@skrr-ai/cli 0.1.120 → 0.1.121

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/independentMachineReservation.js

@@ -0,0 +1,161 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var independentMachineReservation_exports = {};
+__export(independentMachineReservation_exports, {
+  INDEPENDENT_MACHINE_PROFILE_RE: () => INDEPENDENT_MACHINE_PROFILE_RE,
+  INDEPENDENT_MACHINE_RESERVATION_FILE: () => INDEPENDENT_MACHINE_RESERVATION_FILE,
+  readIndependentMachineReservation: () => readIndependentMachineReservation,
+  reserveIndependentMachineProfile: () => reserveIndependentMachineProfile,
+  verifyIndependentMachineReservation: () => verifyIndependentMachineReservation
+});
+module.exports = __toCommonJS(independentMachineReservation_exports);
+var import_node_crypto = __toESM(require("node:crypto"), 1);
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+const INDEPENDENT_MACHINE_PROFILE_RE = /^desktop-bg-[a-f0-9]{32}$/;
+const INDEPENDENT_MACHINE_RESERVATION_FILE = "independent-machine-attempt.json";
+function canonicalOrigin(input) {
+  try {
+    const url = new URL(input);
+    const local = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+    return !url.username && !url.password && url.origin === input && (url.protocol === "https:" || url.protocol === "http:" && local);
+  } catch {
+    return false;
+  }
+}
+function validSecret(secret) {
+  return typeof secret === "string" && /^[A-Za-z0-9_-]{43}$/.test(secret) && Buffer.from(secret, "base64url").length === 32 && Buffer.from(secret, "base64url").toString("base64url") === secret;
+}
+function hashSecret(profile, ownerId, origin, secret) {
+  return import_node_crypto.default.createHash("sha256").update("independent-machine-reservation:v2\0").update(profile).update("\0").update(ownerId).update("\0").update(origin).update("\0").update(secret).digest();
+}
+function reservationPath(root, profile) {
+  if (!import_node_path.default.isAbsolute(root) || !INDEPENDENT_MACHINE_PROFILE_RE.test(profile)) {
+    throw new Error("Invalid independent machine profile");
+  }
+  return import_node_path.default.join(root, "profiles", profile, INDEPENDENT_MACHINE_RESERVATION_FILE);
+}
+function reserveIndependentMachineProfile(options) {
+  if (!import_node_path.default.isAbsolute(options.root) || !/^[a-fA-F0-9]{24}$/.test(options.ownerId) || !canonicalOrigin(options.origin))
+    throw new Error("Invalid background authorization context");
+  const secret = import_node_crypto.default.randomBytes(32).toString("base64url");
+  const encrypted = options.encrypt(secret);
+  if (!Buffer.isBuffer(encrypted) || encrypted.length === 0 || encrypted.length > 4096) {
+    throw new Error("Background authorization secure storage is unavailable");
+  }
+  const profiles = import_node_path.default.join(options.root, "profiles");
+  const rootExisted = import_node_fs.default.existsSync(options.root);
+  const profilesExisted = import_node_fs.default.existsSync(profiles);
+  import_node_fs.default.mkdirSync(profiles, { recursive: true, mode: 448 });
+  for (let i = 0; i < 5; i += 1) {
+    const profile = `desktop-bg-${import_node_crypto.default.randomBytes(16).toString("hex")}`;
+    const dir = import_node_path.default.join(profiles, profile);
+    try {
+      import_node_fs.default.mkdirSync(dir, { mode: 448 });
+    } catch (error) {
+      if (error.code === "EEXIST")
+        continue;
+      throw error;
+    }
+    const reservation = {
+      version: 2,
+      profile,
+      ownerId: options.ownerId.toLowerCase(),
+      origin: options.origin,
+      secretHash: hashSecret(profile, options.ownerId.toLowerCase(), options.origin, secret).toString("hex"),
