@skrr-ai/cli 0.1.119 → 0.1.121

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -40,7 +40,7 @@
  *     when not active. CLI leaves it unset; legacy `OVERSKY_KEK_REQUIRED=1`
  *     env var is still honored as a back-compat trigger.
  */
-import { createHash } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import lockfile from 'proper-lockfile';
@@ -429,6 +429,172 @@ function retiredDekFiles(profile) {
         return [];
     }
 }
+/** Open only the existing wrapped DEK. Recovery must never enroll a new key,
+ * consolidate profile paths or replace an unreadable envelope. A caller gets
+ * an error if the existing file or the platform's read-only unwrap is unsafe
+ * or unavailable. This intentionally does not load retired keys; credentials
+ * that require one remain unavailable rather than triggering a migration. */
+export async function initExistingCredEnvelope(profile) {
+    if (_state.kind === 'active' && _state.profile === profile)
+        return;
+    if (_state.kind !== 'uninit' || typeof profile !== 'string' || !profile) {
+        throw new Error('Existing credential envelope is unavailable');
+    }
+    let fd;
+    let candidate;
+    try {
+        const target = wrappedDekFilePath(profile);
+        fd = fs.openSync(target, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+        const before = fs.fstatSync(fd);
+        const safe = (stat) => stat.isFile() && stat.nlink === 1 && stat.size > 0 && stat.size <= 65_536 &&
+            (stat.mode & 0o077) === 0 && (typeof process.getuid !== 'function' || stat.uid === process.getuid());
+        if (!safe(before))
+            throw new Error('unsafe envelope');
+        const readBounded = () => {
+            const bytes = Buffer.alloc(before.size);
+            let offset = 0;
+            while (offset < bytes.length) {
+                const count = fs.readSync(fd, bytes, offset, bytes.length - offset, offset);
+                if (count <= 0)
+                    throw new Error('changed envelope');
+                offset += count;
+            }
+            return bytes;
+        };
+        const wrapped = readBounded();
+        const kek = getKekStrategy();
+        if (!kek.unwrapExisting || !(await kek.available()))
+            throw new Error('read-only KEK unavailable');
+        candidate = await kek.unwrapExisting(wrapped, buildCredentialAad(profile));
+        if (!Buffer.isBuffer(candidate) || candidate.length !== 32)
+            throw new Error('invalid envelope');
+        // The unwrap can wait for Keychain. A different file, a replaced path or
+        // a second initializer must not make this process adopt a stale key.
+        if (!readBounded().equals(wrapped))
+            throw new Error('changed envelope');
+        const after = fs.fstatSync(fd);
+        const current = fs.lstatSync(target);
+        if (!safe(after) || !safe(current) || before.dev !== after.dev || before.ino !== after.ino ||
+            before.dev !== current.dev || before.ino !== current.ino || before.size !== after.size ||
+            before.size !== current.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs ||
+            before.mtimeMs !== current.mtimeMs || before.ctimeMs !== current.ctimeMs ||
+            wrappedDekFilePath(profile) !== target || _state.kind !== 'uninit') {
+            throw new Error('changed envelope');
+        }
+        for (const old of _retiredDeks)
+            old.fill(0);
+        _retiredDeks = [];
+        _state = { kind: 'active', dek: candidate, kekId: kek.id,
+            kekKind: typeof kek.kind === 'string' || kek.kind === null ? (kek.kind ?? null) : null, profile };
+        candidate = undefined;
+    }
+    catch {
+        if (Buffer.isBuffer(candidate))
+            candidate.fill(0);
+        throw new Error('Existing credential envelope is unavailable');
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/** First enrollment for a reserved desktop background profile. Existing or
+ * ambiguous state is opened read-only or refused; it is never re-enrolled.
+ * The caller must validate the reservation before calling this function. */
+export async function initNewIndependentCredEnvelope(profile) {
+    if (!/^desktop-bg-[a-f0-9]{32}$/.test(profile))
+        throw new Error('Background credential enrollment is unavailable');
+    if (_state.kind === 'active' && _state.profile === profile)
+        return;
+    if (_state.kind !== 'uninit')
+        throw new Error('Background credential enrollment is unavailable');
+    const resolved = resolveProfileStateFile(profile, ACCOUNT_CRED_DEK_WRAPPED);
+    const paths = [resolved.canonicalPath, ...(resolved.legacyPath ? [resolved.legacyPath] : [])];
+    const present = (file) => {
+        try {
+            fs.lstatSync(file);
+            return true;
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return false;
+            throw err;
+        }
+    };
+    if (paths.some(present))
+        return initExistingCredEnvelope(profile);
+    // A missing DEK alongside a previously written identity or credential is
+    // recovery, not first enrollment, even if a retried caller says otherwise.
