@skrr-ai/cli 0.1.122 → 0.1.124

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -45,10 +45,12 @@ import fs from 'node:fs';
 import path from 'node:path';
 import lockfile from 'proper-lockfile';
 import { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, isEnvelopeString as isCredEnvelopeString, generateDek, serialize as credEnvelopeSerialize, } from './credentialEnvelope.js';
-import { getKekStrategy, zeroizeKekCaches } from './kek/index.js';
+import { getKekStrategy, KekUnavailableError, zeroizeKekCaches, } from './kek/index.js';
 import { consolidateProfileState, profileStateDir, profileStateFilePathsToClear, resolveProfileStateFile, RETIRED_COPY_SUFFIX, } from './profileStateDir.js';
+import { assertMayMutateLiveState, rethrowIfLiveStateRefusal } from './liveState.js';
 import { needsReauthState } from './refresh.js';
 import { emitAuthTelemetry, getAuthLogger, getCredEnvelopeFailClosed } from './runtime.js';
+import { atomicWrite0600, ensureStateDir, removeStateFile, writeStateFile } from './stateFiles.js';
 /**
  * Account name the wrapped DEK lives under (file fallback). Keeping the
  * literal here so a future rename surfaces as a single grep target.
@@ -84,37 +86,6 @@ export function __getStateForTest() {
 function wrappedDekFilePath(profile) {
     return resolveProfileStateFile(profile, ACCOUNT_CRED_DEK_WRAPPED).path;
 }
-/**
- * Atomic 0600 write — tmp+fsync+rename+dir-fsync. Same shape as the
- * original daemon/CLI implementations so partial-write races between
- * `sky` and `oversky` produce the same on-disk transitions.
- */
-function atomicWrite0600(target, value) {
-    const dir = path.dirname(target);
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-    const fd = fs.openSync(tmp, 'w', 0o600);
-    try {
-        fs.writeSync(fd, value);
-        fs.fsyncSync(fd);
-    }
-    finally {
-        fs.closeSync(fd);
-    }
-    fs.renameSync(tmp, target);
-    try {
-        const dirFd = fs.openSync(dir, 'r');
-        try {
-            fs.fsyncSync(dirFd);
-        }
-        finally {
-            fs.closeSync(dirFd);
-        }
-    }
-    catch {
-        /* best-effort — Windows / some BSDs reject dir fsync */
-    }
-}
 /**
  * Telemetry shim. Routes through the consumer-supplied logEvent sink
  * (daemon: structured event log; CLI: typically no-op or stderr at DEBUG).
@@ -195,9 +166,9 @@ function credEnvelopeLockPath(profile) {
 async function withCredEnvelopeLock(profile, body) {
     const lockPath = credEnvelopeLockPath(profile);
     const dir = path.dirname(lockPath);
-    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    ensureStateDir(dir, `take the credential envelope lock for profile ${profile}`);
     if (!fs.existsSync(lockPath)) {
-        fs.writeFileSync(lockPath, '', { mode: 0o600 });
+        writeStateFile(lockPath, '', { mode: 0o600 }, 'create the credential envelope lock');
     }
     const acquireStart = Date.now();
     const release = await lockfile.lock(lockPath, {
@@ -338,6 +309,7 @@ async function consolidateWrappedDek(profile, kek, aad) {
         }));
     }
     catch (err) {
+        rethrowIfLiveStateRefusal(err);
         emit('cred_envelope.path_consolidation.failed', false, {
             profile,
             message: err?.message ?? 'unknown',
@@ -407,6 +379,12 @@ async function loadRetiredDeks(profile, kek, aad, active) {
             }
         }
         catch {
+            // A copy kept because it did not open (`keepUnreadableWrappedDek`) is expected not to open
+            // until its KEK comes back; warning on every process start for each of up to eight files
+            // would print on every `skrr` command for as long as it lasts. A retired DEK a
+            // consolidation set aside is different: it opened once, so it failing is news.
+            if (path.basename(target).startsWith(UNREADABLE_DEK_COPY_PREFIX))
+                continue;
             emit('cred_envelope.retired_dek.unreadable', false, {
                 profile,
                 file: path.basename(target),
@@ -414,6 +392,80 @@ async function loadRetiredDeks(profile, kek, aad, active) {
         }
     }
 }
+/**
+ * Prefix of the copy kept when a wrapped DEK could not be opened and is about to be
+ * replaced. It sits in the retired keyring (`<file>.retired.*`), so a key that opens
+ * again later (a restored Keychain item, a transient fault misread as a rotation) brings
+ * back everything sealed under it, and a logout deletes it with the rest.
