@skrr-ai/cli 0.1.121 → 0.1.123

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -45,7 +45,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import lockfile from 'proper-lockfile';
 import { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, isEnvelopeString as isCredEnvelopeString, generateDek, serialize as credEnvelopeSerialize, } from './credentialEnvelope.js';
-import { getKekStrategy, zeroizeKekCaches } from './kek/index.js';
+import { getKekStrategy, KekUnavailableError, zeroizeKekCaches, } from './kek/index.js';
 import { consolidateProfileState, profileStateDir, profileStateFilePathsToClear, resolveProfileStateFile, RETIRED_COPY_SUFFIX, } from './profileStateDir.js';
 import { needsReauthState } from './refresh.js';
 import { emitAuthTelemetry, getAuthLogger, getCredEnvelopeFailClosed } from './runtime.js';
@@ -407,6 +407,12 @@ async function loadRetiredDeks(profile, kek, aad, active) {
             }
         }
         catch {
+            // A copy kept because it did not open (`keepUnreadableWrappedDek`) is expected not to open
+            // until its KEK comes back; warning on every process start for each of up to eight files
+            // would print on every `skrr` command for as long as it lasts. A retired DEK a
+            // consolidation set aside is different: it opened once, so it failing is news.
+            if (path.basename(target).startsWith(UNREADABLE_DEK_COPY_PREFIX))
+                continue;
             emit('cred_envelope.retired_dek.unreadable', false, {
                 profile,
                 file: path.basename(target),
@@ -414,6 +420,79 @@ async function loadRetiredDeks(profile, kek, aad, active) {
         }
     }
 }
+/**
+ * Prefix of the copy kept when a wrapped DEK could not be opened and is about to be
+ * replaced. It sits in the retired keyring (`<file>.retired.*`), so a key that opens
+ * again later (a restored Keychain item, a transient fault misread as a rotation) brings
+ * back everything sealed under it, and a logout deletes it with the rest.
+ */
+const UNREADABLE_DEK_COPY_PREFIX = `${ACCOUNT_CRED_DEK_WRAPPED}${RETIRED_COPY_SUFFIX}.unreadable-`;
+/**
+ * A copy is 92 bytes and only the OLDEST can be the one that matters: every replacement after
+ * the first is usually a copy of a DEK this process itself just enrolled. The first cut kept
+ * two, and three rotations in thirteen seconds (a test pointed at a real home) pushed the
+ * original DEK out, which is exactly the copy that would have restored the profile.
+ */
+const MAX_UNREADABLE_DEK_COPIES = 8;
+/**
+ * Whether a failed unwrap means the KEK could not be READ right now, as opposed to the KEK
+ * being a different key. A locked Keychain, a non-interactive context or a failing helper
+ * say nothing about the key; only an authentication-tag failure under a KEK that was read
+ * does. Matched by name as well as by class, since two copies of this package in one
+ * process (a farmed worktree) have two classes.
+ */
+function isKekUnavailableError(err) {
+    return (err instanceof KekUnavailableError ||
+        err?.name === 'KekUnavailableError');
+}
+/**
+ * Keep the wrapped DEK this process could not open before it is replaced. Replacing it
+ * orphans everything sealed under the old DEK (the device private key, stored tokens), and
+ * the one thing that can still undo that is the old wrapped DEK meeting its KEK again.
+ * Best effort and bounded: a copy that cannot be written must not stop the daemon coming
+ * up, and the oldest copies are pruned.
+ */
+function keepUnreadableWrappedDek(profile, wrapped) {
+    try {
+        const dir = profileStateDir(profile);
+        const existing = fs.existsSync(dir)
+            ? fs
+                .readdirSync(dir)
+                .filter((entry) => entry.startsWith(UNREADABLE_DEK_COPY_PREFIX))
+                .sort()
+            : [];
+        // The same bytes are already kept (a KEK that flaps between two values re-seals nothing
+        // new): do not let a duplicate take a slot from a different DEK.
+        for (const entry of existing) {
+            try {
+                if (fs.readFileSync(path.join(dir, entry)).equals(wrapped))
+                    return entry;
+            }
+            catch {
+                /* an unreadable copy is not a match */
+            }
+        }
+        const name = `${UNREADABLE_DEK_COPY_PREFIX}${new Date().toISOString().replace(/[:.]/g, '-')}`;
+        atomicWrite0600(path.join(dir, name), wrapped);
+        const kept = [...existing, name].sort();
+        for (const stale of kept.slice(0, Math.max(0, kept.length - MAX_UNREADABLE_DEK_COPIES))) {
+            try {
+                fs.unlinkSync(path.join(dir, stale));
+            }
+            catch {
+                /* a copy that will not go costs 92 bytes */
+            }
+        }
+        return name;
+    }
+    catch (err) {
+        emit('cred_envelope.unreadable_dek_copy_failed', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+}
 /** Retired wrapped DEKs for `profile`, oldest first. */
 function retiredDekFiles(profile) {
