@skrr-ai/cli 0.1.122 → 0.1.123

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -242,6 +242,8 @@ async function loadRetiredDeks(profile, kek, aad, active) {
         dek.fill(0);
       }
     } catch {
+      if (import_node_path.default.basename(target).startsWith(UNREADABLE_DEK_COPY_PREFIX))
+        continue;
       emit("cred_envelope.retired_dek.unreadable", false, {
         profile,
         file: import_node_path.default.basename(target)
@@ -249,6 +251,40 @@ async function loadRetiredDeks(profile, kek, aad, active) {
     }
   }
 }
+const UNREADABLE_DEK_COPY_PREFIX = `${ACCOUNT_CRED_DEK_WRAPPED}${import_profileStateDir.RETIRED_COPY_SUFFIX}.unreadable-`;
+const MAX_UNREADABLE_DEK_COPIES = 8;
+function isKekUnavailableError(err) {
+  return err instanceof import_kek.KekUnavailableError || err?.name === "KekUnavailableError";
+}
+function keepUnreadableWrappedDek(profile, wrapped) {
+  try {
+    const dir = (0, import_profileStateDir.profileStateDir)(profile);
+    const existing = import_node_fs.default.existsSync(dir) ? import_node_fs.default.readdirSync(dir).filter((entry) => entry.startsWith(UNREADABLE_DEK_COPY_PREFIX)).sort() : [];
+    for (const entry of existing) {
+      try {
+        if (import_node_fs.default.readFileSync(import_node_path.default.join(dir, entry)).equals(wrapped))
+          return entry;
+      } catch {
+      }
+    }
+    const name = `${UNREADABLE_DEK_COPY_PREFIX}${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+    atomicWrite0600(import_node_path.default.join(dir, name), wrapped);
+    const kept = [...existing, name].sort();
+    for (const stale of kept.slice(0, Math.max(0, kept.length - MAX_UNREADABLE_DEK_COPIES))) {
+      try {
+        import_node_fs.default.unlinkSync(import_node_path.default.join(dir, stale));
+      } catch {
+      }
+    }
+    return name;
+  } catch (err) {
+    emit("cred_envelope.unreadable_dek_copy_failed", false, {
+      profile,
+      message: err?.message ?? "unknown"
+    });
+    return null;
+  }
+}
 function retiredDekFiles(profile) {
   const dir = (0, import_profileStateDir.profileStateDir)(profile);
   const prefix = `${ACCOUNT_CRED_DEK_WRAPPED}${import_profileStateDir.RETIRED_COPY_SUFFIX}.`;
@@ -466,6 +502,8 @@ async function initCredEnvelope(profile) {
   }
   let dek = null;
   let unwrapAttemptedAndFailed = false;
+  let kekUnreadable = null;
+  let unreadableWrapped = null;
   await withCredEnvelopeLock(profile, async () => {
     let wrappedBytes = null;
     try {
@@ -489,6 +527,7 @@ async function initCredEnvelope(profile) {
             kekKind: captureKind()
           });
           unwrapAttemptedAndFailed = true;
+          unreadableWrapped = wrappedBytes;
         } else {
           dek = candidate;
         }
@@ -499,15 +538,33 @@ async function initCredEnvelope(profile) {
           kekKind: captureKind(),
           message: err?.message ?? "unknown"
         });
-        unwrapAttemptedAndFailed = true;
+        if (isKekUnavailableError(err)) {
+          kekUnreadable = err;
+        } else {
+          unwrapAttemptedAndFailed = true;
+          unreadableWrapped = wrappedBytes;
+        }
       }
     }
+    if (kekUnreadable !== null) {
+      _state = { kind: "disabled", reason: "kek_unavailable" };
+      emit("cred_envelope.kek_unavailable", false, {
+        kekId: kek.id,
+        profile,
+        phase: "unwrap",
+        describe: kek.describe(),
+        message: kekUnreadable?.message ?? "unknown"
+      });
+      return;
+    }
     if (unwrapAttemptedAndFailed && dek === null) {
       _kekRotationDetected = true;
+      const keptAs = unreadableWrapped ? keepUnreadableWrappedDek(profile, unreadableWrapped) : null;
       emit("cred_envelope.kek_rotated", false, {
         kekId: kek.id,
         kekKind: captureKind(),
         profile,
+        ...keptAs ? { previousWrappedDekKeptAs: keptAs } : {},
         message: "wrapped DEK present but unwrap failed under available KEK; treating as rotation and re-enrolling"
       });
     }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -11,6 +11,8 @@ type DeviceIdentityState = {
     envelopeProtected: boolean;
 };