+ */
+const UNREADABLE_DEK_COPY_PREFIX = `${ACCOUNT_CRED_DEK_WRAPPED}${RETIRED_COPY_SUFFIX}.unreadable-`;
+/**
+ * A copy is 92 bytes and only the OLDEST can be the one that matters: every replacement after
+ * the first is usually a copy of a DEK this process itself just enrolled. The first cut kept
+ * two, and three rotations in thirteen seconds (a test pointed at a real home) pushed the
+ * original DEK out, which is exactly the copy that would have restored the profile.
+ */
+const MAX_UNREADABLE_DEK_COPIES = 8;
+/**
+ * Whether a failed unwrap means the KEK could not be READ right now, as opposed to the KEK
+ * being a different key. A locked Keychain, a non-interactive context or a failing helper
+ * say nothing about the key; only an authentication-tag failure under a KEK that was read
+ * does. Matched by name as well as by class, since two copies of this package in one
+ * process (a farmed worktree) have two classes.
+ */
+function isKekUnavailableError(err) {
+    return (err instanceof KekUnavailableError ||
+        err?.name === 'KekUnavailableError');
+}
+/**
+ * Keep the wrapped DEK this process could not open before it is replaced. Replacing it
+ * orphans everything sealed under the old DEK (the device private key, stored tokens), and
+ * the one thing that can still undo that is the old wrapped DEK meeting its KEK again.
+ * Best effort and bounded: a copy that cannot be written must not stop the daemon coming
+ * up, and the oldest copies are pruned.
+ */
+function keepUnreadableWrappedDek(profile, wrapped) {
+    try {
+        const dir = profileStateDir(profile);
+        const existing = fs.existsSync(dir)
+            ? fs
+                .readdirSync(dir)
+                .filter((entry) => entry.startsWith(UNREADABLE_DEK_COPY_PREFIX))
+                .sort()
+            : [];
+        // The same bytes are already kept (a KEK that flaps between two values re-seals nothing
+        // new): do not let a duplicate take a slot from a different DEK.
+        for (const entry of existing) {
+            try {
+                if (fs.readFileSync(path.join(dir, entry)).equals(wrapped))
+                    return entry;
+            }
+            catch {
+                /* an unreadable copy is not a match */
+            }
+        }
+        const name = `${UNREADABLE_DEK_COPY_PREFIX}${new Date().toISOString().replace(/[:.]/g, '-')}`;
+        atomicWrite0600(path.join(dir, name), wrapped, 'keep the unreadable wrapped DEK');
+        const kept = [...existing, name].sort();
+        for (const stale of kept.slice(0, Math.max(0, kept.length - MAX_UNREADABLE_DEK_COPIES))) {
+            try {
+                removeStateFile(path.join(dir, stale), 'prune a kept wrapped DEK');
+            }
+            catch {
+                /* a copy that will not go costs 92 bytes */
+            }
+        }
+        return name;
+    }
+    catch (err) {
+        rethrowIfLiveStateRefusal(err);
+        emit('cred_envelope.unreadable_dek_copy_failed', false, {
+            profile,
+            message: err?.message ?? 'unknown',
+        });
+        return null;
+    }
+}
 /** Retired wrapped DEKs for `profile`, oldest first. */
 function retiredDekFiles(profile) {
     const dir = profileStateDir(profile);
@@ -547,6 +599,9 @@ export async function initNewIndependentCredEnvelope(profile) {
     const dek = generateDek();
     let temp;
     try {
+        // Everything below creates, links and deletes inside `dir`, with raw flags
+        // (O_EXCL, link) the shared writers do not offer, so the refusal is asked once here.
+        assertMayMutateLiveState(dir, `enroll the wrapped DEK for background profile ${profile}`);
         const wrapped = await kek.wrap(dek, buildCredentialAad(profile));
         // Another enrollment may have won while the platform store was busy.
         // Its file is opened read-only; this process never overwrites it.