+    const dir = resolved.canonicalDir;
+    const stat = fs.lstatSync(dir);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 ||
+        (typeof process.getuid === 'function' && stat.uid !== process.getuid())) {
+        throw new Error('Background credential enrollment is unavailable');
+    }
+    const artifacts = ['device-private-key', 'device-public-key.jwk', 'auth-binding.json', 'auth.json'];
+    const artifactDirs = [dir, ...(resolved.legacyDir ? [resolved.legacyDir] : [])];
+    const assertEmpty = () => {
+        if (paths.some(present) || artifactDirs.some((root) => artifacts.some((name) => present(path.join(root, name)))) ||
+            wrappedDekFilePath(profile) !== resolved.canonicalPath) {
+            throw new Error('Background credential enrollment needs recovery');
+        }
+    };
+    assertEmpty();
+    const kek = getKekStrategy();
+    if (!kek.unwrapExisting || !(await kek.available()))
+        throw new Error('Background credential enrollment is unavailable');
+    assertEmpty();
+    const dek = generateDek();
+    let temp;
+    try {
+        const wrapped = await kek.wrap(dek, buildCredentialAad(profile));
+        // Another enrollment may have won while the platform store was busy.
+        // Its file is opened read-only; this process never overwrites it.
+        if (paths.some(present))
+            return await initExistingCredEnvelope(profile);
+        assertEmpty();
+        const temporaryPath = path.join(dir, `.cred-dek-enrollment.${randomBytes(12).toString('hex')}.tmp`);
+        const fd = fs.openSync(temporaryPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+            (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+        temp = temporaryPath;
+        try {
+            fs.writeFileSync(fd, wrapped);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        assertEmpty();
+        try {
+            fs.linkSync(temp, resolved.canonicalPath);
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+        }
+        const dirFd = fs.openSync(dir, 'r');
+        try {
+            fs.fsyncSync(dirFd);
+        }
+        finally {
+            fs.closeSync(dirFd);
+        }
+    }
+    finally {
+        dek.fill(0);
+        if (temp) {
+            fs.unlinkSync(temp);
+            const dirFd = fs.openSync(dir, 'r');
+            try {
+                fs.fsyncSync(dirFd);
+            }
+            finally {
+                fs.closeSync(dirFd);
+            }
+        }
+    }
+    await initExistingCredEnvelope(profile);
+}
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.
@@ -440,6 +606,11 @@ function retiredDekFiles(profile) {
  *   4. Any throw → disabled+init_failed; transforms stay passthrough.
  */
 export async function initCredEnvelope(profile) {
+    // A reserved background profile has an independent owner and device key.
+    // Generic status, startup and CLI paths may read it, but cannot replace a
+    // missing or unreadable key. Only validated first enrollment can create one.
+    if (/^desktop-bg-[a-f0-9]{32}$/i.test(profile))
+        return initExistingCredEnvelope(profile);
     if (_state.kind !== 'uninit')
         return;
     if (typeof profile !== 'string' || profile.length === 0) {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonConsentProof.d.ts

@@ -0,0 +1,20 @@
+export interface DaemonConsentPayload {
+    consentVersion: number;
+    consentSource: string;
+    isLegacy: boolean;
+    isReConsent: boolean;
+    scopes: string[];
+    scopeDescriptions: Record<string, string>;
+}
+/** A single canonical, bounded representation on both sides of the log. */
+export declare function normalizeDaemonConsent(input: unknown): DaemonConsentPayload | null;
+export interface DaemonConsentIdentity {
+    pid: number;
+    daemonId: string;
+    userId: string;
+    origin: string;
+}
+/** The bootstrap secret is never logged. This MAC binds the exact consent,
+ * live process, daemon and cloud owner; an old log entry is not authority. */
+export declare function daemonConsentProof(secret: string, identity: DaemonConsentIdentity, payload: DaemonConsentPayload): string;
+export declare function verifyDaemonConsentProof(secret: string, identity: DaemonConsentIdentity, payload: DaemonConsentPayload, proof: string): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonConsentProof.js