 type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key' | 'no_stored_key';
+/** @internal Test seam — how often an unreadable key is looked at again. `null` restores 5 s. */
+export declare function __setUnreadableReloadIntervalForTest(ms: number | null): void;
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -34,6 +34,7 @@ __export(deviceIdentityBridge_exports, {
   __privateKeyPathForTest: () => __privateKeyPathForTest,
   __publicKeyPathForTest: () => __publicKeyPathForTest,
   __setStateForTest: () => __setStateForTest,
+  __setUnreadableReloadIntervalForTest: () => __setUnreadableReloadIntervalForTest,
   clearEnrollmentMarker: () => clearEnrollmentMarker,
   describeDeviceIdentityState: () => describeDeviceIdentityState,
   describeDeviceKeySplit: () => describeDeviceKeySplit,
@@ -65,6 +66,58 @@ const DEVICE_IDENTITY_FILES = [
 const DAEMON_NOT_FOUND_BACKOFF_MS = 15 * 60 * 1e3;
 let _state = { kind: "uninit" };
 let _initializing = null;
+let _unreadableSeen = null;
+let _unreadableReloadIntervalMs = 5e3;
+function __setUnreadableReloadIntervalForTest(ms) {
+  _unreadableReloadIntervalMs = ms ?? 5e3;
+}
+function keyFilesStamp(profile) {
+  const part = (file) => {
+    try {
+      const s = import_node_fs.default.statSync(file);
+      return `${s.mtimeMs}:${s.size}`;
+    } catch {
+      return "absent";
+    }
+  };
+  return `${part(publicKeyPath(profile))}|${part(privateKeyPath(profile))}`;
+}
+function reloadIfRecovered() {
+  if (_state.kind !== "disabled" || _state.reason !== "unreadable_key")
+    return;
+  const seen = _unreadableSeen;
+  if (!seen || _initializing)
+    return;
+  const now = Date.now();
+  if (now - seen.checkedAt < _unreadableReloadIntervalMs)
+    return;
+  seen.checkedAt = now;
+  let stamp;
+  try {
+    stamp = keyFilesStamp(seen.profile);
+  } catch {
+    return;
+  }
+  if (stamp === seen.stamp)
+    return;
+  seen.stamp = stamp;
+  let keypair = null;
+  try {
+    keypair = loadKeypair(seen.profile);
+  } catch {
+    keypair = null;
+  }
+  if (!keypair)
+    return;
+  _state = {
+    kind: "active",
+    keypair,
+    profile: seen.profile,
+    envelopeProtected: (0, import_credentialEnvelopeBridge.isCredEnvelopeActive)()
+  };
+  _unreadableSeen = null;
+  emit("reloaded_after_recovery", true, { profile: seen.profile, thumbprint: keypair.thumbprint });
+}
 async function withDeviceIdentityLock(profile, body) {
   const dir = (0, import_profileStateDir.profileStateDir)(profile);
   import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
@@ -380,6 +433,7 @@ async function initDeviceIdentityLocked(profile, options = {}) {
   const hasStoredKey = storedKeyMaterialExists(profile);
   if (hasStoredKey && (!options.recoverUnreadable || independent)) {
     _state = { kind: "disabled", reason: "unreadable_key" };
+    _unreadableSeen = independent ? null : { profile, stamp: keyFilesStamp(profile), checkedAt: Date.now() };
     emit("recovery_required", false, { profile, reason: "stored_key_unreadable" });
     return;
   }
@@ -446,16 +500,20 @@ async function resetDeviceIdentity(opts) {
     });
   }
   _state = { kind: "uninit" };
+  _unreadableSeen = null;
 }
 function isDeviceIdentityActive() {
+  reloadIfRecovered();
   return _state.kind === "active";
 }
 function getDevicePublicKey() {
+  reloadIfRecovered();
   if (_state.kind !== "active")
     return null;
   return { jwk: _state.keypair.publicJwk, thumbprint: _state.keypair.thumbprint };
 }
 function describeDeviceIdentityState() {
+  reloadIfRecovered();
   if (_state.kind === "disabled") {
     return { kind: "disabled", reason: _state.reason };
   }
@@ -470,6 +528,7 @@ function describeDeviceIdentityState() {
   return { kind: "uninit" };
 }
 function signServerRequest(opts) {
+  reloadIfRecovered();
   if (_state.kind !== "active")
     return null;
   try {
@@ -676,6 +735,7 @@ async function enrollWithServer(opts) {
   __privateKeyPathForTest,
   __publicKeyPathForTest,
   __setStateForTest,
+  __setUnreadableReloadIntervalForTest,
   clearEnrollmentMarker,
   describeDeviceIdentityState,