@@ -699,6 +754,8 @@ export async function initCredEnvelope(profile) {
     }
     let dek = null;
     let unwrapAttemptedAndFailed = false;
+    let kekUnreadable = null;
+    let unreadableWrapped = null;
     await withCredEnvelopeLock(profile, async () => {
         // Re-stat after acquiring the lock — a sibling sky/oversky may have
         // enrolled while we were waiting. Without this, both processes would
@@ -728,6 +785,7 @@ export async function initCredEnvelope(profile) {
                         kekKind: captureKind(),
                     });
                     unwrapAttemptedAndFailed = true;
+                    unreadableWrapped = wrappedBytes;
                 }
                 else {
                     dek = candidate;
@@ -740,21 +798,45 @@ export async function initCredEnvelope(profile) {
                     kekKind: captureKind(),
                     message: err?.message ?? 'unknown',
                 });
-                unwrapAttemptedAndFailed = true;
+                if (isKekUnavailableError(err)) {
+                    // The KEK could not be read; that is not evidence it changed. Enrolling here would
+                    // replace a DEK that is still good with one the next start cannot tell apart from
+                    // a rotation, and orphan everything sealed under it.
+                    kekUnreadable = err;
+                }
+                else {
+                    unwrapAttemptedAndFailed = true;
+                    unreadableWrapped = wrappedBytes;
+                }
             }
         }
+        if (kekUnreadable !== null) {
+            _state = { kind: 'disabled', reason: 'kek_unavailable' };
+            emit('cred_envelope.kek_unavailable', false, {
+                kekId: kek.id,
+                profile,
+                phase: 'unwrap',
+                describe: kek.describe(),
+                message: kekUnreadable?.message ?? 'unknown',
+            });
+            return;
+        }
         // KEK rotation detection (gap G4). If the wrapped file was present,
         // KEK reported `available=true`, but unwrap threw — the most likely
         // explanation is the KEK was rotated underneath us. Surface this as
         // a distinct event so dashboards can count rotations separately
         // from genuinely-corrupt blobs, while still falling through to a
-        // fresh enrollment so the daemon stays operational.
+        // fresh enrollment so the daemon stays operational. The old wrapped DEK is
+        // kept first: enrolling replaces it, and it is the only way back to what
+        // was sealed under it.
         if (unwrapAttemptedAndFailed && dek === null) {
             _kekRotationDetected = true;
+            const keptAs = unreadableWrapped ? keepUnreadableWrappedDek(profile, unreadableWrapped) : null;
             emit('cred_envelope.kek_rotated', false, {
                 kekId: kek.id,
                 kekKind: captureKind(),
                 profile,
+                ...(keptAs ? { previousWrappedDekKeptAs: keptAs } : {}),
                 message: 'wrapped DEK present but unwrap failed under available KEK; treating as rotation and re-enrolling',
             });
         }
@@ -763,7 +845,7 @@ export async function initCredEnvelope(profile) {
             try {
                 dek = generateDek();
                 const wrapped = await kek.wrap(dek, aad);
-                atomicWrite0600(targetPath, wrapped);
+                atomicWrite0600(targetPath, wrapped, `write the wrapped DEK for profile ${profile}`);
                 emit('cred_envelope.dek_enrolled', true, {
                     kekId: kek.id,
                     kekKind: captureKind(),
@@ -772,6 +854,7 @@ export async function initCredEnvelope(profile) {
                 });
             }
             catch (err) {
+                rethrowIfLiveStateRefusal(err);
                 _state = { kind: 'disabled', reason: 'init_failed' };
                 emit('cred_envelope.init_failed', false, {
                     reason: 'enrollment_failed',
@@ -820,9 +903,10 @@ export async function resetCredEnvelope(opts) {
             ...retiredDekFiles(opts.profile),
         ]) {
             try {
-                fs.unlinkSync(target);
+                removeStateFile(target, `delete the wrapped DEK file ${path.basename(target)}`);
             }
             catch (err) {
+                rethrowIfLiveStateRefusal(err);
                 if (err.code !== 'ENOENT') {
                     emit('cred_envelope.clear_failed', false, {
                         profile: opts.profile,

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -1,4 +1,34 @@
-import { type DeviceKeyPair, type Ed25519PublicJwk } from './deviceKey.js';
+import { type DeviceKeyAlg, type DevicePublicJwk } from './deviceKey.js';
+import { type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
+import { type HardwareKeyCapability, type HardwareKeyRecord } from './deviceKeyHardware.js';
+/**
+ * The `cred_envelope.read.decrypt_failed` hint for the device PRIVATE key
+ * (OSK-20506).