     const dir = profileStateDir(profile);
@@ -699,6 +778,8 @@ export async function initCredEnvelope(profile) {
     }
     let dek = null;
     let unwrapAttemptedAndFailed = false;
+    let kekUnreadable = null;
+    let unreadableWrapped = null;
     await withCredEnvelopeLock(profile, async () => {
         // Re-stat after acquiring the lock — a sibling sky/oversky may have
         // enrolled while we were waiting. Without this, both processes would
@@ -728,6 +809,7 @@ export async function initCredEnvelope(profile) {
                         kekKind: captureKind(),
                     });
                     unwrapAttemptedAndFailed = true;
+                    unreadableWrapped = wrappedBytes;
                 }
                 else {
                     dek = candidate;
@@ -740,21 +822,45 @@ export async function initCredEnvelope(profile) {
                     kekKind: captureKind(),
                     message: err?.message ?? 'unknown',
                 });
-                unwrapAttemptedAndFailed = true;
+                if (isKekUnavailableError(err)) {
+                    // The KEK could not be read; that is not evidence it changed. Enrolling here would
+                    // replace a DEK that is still good with one the next start cannot tell apart from
+                    // a rotation, and orphan everything sealed under it.
+                    kekUnreadable = err;
+                }
+                else {
+                    unwrapAttemptedAndFailed = true;
+                    unreadableWrapped = wrappedBytes;
+                }
             }
         }
+        if (kekUnreadable !== null) {
+            _state = { kind: 'disabled', reason: 'kek_unavailable' };
+            emit('cred_envelope.kek_unavailable', false, {
+                kekId: kek.id,
+                profile,
+                phase: 'unwrap',
+                describe: kek.describe(),
+                message: kekUnreadable?.message ?? 'unknown',
+            });
+            return;
+        }
         // KEK rotation detection (gap G4). If the wrapped file was present,
         // KEK reported `available=true`, but unwrap threw — the most likely
         // explanation is the KEK was rotated underneath us. Surface this as
         // a distinct event so dashboards can count rotations separately
         // from genuinely-corrupt blobs, while still falling through to a
-        // fresh enrollment so the daemon stays operational.
+        // fresh enrollment so the daemon stays operational. The old wrapped DEK is
+        // kept first: enrolling replaces it, and it is the only way back to what
+        // was sealed under it.
         if (unwrapAttemptedAndFailed && dek === null) {
             _kekRotationDetected = true;
+            const keptAs = unreadableWrapped ? keepUnreadableWrappedDek(profile, unreadableWrapped) : null;
             emit('cred_envelope.kek_rotated', false, {
                 kekId: kek.id,
                 kekKind: captureKind(),
                 profile,
+                ...(keptAs ? { previousWrappedDekKeptAs: keptAs } : {}),
                 message: 'wrapped DEK present but unwrap failed under available KEK; treating as rotation and re-enrolling',
             });
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -11,6 +11,8 @@ type DeviceIdentityState = {
     envelopeProtected: boolean;
 };
 type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key' | 'no_stored_key';
+/** @internal Test seam — how often an unreadable key is looked at again. `null` restores 5 s. */
+export declare function __setUnreadableReloadIntervalForTest(ms: number | null): void;
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -58,6 +58,76 @@ const DEVICE_IDENTITY_FILES = [
 const DAEMON_NOT_FOUND_BACKOFF_MS = 15 * 60 * 1000;
 let _state = { kind: 'uninit' };
 let _initializing = null;
+/**
+ * What this process saw when it gave up on a stored key it could not read: the profile, and
+ * the mtimes of the two key files. A process that is already running has no way to learn that
+ * someone else has since written a readable key (the desktop's recovery, an interactive
+ * login in another process), and used to sit disabled until it was restarted, signing
+ * nothing. `reloadIfRecovered` reads the key again, but only when one of those files has
+ * changed, so a key that stays unreadable costs one `stat` and no log line.
+ */
+let _unreadableSeen = null;
+let _unreadableReloadIntervalMs = 5_000;
+/** @internal Test seam — how often an unreadable key is looked at again. `null` restores 5 s. */
+export function __setUnreadableReloadIntervalForTest(ms) {
+    _unreadableReloadIntervalMs = ms ?? 5_000;
+}
+function keyFilesStamp(profile) {
+    const part = (file) => {
+        try {
+            const s = fs.statSync(file);
+            return `${s.mtimeMs}:${s.size}`;
+        }
+        catch {
+            return 'absent';
+        }
+    };
+    return `${part(publicKeyPath(profile))}|${part(privateKeyPath(profile))}`;
+}
+/**
+ * If a key this process could not read has been replaced on disk since, load it. Never
