@skrr-ai/cli 0.1.120 → 0.1.121

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/desktopDaemonProof.d.ts

@@ -0,0 +1,21 @@
+export declare const DESKTOP_DAEMON_PROOF_NAMESPACE = "/desktop-proof-v1";
+export declare const DESKTOP_DAEMON_RENEWAL_NAMESPACE = "/desktop-renewal-v1";
+export interface DesktopDaemonOwner {
+    userId: string;
+    serverUrl: string;
+}
+export interface DesktopDaemonChallenge {
+    owner: DesktopDaemonOwner;
+    port: number;
+    clientNonce: string;
+    serverNonce: string;
+}
+/** The same canonical owner is used by the daemon's owner boundary and MAC. */
+export declare function normalizeDesktopDaemonOwner(input: unknown): DesktopDaemonOwner | null;
+/** Role separation prevents reflecting the daemon's proof as client proof. */
+export declare function desktopDaemonProof(secret: string, role: 'daemon' | 'desktop', challenge: DesktopDaemonChallenge): string;
+/** Renewal uses a distinct domain so a proof for this narrow channel cannot
+ * be reflected or replayed as a normal desktop attachment. */
+export declare function desktopRenewalProof(secret: string, role: 'daemon' | 'desktop', challenge: DesktopDaemonChallenge): string;
+export declare function verifyDesktopDaemonProof(secret: string, role: 'daemon' | 'desktop', challenge: DesktopDaemonChallenge, proof: unknown): boolean;
+export declare function verifyDesktopRenewalProof(secret: string, role: 'daemon' | 'desktop', challenge: DesktopDaemonChallenge, proof: unknown): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/desktopDaemonProof.js

@@ -0,0 +1,62 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+export const DESKTOP_DAEMON_PROOF_NAMESPACE = '/desktop-proof-v1';
+export const DESKTOP_DAEMON_RENEWAL_NAMESPACE = '/desktop-renewal-v1';
+/** The same canonical owner is used by the daemon's owner boundary and MAC. */
+export function normalizeDesktopDaemonOwner(input) {
+    if (!input || typeof input !== 'object' || Array.isArray(input))
+        return null;
+    const value = input;
+    if (typeof value.userId !== 'string' || !value.userId || value.userId.length > 128 ||
+        typeof value.serverUrl !== 'string' || value.serverUrl.length > 2048)
+        return null;
+    try {
+        const url = new URL(value.serverUrl);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return null;
+        return { userId: value.userId, serverUrl: url.origin };
+    }
+    catch {
+        return null;
+    }
+}
+/** Role separation prevents reflecting the daemon's proof as client proof. */
+export function desktopDaemonProof(secret, role, challenge) {
+    return proofForPurpose(secret, role, challenge, 'skrr-desktop-daemon-proof:v1\0');
+}
+/** Renewal uses a distinct domain so a proof for this narrow channel cannot
+ * be reflected or replayed as a normal desktop attachment. */
+export function desktopRenewalProof(secret, role, challenge) {
+    return proofForPurpose(secret, role, challenge, 'skrr-desktop-renewal-proof:v1\0');
+}
+function proofForPurpose(secret, role, challenge, domain) {
+    const key = Buffer.from(secret, 'base64');
+    const owner = normalizeDesktopDaemonOwner(challenge.owner);
+    if (key.length !== 32 || key.toString('base64') !== secret || !owner ||
+        !Number.isInteger(challenge.port) || challenge.port < 1 || challenge.port > 65535 ||
+        !/^[a-f0-9]{64}$/.test(challenge.clientNonce) || !/^[a-f0-9]{64}$/.test(challenge.serverNonce)) {
+        throw new Error('Invalid desktop daemon challenge');
+    }
+    return createHmac('sha256', key).update(domain).update(JSON.stringify([
+        role, challenge.port, owner.userId, owner.serverUrl, challenge.clientNonce, challenge.serverNonce,
+    ])).digest('hex');
+}
+export function verifyDesktopDaemonProof(secret, role, challenge, proof) {
+    if (typeof proof !== 'string' || !/^[a-f0-9]{64}$/.test(proof))
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(proof, 'hex'), Buffer.from(desktopDaemonProof(secret, role, challenge), 'hex'));
+    }
+    catch {
+        return false;
+    }
+}
+export function verifyDesktopRenewalProof(secret, role, challenge, proof) {
+    if (typeof proof !== 'string' || !/^[a-f0-9]{64}$/.test(proof))
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(proof, 'hex'), Buffer.from(desktopRenewalProof(secret, role, challenge), 'hex'));
+    }
+    catch {
+        return false;
+    }
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -51,9 +51,8 @@ export declare function describeDeviceKeySplit(profile: string): {
  * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
  * never replaces anything: for a short-lived process that must only READ the
  * daemon's key while the daemon itself may be creating it (OSK-15990's
- * `skrrd device-proof`). The persist below is not an exclusive create, so a
- * second creator racing the daemon could leave the daemon holding one key in
- * memory and the disk another.