   describeDeviceKeySplit,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -25,11 +25,11 @@ export { loginWithLocalhost, LoginInitError, LoginExchangeError, type BrowserOpe
 export { parseTtlDays, MIN_TTL_DAYS, MAX_TTL_DAYS, type ParseTtlResult, type ParseTtlSuccess, type ParseTtlError, } from './ttlParser.js';
 export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRecoveryCode, } from './recoveryCode.js';
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
-export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
+export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, isMasterKekKeychainService, LinuxKek, MacosKek, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
 export { DPOP_HEADER, DPOP_MAX_AGE_SECONDS, DPOP_PROOF_INVALID, DPOP_PROOF_REQUIRED, DPOP_PROOF_TYP, DPOP_PROOF_VERIFY_UNAVAILABLE, accessTokenHash, createDpopKey, isAth, isJwkThumbprint, normalizeDpopHtu, verifyDpopProof, type DpopKey, type DpopProofClaims, type DpopProofRequest, type DpopVerifyFailureReason, type DpopVerifyOptions, type DpopVerifyResult, } from './dpop.js';
 export { initCredEnvelope, initExistingCredEnvelope, initNewIndependentCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setUnreadableReloadIntervalForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, getMachineUuidForProfile, describeMachineIdentity, type MachineIdentityDescription, type MachineIdentityReason, getHardwareMachineUuid, setMachineUuidProfile, getMachineUuidProfile, qualifyMachineUuid, MACHINE_IDENTITY_FILENAME, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -66,6 +66,8 @@ __export(index_exports, {
   LoginInitError: () => import_loginWithLocalhost.LoginInitError,
   LoopbackTargetRefusedError: () => import_loopbackHttp.LoopbackTargetRefusedError,
   MACHINE_IDENTITY_FILENAME: () => import_machineUuid.MACHINE_IDENTITY_FILENAME,
+  MASTER_KEK_KEYCHAIN_ACCOUNT: () => import_kek.MASTER_KEK_KEYCHAIN_ACCOUNT,
+  MASTER_KEK_KEYCHAIN_SERVICE: () => import_kek.MASTER_KEK_KEYCHAIN_SERVICE,
   MAX_SIGS: () => import_releaseManifest.MAX_SIGS,
   MAX_TTL_DAYS: () => import_ttlParser.MAX_TTL_DAYS,
   MIN_TTL_DAYS: () => import_ttlParser.MIN_TTL_DAYS,
@@ -115,6 +117,7 @@ __export(index_exports, {
   __setDeviceIdentityStateForTest: () => import_deviceIdentityBridge.__setStateForTest,
   __setFdReaderForTest: () => import_fdToken.__setFdReaderForTest,
   __setKekStrategyForTest: () => import_kek.__setKekStrategyForTest,
+  __setUnreadableReloadIntervalForTest: () => import_deviceIdentityBridge.__setUnreadableReloadIntervalForTest,
   __wrappedDekFilePathForTest: () => import_credentialEnvelopeBridge.__wrappedDekFilePathForTest,
   accessTokenHash: () => import_dpop.accessTokenHash,
   assemblePairBundleBase64: () => import_daemonPair.assemblePairBundleBase64,
@@ -209,6 +212,7 @@ __export(index_exports, {
   isJwkThumbprint: () => import_dpop.isJwkThumbprint,
   isLoopbackAddress: () => import_loopbackHttp.isLoopbackAddress,
   isLoopbackHostname: () => import_loopbackHttp.isLoopbackHostname,
+  isMasterKekKeychainService: () => import_kek.isMasterKekKeychainService,
   isStaticTokenKind: () => import_credentialResolver.isStaticTokenKind,
   isTrustedArtifactOrigin: () => import_releaseManifest.isTrustedArtifactOrigin,
   isValidRecoveryCode: () => import_recoveryCode.isValidRecoveryCode,
@@ -370,6 +374,8 @@ var import_independentMachineReservation = require("./independentMachineReservat
   LoginInitError,
   LoopbackTargetRefusedError,
   MACHINE_IDENTITY_FILENAME,
+  MASTER_KEK_KEYCHAIN_ACCOUNT,
+  MASTER_KEK_KEYCHAIN_SERVICE,
   MAX_SIGS,
   MAX_TTL_DAYS,
   MIN_TTL_DAYS,
@@ -419,6 +425,7 @@ var import_independentMachineReservation = require("./independentMachineReservat
   __setDeviceIdentityStateForTest,
   __setFdReaderForTest,
   __setKekStrategyForTest,
+  __setUnreadableReloadIntervalForTest,
   __wrappedDekFilePathForTest,
   accessTokenHash,
   assemblePairBundleBase64,
@@ -513,6 +520,7 @@ var import_independentMachineReservation = require("./independentMachineReservat
   isJwkThumbprint,
   isLoopbackAddress,
   isLoopbackHostname,
+  isMasterKekKeychainService,
   isStaticTokenKind,
   isTrustedArtifactOrigin,
   isValidRecoveryCode,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/kek/index.d.ts