+      encryptedSecret: encrypted.toString("base64"),
+      createdAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    const file = reservationPath(options.root, profile);
+    const fd = import_node_fs.default.openSync(file, import_node_fs.default.constants.O_WRONLY | import_node_fs.default.constants.O_CREAT | import_node_fs.default.constants.O_EXCL | (import_node_fs.default.constants.O_NOFOLLOW ?? 0), 384);
+    try {
+      import_node_fs.default.writeFileSync(fd, `${JSON.stringify(reservation)}
+`, "utf8");
+      import_node_fs.default.fsyncSync(fd);
+    } finally {
+      import_node_fs.default.closeSync(fd);
+    }
+    const directories = [
+      dir,
+      profiles,
+      ...!profilesExisted ? [options.root] : [],
+      ...!rootExisted ? [import_node_path.default.dirname(options.root)] : []
+    ];
+    for (const directory of directories) {
+      const directoryFd = import_node_fs.default.openSync(directory, "r");
+      try {
+        import_node_fs.default.fsyncSync(directoryFd);
+      } finally {
+        import_node_fs.default.closeSync(directoryFd);
+      }
+    }
+    return { reservation, secret };
+  }
+  throw new Error("Could not reserve a new background machine profile");
+}
+function readIndependentMachineReservation(root, profile) {
+  try {
+    const file = reservationPath(root, profile);
+    const directory = import_node_fs.default.lstatSync(import_node_path.default.dirname(file));
+    if (!directory.isDirectory() || directory.isSymbolicLink())
+      return null;
+    const fd = import_node_fs.default.openSync(file, import_node_fs.default.constants.O_RDONLY | (import_node_fs.default.constants.O_NOFOLLOW ?? 0));
+    let raw;
+    try {
+      const stat = import_node_fs.default.fstatSync(fd);
+      if (!stat.isFile() || stat.nlink !== 1 || stat.size > 8192 || (stat.mode & 63) !== 0)
+        return null;
+      raw = import_node_fs.default.readFileSync(fd, "utf8");
+    } finally {
+      import_node_fs.default.closeSync(fd);
+    }
+    const value = JSON.parse(raw);
+    if (value.version !== 2 || value.profile !== profile || typeof value.ownerId !== "string" || !/^[a-f0-9]{24}$/.test(value.ownerId) || typeof value.origin !== "string" || !canonicalOrigin(value.origin) || typeof value.secretHash !== "string" || !/^[a-f0-9]{64}$/.test(value.secretHash) || typeof value.encryptedSecret !== "string" || !/^[A-Za-z0-9+/]+={0,2}$/.test(value.encryptedSecret) || typeof value.createdAt !== "string" || !Number.isFinite(Date.parse(value.createdAt)))
+      return null;
+    return value;
+  } catch {
+    return null;
+  }
+}
+function verifyIndependentMachineReservation(root, profile, secret) {
+  if (!validSecret(secret))
+    return false;
+  const saved = readIndependentMachineReservation(root, profile);
+  if (!saved)
+    return false;
+  return import_node_crypto.default.timingSafeEqual(Buffer.from(saved.secretHash, "hex"), hashSecret(profile, saved.ownerId, saved.origin, secret));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  INDEPENDENT_MACHINE_PROFILE_RE,
+  INDEPENDENT_MACHINE_RESERVATION_FILE,
+  readIndependentMachineReservation,
+  reserveIndependentMachineProfile,
+  verifyIndependentMachineReservation
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/independentMachineScopes.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The capabilities explained to a person before a separate background
+ * machine is authorized. This version is an immutable wire contract: adding
+ * access needs a new contract and a new authorization, not an edit to v1.