@@ -0,0 +1,43 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+/** A single canonical, bounded representation on both sides of the log. */
+export function normalizeDaemonConsent(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    const value = input;
+    if (!Number.isSafeInteger(value.consentVersion) || value.consentVersion < 0 ||
+        typeof value.consentSource !== 'string' || value.consentSource.length > 64 ||
+        typeof value.isLegacy !== 'boolean' || typeof value.isReConsent !== 'boolean' ||
+        !Array.isArray(value.scopes) || value.scopes.length > 128 ||
+        !value.scopes.every((scope) => typeof scope === 'string' && scope.length <= 256) ||
+        !value.scopeDescriptions || typeof value.scopeDescriptions !== 'object' || Array.isArray(value.scopeDescriptions))
+        return null;
+    const entries = Object.entries(value.scopeDescriptions)
+        .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    if (entries.length > 128 || entries.some(([key, text]) => key.length > 256 || typeof text !== 'string' || text.length > 1024))
+        return null;
+    return { consentVersion: value.consentVersion, consentSource: value.consentSource,
+        isLegacy: value.isLegacy, isReConsent: value.isReConsent, scopes: value.scopes,
+        scopeDescriptions: Object.fromEntries(entries) };
+}
+/** The bootstrap secret is never logged. This MAC binds the exact consent,
+ * live process, daemon and cloud owner; an old log entry is not authority. */
+export function daemonConsentProof(secret, identity, payload) {
+    const key = Buffer.from(secret, 'base64');
+    if (key.length !== 32 || !Number.isSafeInteger(identity.pid) || identity.pid <= 0 ||
+        !identity.daemonId || !identity.userId)
+        throw new Error('Invalid daemon consent identity');
+    const origin = new URL(identity.origin).origin;
+    return createHmac('sha256', key).update('skrr-daemon-consent:v1\0').update(JSON.stringify([
+        identity.pid, identity.daemonId, identity.userId.toLowerCase(), origin, payload,
+    ])).digest('hex');
+}
+export function verifyDaemonConsentProof(secret, identity, payload, proof) {
+    if (!/^[a-f0-9]{64}$/.test(proof))
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(proof, 'hex'), Buffer.from(daemonConsentProof(secret, identity, payload), 'hex'));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonToolApproval.js

@@ -67,6 +67,7 @@ export function categoryForDaemonTool(toolName) {
         case 'filelist':
         case 'filestat':
         case 'filereadtagged':
+        case 'personaldata':
             return 'read';
         case 'write':
         case 'edit':

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonWire.js

@@ -46,8 +46,8 @@
  * heard is `firstPartyHarness.ts`'s and the API's `sessionProvider.js`'s
  * decision, not this table's.
  */
-import { COMPUTER_DESKTOP_CAPABILITY, COMPUTER_DESKTOP_CONTROL_CAPABILITY, DAEMON_COMPUTER_DESKTOP_EVENTS } from './desktopWire.js';
-import { COMPUTER_CAPABILITIES, DAEMON_COMPUTER_EVENTS, DAEMON_COMPUTER_REPORT_EVENT_KEYS, } from './computerWire.js';
+import { COMPUTER_DESKTOP_CAPABILITY, COMPUTER_DESKTOP_CONTROL_CAPABILITY, DAEMON_COMPUTER_DESKTOP_EVENTS, } from './desktopWire.js';
+import { COMPUTER_CAPABILITIES, DAEMON_COMPUTER_EVENTS, DAEMON_COMPUTER_REPORT_EVENT_KEYS, DAEMON_COMPUTER_USE_CONTROL_EVENT, } from './computerWire.js';
 // ---------------------------------------------------------------------------
 // Vocabulary
 // ---------------------------------------------------------------------------
@@ -283,34 +283,53 @@ const TOOLS = [
         capability: TOOL_RESPONSE_OUTBOX,
     }),
     toDaemon('daemon:tool:cancel', 'Abandon a running tool call.'),
-    toDaemon('daemon:computer:use-control', 'An authorized person observes, configures, stops or recovers the machine Computer Use provider.', {
-        stability: 'experimental', capability: 'computer_use_mcp_v1', delivery: 'acked', answeredBy: 'daemon:computer:ack',
+    toDaemon(DAEMON_COMPUTER_USE_CONTROL_EVENT, 'An authorized person observes, configures, stops or recovers the machine Computer Use provider.', {
+        stability: 'experimental',
+        capability: 'computer_use_mcp_v1',
+        delivery: 'acked',
+        answeredBy: DAEMON_COMPUTER_EVENTS.ack,
         payload: { kind: 'zod', schema: 'daemonComputerUseControlSchema' },