+ * creates, replaces or deletes anything: it only picks up what another process wrote
+ * under the same lock, which is not the silent replacement the `recoverUnreadable` gate
+ * exists to prevent.
+ */
+function reloadIfRecovered() {
+    if (_state.kind !== 'disabled' || _state.reason !== 'unreadable_key')
+        return;
+    const seen = _unreadableSeen;
+    if (!seen || _initializing)
+        return;
+    const now = Date.now();
+    if (now - seen.checkedAt < _unreadableReloadIntervalMs)
+        return;
+    seen.checkedAt = now;
+    let stamp;
+    try {
+        stamp = keyFilesStamp(seen.profile);
+    }
+    catch {
+        return;
+    }
+    if (stamp === seen.stamp)
+        return;
+    seen.stamp = stamp;
+    let keypair = null;
+    try {
+        keypair = loadKeypair(seen.profile);
+    }
+    catch {
+        keypair = null;
+    }
+    if (!keypair)
+        return;
+    _state = {
+        kind: 'active',
+        keypair,
+        profile: seen.profile,
+        envelopeProtected: isCredEnvelopeActive(),
+    };
+    _unreadableSeen = null;
+    emit('reloaded_after_recovery', true, { profile: seen.profile, thumbprint: keypair.thumbprint });
+}
 /**
  * The CLI, daemon, and desktop's short-lived signer resolve the same canonical
  * profile directory even when an older private key still lives in the nested
@@ -500,6 +570,9 @@ async function initDeviceIdentityLocked(profile, options = {}) {
     const hasStoredKey = storedKeyMaterialExists(profile);
     if (hasStoredKey && (!options.recoverUnreadable || independent)) {
         _state = { kind: 'disabled', reason: 'unreadable_key' };
+        _unreadableSeen = independent
+            ? null
+            : { profile, stamp: keyFilesStamp(profile), checkedAt: Date.now() };
         emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
         return;
     }
@@ -577,9 +650,11 @@ export async function resetDeviceIdentity(opts) {
         });
     }
     _state = { kind: 'uninit' };
+    _unreadableSeen = null;
 }
 /** True iff init has completed and a keypair is in memory. */
 export function isDeviceIdentityActive() {
+    reloadIfRecovered();
     return _state.kind === 'active';
 }
 /**
@@ -588,6 +663,7 @@ export function isDeviceIdentityActive() {
  * on the in-flight request.
  */
 export function getDevicePublicKey() {
+    reloadIfRecovered();
     if (_state.kind !== 'active')
         return null;
     return { jwk: _state.keypair.publicJwk, thumbprint: _state.keypair.thumbprint };
@@ -597,6 +673,7 @@ export function getDevicePublicKey() {
  * `oversky status` and CLI debug commands. Never includes the private key.
  */
 export function describeDeviceIdentityState() {
+    reloadIfRecovered();
     if (_state.kind === 'disabled') {
         return { kind: 'disabled', reason: _state.reason };
     }
@@ -620,6 +697,7 @@ export function describeDeviceIdentityState() {
  * passes directly into `refreshDaemonToken`'s `signRequestProof` slot.
  */
 export function signServerRequest(opts) {
+    reloadIfRecovered();
     if (_state.kind !== 'active')
         return null;
     try {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -25,11 +25,11 @@ export { loginWithLocalhost, LoginInitError, LoginExchangeError, type BrowserOpe
 export { parseTtlDays, MIN_TTL_DAYS, MAX_TTL_DAYS, type ParseTtlResult, type ParseTtlSuccess, type ParseTtlError, } from './ttlParser.js';
 export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRecoveryCode, } from './recoveryCode.js';
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
-export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
+export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, isMasterKekKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -98,7 +98,7 @@ export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as cred
 // Tests that need the unavailable branch must inject `UnavailableKek`;
 // `__setKekStrategyForTest(null)` restores the PLATFORM default, which is not
 // the same thing and differs per OS.
-export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, } from './kek/index.js';
+export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, isMasterKekKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, } from './kek/index.js';
 // L11 Phase 1 — Device identity (Ed25519) + DPoP-shaped proof JWS.
 // The crypto half of the two-axis identity story; daemon-side
 // persistence + signing lives in `daemon/src/deviceIdentity.ts`.
@@ -121,7 +121,7 @@ export {
 // deviceIdentity bridge
 initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, 
 // Test seams — file path resolvers + state setters for spec files.
-__publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
+__publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
 // Hardware machine identity sent as `machineUuid` (IOPlatformUUID /
 // machine-id / MachineGuid). ONE implementation for daemon and CLI —
 // OSK-12063. Also exposed dependency-free as `@skrr-ai/auth-core/machine-uuid`.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/index.d.ts

