@skrr-ai/cli 0.1.122 → 0.1.124

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/refresh.js

@@ -25,7 +25,9 @@ import fs from 'node:fs';
 import path from 'node:path';
 import lockfile from 'proper-lockfile';
 import { getAuthLogger, getAuthConfigDir, emitAuthTelemetry, notifyResponseObserver, } from './runtime.js';
+import { rethrowIfLiveStateRefusal } from './liveState.js';
 import { permanentReasonForRefreshCode } from './refreshClassification.js';
+import { ensureStateDir, removeStateFile, writeStateFile } from './stateFiles.js';
 import { PermanentAuthFailure, TransientAuthFailure, } from './types.js';
 /**
  * P1-6: Reduced from 30 s to 5 s.
@@ -254,9 +256,9 @@ export async function withAuthLock(body, daemonId) {
     const lockPath = authLockPath();
     const dir = path.dirname(lockPath);
     if (!fs.existsSync(dir))
-        fs.mkdirSync(dir, { recursive: true });
+        ensureStateDir(dir, 'create the auth lock directory', null);
     if (!fs.existsSync(lockPath)) {
-        fs.writeFileSync(lockPath, '', { mode: 0o600 });
+        writeStateFile(lockPath, '', { mode: 0o600 }, 'create the auth lock');
     }
     const acquireStart = Date.now();
     emitAuthTelemetry({
@@ -611,7 +613,12 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
     // "proof-per-attempt invariant: a retry loop must call buildRequestInit()
     // per attempt" in `refresh.deviceProof.test.ts` asserts the function
     // is defined inside `doRefresh` and will fail if it is moved.
-    function buildRequestInit() {
+    // Whether the request the server just answered carried a device proof. A
+    // `DEVICE_PROOF_MISSING` is only a LOCAL fact (no key to sign with) when we
+    // know none went out; if one did, something between us stripped it.
+    let proofAttached = false;
+    async function buildRequestInit() {
+        proofAttached = false;
         // Phase 3-R5: the stable `X-Oversky-Origin` header is the server's
         // preferred identity signal on the benign-grace rotation match. Newer
         // servers prefer it over the raw User-Agent; older servers ignore
@@ -633,7 +640,9 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         __refreshDiagnostics.requestAttemptCount += 1;
         if (options.signRequestProof) {
             try {
-                const proof = options.signRequestProof({
+                // Awaited: a hardware key signs in a helper process. A synchronous
+                // signer (a test double, an older caller) still works unchanged.
+                const proof = await options.signRequestProof({
                     method: 'POST',
                     url,
                     refreshToken: currentRefreshToken,
@@ -646,6 +655,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
                 __refreshDiagnostics.proofAttemptCount += 1;
                 if (typeof proof === 'string' && proof.length > 0) {
                     headers['OverSky-DPoP'] = proof;
+                    proofAttached = true;
                 }
             }
             catch (err) {
@@ -669,7 +679,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         // Single attempt today. The builder structure is the load-bearing
         // bit: any future retry must call `buildRequestInit()` again so
         // the per-attempt invariant — fresh jti per request — holds.
-        response = await fetch(url, buildRequestInit());
+        response = await fetch(url, await buildRequestInit());
         notifyResponseObserver(response);
     }
     catch (err) {
@@ -867,10 +877,29 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         // the FINAL fallback. The distinct `UNKNOWN_401` telemetry tag is kept
         // on BOTH branches so monitoring can still see a server-side bug
         // separately from a real expiration (and watch the retry-vs-latch split).
+        //
+        // One unknown-shape 401 IS diagnosable: the server demanded a device proof
+        // (`DEVICE_PROOF_MISSING`) and this request carried none. That is a fact
+        // about this machine — an unreadable, never-created or unwired device key —
+        // and it never self-heals, but it stays on the same budget (a proxy that
+        // strips the header, or an identity still initialising, reads the same on
+        // one attempt). Only what the exhausted latch SAYS differs, so a person is
+        // sent to the sign-in that mints a key rather than told "sign in again".
+        // If a proof DID go out, the header was lost on the way: that stays generic.
+        const noLocalProof = parsedBody.code === 'DEVICE_PROOF_MISSING' && !proofAttached;
+        const latchReason = noLocalProof
+            ? 'DEVICE_KEY_UNAVAILABLE'
+            : 'UNKNOWN_401';
         const message = parsedBody.message || 'Unknown auth failure';
+        const latchMessage = noLocalProof
+            ? `This computer has no usable device key, so the refresh carried no device proof (server: ${message})`
+            : message;
         const { exhausted, count } = recordUnknown401(daemonId, Date.now());
         if (!exhausted) {
-            log.warn(`[auth/refresh] unknown-shape 401 (${count}/${UNKNOWN_401_BUDGET}) — treating as transient, will retry: ${message}`);
+            log.warn(`[auth/refresh] unknown-shape 401 (${count}/${UNKNOWN_401_BUDGET}) — treating as transient, will retry: ${message}` +
+                (noLocalProof
+                    ? ' (no device proof was sent: this machine has no usable device key)'
+                    : ''));
             emitAuthTelemetry({
                 timestamp: new Date().toISOString(),
                 eventType: 'auth',
@@ -893,7 +922,7 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
         // permanent behavior: latch + persist the reauth flag so the daemon
         // surfaces the banner and the interactive modal becomes the final
         // recovery path.
-        log.warn(`[auth/refresh] unknown-shape 401 budget exhausted (${count}/${UNKNOWN_401_BUDGET}) — latching permanent: ${message}`);
+        log.warn(`[auth/refresh] unknown-shape 401 budget exhausted (${count}/${UNKNOWN_401_BUDGET}) — latching permanent ${latchReason}: ${message}`);
         emitAuthTelemetry({
             timestamp: new Date().toISOString(),
             eventType: 'auth',
@@ -902,18 +931,18 @@ async function doRefresh(serverUrl, currentRefreshToken, daemonId, options = {})
                 event: 'refresh_failure',
                 daemonId,
                 durationMs: Date.now() - startMs,
-                errorCode: 'UNKNOWN_401',
+                errorCode: latchReason,
                 statusCode: 401,
                 transient: false,
                 unknown401Streak: count,
             },
         });
         persistReauthState({
-            code: 'UNKNOWN_401',
-            message,
+            code: latchReason,
+            message: latchMessage,
             at: Date.now(),
         });
-        throw new PermanentAuthFailure('UNKNOWN_401', message);
+        throw new PermanentAuthFailure(latchReason, latchMessage);
     }
     // 5xx / unexpected — transient. Caller will back off.
     // RESET SEMANTICS (Finding 4 follow-up): a 5xx is transient and does NOT
@@ -947,12 +976,11 @@ export function persistReauthState(state) {
     try {
         const dir = path.dirname(flagPath);
         if (!fs.existsSync(dir))
-            fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
-        fs.writeFileSync(flagPath, JSON.stringify(state, null, 2) + '\n', {
-            mode: 0o600,
-        });
+            ensureStateDir(dir, 'create the re-auth latch directory');
+        writeStateFile(flagPath, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 }, 'write the re-auth latch');
     }
     catch (err) {
+        rethrowIfLiveStateRefusal(err);
         log.debug(`[auth/refresh] failed to persist reauth flag: ${err?.message}`);
     }
 }
@@ -984,9 +1012,10 @@ export function clearReauthState() {
     try {
         const flagPath = reauthFlagPath();
         if (fs.existsSync(flagPath))
-            fs.unlinkSync(flagPath);
+            removeStateFile(flagPath, 'clear the re-auth latch');
     }
     catch (err) {
+        rethrowIfLiveStateRefusal(err);
         log.debug(`[auth/refresh] clearReauthState: ${err?.message}`);
     }
 }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/stateFiles.d.ts