     }),
     toDaemon('daemon:computer-use:rotate-credential', 'The approved hosted-desktop owner requests credential rotation for this exact active machine lease generation.', {
-        stability: 'experimental', capability: 'computer_use_mcp_v1', delivery: 'acked', answeredBy: 'daemon:computer:ack',
+        stability: 'experimental',
+        capability: 'computer_use_mcp_v1',
+        delivery: 'acked',
+        answeredBy: DAEMON_COMPUTER_EVENTS.ack,
         payload: { kind: 'zod', schema: 'daemonComputerUseRotateCredentialSchema' },
     }),
     toDaemon('daemon:computer-use:revoke', 'Revoke cloud Computer Use bindings after owner machine authority was removed.', {
-        stability: 'experimental', capability: 'computer_use_mcp_v1',
+        stability: 'experimental',
+        capability: 'computer_use_mcp_v1',
         payload: { kind: 'zod', schema: 'daemonComputerUseRevokeSchema' },
     }),
     ...['subscribe', 'protocol', 'unsubscribe'].map((operation) => toDaemon(DAEMON_COMPUTER_DESKTOP_EVENTS[operation], `Read-only desktop stream: ${operation}; bound to an authenticated attachment and generation.`, {
-        stability: 'experimental', capability: COMPUTER_DESKTOP_CAPABILITY,
-        delivery: 'acked', answeredBy: 'daemon:computer:ack',
-        payload: { kind: 'zod', schema: `daemonComputerDesktop${operation[0].toUpperCase()}${operation.slice(1)}Schema` },
+        stability: 'experimental',
+        capability: COMPUTER_DESKTOP_CAPABILITY,
+        delivery: 'acked',
+        answeredBy: DAEMON_COMPUTER_EVENTS.ack,
+        payload: {
+            kind: 'zod',
+            schema: `daemonComputerDesktop${operation[0].toUpperCase()}${operation.slice(1)}Schema`,
+        },
     })),
     ...['control', 'input'].map((operation) => toDaemon(DAEMON_COMPUTER_DESKTOP_EVENTS[operation], `Human-only typed desktop ${operation}; exact authenticated attachment, stream and generation.`, {
-        stability: 'experimental', capability: COMPUTER_DESKTOP_CONTROL_CAPABILITY,
-        delivery: 'acked', answeredBy: 'daemon:computer:ack',
-        payload: { kind: 'zod', schema: `daemonComputerDesktop${operation[0].toUpperCase()}${operation.slice(1)}Schema` },
+        stability: 'experimental',
+        capability: COMPUTER_DESKTOP_CONTROL_CAPABILITY,
+        delivery: 'acked',
+        answeredBy: DAEMON_COMPUTER_EVENTS.ack,
+        payload: {
+            kind: 'zod',
+            schema: `daemonComputerDesktop${operation[0].toUpperCase()}${operation.slice(1)}Schema`,
+        },
     })),
     toServer(DAEMON_COMPUTER_DESKTOP_EVENTS.controlChanged, 'Private desktop holder and input revocation fact; never carries a control token.', {
-        stability: 'experimental', capability: COMPUTER_DESKTOP_CONTROL_CAPABILITY,
+        stability: 'experimental',
+        capability: COMPUTER_DESKTOP_CONTROL_CAPABILITY,
         payload: { kind: 'zod', schema: 'computerDesktopControlResultSchema' },
     }),
     toServer(DAEMON_COMPUTER_DESKTOP_EVENTS.data, 'Read-only desktop stream data or a terminal close fact for one attachment generation.', {
-        stability: 'experimental', capability: COMPUTER_DESKTOP_CAPABILITY,
+        stability: 'experimental',
+        capability: COMPUTER_DESKTOP_CAPABILITY,
         payload: { kind: 'zod', schema: 'computerDesktopDataSchema' },
     }),
     toServer('daemon:wire:chunk', 'One slice of a tool or session response above the single-message ceiling, sha256-checked and reassembled by the API before the reassembled event reaches its normal handler. Sent only to a server that announced `serverCaps.wireChunking`; the last slice is acked by that handler (OSK-16616).', {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/desktopDaemonProof.d.ts

@@ -0,0 +1,21 @@
+export declare const DESKTOP_DAEMON_PROOF_NAMESPACE = "/desktop-proof-v1";
+export declare const DESKTOP_DAEMON_RENEWAL_NAMESPACE = "/desktop-renewal-v1";
+export interface DesktopDaemonOwner {
+    userId: string;
+    serverUrl: string;
+}
+export interface DesktopDaemonChallenge {
+    owner: DesktopDaemonOwner;
+    port: number;
+    clientNonce: string;
+    serverNonce: string;
+}
+/** The same canonical owner is used by the daemon's owner boundary and MAC. */
+export declare function normalizeDesktopDaemonOwner(input: unknown): DesktopDaemonOwner | null;