@@ -19,6 +19,7 @@ export { MacosKek } from './macos.js';
 export { LinuxKek } from './linux.js';
 export { WindowsKek } from './windows.js';
 export { zeroizeKekCaches, registerZeroizeHook } from './zeroize-registry.js';
+export { isMasterKekKeychainService, MASTER_KEK_KEYCHAIN_ACCOUNT, MASTER_KEK_KEYCHAIN_SERVICE, } from './masterKekService.js';
 /**
  * @internal Test-only seam — inject a synthetic KEK strategy that wraps
  * with a fixed in-memory key. Resets to platform default when called

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/kek/index.js

@@ -31,11 +31,14 @@ __export(index_exports, {
   InMemoryKek: () => InMemoryKek,
   KekUnavailableError: () => import_types2.KekUnavailableError,
   LinuxKek: () => import_linux2.LinuxKek,
+  MASTER_KEK_KEYCHAIN_ACCOUNT: () => import_masterKekService.MASTER_KEK_KEYCHAIN_ACCOUNT,
+  MASTER_KEK_KEYCHAIN_SERVICE: () => import_masterKekService.MASTER_KEK_KEYCHAIN_SERVICE,
   MacosKek: () => import_macos2.MacosKek,
   UnavailableKek: () => UnavailableKek,
   WindowsKek: () => import_windows2.WindowsKek,
   __setKekStrategyForTest: () => __setKekStrategyForTest,
   getKekStrategy: () => getKekStrategy,
+  isMasterKekKeychainService: () => import_masterKekService.isMasterKekKeychainService,
   registerZeroizeHook: () => import_zeroize_registry.registerZeroizeHook,
   zeroizeKekCaches: () => import_zeroize_registry.zeroizeKekCaches
 });
@@ -49,6 +52,7 @@ var import_macos2 = require("./macos.js");
 var import_linux2 = require("./linux.js");
 var import_windows2 = require("./windows.js");
 var import_zeroize_registry = require("./zeroize-registry.js");
+var import_masterKekService = require("./masterKekService.js");
 class UnsupportedPlatformKek {
   id;
   platform;
@@ -148,11 +152,14 @@ class UnavailableKek {
   InMemoryKek,
   KekUnavailableError,
   LinuxKek,
+  MASTER_KEK_KEYCHAIN_ACCOUNT,
+  MASTER_KEK_KEYCHAIN_SERVICE,
   MacosKek,
   UnavailableKek,
   WindowsKek,
   __setKekStrategyForTest,
   getKekStrategy,
+  isMasterKekKeychainService,
   registerZeroizeHook,
   zeroizeKekCaches
 });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/kek/linux.js