+ */
+export declare const INDEPENDENT_MACHINE_SCOPE_CONTRACT_V1: "desktop-background-v1";
+export declare const INDEPENDENT_MACHINE_PERMISSIONS_V1: readonly [Readonly<{
+    scope: "daemon:tools:bash";
+    description: "Run terminal commands and local agents";
+}>, Readonly<{
+    scope: "daemon:tools:fs:read";
+    description: "Read files in allowed folders";
+}>, Readonly<{
+    scope: "daemon:tools:fs:write";
+    description: "Create and edit files in allowed folders";
+}>, Readonly<{
+    scope: "daemon:browser:cdp";
+    description: "Control connected browser tabs";
+}>, Readonly<{
+    scope: "daemon:session:replay";
+    description: "Replay results recorded while offline";
+}>, Readonly<{
+    scope: "daemon:offline-queue";
+    description: "Send queued results after reconnecting";
+}>];
+export declare const INDEPENDENT_MACHINE_SCOPES_V1: readonly string[];

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/independentMachineScopes.js

@@ -0,0 +1,41 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var independentMachineScopes_exports = {};
+__export(independentMachineScopes_exports, {
+  INDEPENDENT_MACHINE_PERMISSIONS_V1: () => INDEPENDENT_MACHINE_PERMISSIONS_V1,
+  INDEPENDENT_MACHINE_SCOPES_V1: () => INDEPENDENT_MACHINE_SCOPES_V1,
+  INDEPENDENT_MACHINE_SCOPE_CONTRACT_V1: () => INDEPENDENT_MACHINE_SCOPE_CONTRACT_V1
+});
+module.exports = __toCommonJS(independentMachineScopes_exports);
+const INDEPENDENT_MACHINE_SCOPE_CONTRACT_V1 = "desktop-background-v1";
+const INDEPENDENT_MACHINE_PERMISSIONS_V1 = Object.freeze([
+  Object.freeze({ scope: "daemon:tools:bash", description: "Run terminal commands and local agents" }),
+  Object.freeze({ scope: "daemon:tools:fs:read", description: "Read files in allowed folders" }),
+  Object.freeze({ scope: "daemon:tools:fs:write", description: "Create and edit files in allowed folders" }),
+  Object.freeze({ scope: "daemon:browser:cdp", description: "Control connected browser tabs" }),
+  Object.freeze({ scope: "daemon:session:replay", description: "Replay results recorded while offline" }),
+  Object.freeze({ scope: "daemon:offline-queue", description: "Send queued results after reconnecting" })
+]);
+const INDEPENDENT_MACHINE_SCOPES_V1 = Object.freeze(INDEPENDENT_MACHINE_PERMISSIONS_V1.map((permission) => permission.scope));
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  INDEPENDENT_MACHINE_PERMISSIONS_V1,
+  INDEPENDENT_MACHINE_SCOPES_V1,
+  INDEPENDENT_MACHINE_SCOPE_CONTRACT_V1
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -28,7 +28,7 @@ export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as cred
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
-export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
+export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
@@ -50,3 +50,4 @@ export * from './harnessPermissionControls.js';
 export { compareReleaseVersions } from './releaseVersions.js';
 export * from './computerUse.js';
 export * from './desktopWire.js';
+export { INDEPENDENT_MACHINE_PROFILE_RE, INDEPENDENT_MACHINE_RESERVATION_FILE, readIndependentMachineReservation, reserveIndependentMachineProfile, verifyIndependentMachineReservation, type IndependentMachineReservation, } from './independentMachineReservation.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -47,6 +47,8 @@ __export(index_exports, {
   HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT: () => import_harnessSkillLayout.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT,
   HARNESS_TIERS: () => import_harnessTrust.HARNESS_TIERS,
   HOSTED_RUNTIME_MACHINE_SOURCES: () => import_machineUuid.HOSTED_RUNTIME_MACHINE_SOURCES,
+  INDEPENDENT_MACHINE_PROFILE_RE: () => import_independentMachineReservation.INDEPENDENT_MACHINE_PROFILE_RE,
+  INDEPENDENT_MACHINE_RESERVATION_FILE: () => import_independentMachineReservation.INDEPENDENT_MACHINE_RESERVATION_FILE,
   InMemoryKek: () => import_kek.InMemoryKek,
   KekUnavailableError: () => import_kek.KekUnavailableError,
   LEGACY_CONFIG_DIR_NAMES: () => import_localIdentity.LEGACY_CONFIG_DIR_NAMES,
@@ -189,6 +191,8 @@ __export(index_exports, {
   hostedRuntimeIdOverride: () => import_machineUuid.hostedRuntimeIdOverride,
   initCredEnvelope: () => import_credentialEnvelopeBridge.initCredEnvelope,
   initDeviceIdentity: () => import_deviceIdentityBridge.initDeviceIdentity,