+ * `skrrd device-proof`). Readers and writers both take the profile lock so
+ * they cannot observe an incomplete write from another updated process.
  */
 export declare function initDeviceIdentity(profile: string, options?: {
     recoverUnreadable?: boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -31,9 +31,10 @@
  */
 import fs from 'node:fs';
 import path from 'node:path';
+import lockfile from 'proper-lockfile';
 import { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, } from './deviceKey.js';
 import { hasCredEnvelopePathConflict, isCredEnvelopeActive, maybeDecryptOnRead, splitKeyConvergencePolicy, wrapIfActiveOrPassthrough, } from './credentialEnvelopeBridge.js';
-import { consolidateProfileState, profileStateFilePathsToClear, resolveProfileStateDir, } from './profileStateDir.js';
+import { consolidateProfileState, profileStateFilePathsToClear, profileStateDir, resolveProfileStateDir, } from './profileStateDir.js';
 import { emitAuthTelemetry, getAuthLogger } from './runtime.js';
 const PUBLIC_KEY_FILENAME = 'device-public-key.jwk';
 const PRIVATE_KEY_FILENAME = 'device-private-key';
@@ -56,6 +57,34 @@ const DEVICE_IDENTITY_FILES = [
 // so every CLI command does not repeat the same guaranteed 404.
 const DAEMON_NOT_FOUND_BACKOFF_MS = 15 * 60 * 1000;
 let _state = { kind: 'uninit' };
+let _initializing = null;
+/**
+ * The CLI, daemon, and desktop's short-lived signer resolve the same canonical
+ * profile directory even when an older private key still lives in the nested
+ * legacy directory. Serialize the entire read/consolidate/create transaction;
+ * otherwise two first starts can each retain a different key in memory.
+ *
+ * Never proceed unlocked. The long stale interval favors preserving a pinned
+ * identity if a process is paused; a contended caller fails and can retry.
+ * Versions that predate this lock do not participate and still require an
+ * orderly upgrade before using the new-profile authorization path.
+ */
+async function withDeviceIdentityLock(profile, body) {
+    const dir = profileStateDir(profile);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const release = await lockfile.lock(dir, {
+        realpath: false,
+        lockfilePath: path.join(dir, '.device-identity.lock'),
+        stale: 10 * 60 * 1000,
+        retries: { retries: 20, minTimeout: 100, maxTimeout: 500, factor: 1.25 },
+    });
+    try {
+        return await body();
+    }
+    finally {
+        await release();
+    }
+}
 /** @internal Test seam — force-set state. */
 export function __setStateForTest(next) {
     const prev = _state;
@@ -72,6 +101,11 @@ export function __getStateForTest() {
  * that decides which copy the group is read from.
  */
 function profileConfigDir(profile) {
+    // A reserved independent profile has a server-pinned owner and device key.
+    // An older nested copy is not authority to replace or shadow its canonical
+    // key, even when generic profile-convergence policy favors that copy.