@@ -42,10 +42,11 @@ var import_node_fs = __toESM(require("node:fs"), 1);
 var import_credentialEnvelope = require("../credentialEnvelope.js");
 var import_types = require("./types.js");
 var import_zeroize_registry = require("./zeroize-registry.js");
+var import_masterKekService = require("./masterKekService.js");
 const KIND_LIBSECRET = "linux-libsecret-shellout";
 const KIND_HKDF = "linux-machineid-hkdf";
-const SS_SERVICE = "ai.skrr.daemon.kek";
-const SS_ACCOUNT = "master-kek-v1";
+const SS_SERVICE = import_masterKekService.MASTER_KEK_KEYCHAIN_SERVICE;
+const SS_ACCOUNT = import_masterKekService.MASTER_KEK_KEYCHAIN_ACCOUNT;
 const DBUS_TRANSPORT_ERRORS = [
   "D-Bus",
   "org.freedesktop.secrets",

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/kek/macos.js

@@ -46,9 +46,10 @@ var import_node_fs = __toESM(require("node:fs"), 1);
 var import_credentialEnvelope = require("../credentialEnvelope.js");
 var import_types = require("./types.js");
 var import_zeroize_registry = require("./zeroize-registry.js");
+var import_masterKekService = require("./masterKekService.js");
 const KIND_SHELLOUT = "macos-keychain-shellout";
-const KEYCHAIN_SERVICE = "ai.skrr.daemon.kek";
-const KEYCHAIN_ACCOUNT = "master-kek-v1";
+const KEYCHAIN_SERVICE = import_masterKekService.MASTER_KEK_KEYCHAIN_SERVICE;
+const KEYCHAIN_ACCOUNT = import_masterKekService.MASTER_KEK_KEYCHAIN_ACCOUNT;
 const SECURITY_ITEM_NOT_FOUND = 44;
 const execFileAsync = (0, import_node_util.promisify)(import_node_child_process.execFile);
 let _execFileForTest = null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/kek/masterKekService.d.ts

@@ -0,0 +1,29 @@
+/**
+ * kek/masterKekService.ts — the one place that names the machine-wide master KEK.
+ *
+ * The master KEK is ONE keychain item shared by every profile on the machine
+ * (`service=ai.skrr.daemon.kek`, `account=master-kek-v1`). Each profile's
+ * `cred-dek-wrapped` is sealed under it, and everything a profile stores — its
+ * tokens, its BYOK keys, its device private key — is sealed under that DEK.
+ * Deleting this one item therefore orphans every credential envelope on the
+ * machine at once, and nothing can bring it back: the key is random.
+ *
+ * It was deleted by accident on 2026-10-29. The desktop app's sign-out purge
+ * enumerates every service matching `ai.(skrr|oversky).daemon*` and drains each
+ * one, because that prefix used to hold only per-profile credential slots. The
+ * KEK moved under the same prefix without the purge being told, so a routine
+ * "your saved session was rejected" at app launch deleted it. The next daemon
+ * start could not open the DEK, treated that as a rotation, enrolled a new one,
+ * and the device private key sealed under the old DEK was gone for good — which
+ * the server then saw as `DEVICE_PROOF_MISSING` on every CLI hand-off.
+ *
+ * So anything that deletes keychain items by PREFIX or PATTERN asks
+ * `isMasterKekKeychainService` first. Deleting the KEK is a decision a caller
+ * makes by name, never a side effect of a sweep.
+ */
+/** Keychain `service` of the master KEK. */
+export declare const MASTER_KEK_KEYCHAIN_SERVICE = "ai.skrr.daemon.kek";
+/** Keychain `account` of the master KEK. */
+export declare const MASTER_KEK_KEYCHAIN_ACCOUNT = "master-kek-v1";
+/** Whether a keychain service name holds master-KEK material. */
+export declare function isMasterKekKeychainService(service: string): boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/kek/masterKekService.js

@@ -0,0 +1,37 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var masterKekService_exports = {};
+__export(masterKekService_exports, {
+  MASTER_KEK_KEYCHAIN_ACCOUNT: () => MASTER_KEK_KEYCHAIN_ACCOUNT,
+  MASTER_KEK_KEYCHAIN_SERVICE: () => MASTER_KEK_KEYCHAIN_SERVICE,
+  isMasterKekKeychainService: () => isMasterKekKeychainService
+});
+module.exports = __toCommonJS(masterKekService_exports);
+const MASTER_KEK_KEYCHAIN_SERVICE = "ai.skrr.daemon.kek";
+const MASTER_KEK_KEYCHAIN_ACCOUNT = "master-kek-v1";
+const MASTER_KEK_SERVICE_PATTERN = /^ai\.(?:skrr|oversky)\.daemon\.kek(?:\..*)?$/;
+function isMasterKekKeychainService(service) {
+  return typeof service === "string" && MASTER_KEK_SERVICE_PATTERN.test(service);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MASTER_KEK_KEYCHAIN_ACCOUNT,
+  MASTER_KEK_KEYCHAIN_SERVICE,
+  isMasterKekKeychainService
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/messages.d.ts