@@ -0,0 +1,31 @@
+/**
+ * stateFiles.ts — the ONE place auth-core mutates credential state on disk.
+ *
+ * Every write, delete, rename and mkdir of a wrapped DEK, a device key, an enrollment marker, a
+ * lock sentinel, a re-auth latch or a machine identity goes through a function here, and each
+ * asks `assertMayMutateLiveState` first: a test process aimed at the account's real home is
+ * refused with a named error before a byte changes (`liveState.ts` says why that cannot be left
+ * to each runner).
+ *
+ * This is the "own a control surface, or do not touch it" rule applied to the real home. The
+ * atomic writer used to exist three times (device identity, credential envelope, profile
+ * consolidation), so a guard added to one left two doors open. `stateFileBoundary.spec.ts`
+ * fails when a file other than this one starts calling a raw `fs` mutator, so a fourth copy
+ * cannot appear unguarded.
+ *
+ * Outside a test process every function here is exactly the `fs` call it wraps.
+ */
+import fs from 'node:fs';
+/** `mkdir -p` for a state directory, 0700 unless `mode` says otherwise. */
+export declare function ensureStateDir(dir: string, what: string, mode?: number | null): void;
+/**
+ * Atomic 0600 write — tmp+fsync+rename+dir-fsync. The same shape the daemon and CLI always used,
+ * so a partial-write race between `skrr` and `skrrd` produces the same on-disk transitions.
+ */
+export declare function atomicWrite0600(target: string, value: Buffer | string, what: string): void;
+/** `fs.writeFileSync` for a state file: lock sentinels, a re-auth latch, a machine identity. */
+export declare function writeStateFile(target: string, data: string | NodeJS.ArrayBufferView, options: fs.WriteFileOptions, what: string): void;
+/** `fs.unlinkSync` for a state file. Throws what `unlinkSync` throws, ENOENT included. */
+export declare function removeStateFile(target: string, what: string): void;
+/** `fs.renameSync` between state paths; both ends are checked. */
+export declare function renameStateFile(from: string, to: string, what: string): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/stateFiles.js