+/** Role separation prevents reflecting the daemon's proof as client proof. */
+export declare function desktopDaemonProof(secret: string, role: 'daemon' | 'desktop', challenge: DesktopDaemonChallenge): string;
+/** Renewal uses a distinct domain so a proof for this narrow channel cannot
+ * be reflected or replayed as a normal desktop attachment. */
+export declare function desktopRenewalProof(secret: string, role: 'daemon' | 'desktop', challenge: DesktopDaemonChallenge): string;
+export declare function verifyDesktopDaemonProof(secret: string, role: 'daemon' | 'desktop', challenge: DesktopDaemonChallenge, proof: unknown): boolean;
+export declare function verifyDesktopRenewalProof(secret: string, role: 'daemon' | 'desktop', challenge: DesktopDaemonChallenge, proof: unknown): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/desktopDaemonProof.js

@@ -0,0 +1,62 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+export const DESKTOP_DAEMON_PROOF_NAMESPACE = '/desktop-proof-v1';
+export const DESKTOP_DAEMON_RENEWAL_NAMESPACE = '/desktop-renewal-v1';
+/** The same canonical owner is used by the daemon's owner boundary and MAC. */
+export function normalizeDesktopDaemonOwner(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    const value = input;
+    if (typeof value.userId !== 'string' || !value.userId || value.userId.length > 128 ||
+        typeof value.serverUrl !== 'string' || value.serverUrl.length > 2048)
+        return null;
+    try {
+        const url = new URL(value.serverUrl);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return null;
+        return { userId: value.userId, serverUrl: url.origin };
+    }
+    catch {
+        return null;
+    }
+}
+/** Role separation prevents reflecting the daemon's proof as client proof. */
+export function desktopDaemonProof(secret, role, challenge) {
+    return proofForPurpose(secret, role, challenge, 'skrr-desktop-daemon-proof:v1\0');
+}
+/** Renewal uses a distinct domain so a proof for this narrow channel cannot
+ * be reflected or replayed as a normal desktop attachment. */
+export function desktopRenewalProof(secret, role, challenge) {
+    return proofForPurpose(secret, role, challenge, 'skrr-desktop-renewal-proof:v1\0');
+}
+function proofForPurpose(secret, role, challenge, domain) {
+    const key = Buffer.from(secret, 'base64');
+    const owner = normalizeDesktopDaemonOwner(challenge.owner);
+    if (key.length !== 32 || key.toString('base64') !== secret || !owner ||
+        !Number.isInteger(challenge.port) || challenge.port < 1 || challenge.port > 65535 ||
+        !/^[a-f0-9]{64}$/.test(challenge.clientNonce) || !/^[a-f0-9]{64}$/.test(challenge.serverNonce)) {
+        throw new Error('Invalid desktop daemon challenge');
+    }
+    return createHmac('sha256', key).update(domain).update(JSON.stringify([
+        role, challenge.port, owner.userId, owner.serverUrl, challenge.clientNonce, challenge.serverNonce,
+    ])).digest('hex');
+}
+export function verifyDesktopDaemonProof(secret, role, challenge, proof) {
+    if (typeof proof !== 'string' || !/^[a-f0-9]{64}$/.test(proof))
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(proof, 'hex'), Buffer.from(desktopDaemonProof(secret, role, challenge), 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyDesktopRenewalProof(secret, role, challenge, proof) {
+    if (typeof proof !== 'string' || !/^[a-f0-9]{64}$/.test(proof))
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(proof, 'hex'), Buffer.from(desktopRenewalProof(secret, role, challenge), 'hex'));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -51,9 +51,8 @@ export declare function describeDeviceKeySplit(profile: string): {
  * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
  * never replaces anything: for a short-lived process that must only READ the
  * daemon's key while the daemon itself may be creating it (OSK-15990's
- * `skrrd device-proof`). The persist below is not an exclusive create, so a
- * second creator racing the daemon could leave the daemon holding one key in
- * memory and the disk another.
+ * `skrrd device-proof`). Readers and writers both take the profile lock so
+ * they cannot observe an incomplete write from another updated process.
  */
 export declare function initDeviceIdentity(profile: string, options?: {
     recoverUnreadable?: boolean;