@@ -1,4 +1,4 @@
-export type AuthFailureReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'UNKNOWN_401' | 'UNKNOWN';
+export type AuthFailureReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'DEVICE_KEY_UNAVAILABLE' | 'TOKEN_EXPIRED' | 'TOKEN_INVALID' | 'UNKNOWN_401' | 'UNKNOWN';
 /**
  * The command that recovers this process from a re-auth latch.
  *

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/messages.js

@@ -30,6 +30,7 @@ const REASON_HUMAN = {
   REFRESH_EXPIRED: "Your session has expired.",
   SESSION_REVOKED: "Your session was ended (you signed out elsewhere or your password changed).",
   DEVICE_KEY_MISMATCH: "This computer's device key no longer matches the one skrr registered for it, so its session cannot be renewed.",
+  DEVICE_KEY_UNAVAILABLE: "This computer's device key could not be read, so skrr cannot prove which device is asking and its session cannot be renewed. Signing in again creates a new one.",
   TOKEN_EXPIRED: "Your access token has expired.",
   TOKEN_INVALID: "Your saved credentials are no longer valid.",
   UNKNOWN_401: "skrr needs you to sign in again.",

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refresh.js

@@ -282,7 +282,9 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
   if (options.machineUuid) {
     body.machineUuid = options.machineUuid;
   }
+  let proofAttached = false;
   function buildRequestInit() {
+    proofAttached = false;
     const headers = { "Content-Type": "application/json" };
     if (options.origin) {
       headers["X-Oversky-Origin"] = options.origin;
@@ -298,6 +300,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         __refreshDiagnostics.proofAttemptCount += 1;
         if (typeof proof === "string" && proof.length > 0) {
           headers["OverSky-DPoP"] = proof;
+          proofAttached = true;
         }
       } catch (err) {
         __refreshDiagnostics.proofAttemptCount += 1;
@@ -426,10 +429,13 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
       });
       throw new import_types.PermanentAuthFailure(code, parsedBody.message || code, revocationReason);
     }
+    const noLocalProof = parsedBody.code === "DEVICE_PROOF_MISSING" && !proofAttached;
+    const latchReason = noLocalProof ? "DEVICE_KEY_UNAVAILABLE" : "UNKNOWN_401";
     const message = parsedBody.message || "Unknown auth failure";
+    const latchMessage = noLocalProof ? `This computer has no usable device key, so the refresh carried no device proof (server: ${message})` : message;
     const { exhausted, count } = recordUnknown401(daemonId, Date.now());
     if (!exhausted) {
-      log.warn(`[auth/refresh] unknown-shape 401 (${count}/${UNKNOWN_401_BUDGET}) \u2014 treating as transient, will retry: ${message}`);
+      log.warn(`[auth/refresh] unknown-shape 401 (${count}/${UNKNOWN_401_BUDGET}) \u2014 treating as transient, will retry: ${message}` + (noLocalProof ? " (no device proof was sent: this machine has no usable device key)" : ""));
       (0, import_runtime.emitAuthTelemetry)({
         timestamp: (/* @__PURE__ */ new Date()).toISOString(),
         eventType: "auth",
@@ -448,7 +454,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
       });
       throw new import_types.TransientAuthFailure(`Unknown auth failure (transient, retrying): ${message}`);
     }
-    log.warn(`[auth/refresh] unknown-shape 401 budget exhausted (${count}/${UNKNOWN_401_BUDGET}) \u2014 latching permanent: ${message}`);
+    log.warn(`[auth/refresh] unknown-shape 401 budget exhausted (${count}/${UNKNOWN_401_BUDGET}) \u2014 latching permanent ${latchReason}: ${message}`);
     (0, import_runtime.emitAuthTelemetry)({
       timestamp: (/* @__PURE__ */ new Date()).toISOString(),
       eventType: "auth",
@@ -457,18 +463,18 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         event: "refresh_failure",
         daemonId,
         durationMs: Date.now() - startMs,
-        errorCode: "UNKNOWN_401",
+        errorCode: latchReason,
         statusCode: 401,
         transient: false,
         unknown401Streak: count
       }
     });
     persistReauthState({
-      code: "UNKNOWN_401",
-      message,
+      code: latchReason,
+      message: latchMessage,
       at: Date.now()
     });
-    throw new import_types.PermanentAuthFailure("UNKNOWN_401", message);
+    throw new import_types.PermanentAuthFailure(latchReason, latchMessage);
   }
   let bodyText = "";
   try {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/telemetryRedaction.d.ts

