate keyset text. Null when it is not a well-formed keyset. */
+export declare function parseApprovalKeysetText(text: unknown): ApprovalKeyset | null;
+/**
+ * Why a keyset document was not adopted. Internal-only (daemon log and the
+ * `skrrd status` approvals line's last-refresh note), never a person's action
+ * except through the runbook in daemon/CLAUDE.md:
+ *  - `malformed` — not a keyset document
+ *  - `untrusted` — no valid signature by a key the daemon already trusts (a
+ *                  pinned key or an embedded root), or, for a first pin with no
+ *                  anchor, not even self-signed
+ *  - `rollback`  — `seq` is lower than the pinned keyset's
+ *  - `conflict`  — same `seq` as the pinned keyset with different keys
+ */
+export type ApprovalKeysetRefusalReason = 'malformed' | 'untrusted' | 'rollback' | 'conflict';
+export type ApprovalKeysetVerdict = {
+    ok: true;
+    keyset: ApprovalKeyset;
+    /** The canonical text to pin. */
+    text: string;
+    /** `first_pin` (TOFU or root-anchored), `rotated`, or `unchanged`. */
+    change: 'first_pin' | 'rotated' | 'unchanged';
+} | {
+    ok: false;
+    reason: ApprovalKeysetRefusalReason;
+};
+/**
+ * Daemon side: decide whether to adopt a keyset document.
+ *
+ *  - Pinned: at least one signature must verify under a key in the PINNED set
+ *    (or an anchor). The new set may drop or add keys — that is rotation — but
+ *    its `seq` may not fall, and the same `seq` must be the same set.
+ *  - Not pinned, anchors given (an embedded root for this server origin): at
+ *    least one signature must verify under an anchor. No TOFU.
+ *  - Not pinned, no anchors: trust on first use. The document must still be
+ *    signed by a key it lists (proof that whoever served it holds one), but
+ *    its authority is the authenticated HTTPS fetch it came from.
+ *
+ * A signature is checked against the TRUSTED copy of a key, looked up by kid —
+ * never against the key the new document lists under that kid, or a document
+ * could swap a key's bytes while keeping its name.
+ */
+export declare function verifyApprovalKeysetDocument(doc: unknown, trust: {
+    pinned: ApprovalKeyset | null;
+    anchors?: readonly ApprovalPublicKey[];
+}): ApprovalKeysetVerdict;
+export interface SignedToolApprovalPayload {
+    v: 2;
+    toolUseId: string;
+    toolName: string;
+    /** SHA-256 of the canonical tool input (`canonicalToolInputDigest`). */
+    inputSha256: string;
+    decidedBy: 'user';
+    /** The daemon this approval was minted for — another daemon refuses it. */
+    daemonId: string;
+    /** The agent session the call belongs to. */
+    sessionId: string;
+    issuedAt: number;
+    expiresAt: number;
+}
+export interface SignedToolApproval {
+    v: 2;
+    /** Canonical JSON text of a `SignedToolApprovalPayload` — the signed bytes. */
+    payload: string;
+    kid: string;
+    /** base64 Ed25519 signature over the domain prefix + `payload`. */
+    sig: string;
+}
+/** Server side: mint and sign a v2 attestation after a person approved THIS call. */
+export declare function signToolApproval(args: {
+    toolUseId: string;
+    toolName: string;
+    toolInput: unknown;
+    daemonId: string;
+    sessionId: string;
+    signer: ApprovalSigner;
+    now?: number;
+    ttlMs?: number;
+}): SignedToolApproval;
+export interface SignedToolApprovalCall {
+    toolUseId: string;
+    toolName: string;
+    toolInput: unknown;
+    /** The verifying daemon's own id. */
+    daemonId: string;
+    /** The session the request says it belongs to. */
+    sessionId: string;
+    now?: number;
+}
+export type SignedToolApprovalVerdict = {
+    ok: true;
+    toolUseId: string;
+    expiresAt: number;
+} | {
+    ok: false;
+    reason: AttestedToolApprovalRefusalReason;
+};
+/**
+ * Daemon side: verify a v2 attestation against the pinned keyset and the call.
+ * Order matters: nothing in the payload is READ until the signature verified
+ * under a pinned key, so an unsigned claim can never pick which check runs.
+ */
+export declare function verifySignedToolApproval(approval: unknown, call: SignedToolApprovalCall, keyset: ApprovalKeyset): SignedToolApprovalVerdict;
+/**
+ * Where the verifying daemon stands with the platform's approval keyset.
+ * `unreadable` is its own state, not `unpinned`: a pin file that exists and
+ * cannot be read must not quietly re-open the unsigned path.
+ */
+export type ApprovalKeysetPinState = {
+    state: 'pinned';
+    keyset: ApprovalKeyset;
+} | {
+    state: 'unpinned';
+} | {
+    state: 'unreadable';
+};
+/**
+ * Daemon side: THE decision for any attestation, whatever version arrived.
+ *
+ *  - pinned     → only v2 verified against the pinned keyset approves; v1 is
+ *                 refused as `unsigned` (downgrade protection).
+ *  - unpinned   → legacy: v1 is verified exactly as before; v2 is refused as
+ *                 `unpinned` (nothing here could check it — the server should
+ *                 not have sent it, since this daemon did not announce
+ *                 `tool_approval_signed_v1`).
+ *  - unreadable → nothing approves.
+ *
+ * Returns the claims the spend-once ledger keys on when it approves.
+ */
+export declare function verifyToolApprovalAttestation(approval: unknown, call: SignedToolApprovalCall, pin: ApprovalKeysetPinState): SignedToolApprovalVerdict & {
+    signed?: boolean;
+};