+    if (/^desktop-bg-[a-f0-9]{32}$/i.test(profile))
+        return profileStateDir(profile);
     return resolveProfileStateDir(profile, PRIVATE_KEY_FILENAME).dir;
 }
 function publicKeyPath(profile) {
@@ -177,6 +211,50 @@ function persistKeypair(profile, kp) {
     });
     return { envelopeProtected };
 }
+/** Reserved identities are read without following links or accepting an
+ * unbounded, shared, unsealed or concurrently replaced key file. */
+function readIndependentIdentityFile(file, sealed) {
+    if (typeof fs.constants.O_NOFOLLOW !== 'number' || typeof fs.constants.O_NONBLOCK !== 'number')
+        return null;
+    let fd;
+    try {
+        fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+    }
+    catch {
+        return null;
+    }
+    try {
+        const before = fs.fstatSync(fd);
+        if (!before.isFile() || before.nlink !== 1 || before.size > 16_384 || (before.mode & 0o077) !== 0 ||
+            (typeof process.getuid === 'function' && before.uid !== process.getuid()))
+            return null;
+        const bytes = Buffer.alloc(before.size);
+        let offset = 0;
+        while (offset < bytes.length) {
+            const count = fs.readSync(fd, bytes, offset, bytes.length - offset, offset);
+            if (count <= 0)
+                return null;
+            offset += count;
+        }
+        const after = fs.fstatSync(fd);
+        const current = fs.lstatSync(file);
+        if (!current.isFile() || current.isSymbolicLink() || current.dev !== before.dev || current.ino !== before.ino ||
+            current.size !== before.size || current.nlink !== before.nlink || current.mode !== before.mode ||
+            current.uid !== before.uid || current.mtimeMs !== before.mtimeMs || current.ctimeMs !== before.ctimeMs ||
+            before.dev !== after.dev || before.ino !== after.ino || before.size !== after.size || before.nlink !== after.nlink ||
+            before.mode !== after.mode || before.uid !== after.uid || before.mtimeMs !== after.mtimeMs ||
+            before.ctimeMs !== after.ctimeMs)
+            return null;
+        const value = bytes.toString('utf8');
+        return sealed && !value.startsWith('osk-env1:') ? null : value;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
 /**
  * Load a previously-persisted keypair. Returns null on missing files,
  * decrypt failure, public/private mismatch (file-swap defense), or
@@ -185,11 +263,13 @@ function persistKeypair(profile, kp) {
 function loadKeypair(profile) {
     const pubPath = publicKeyPath(profile);
     const privPath = privateKeyPath(profile);
-    if (!fs.existsSync(pubPath) || !fs.existsSync(privPath)) {
+    const independent = /^desktop-bg-[a-f0-9]{32}$/i.test(profile);
+    if (!independent && (!fs.existsSync(pubPath) || !fs.existsSync(privPath)))
+        return null;
+    const pubRaw = independent ? readIndependentIdentityFile(pubPath, false) : fs.readFileSync(pubPath, 'utf-8');
+    const privRaw = independent ? readIndependentIdentityFile(privPath, true) : fs.readFileSync(privPath, 'utf-8');
+    if (pubRaw === null || privRaw === null)
         return null;
-    }
-    const pubRaw = fs.readFileSync(pubPath, 'utf-8');
-    const privRaw = fs.readFileSync(privPath, 'utf-8');
     let publicJwk;
     let storedThumbprint;
     try {
@@ -348,23 +428,47 @@ async function consolidateDeviceIdentity(profile) {
  * `createIfMissing: false` stops before step 2 (disabled+no_stored_key) and
  * never replaces anything: for a short-lived process that must only READ the
  * daemon's key while the daemon itself may be creating it (OSK-15990's
- * `skrrd device-proof`). The persist below is not an exclusive create, so a
- * second creator racing the daemon could leave the daemon holding one key in
- * memory and the disk another.
+ * `skrrd device-proof`). Readers and writers both take the profile lock so
+ * they cannot observe an incomplete write from another updated process.
  */
 export async function initDeviceIdentity(profile, options = {}) {
+    if (_initializing)
+        return _initializing;
     if (_state.kind !== 'uninit')
         return;
-    if (typeof profile !== 'string' || profile.length === 0) {
+    if (typeof profile !== 'string' || !/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(profile)) {
         _state = { kind: 'disabled', reason: 'init_failed' };
-        emit('init_failed', false, { reason: 'empty_profile' });
+        emit('init_failed', false, { reason: 'invalid_profile' });
         return;
     }
+    const job = withDeviceIdentityLock(profile, async () => {
+        if (_state.kind === 'uninit')
+            await initDeviceIdentityLocked(profile, options);
+    }).catch((err) => {
+        _state = { kind: 'disabled', reason: 'init_failed' };
+        emit('init_failed', false, {
+            profile,
+            reason: 'identity_lock_unavailable',
+            message: err instanceof Error ? err.message : 'unknown',
+        });
+    });
+    _initializing = job;
+    try {
+        await job;
+    }
+    finally {
+        if (_initializing === job)
+            _initializing = null;
+    }
+}
+async function initDeviceIdentityLocked(profile, options = {}) {
     // OSK-10314 — converge the two directories this profile may have before
     // resolving any of the four files. Must run after `initCredEnvelope`, which
     // both consumers already guarantee, because the private key's readability
     // depends on which DEK ended up active.