@@ -19,6 +19,7 @@ export { MacosKek } from './macos.js';
 export { LinuxKek } from './linux.js';
 export { WindowsKek } from './windows.js';
 export { zeroizeKekCaches, registerZeroizeHook } from './zeroize-registry.js';
+export { isMasterKekKeychainService, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, } from './masterKekService.js';
 /**
  * @internal Test-only seam — inject a synthetic KEK strategy that wraps
  * with a fixed in-memory key. Resets to platform default when called

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/index.js

@@ -7,6 +7,7 @@ export { MacosKek } from './macos.js';
 export { LinuxKek } from './linux.js';
 export { WindowsKek } from './windows.js';
 export { zeroizeKekCaches, registerZeroizeHook } from './zeroize-registry.js';
+export { isMasterKekKeychainService, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, } from './masterKekService.js';
 /**
  * Strategy used when the current platform has no implementation. Always
  * unavailable; never throws on probe. Provides an honest `id` so fleet

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/linux.js

@@ -60,12 +60,13 @@ import fs from 'node:fs';
 import { openBuffer, sealBuffer, deserialize as envelopeDeserialize, serialize as envelopeSerialize, KEY_LEN, } from '../credentialEnvelope.js';
 import { KekUnavailableError } from './types.js';
 import { registerZeroizeHook } from './zeroize-registry.js';
+import { MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE } from './masterKekService.js';
 /** Stable telemetry kind strings — one per backend tier. */
 const KIND_LIBSECRET = 'linux-libsecret-shellout';
 const KIND_HKDF = 'linux-machineid-hkdf';
 /** Secret Service item attributes for the master KEK (Tier-2). */
-const SS_SERVICE = 'ai.skrr.daemon.kek';
-const SS_ACCOUNT = 'master-kek-v1';
+const SS_SERVICE = MASTER_KEK_KEYCHAIN_SERVICE;
+const SS_ACCOUNT = MASTER_KEK_KEYCHAIN_ACCOUNT;
 /** D-Bus transport error substrings — any of these in stderr means no session. */
 const DBUS_TRANSPORT_ERRORS = [
     'D-Bus',