+  initExistingCredEnvelope: () => import_credentialEnvelopeBridge.initExistingCredEnvelope,
+  initNewIndependentCredEnvelope: () => import_credentialEnvelopeBridge.initNewIndependentCredEnvelope,
   installLockExitHandlers: () => import_refresh.installLockExitHandlers,
   invalidateAuthHelperCache: () => import_credentialResolver.invalidateAuthHelperCache,
   invalidateHeadersHelperCache: () => import_headers_helper.invalidateHeadersHelperCache,
@@ -238,9 +242,11 @@ __export(index_exports, {
   publicJwkFromX: () => import_deviceKey.publicJwkFromX,
   qualifyMachineUuid: () => import_machineUuid.qualifyMachineUuid,
   readAuthFromFd: () => import_fdToken.readAuthFromFd,
+  readIndependentMachineReservation: () => import_independentMachineReservation.readIndependentMachineReservation,
   reauthCommand: () => import_messages.reauthCommand,
   refreshDaemonToken: () => import_refresh.refreshDaemonToken,
   registerZeroizeHook: () => import_kek.registerZeroizeHook,
+  reserveIndependentMachineProfile: () => import_independentMachineReservation.reserveIndependentMachineProfile,
   resetCredEnvelope: () => import_credentialEnvelopeBridge.resetCredEnvelope,
   resetDeviceIdentity: () => import_deviceIdentityBridge.resetDeviceIdentity,
   resolveChannelManifestUrl: () => import_firstPartyHarnessChannels.resolveChannelManifestUrl,
@@ -263,6 +269,7 @@ __export(index_exports, {
   verifyChallenge: () => import_pkce.verifyChallenge,
   verifyDeviceProof: () => import_deviceKey.verifyProof,
   verifyDpopProof: () => import_dpop.verifyDpopProof,
+  verifyIndependentMachineReservation: () => import_independentMachineReservation.verifyIndependentMachineReservation,
   verifyManifest: () => import_releaseManifest.verifyManifest,
   withAuthLock: () => import_refresh.withAuthLock,
   withLoopbackNoProxy: () => import_spawnEnv.withLoopbackNoProxy,
@@ -313,6 +320,7 @@ __reExport(index_exports, require("./harnessPermissionControls.js"), module.expo
 var import_releaseVersions = require("./releaseVersions.js");
 __reExport(index_exports, require("./computerUse.js"), module.exports);
 __reExport(index_exports, require("./desktopWire.js"), module.exports);
+var import_independentMachineReservation = require("./independentMachineReservation.js");
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ALL_DAEMON_SCOPES,
@@ -343,6 +351,8 @@ __reExport(index_exports, require("./desktopWire.js"), module.exports);
   HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT,
   HARNESS_TIERS,
   HOSTED_RUNTIME_MACHINE_SOURCES,
+  INDEPENDENT_MACHINE_PROFILE_RE,
+  INDEPENDENT_MACHINE_RESERVATION_FILE,
   InMemoryKek,
   KekUnavailableError,
   LEGACY_CONFIG_DIR_NAMES,
@@ -485,6 +495,8 @@ __reExport(index_exports, require("./desktopWire.js"), module.exports);
   hostedRuntimeIdOverride,
   initCredEnvelope,
   initDeviceIdentity,
+  initExistingCredEnvelope,
+  initNewIndependentCredEnvelope,
   installLockExitHandlers,
   invalidateAuthHelperCache,
   invalidateHeadersHelperCache,
@@ -534,9 +546,11 @@ __reExport(index_exports, require("./desktopWire.js"), module.exports);
   publicJwkFromX,
   qualifyMachineUuid,
   readAuthFromFd,
+  readIndependentMachineReservation,
   reauthCommand,
   refreshDaemonToken,
   registerZeroizeHook,
+  reserveIndependentMachineProfile,
   resetCredEnvelope,
   resetDeviceIdentity,
   resolveChannelManifestUrl,
@@ -559,6 +573,7 @@ __reExport(index_exports, require("./desktopWire.js"), module.exports);
   verifyChallenge,
   verifyDeviceProof,
   verifyDpopProof,
+  verifyIndependentMachineReservation,
   verifyManifest,
   withAuthLock,
   withLoopbackNoProxy,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/kek/macos.js

@@ -178,7 +178,6 @@ async function writeKekToKeychain(kek, service, account) {
       account,
       "-w",
       b64,
-      "-U",
       keychainPath
     ]);
   } catch (err) {
@@ -219,9 +218,26 @@ async function resolveOrCreateKek(service, account) {
     return existing;
   }
   const fresh = import_node_crypto.default.randomBytes(import_credentialEnvelope.KEY_LEN);
-  await writeKekToKeychain(fresh, service, account);
-  _kekCacheBySvc.set(cacheKey, fresh);
-  return fresh;
+  try {
+    try {
+      await writeKekToKeychain(fresh, service, account);
+    } catch (error) {
+      const winner = await readKekFromKeychain(service, account).catch(() => null);