-    await consolidateDeviceIdentity(profile);
+    const independent = /^desktop-bg-[a-f0-9]{32}$/i.test(profile);
+    if (!independent)
+        await consolidateDeviceIdentity(profile);
     let keypair = null;
     try {
         keypair = loadKeypair(profile);
@@ -394,12 +498,12 @@ export async function initDeviceIdentity(profile, options = {}) {
     // DEVICE_KEY_MISMATCH. Only an explicit interactive login may replace it;
     // that login proves the new key and re-pins it before issuing credentials.
     const hasStoredKey = storedKeyMaterialExists(profile);
-    if (hasStoredKey && !options.recoverUnreadable) {
+    if (hasStoredKey && (!options.recoverUnreadable || independent)) {
         _state = { kind: 'disabled', reason: 'unreadable_key' };
         emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
         return;
     }
-    if (options.createIfMissing === false) {
+    if (options.createIfMissing === false || (independent && options.createIfMissing !== true)) {
         _state = { kind: 'disabled', reason: 'no_stored_key' };
         emit('no_stored_key', false, { profile });
         return;
@@ -448,25 +552,29 @@ export async function initDeviceIdentity(profile, options = {}) {
  * the daemon's pinned identity.
  */
 export async function resetDeviceIdentity(opts) {
+    if (_initializing)
+        await _initializing;
     if (opts?.clearOnDisk && opts.profile) {
         // Every location, not just the resolved one. A reset that cleared only the
         // canonical copy would leave the pre-consolidation copy for the next init to
         // adopt — a deleted device key that reappears.
         const targets = [PUBLIC_KEY_FILENAME, PRIVATE_KEY_FILENAME].flatMap((name) => profileStateFilePathsToClear(opts.profile, name));
-        for (const p of targets) {
-            try {
-                fs.unlinkSync(p);
-            }
-            catch (err) {
-                if (err.code !== 'ENOENT') {
-                    emit('clear_failed', false, {
-                        profile: opts.profile,
-                        file: path.basename(p),
-                        message: err?.message ?? 'unknown',
-                    });
+        await withDeviceIdentityLock(opts.profile, async () => {
+            for (const p of targets) {
+                try {
+                    fs.unlinkSync(p);
+                }
+                catch (err) {
+                    if (err.code !== 'ENOENT') {
+                        emit('clear_failed', false, {
+                            profile: opts.profile,
+                            file: path.basename(p),
+                            message: err?.message ?? 'unknown',
+                        });
+                    }
                 }
             }
-        }
+        });
     }
     _state = { kind: 'uninit' };
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/independentMachineReservation.d.ts

@@ -0,0 +1,27 @@
+/** The desktop reserves a new profile for every background authorization. */
+export declare const INDEPENDENT_MACHINE_PROFILE_RE: RegExp;
+export declare const INDEPENDENT_MACHINE_RESERVATION_FILE = "independent-machine-attempt.json";
+export interface IndependentMachineReservation {
+    version: 2;
+    profile: string;
+    ownerId: string;
+    origin: string;
+    secretHash: string;
+    encryptedSecret: string;
+    createdAt: string;
+}
+/** Reserve a previously absent profile and persist the encrypted attempt secret.