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/macos.js

@@ -57,6 +57,7 @@ import fs from 'node:fs';
 import { openBuffer, sealBuffer, deserialize as envelopeDeserialize, serialize as envelopeSerialize, KEY_LEN, } from '../credentialEnvelope.js';
 import { KekUnavailableError } from './types.js';
 import { registerZeroizeHook } from './zeroize-registry.js';
+import { MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE } from './masterKekService.js';
 /**
  * Stable telemetry kind string — fleet dashboards size the macOS cohort
  * by this value. Only one backend ships in this module today.
@@ -68,8 +69,8 @@ const KIND_SHELLOUT = 'macos-keychain-shellout';
  * Test seams and smoke tests can override either field via the
  * `MacosKek` constructor without touching this canonical pair.
  */
-const KEYCHAIN_SERVICE = 'ai.skrr.daemon.kek';
-const KEYCHAIN_ACCOUNT = 'master-kek-v1';
+const KEYCHAIN_SERVICE = MASTER_KEK_KEYCHAIN_SERVICE;
+const KEYCHAIN_ACCOUNT = MASTER_KEK_KEYCHAIN_ACCOUNT;
 /** `security` exit code when the requested item does not exist. */
 const SECURITY_ITEM_NOT_FOUND = 44;
 const execFileAsync = promisify(execFile);

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/masterKekService.d.ts

@@ -0,0 +1,29 @@
+/**
+ * kek/masterKekService.ts — the one place that names the machine-wide master KEK.
+ *
+ * The master KEK is ONE keychain item shared by every profile on the machine
+ * (`service=ai.skrr.daemon.kek`, `account=master-kek-v1`). Each profile's
+ * `cred-dek-wrapped` is sealed under it, and everything a profile stores — its
+ * tokens, its BYOK keys, its device private key — is sealed under that DEK.
+ * Deleting this one item therefore orphans every credential envelope on the
+ * machine at once, and nothing can bring it back: the key is random.
+ *
+ * It was deleted by accident on 2026-10-29. The desktop app's sign-out purge
+ * enumerates every service matching `ai.(skrr|oversky).daemon*` and drains each
+ * one, because that prefix used to hold only per-profile credential slots. The
+ * KEK moved under the same prefix without the purge being told, so a routine
+ * "your saved session was rejected" at app launch deleted it. The next daemon
+ * start could not open the DEK, treated that as a rotation, enrolled a new one,
+ * and the device private key sealed under the old DEK was gone for good — which
+ * the server then saw as `DEVICE_PROOF_MISSING` on every CLI hand-off.
+ *
+ * So anything that deletes keychain items by PREFIX or PATTERN asks
+ * `isMasterKekKeychainService` first. Deleting the KEK is a decision a caller
+ * makes by name, never a side effect of a sweep.
+ */
+/** Keychain `service` of the master KEK. */
+export declare const MASTER_KEK_KEYCHAIN_SERVICE = "ai.skrr.daemon.kek";
+/** Keychain `account` of the master KEK. */
+export declare const MASTER_KEK_KEYCHAIN_ACCOUNT = "master-kek-v1";
+/** Whether a keychain service name holds master-KEK material. */
+export declare function isMasterKekKeychainService(service: string): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/kek/masterKekService.js