@@ -61,6 +61,9 @@ export declare const PREVIEW_TOKEN_REDACTION: "pvw_[redacted]";
 export declare const QR_SIGN_IN_REDACTION: "[redacted]";
 /** Fields are protocol-specific; preserve ordinary request ids, error codes and metrics. */
 export declare function isQrSignInSecretField(key: string): boolean;
+export declare function isOAuthQuerySecretField(key: string): boolean;
+export declare function isOAuthQueryContainerField(key: string): boolean;
+export declare function isGraphHandoffCookieField(key: string): boolean;
 /**
  * Replace every credential that travels in a URL with a marker: a Hosted Machine preview token with
  * {@link PREVIEW_TOKEN_REDACTION}, and a workspace invitation, platform invitation, member link or operator code with

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/telemetryRedaction.js

@@ -20,6 +20,9 @@ var telemetryRedaction_exports = {};
 __export(telemetryRedaction_exports, {
   PREVIEW_TOKEN_REDACTION: () => PREVIEW_TOKEN_REDACTION,
   QR_SIGN_IN_REDACTION: () => QR_SIGN_IN_REDACTION,
+  isGraphHandoffCookieField: () => isGraphHandoffCookieField,
+  isOAuthQueryContainerField: () => isOAuthQueryContainerField,
+  isOAuthQuerySecretField: () => isOAuthQuerySecretField,
   isQrSignInSecretField: () => isQrSignInSecretField,
   redactPreviewTokens: () => redactPreviewTokens,
   redactPreviewTokensDeep: () => redactPreviewTokensDeep,
@@ -53,6 +56,18 @@ function isQrSignInSecretField(key) {
   return QR_SECRET_FIELDS.has(leaf.replace(/[_-]/g, "").toLowerCase());
 }
 const QR_SECRET_ASSIGNMENT = /((?:["']?)(?:statusToken|claimToken|codeVerifier|codeChallenge|comparisonCode|status_token|claim_token|code_verifier|code_challenge|comparison_code)(?:["']?)\s*[:=]\s*["']?)([A-Za-z0-9._~%+-]+)/gi;
+const OAUTH_QUERY_SECRET = /(^|[?&]|%(?:25)*26)(code|state|error_description|handoff)(=|%(?:25)*3[dD])([^&#\s"'<>]*)/gi;
+function isOAuthQuerySecretField(key) {
+  return ["code", "state", "error_description", "handoff"].includes(key.toLowerCase());
+}
+function isOAuthQueryContainerField(key) {
+  const leaf = (key.split(".").pop() || "").replace(/[_-]/g, "").toLowerCase();
+  return leaf === "query" || leaf === "querystring";
+}
+function isGraphHandoffCookieField(key) {
+  return key.toLowerCase() === "__secure-pc-graph-handoff";
+}
+const GRAPH_HANDOFF_COOKIE = /((?:_|%(?:25)*5[fF]){2}secure(?:-|%(?:25)*2[dD])pc(?:-|%(?:25)*2[dD])graph(?:-|%(?:25)*2[dD])handoff(?:=|%(?:25)*3[dD]))([^;,&\s"'<>]+)/gi;
 function redactQrSignInText(value) {
   const standaloneQuery = /(?:^|[?&])direction=(?:mobile_approves_web|web_approves_mobile)(?:&|$)/.test(value) ? value.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`) : value;
   return standaloneQuery.replace(QR_REQUEST_PATH, `$1${QR_SIGN_IN_REDACTION}`).replace(QR_LINK_QUERY, (_match, prefix, query) => prefix + query.replace(QR_REQUEST_QUERY, `$1$2${QR_SIGN_IN_REDACTION}`)).replace(QR_SECRET_ASSIGNMENT, `$1${QR_SIGN_IN_REDACTION}`);
@@ -62,7 +77,7 @@ const credentialMarker = (_match, prefix) => `${prefix}_[redacted]`;
 function redactPreviewTokens(value) {
   if (typeof value !== "string")
     return value;
-  const qrSafe = redactQrSignInText(value);
+  const qrSafe = redactQrSignInText(value).replace(OAUTH_QUERY_SECRET, "$1$2$3[redacted]").replace(GRAPH_HANDOFF_COOKIE, "$1[redacted]");
   if (!CREDENTIAL_HINTS.some((hint) => qrSafe.indexOf(hint) !== -1))
     return qrSafe;
   return qrSafe.replace(PREVIEW_TOKEN, PREVIEW_TOKEN_REDACTION).replace(SIGNED_CREDENTIAL, credentialMarker).replace(LEGACY_OPERATOR_CODE, credentialMarker);
@@ -81,7 +96,7 @@ function redactPreviewTokensDeep(root, limits = {}) {
     let visited = 0;
     let complete = true;
     const rewrite = (holder, key, current) => {
-      const next = isQrSignInSecretField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
+      const next = isQrSignInSecretField(key) || isGraphHandoffCookieField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
       if (next === current) {
         return;
       }
@@ -119,7 +134,27 @@ function redactPreviewTokensDeep(root, limits = {}) {
           complete = false;
           continue;
         }
-        if (isQrSignInSecretField(key) || typeof child === "string") {
+        if (isOAuthQueryContainerField(key) && Array.isArray(child)) {
+          try {
+            holder[key] = "[redacted]";
+          } catch {
+            complete = false;
+          }
+          if (holder[key] !== "[redacted]")
+            complete = false;
+          continue;
+        }
+        if (isOAuthQueryContainerField(key) && child && typeof child === "object" && !Array.isArray(child)) {
+          const query = child;
+          for (const queryKey of Object.keys(query)) {
+            if (isOAuthQuerySecretField(queryKey)) {
+              query[queryKey] = "[redacted]";
+              if (query[queryKey] !== "[redacted]")
+                complete = false;
+            }
+          }
+        }
+        if (isQrSignInSecretField(key) || isGraphHandoffCookieField(key) || typeof child === "string") {
           rewrite(holder, key, child);
         } else if (child !== null && typeof child === "object") {
           if (depth + 1 > maxDepth) {
@@ -166,6 +201,9 @@ function withPreviewTokenRedaction(options) {
 0 && (module.exports = {
   PREVIEW_TOKEN_REDACTION,
   QR_SIGN_IN_REDACTION,
+  isGraphHandoffCookieField,
+  isOAuthQueryContainerField,
+  isOAuthQuerySecretField,
   isQrSignInSecretField,
   redactPreviewTokens,
   redactPreviewTokensDeep,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/types.d.ts