+      if (!winner)
+        throw error;
+      _kekCacheBySvc.set(cacheKey, winner);
+      return winner;
+    }
+    const persisted = await readKekFromKeychain(service, account);
+    if (!persisted || !persisted.equals(fresh)) {
+      persisted?.fill(0);
+      throw new import_types.KekUnavailableError(KIND_SHELLOUT, "created master KEK could not be verified");
+    }
+    _kekCacheBySvc.set(cacheKey, persisted);
+    return persisted;
+  } finally {
+    fresh.fill(0);
+  }
 }
 async function resolveExistingKek(service, account) {
   const cacheKey = `${service}::${account}`;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.d.ts

@@ -54,6 +54,16 @@ export declare function splitKeyConvergencePolicy(): {
     converge: boolean;
     reason: 'daemon_key_pinned' | 'daemon_key_refused';
 };
+/** Open only the existing wrapped DEK. Recovery must never enroll a new key,
+ * consolidate profile paths or replace an unreadable envelope. A caller gets
+ * an error if the existing file or the platform's read-only unwrap is unsafe
+ * or unavailable. This intentionally does not load retired keys; credentials
+ * that require one remain unavailable rather than triggering a migration. */
+export declare function initExistingCredEnvelope(profile: string): Promise<void>;
+/** First enrollment for a reserved desktop background profile. Existing or
+ * ambiguous state is opened read-only or refused; it is never re-enrolled.
+ * The caller must validate the reservation before calling this function. */
+export declare function initNewIndependentCredEnvelope(profile: string): Promise<void>;
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -40,7 +40,7 @@
  *     when not active. CLI leaves it unset; legacy `OVERSKY_KEK_REQUIRED=1`
  *     env var is still honored as a back-compat trigger.
  */
-import { createHash } from 'node:crypto';
+import { createHash, randomBytes } from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
 import lockfile from 'proper-lockfile';
@@ -429,6 +429,172 @@ function retiredDekFiles(profile) {
         return [];
     }
 }
+/** Open only the existing wrapped DEK. Recovery must never enroll a new key,
+ * consolidate profile paths or replace an unreadable envelope. A caller gets
+ * an error if the existing file or the platform's read-only unwrap is unsafe
+ * or unavailable. This intentionally does not load retired keys; credentials
+ * that require one remain unavailable rather than triggering a migration. */
+export async function initExistingCredEnvelope(profile) {
+    if (_state.kind === 'active' && _state.profile === profile)
+        return;
+    if (_state.kind !== 'uninit' || typeof profile !== 'string' || !profile) {
+        throw new Error('Existing credential envelope is unavailable');
+    }
+    let fd;
+    let candidate;
+    try {
+        const target = wrappedDekFilePath(profile);
+        fd = fs.openSync(target, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+        const before = fs.fstatSync(fd);
+        const safe = (stat) => stat.isFile() && stat.nlink === 1 && stat.size > 0 && stat.size <= 65_536 &&
+            (stat.mode & 0o077) === 0 && (typeof process.getuid !== 'function' || stat.uid === process.getuid());
+        if (!safe(before))
+            throw new Error('unsafe envelope');
+        const readBounded = () => {
+            const bytes = Buffer.alloc(before.size);
+            let offset = 0;
+            while (offset < bytes.length) {
+                const count = fs.readSync(fd, bytes, offset, bytes.length - offset, offset);
+                if (count <= 0)
+                    throw new Error('changed envelope');
+                offset += count;
+            }
+            return bytes;
+        };
+        const wrapped = readBounded();
+        const kek = getKekStrategy();
+        if (!kek.unwrapExisting || !(await kek.available()))
+            throw new Error('read-only KEK unavailable');
+        candidate = await kek.unwrapExisting(wrapped, buildCredentialAad(profile));
+        if (!Buffer.isBuffer(candidate) || candidate.length !== 32)
+            throw new Error('invalid envelope');
+        // The unwrap can wait for Keychain. A different file, a replaced path or
+        // a second initializer must not make this process adopt a stale key.