+ *
+ * The envelope's default hint says "signing in again rebuilds it", which is true
+ * of a credential and false of this: `skrr login` never creates or replaces a
+ * device key, and only an interactive daemon sign-in does (it re-pins the new key
+ * on the server). `loadKeypair` hands this to `maybeDecryptOnRead` so the
+ * producer says WHAT failed; a presenter that already prints one device-key line
+ * (the CLI's `recovery_required` notice) recognises it by identity and prints
+ * nothing for the decrypt failure, instead of two lines with two remedies. A
+ * logger that prints every warning, the daemon's, shows this one as written.
+ *
+ * Compared by value by the CLI presenter: change the text and the CLI prints the
+ * credential line again, which `auth-core-init.device-key.spec.ts` catches.
+ */
+export declare const DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT = "stored device key is unreadable on this machine \u2014 only an interactive daemon sign-in replaces it";
+/**
+ * `key` is a handle, never a keypair: nothing in this module (or any caller of
+ * it) can read a private scalar once a key is active, which is what lets a
+ * hardware key stand in for a software one without a second code path.
+ *
+ * `envelopeProtected` is about the PRIVATE KEY FILE being sealed under the
+ * credential envelope. A hardware record is deliberately not sealed (it is
+ * useless off this machine, and sealing it would tie the device identity's life
+ * to the envelope key again), so it is always `false` for hardware and says
+ * nothing about how well that key is protected: read `key.custody` for that.
+ */
 type DeviceIdentityState = {
     kind: 'uninit';
 } | {
@@ -6,11 +36,13 @@ type DeviceIdentityState = {
     reason: DisabledReason;
 } | {
     kind: 'active';
-    keypair: DeviceKeyPair;
+    key: DeviceKeyHandle;
     profile: string;
     envelopeProtected: boolean;
 };
 type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key' | 'no_stored_key';
+/** @internal Test seam — how often an unreadable key is looked at again. `null` restores 5 s. */
+export declare function __setUnreadableReloadIntervalForTest(ms: number | null): void;
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
@@ -67,6 +99,69 @@ export declare function resetDeviceIdentity(opts?: {
     profile?: string;
     clearOnDisk?: boolean;
 }): Promise<void>;
+/**
+ * A hardware key that exists only in memory. It is not this machine's identity
+ * until `commitDeviceKeyCandidate`, and it leaves nothing behind if it is
+ * dropped: a Secure Enclave key lives in the blob and nowhere else.
+ *
+ * That is the whole safety argument for an upgrade. The server learns the new key
+ * from a proof signed with it (an interactive sign-in re-pins the row), so the
+ * order has to be: create the candidate, sign the sign-in with it, and only after
+ * the server has accepted that sign-in make it the identity. The software key
+ * stays on disk, untouched and active, through every step before the last one.
+ */
+export interface DeviceKeyCandidate {
+    readonly key: DeviceKeyHandle;
+    /** @internal what `commitDeviceKeyCandidate` persists. */
+    readonly record: HardwareKeyRecord;
+}
+export type DeviceKeyCandidateResult = {
+    ok: true;
+    candidate: DeviceKeyCandidate;
+} | {
+    ok: false;
+    reason: 'already_hardware' | 'independent_profile' | 'unavailable' | 'create_failed';
+    capability?: HardwareKeyCapability;
+    message?: string;
+};
+/**
+ * Create a hardware key candidate if this machine can hold one and does not
+ * already. Never throws and never touches disk, so an interactive sign-in can
+ * call it unconditionally and fall back to the key it has on any answer but ok.
+ */
+export declare function prepareHardwareKeyCandidate(profile: string): Promise<DeviceKeyCandidateResult>;
+/** Sign a request with a candidate (the upgrade's sign-in proof). Null on failure, like `signServerRequest`. */
+export declare function signWithCandidate(candidate: DeviceKeyCandidate, opts: {
+    method: string;
+    url: string;
+    refreshToken?: string;
+    accessToken?: string;
+}): Promise<string | null>;
+/**
+ * Make a candidate this profile's device identity. Call it only after the
+ * server has accepted a sign-in proven with `candidate`: until then the software
+ * key is the identity the server pins, and replacing it early is the failure
+ * this API exists to prevent.
+ *
+ * Under the identity lock, in the order that survives a crash: retire the old
+ * key, write the hardware record (authoritative), then the public file, then
+ * clear the enrollment marker (it records the OLD thumbprint and would otherwise
+ * short-circuit every later enrollment as already done).