@@ -0,0 +1,38 @@
+/**
+ * kek/masterKekService.ts — the one place that names the machine-wide master KEK.
+ *
+ * The master KEK is ONE keychain item shared by every profile on the machine
+ * (`service=ai.skrr.daemon.kek`, `account=master-kek-v1`). Each profile's
+ * `cred-dek-wrapped` is sealed under it, and everything a profile stores — its
+ * tokens, its BYOK keys, its device private key — is sealed under that DEK.
+ * Deleting this one item therefore orphans every credential envelope on the
+ * machine at once, and nothing can bring it back: the key is random.
+ *
+ * It was deleted by accident on 2026-10-29. The desktop app's sign-out purge
+ * enumerates every service matching `ai.(skrr|oversky).daemon*` and drains each
+ * one, because that prefix used to hold only per-profile credential slots. The
+ * KEK moved under the same prefix without the purge being told, so a routine
+ * "your saved session was rejected" at app launch deleted it. The next daemon
+ * start could not open the DEK, treated that as a rotation, enrolled a new one,
+ * and the device private key sealed under the old DEK was gone for good — which
+ * the server then saw as `DEVICE_PROOF_MISSING` on every CLI hand-off.
+ *
+ * So anything that deletes keychain items by PREFIX or PATTERN asks
+ * `isMasterKekKeychainService` first. Deleting the KEK is a decision a caller
+ * makes by name, never a side effect of a sweep.
+ */
+/** Keychain `service` of the master KEK. */
+export const MASTER_KEK_KEYCHAIN_SERVICE = 'ai.skrr.daemon.kek';
+/** Keychain `account` of the master KEK. */
+export const MASTER_KEK_KEYCHAIN_ACCOUNT = 'master-kek-v1';
+/**
+ * The master KEK under the current brand and the one before the rename, plus
+ * anything namespaced beneath either (`…kek.probe`, the Linux Secret Service
+ * probe). The pre-rename item is protected too: leaving a dead item behind costs
+ * bytes, and deleting key material is the one step that cannot be taken back.
+ */
+const MASTER_KEK_SERVICE_PATTERN = /^ai\.(?:skrr|oversky)\.daemon\.kek(?:\..*)?$/;
+/** Whether a keychain service name holds master-KEK material. */
+export function isMasterKekKeychainService(service) {
+    return typeof service === 'string' && MASTER_KEK_SERVICE_PATTERN.test(service);
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/messages.d.ts

@@ -1,4 +1,4 @@
-export type AuthFailureReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'UNKNOWN_401' | 'UNKNOWN';
+export type AuthFailureReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'DEVICE_KEY_UNAVAILABLE' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'UNKNOWN_401' | 'UNKNOWN';
 /**
  * The command that recovers this process from a re-auth latch.
  *

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/messages.js

@@ -13,6 +13,7 @@ const REASON_HUMAN = {
     REFRESH_EXPIRED: 'Your session has expired.',
     SESSION_REVOKED: 'Your session was ended (you signed out elsewhere or your password changed).',
     DEVICE_KEY_MISMATCH: "This computer's device key no longer matches the one skrr registered for it, so its session cannot be renewed.",
+    DEVICE_KEY_UNAVAILABLE: "This computer's device key could not be read, so skrr cannot prove which device is asking and its session cannot be renewed. Signing in again creates a new one.",
     TOKEN_EXPIRED: 'Your access token has expired.',
     TOKEN_INVALID: 'Your saved credentials are no longer valid.',
     UNKNOWN_401: 'skrr needs you to sign in again.',