+ * `encrypt` must use the platform secure store and throw if it is unavailable. */
+export declare function reserveIndependentMachineProfile(options: {
+    root: string;
+    ownerId: string;
+    origin: string;
+    encrypt: (secret: string) => Buffer;
+}): {
+    reservation: IndependentMachineReservation;
+    secret: string;
+};
+/** A saved reservation is a selection hint, never proof of machine ownership. */
+export declare function readIndependentMachineReservation(root: string, profile: string): IndependentMachineReservation | null;
+/** Confirm a one-shot signer is acting on the desktop's reserved attempt. */
+export declare function verifyIndependentMachineReservation(root: string, profile: string, secret: unknown): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/independentMachineReservation.js

@@ -0,0 +1,132 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+/** The desktop reserves a new profile for every background authorization. */
+export const INDEPENDENT_MACHINE_PROFILE_RE = /^desktop-bg-[a-f0-9]{32}$/;
+export const INDEPENDENT_MACHINE_RESERVATION_FILE = 'independent-machine-attempt.json';
+function canonicalOrigin(input) {
+    try {
+        const url = new URL(input);
+        const local = ['localhost', '127.0.0.1', '[::1]'].includes(url.hostname);
+        return !url.username && !url.password && url.origin === input &&
+            (url.protocol === 'https:' || (url.protocol === 'http:' && local));
+    }
+    catch {
+        return false;
+    }
+}
+function validSecret(secret) {
+    return typeof secret === 'string' && /^[A-Za-z0-9_-]{43}$/.test(secret) &&
+        Buffer.from(secret, 'base64url').length === 32 &&
+        Buffer.from(secret, 'base64url').toString('base64url') === secret;
+}
+function hashSecret(profile, ownerId, origin, secret) {
+    return crypto.createHash('sha256').update('independent-machine-reservation:v2\0')
+        .update(profile).update('\0').update(ownerId).update('\0').update(origin).update('\0').update(secret).digest();
+}
+function reservationPath(root, profile) {
+    if (!path.isAbsolute(root) || !INDEPENDENT_MACHINE_PROFILE_RE.test(profile)) {
+        throw new Error('Invalid independent machine profile');
+    }
+    return path.join(root, 'profiles', profile, INDEPENDENT_MACHINE_RESERVATION_FILE);
+}
+/** Reserve a previously absent profile and persist the encrypted attempt secret.
+ * `encrypt` must use the platform secure store and throw if it is unavailable. */
+export function reserveIndependentMachineProfile(options) {
+    if (!path.isAbsolute(options.root) || !/^[a-fA-F0-9]{24}$/.test(options.ownerId) ||
+        !canonicalOrigin(options.origin))
+        throw new Error('Invalid background authorization context');
+    const secret = crypto.randomBytes(32).toString('base64url');
+    const encrypted = options.encrypt(secret);
+    if (!Buffer.isBuffer(encrypted) || encrypted.length === 0 || encrypted.length > 4096) {
+        throw new Error('Background authorization secure storage is unavailable');
+    }
+    const profiles = path.join(options.root, 'profiles');
+    const rootExisted = fs.existsSync(options.root);
+    const profilesExisted = fs.existsSync(profiles);
+    fs.mkdirSync(profiles, { recursive: true, mode: 0o700 });
+    for (let i = 0; i < 5; i += 1) {
+        const profile = `desktop-bg-${crypto.randomBytes(16).toString('hex')}`;
+        const dir = path.join(profiles, profile);
+        try {
+            fs.mkdirSync(dir, { mode: 0o700 });
+        }
+        catch (error) {
+            if (error.code === 'EEXIST')
+                continue;
+            throw error;
+        }
+        const reservation = {
+            version: 2, profile, ownerId: options.ownerId.toLowerCase(), origin: options.origin,
+            secretHash: hashSecret(profile, options.ownerId.toLowerCase(), options.origin, secret).toString('hex'),
+            encryptedSecret: encrypted.toString('base64'),
+            createdAt: new Date().toISOString(),
+        };
+        const file = reservationPath(options.root, profile);
+        const fd = fs.openSync(file, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL |
+            (fs.constants.O_NOFOLLOW ?? 0), 0o600);
+        try {
+            fs.writeFileSync(fd, `${JSON.stringify(reservation)}\n`, 'utf8');
+            fs.fsyncSync(fd);
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        const directories = [dir, profiles, ...(!profilesExisted ? [options.root] : []),
+            ...(!rootExisted ? [path.dirname(options.root)] : [])];
+        for (const directory of directories) {
+            const directoryFd = fs.openSync(directory, 'r');
+            try {
+                fs.fsyncSync(directoryFd);
+            }
+            finally {
+                fs.closeSync(directoryFd);
+            }
+        }
+        // A profile whose reservation cannot be written is never used. Keep any
+        // uncertain directory for recovery rather than deleting other state.