+ */
+export declare function commitDeviceKeyCandidate(profile: string, candidate: DeviceKeyCandidate): Promise<void>;
+/** A sign-in that takes longer than this has been abandoned; its pending key is not committed. */
+export declare const PENDING_HARDWARE_KEY_MAX_AGE_MS: number;
+/** Park a candidate so a later process can commit or discard it. Replaces any earlier one. */
+export declare function persistPendingHardwareKey(profile: string, candidate: DeviceKeyCandidate): Promise<void>;
+export type PendingHardwareKeyOutcome = 'committed' | 'no_pending' | 'mismatch' | 'expired' | 'unreadable';
+/**
+ * Make the parked candidate this profile's identity, if it is the one the caller
+ * proved the sign-in with (`thumbprint`) and it is not stale. Anything else
+ * commits nothing: the software key stays the identity, and the answer says why.
+ */
+export declare function commitPendingHardwareKey(profile: string, thumbprint: string): Promise<PendingHardwareKeyOutcome>;
+/** Drop the parked candidate (the sign-in failed or was refused). Idempotent. */
+export declare function discardPendingHardwareKey(profile: string): Promise<void>;
 /** True iff init has completed and a keypair is in memory. */
 export declare function isDeviceIdentityActive(): boolean;
 /**
@@ -75,8 +170,10 @@ export declare function isDeviceIdentityActive(): boolean;
  * on the in-flight request.
  */
 export declare function getDevicePublicKey(): {
-    jwk: Ed25519PublicJwk;
+    jwk: DevicePublicJwk;
     thumbprint: string;
+    alg: DeviceKeyAlg;
+    custody: DeviceKeyCustody;
 } | null;
 /**
  * Operator-readable summary of device-identity state. Used by
@@ -88,13 +185,47 @@ export declare function describeDeviceIdentityState(): {
     thumbprint?: string;
     profile?: string;
     envelopeProtected?: boolean;
+    alg?: DeviceKeyAlg;
+    /** Whether the private half can be copied off this machine. Absent unless active. */
+    custody?: DeviceKeyCustody;
+    /**
+     * For a hardware key: can THIS process sign with it right now? False means the
+     * key exists and is intact but the helper that signs with it is not installed
+     * where this process can find it (a CLI without the desktop app's helper, an
+     * app update that has not landed). It is a different fact from an unreadable
+     * key, and it must never lead to replacing the key.
+     */
+    canSign?: boolean;
+};
+export type StoredDeviceKeyDescription = {
+    stored: false;
+} | {
+    stored: true;
+    alg: DeviceKeyAlg;
+    custody: DeviceKeyCustody;
+    thumbprint: string;
+    /** A hardware key needs the helper to sign; a software key never does. */
+    canSign: boolean;
 };
+/**
+ * What a profile's device key IS, read from its plaintext public record alone. For
+ * `status`, which is a different process from the daemon and may run while the
+ * daemon is stopped: it opens nothing, needs no envelope key and writes nothing, so
+ * it answers even when the private half is unreadable. Not evidence the key can be
+ * used (only `describeDeviceIdentityState` in the process that loaded it says that);
+ * evidence of what kind of key the profile has, which nothing else showed.
+ */
+export declare function describeStoredDeviceKey(profile: string): StoredDeviceKeyDescription;
 /**
  * Sign an outgoing request with the device key. Returns the JWS Compact
  * Serialization, or null when device identity is not active. NEVER
  * throws — a failed sign returns null and emits a telemetry event so
  * the caller can fall back to bearer-only auth without an outage.
  *
+ * Asynchronous because a hardware key signs in a helper process. A software key
+ * resolves on the next microtask, so a caller that awaits pays nothing it can
+ * measure; a caller that could not await could not have a hardware key.
+ *
  * Shape matches `DeviceProofSigner` from `./refresh.ts` so the function
  * passes directly into `refreshDaemonToken`'s `signRequestProof` slot.
  */
@@ -103,7 +234,7 @@ export declare function signServerRequest(opts: {
     url: string;
     refreshToken?: string;
     accessToken?: string;
-}): string | null;
+}): Promise<string | null>;
 /** @internal Test seams — file path resolvers. */
 export declare function __publicKeyPathForTest(profile: string): string;
 export declare function __privateKeyPathForTest(profile: string): string;