+        if (!readBounded().equals(wrapped))
+            throw new Error('changed envelope');
+        const after = fs.fstatSync(fd);
+        const current = fs.lstatSync(target);
+        if (!safe(after) || !safe(current) || before.dev !== after.dev || before.ino !== after.ino ||
+            before.dev !== current.dev || before.ino !== current.ino || before.size !== after.size ||
+            before.size !== current.size || before.mtimeMs !== after.mtimeMs || before.ctimeMs !== after.ctimeMs ||
+            before.mtimeMs !== current.mtimeMs || before.ctimeMs !== current.ctimeMs ||
+            wrappedDekFilePath(profile) !== target || _state.kind !== 'uninit') {
+            throw new Error('changed envelope');
+        }
+        for (const old of _retiredDeks)
+            old.fill(0);
+        _retiredDeks = [];
+        _state = { kind: 'active', dek: candidate, kekId: kek.id,
+            kekKind: typeof kek.kind === 'string' || kek.kind === null ? (kek.kind ?? null) : null, profile };
+        candidate = undefined;
+    }
+    catch {
+        if (Buffer.isBuffer(candidate))
+            candidate.fill(0);
+        throw new Error('Existing credential envelope is unavailable');
+    }
+    finally {
+        if (fd !== undefined)
+            fs.closeSync(fd);
+    }
+}
+/** First enrollment for a reserved desktop background profile. Existing or
+ * ambiguous state is opened read-only or refused; it is never re-enrolled.
+ * The caller must validate the reservation before calling this function. */
+export async function initNewIndependentCredEnvelope(profile) {
+    if (!/^desktop-bg-[a-f0-9]{32}$/.test(profile))
+        throw new Error('Background credential enrollment is unavailable');
+    if (_state.kind === 'active' && _state.profile === profile)
+        return;
+    if (_state.kind !== 'uninit')
+        throw new Error('Background credential enrollment is unavailable');
+    const resolved = resolveProfileStateFile(profile, ACCOUNT_CRED_DEK_WRAPPED);
+    const paths = [resolved.canonicalPath, ...(resolved.legacyPath ? [resolved.legacyPath] : [])];
+    const present = (file) => {
+        try {
+            fs.lstatSync(file);
+            return true;
+        }
+        catch (err) {
+            if (err.code === 'ENOENT')
+                return false;
+            throw err;
+        }
+    };
+    if (paths.some(present))
+        return initExistingCredEnvelope(profile);
+    // A missing DEK alongside a previously written identity or credential is
+    // recovery, not first enrollment, even if a retried caller says otherwise.
+    const dir = resolved.canonicalDir;
+    const stat = fs.lstatSync(dir);
+    if (!stat.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o077) !== 0 ||
+        (typeof process.getuid === 'function' && stat.uid !== process.getuid())) {
+        throw new Error('Background credential enrollment is unavailable');
+    }
+    const artifacts = ['device-private-key', 'device-public-key.jwk', 'auth-binding.json', 'auth.json'];
+    const artifactDirs = [dir, ...(resolved.legacyDir ? [resolved.legacyDir] : [])];
+    const assertEmpty = () => {
+        if (paths.some(present) || artifactDirs.some((root) => artifacts.some((name) => present(path.join(root, name)))) ||
+            wrappedDekFilePath(profile) !== resolved.canonicalPath) {
+            throw new Error('Background credential enrollment needs recovery');
+        }
+    };
+    assertEmpty();
+    const kek = getKekStrategy();
+    if (!kek.unwrapExisting || !(await kek.available()))
+        throw new Error('Background credential enrollment is unavailable');
+    assertEmpty();
+    const dek = generateDek();
+    let temp;
+    try {
+        const wrapped = await kek.wrap(dek, buildCredentialAad(profile));
+        // Another enrollment may have won while the platform store was busy.
+        // Its file is opened read-only; this process never overwrites it.
+        if (paths.some(present))
+            return await initExistingCredEnvelope(profile);
+        assertEmpty();
+        const temporaryPath = path.join(dir, `.cred-dek-enrollment.${randomBytes(12).toString('hex')}.tmp`);
+        const fd = fs.openSync(temporaryPath, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+            (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+        temp = temporaryPath;
+        try {
+            fs.writeFileSync(fd, wrapped);
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        assertEmpty();
+        try {
+            fs.linkSync(temp, resolved.canonicalPath);
+        }
+        catch (err) {
+            if (err.code !== 'EEXIST')
+                throw err;
+        }
+        const dirFd = fs.openSync(dir, 'r');
+        try {
+            fs.fsyncSync(dirFd);
+        }
+        finally {
+            fs.closeSync(dirFd);
+        }
+    }
+    finally {
+        dek.fill(0);
+        if (temp) {
+            fs.unlinkSync(temp);
+            const dirFd = fs.openSync(dir, 'r');
+            try {
+                fs.fsyncSync(dirFd);
+            }
+            finally {
+                fs.closeSync(dirFd);
+            }
+        }
+    }
+    await initExistingCredEnvelope(profile);
+}
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.