@@ -67,6 +67,12 @@ export interface TokenPair {
  *                       (server code `DEVICE_PROOF_THUMBPRINT_MISMATCH`).
  *                       The daemon signs every retry with the same key, so
  *                       retrying can never succeed.
+ *   - DEVICE_KEY_UNAVAILABLE — the server demanded a device proof
+ *                       (`DEVICE_PROOF_MISSING`) and this process had none
+ *                       to send: the key is unreadable, never created, or no
+ *                       signer is wired. Unlike `DEVICE_KEY_MISMATCH` there is
+ *                       no second key to reconcile; the fix is an interactive
+ *                       daemon sign-in, which mints and re-pins a new one.
  *   - UNKNOWN_401     — server returned 401 with a code we don't
  *                       recognize. Treated as permanent (better to prompt
  *                       re-auth than to loop forever) but tagged
@@ -79,7 +85,7 @@ export interface TokenPair {
  * Without this, the client `describeAuthFailure` exhaustiveness check
  * was silently broken for the non-REFRESH branches.
  */
-export type PermanentAuthReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'TOKEN_INVALID' | 'TOKEN_EXPIRED' | 'UNKNOWN_401';
+export type PermanentAuthReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'DEVICE_KEY_UNAVAILABLE' | 'TOKEN_INVALID' | 'TOKEN_EXPIRED' | 'UNKNOWN_401';
 export declare class PermanentAuthFailure extends Error {
     readonly code: PermanentAuthReason;
     /**