+        return { reservation, secret };
+    }
+    throw new Error('Could not reserve a new background machine profile');
+}
+/** A saved reservation is a selection hint, never proof of machine ownership. */
+export function readIndependentMachineReservation(root, profile) {
+    try {
+        const file = reservationPath(root, profile);
+        const directory = fs.lstatSync(path.dirname(file));
+        if (!directory.isDirectory() || directory.isSymbolicLink())
+            return null;
+        const fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+        let raw;
+        try {
+            const stat = fs.fstatSync(fd);
+            if (!stat.isFile() || stat.nlink !== 1 || stat.size > 8192 || (stat.mode & 0o077) !== 0)
+                return null;
+            raw = fs.readFileSync(fd, 'utf8');
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+        const value = JSON.parse(raw);
+        if (value.version !== 2 || value.profile !== profile ||
+            typeof value.ownerId !== 'string' || !/^[a-f0-9]{24}$/.test(value.ownerId) ||
+            typeof value.origin !== 'string' || !canonicalOrigin(value.origin) ||
+            typeof value.secretHash !== 'string' || !/^[a-f0-9]{64}$/.test(value.secretHash) ||
+            typeof value.encryptedSecret !== 'string' || !/^[A-Za-z0-9+/]+={0,2}$/.test(value.encryptedSecret) ||
+            typeof value.createdAt !== 'string' || !Number.isFinite(Date.parse(value.createdAt)))
+            return null;
+        return value;
+    }
+    catch {
+        return null;
+    }
+}
+/** Confirm a one-shot signer is acting on the desktop's reserved attempt. */
+export function verifyIndependentMachineReservation(root, profile, secret) {
+    if (!validSecret(secret))
+        return false;
+    const saved = readIndependentMachineReservation(root, profile);
+    if (!saved)
+        return false;
+    return crypto.timingSafeEqual(Buffer.from(saved.secretHash, 'hex'), hashSecret(profile, saved.ownerId, saved.origin, secret));
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/independentMachineScopes.d.ts

@@ -0,0 +1,26 @@
+/**
+ * The capabilities explained to a person before a separate background
+ * machine is authorized. This version is an immutable wire contract: adding
+ * access needs a new contract and a new authorization, not an edit to v1.
+ */
+export declare const INDEPENDENT_MACHINE_SCOPE_CONTRACT_V1: "desktop-background-v1";
+export declare const INDEPENDENT_MACHINE_PERMISSIONS_V1: readonly [Readonly<{
+    scope: "daemon:tools:bash";
+    description: "Run terminal commands and local agents";
+}>, Readonly<{
+    scope: "daemon:tools:fs:read";
+    description: "Read files in allowed folders";
+}>, Readonly<{
+    scope: "daemon:tools:fs:write";
+    description: "Create and edit files in allowed folders";
+}>, Readonly<{
+    scope: "daemon:browser:cdp";
+    description: "Control connected browser tabs";
+}>, Readonly<{
+    scope: "daemon:session:replay";
+    description: "Replay results recorded while offline";
+}>, Readonly<{
+    scope: "daemon:offline-queue";
+    description: "Send queued results after reconnecting";
+}>];
+export declare const INDEPENDENT_MACHINE_SCOPES_V1: readonly string[];

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/independentMachineScopes.js

@@ -0,0 +1,15 @@
+/**
+ * The capabilities explained to a person before a separate background
+ * machine is authorized. This version is an immutable wire contract: adding
+ * access needs a new contract and a new authorization, not an edit to v1.