@@ -440,6 +606,11 @@ function retiredDekFiles(profile) {
  *   4. Any throw → disabled+init_failed; transforms stay passthrough.
  */
 export async function initCredEnvelope(profile) {
+    // A reserved background profile has an independent owner and device key.
+    // Generic status, startup and CLI paths may read it, but cannot replace a
+    // missing or unreadable key. Only validated first enrollment can create one.
+    if (/^desktop-bg-[a-f0-9]{32}$/i.test(profile))
+        return initExistingCredEnvelope(profile);
     if (_state.kind !== 'uninit')
         return;
     if (typeof profile !== 'string' || profile.length === 0) {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonConsentProof.d.ts

@@ -0,0 +1,20 @@
+export interface DaemonConsentPayload {
+    consentVersion: number;
+    consentSource: string;
+    isLegacy: boolean;
+    isReConsent: boolean;
+    scopes: string[];
+    scopeDescriptions: Record<string, string>;
+}
+/** A single canonical, bounded representation on both sides of the log. */
+export declare function normalizeDaemonConsent(input: unknown): DaemonConsentPayload | null;
+export interface DaemonConsentIdentity {
+    pid: number;
+    daemonId: string;
+    userId: string;
+    origin: string;
+}
+/** The bootstrap secret is never logged. This MAC binds the exact consent,
+ * live process, daemon and cloud owner; an old log entry is not authority. */
+export declare function daemonConsentProof(secret: string, identity: DaemonConsentIdentity, payload: DaemonConsentPayload): string;
+export declare function verifyDaemonConsentProof(secret: string, identity: DaemonConsentIdentity, payload: DaemonConsentPayload, proof: string): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/daemonConsentProof.js

@@ -0,0 +1,43 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+/** A single canonical, bounded representation on both sides of the log. */
+export function normalizeDaemonConsent(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    const value = input;
+    if (!Number.isSafeInteger(value.consentVersion) || value.consentVersion < 0 ||
+        typeof value.consentSource !== 'string' || value.consentSource.length > 64 ||
+        typeof value.isLegacy !== 'boolean' || typeof value.isReConsent !== 'boolean' ||
+        !Array.isArray(value.scopes) || value.scopes.length > 128 ||
+        !value.scopes.every((scope) => typeof scope === 'string' && scope.length <= 256) ||
+        !value.scopeDescriptions || typeof value.scopeDescriptions !== 'object' || Array.isArray(value.scopeDescriptions))
+        return null;
+    const entries = Object.entries(value.scopeDescriptions)
+        .sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0);
+    if (entries.length > 128 || entries.some(([key, text]) => key.length > 256 || typeof text !== 'string' || text.length > 1024))
+        return null;
+    return { consentVersion: value.consentVersion, consentSource: value.consentSource,
+        isLegacy: value.isLegacy, isReConsent: value.isReConsent, scopes: value.scopes,
+        scopeDescriptions: Object.fromEntries(entries) };
+}
+/** The bootstrap secret is never logged. This MAC binds the exact consent,
+ * live process, daemon and cloud owner; an old log entry is not authority. */
+export function daemonConsentProof(secret, identity, payload) {
+    const key = Buffer.from(secret, 'base64');
+    if (key.length !== 32 || !Number.isSafeInteger(identity.pid) || identity.pid <= 0 ||
+        !identity.daemonId || !identity.userId)
+        throw new Error('Invalid daemon consent identity');
+    const origin = new URL(identity.origin).origin;
+    return createHmac('sha256', key).update('skrr-daemon-consent:v1\0').update(JSON.stringify([
+        identity.pid, identity.daemonId, identity.userId.toLowerCase(), origin, payload,
+    ])).digest('hex');
+}
+export function verifyDaemonConsentProof(secret, identity, payload, proof) {
+    if (!/^[a-f0-9]{64}$/.test(proof))
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(proof, 'hex'), Buffer.from(daemonConsentProof(secret, identity, payload), 'hex'));
+    }
+    catch {
+        return false;
+    }
+}