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/refresh.js

@@ -611,7 +611,12 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
     // "proof-per-attempt invariant: a retry loop must call buildRequestInit()
     // per attempt" in `refresh.deviceProof.test.ts` asserts the function
     // is defined inside `doRefresh` and will fail if it is moved.
+    // Whether the request the server just answered carried a device proof. A
+    // `DEVICE_PROOF_MISSING` is only a LOCAL fact (no key to sign with) when we
+    // know none went out; if one did, something between us stripped it.
+    let proofAttached = false;
     function buildRequestInit() {
+        proofAttached = false;
         // Phase 3-R5: the stable `X-Oversky-Origin` header is the server's
         // preferred identity signal on the benign-grace rotation match. Newer
         // servers prefer it over the raw User-Agent; older servers ignore
@@ -646,6 +651,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
                 __refreshDiagnostics.proofAttemptCount += 1;
                 if (typeof proof === 'string' && proof.length > 0) {
                     headers['OverSky-DPoP'] = proof;
+                    proofAttached = true;
                 }
             }
             catch (err) {
@@ -867,10 +873,29 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         // the FINAL fallback. The distinct `UNKNOWN_401` telemetry tag is kept
         // on BOTH branches so monitoring can still see a server-side bug
         // separately from a real expiration (and watch the retry-vs-latch split).
+        //
+        // One unknown-shape 401 IS diagnosable: the server demanded a device proof
+        // (`DEVICE_PROOF_MISSING`) and this request carried none. That is a fact
+        // about this machine — an unreadable, never-created or unwired device key —
+        // and it never self-heals, but it stays on the same budget (a proxy that
+        // strips the header, or an identity still initialising, reads the same on
+        // one attempt). Only what the exhausted latch SAYS differs, so a person is
+        // sent to the sign-in that mints a key rather than told "sign in again".
+        // If a proof DID go out, the header was lost on the way: that stays generic.
+        const noLocalProof = parsedBody.code === 'DEVICE_PROOF_MISSING' && !proofAttached;
+        const latchReason = noLocalProof
+            ? 'DEVICE_KEY_UNAVAILABLE'
+            : 'UNKNOWN_401';
         const message = parsedBody.message || 'Unknown auth failure';
+        const latchMessage = noLocalProof
+            ? `This computer has no usable device key, so the refresh carried no device proof (server: ${message})`
+            : message;
         const { exhausted, count } = recordUnknown401(daemonId, Date.now());
         if (!exhausted) {
-            log.warn(`[auth/refresh] unknown-shape 401 (${count}/${UNKNOWN_401_BUDGET}) — treating as transient, will retry: ${message}`);
+            log.warn(`[auth/refresh] unknown-shape 401 (${count}/${UNKNOWN_401_BUDGET}) — treating as transient, will retry: ${message}` +
+                (noLocalProof
+                    ? ' (no device proof was sent: this machine has no usable device key)'
+                    : ''));
             emitAuthTelemetry({
                 timestamp: new Date().toISOString(),
                 eventType: 'auth',
@@ -893,7 +918,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         // permanent behavior: latch + persist the reauth flag so the daemon
         // surfaces the banner and the interactive modal becomes the final
         // recovery path.
-        log.warn(`[auth/refresh] unknown-shape 401 budget exhausted (${count}/${UNKNOWN_401_BUDGET}) — latching permanent: ${message}`);
+        log.warn(`[auth/refresh] unknown-shape 401 budget exhausted (${count}/${UNKNOWN_401_BUDGET}) — latching permanent ${latchReason}: ${message}`);
         emitAuthTelemetry({
             timestamp: new Date().toISOString(),
             eventType: 'auth',
@@ -902,18 +927,18 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
                 event: 'refresh_failure',
                 daemonId,
                 durationMs: Date.now() - startMs,
-                errorCode: 'UNKNOWN_401',
+                errorCode: latchReason,
                 statusCode: 401,
                 transient: false,
                 unknown401Streak: count,
             },
         });
         persistReauthState({
-            code: 'UNKNOWN_401',
-            message,
+            code: latchReason,
+            message: latchMessage,
             at: Date.now(),
         });
-        throw new PermanentAuthFailure('UNKNOWN_401', message);
+        throw new PermanentAuthFailure(latchReason, latchMessage);
     }
     // 5xx / unexpected — transient. Caller will back off.
     // RESET SEMANTICS (Finding 4 follow-up): a 5xx is transient and does NOT

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/telemetryRedaction.d.ts

@@ -61,6 +61,9 @@ export declare const PREVIEW_TOKEN_REDACTION: "pvw_[redacted]";
 export declare const QR_SIGN_IN_REDACTION: "[redacted]";
 /** Fields are protocol-specific; preserve ordinary request ids, error codes and metrics. */
 export declare function isQrSignInSecretField(key: string): boolean;
+export declare function isOAuthQuerySecretField(key: string): boolean;
+export declare function isOAuthQueryContainerField(key: string): boolean;
+export declare function isGraphHandoffCookieField(key: string): boolean;
 /**
  * Replace every credential that travels in a URL with a marker: a Hosted Machine preview token with
  * {@link PREVIEW_TOKEN_REDACTION}, and a workspace invitation, platform invitation, member link or operator code with