+ */
+export const INDEPENDENT_MACHINE_SCOPE_CONTRACT_V1 = 'desktop-background-v1';
+export const INDEPENDENT_MACHINE_PERMISSIONS_V1 = Object.freeze([
+    Object.freeze({ scope: 'daemon:tools:bash', description: 'Run terminal commands and local agents' }),
+    Object.freeze({ scope: 'daemon:tools:fs:read', description: 'Read files in allowed folders' }),
+    Object.freeze({ scope: 'daemon:tools:fs:write', description: 'Create and edit files in allowed folders' }),
+    Object.freeze({ scope: 'daemon:browser:cdp', description: 'Control connected browser tabs' }),
+    Object.freeze({ scope: 'daemon:session:replay', description: 'Replay results recorded while offline' }),
+    Object.freeze({ scope: 'daemon:offline-queue', description: 'Send queued results after reconnecting' }),
+]);
+export const INDEPENDENT_MACHINE_SCOPES_V1 = Object.freeze(INDEPENDENT_MACHINE_PERMISSIONS_V1.map((permission) => permission.scope));

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -28,7 +28,7 @@ export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as cred
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
-export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
+export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
@@ -50,3 +50,4 @@ export * from './harnessPermissionControls.js';
 export { compareReleaseVersions } from './releaseVersions.js';
 export * from './computerUse.js';
 export * from './desktopWire.js';
+export { INDEPENDENT_MACHINE_PROFILE_RE, INDEPENDENT_MACHINE_RESERVATION_FILE, readIndependentMachineReservation, reserveIndependentMachineProfile, verifyIndependentMachineReservation, type IndependentMachineReservation, } from './independentMachineReservation.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -112,7 +112,7 @@ export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUI
 // Daemon and CLI consume these; the underlying primitives live above.
 export { 
 // credEnvelope bridge
-initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
+initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
 // Test seams — `__`-prefixed so consumers don't import them in
 // production code paths. Re-exported here so CLI/daemon spec files
 // can resolve the wrapped-DEK path against the same module instance.
@@ -186,3 +186,4 @@ export * from './harnessPermissionControls.js';
 export { compareReleaseVersions } from './releaseVersions.js';
 export * from './computerUse.js';
 export * from './desktopWire.js';
+export { INDEPENDENT_MACHINE_PROFILE_RE, INDEPENDENT_MACHINE_RESERVATION_FILE, readIndependentMachineReservation, reserveIndependentMachineProfile, verifyIndependentMachineReservation, } from './independentMachineReservation.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/macos.js

@@ -272,17 +272,9 @@ async function readKekFromKeychain(service, account) {
     }
 }
 /**
- * Persist a master KEK to the keychain. Uses `-U` so the upsert is
- * idempotent — repeated first-use races just overwrite each other rather
- * than failing with "item already exists." We accept the second-writer-
- * wins outcome because (a) the daemon is single-tenant per profile and
- * (b) all writers are generating the same shape of secret.
- *
- * Race note: if two daemon processes both miss and both store within the
- * same TOCTOU window, the second overwrite wins and any DEKs already
- * wrapped under the first KEK become permanently unrecoverable. The
- * envelope path's caller (`credEnvelope.ts:initCredEnvelope`) handles
- * this gracefully — `unwrap` failure → log + treat as first enrollment.
+ * Create a master KEK without replacing an existing item. This key is shared
+ * by profiles, so even a first-use race in a different process must not
+ * overwrite the key protecting already wrapped credentials.
  *
  * The `service` / `account` parameters are threaded from the calling
  * `MacosKek` instance so each instance keeps its own keychain entry.
@@ -312,7 +304,6 @@ async function writeKekToKeychain(kek, service, account) {
             account,
             '-w',
             b64,
-            '-U',
             keychainPath,
         ]);
     }
@@ -410,9 +401,31 @@ async function resolveOrCreateKek(service, account) {
         return existing;
     }
     const fresh = crypto.randomBytes(KEY_LEN);
-    await writeKekToKeychain(fresh, service, account);
-    _kekCacheBySvc.set(cacheKey, fresh);
-    return fresh;
+    try {
+        try {
+            await writeKekToKeychain(fresh, service, account);
+        }
+        catch (error) {
+            // A concurrent creator may have won. Only a successful read of its
+            // existing item makes the failed create recoverable; all other errors
+            // remain failures and must not cause an update or a second write.
+            const winner = await readKekFromKeychain(service, account).catch(() => null);
+            if (!winner)
+                throw error;
+            _kekCacheBySvc.set(cacheKey, winner);
+            return winner;
+        }
+        const persisted = await readKekFromKeychain(service, account);
+        if (!persisted || !persisted.equals(fresh)) {
+            persisted?.fill(0);
+            throw new KekUnavailableError(KIND_SHELLOUT, 'created master KEK could not be verified');
+        }
+        _kekCacheBySvc.set(cacheKey, persisted);
+        return persisted;
+    }
+    finally {
+        fresh.fill(0);
+    }
 }
 /** Resolve an already-persisted master KEK without creating one. */
 async function resolveExistingKek(service, account) {