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/telemetryRedaction.js

@@ -107,6 +107,21 @@ export function isQrSignInSecretField(key) {
     return QR_SECRET_FIELDS.has(leaf.replace(/[_-]/g, '').toLowerCase());
 }
 const QR_SECRET_ASSIGNMENT = /((?:["']?)(?:statusToken|claimToken|codeVerifier|codeChallenge|comparisonCode|status_token|claim_token|code_verifier|code_challenge|comparison_code)(?:["']?)\s*[:=]\s*["']?)([A-Za-z0-9._~%+-]+)/gi;
+// OAuth callback queries may be exported detached from their URL. Redact
+// sensitive parameter values even without path context, including when the
+// query separators were percent-encoded by an enclosing URL.
+const OAUTH_QUERY_SECRET = /(^|[?&]|%(?:25)*26)(code|state|error_description|handoff)(=|%(?:25)*3[dD])([^&#\s"'<>]*)/gi;
+export function isOAuthQuerySecretField(key) {
+    return ['code', 'state', 'error_description', 'handoff'].includes(key.toLowerCase());
+}
+export function isOAuthQueryContainerField(key) {
+    const leaf = (key.split('.').pop() || '').replace(/[_-]/g, '').toLowerCase();
+    return leaf === 'query' || leaf === 'querystring';
+}
+export function isGraphHandoffCookieField(key) {
+    return key.toLowerCase() === '__secure-pc-graph-handoff';
+}
+const GRAPH_HANDOFF_COOKIE = /((?:_|%(?:25)*5[fF]){2}secure(?:-|%(?:25)*2[dD])pc(?:-|%(?:25)*2[dD])graph(?:-|%(?:25)*2[dD])handoff(?:=|%(?:25)*3[dD]))([^;,&\s"'<>]+)/gi;
 function redactQrSignInText(value) {
     // Undici/Sentry may split url.query/query_string from its path. The QR's
     // direction vocabulary identifies that standalone query without treating an
@@ -124,7 +139,8 @@ const credentialMarker = (_match, prefix) => `${prefix}_[redacted]`;
 export function redactPreviewTokens(value) {
     if (typeof value !== 'string')
         return value;
-    const qrSafe = redactQrSignInText(value);
+    const qrSafe = redactQrSignInText(value).replace(OAUTH_QUERY_SECRET, '$1$2$3[redacted]')
+        .replace(GRAPH_HANDOFF_COOKIE, '$1[redacted]');
     if (!CREDENTIAL_HINTS.some((hint) => qrSafe.indexOf(hint) !== -1))
         return qrSafe;
     return qrSafe
@@ -153,7 +169,7 @@ export function redactPreviewTokensDeep(root, limits = {}) {
         let visited = 0;
         let complete = true;
         const rewrite = (holder, key, current) => {
-            const next = isQrSignInSecretField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
+            const next = isQrSignInSecretField(key) || isGraphHandoffCookieField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
             if (next === current) {
                 return;
             }
@@ -195,7 +211,28 @@ export function redactPreviewTokensDeep(root, limits = {}) {
                     complete = false;
                     continue;
                 }
-                if (isQrSignInSecretField(key) || typeof child === 'string') {
+                if (isOAuthQueryContainerField(key) && Array.isArray(child)) {
+                    try {
+                        holder[key] = '[redacted]';
+                    }
+                    catch {
+                        complete = false;
+                    }
+                    if (holder[key] !== '[redacted]')
+                        complete = false;
+                    continue;
+                }
+                if (isOAuthQueryContainerField(key) && child && typeof child === 'object' && !Array.isArray(child)) {
+                    const query = child;
+                    for (const queryKey of Object.keys(query)) {
+                        if (isOAuthQuerySecretField(queryKey)) {
+                            query[queryKey] = '[redacted]';
+                            if (query[queryKey] !== '[redacted]')
+                                complete = false;
+                        }
+                    }
+                }
+                if (isQrSignInSecretField(key) || isGraphHandoffCookieField(key) || typeof child === 'string') {
                     rewrite(holder, key, child);
                 }
                 else if (child !== null && typeof child === 'object') {