@@ -0,0 +1,73 @@
+/**
+ * stateFiles.ts — the ONE place auth-core mutates credential state on disk.
+ *
+ * Every write, delete, rename and mkdir of a wrapped DEK, a device key, an enrollment marker, a
+ * lock sentinel, a re-auth latch or a machine identity goes through a function here, and each
+ * asks `assertMayMutateLiveState` first: a test process aimed at the account's real home is
+ * refused with a named error before a byte changes (`liveState.ts` says why that cannot be left
+ * to each runner).
+ *
+ * This is the "own a control surface, or do not touch it" rule applied to the real home. The
+ * atomic writer used to exist three times (device identity, credential envelope, profile
+ * consolidation), so a guard added to one left two doors open. `stateFileBoundary.spec.ts`
+ * fails when a file other than this one starts calling a raw `fs` mutator, so a fourth copy
+ * cannot appear unguarded.
+ *
+ * Outside a test process every function here is exactly the `fs` call it wraps.
+ */
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertMayMutateLiveState } from './liveState.js';
+/** `mkdir -p` for a state directory, 0700 unless `mode` says otherwise. */
+export function ensureStateDir(dir, what, mode = 0o700) {
+    assertMayMutateLiveState(dir, what);
+    fs.mkdirSync(dir, mode === null ? { recursive: true } : { recursive: true, mode });
+}
+/**
+ * Atomic 0600 write — tmp+fsync+rename+dir-fsync. The same shape the daemon and CLI always used,
+ * so a partial-write race between `skrr` and `skrrd` produces the same on-disk transitions.
+ */
+export function atomicWrite0600(target, value, what) {
+    assertMayMutateLiveState(target, what);
+    const dir = path.dirname(target);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+    const buf = typeof value === 'string' ? Buffer.from(value, 'utf-8') : value;
+    const fd = fs.openSync(tmp, 'w', 0o600);
+    try {
+        fs.writeSync(fd, buf);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, target);
+    try {
+        const dirFd = fs.openSync(dir, 'r');
+        try {
+            fs.fsyncSync(dirFd);
+        }
+        finally {
+            fs.closeSync(dirFd);
+        }
+    }
+    catch {
+        /* best-effort — Windows / some BSDs reject dir fsync */
+    }
+}
+/** `fs.writeFileSync` for a state file: lock sentinels, a re-auth latch, a machine identity. */
+export function writeStateFile(target, data, options, what) {
+    assertMayMutateLiveState(target, what);
+    fs.writeFileSync(target, data, options);
+}
+/** `fs.unlinkSync` for a state file. Throws what `unlinkSync` throws, ENOENT included. */
+export function removeStateFile(target, what) {
+    assertMayMutateLiveState(target, what);
+    fs.unlinkSync(target);
+}
+/** `fs.renameSync` between state paths; both ends are checked. */
+export function renameStateFile(from, to, what) {
+    assertMayMutateLiveState(from, what);
+    assertMayMutateLiveState(to, what);
+    fs.renameSync(from, to);
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/telemetryRedaction.d.ts

@@ -61,6 +61,9 @@ export declare const PREVIEW_TOKEN_REDACTION: "pvw_[redacted]";
 export declare const QR_SIGN_IN_REDACTION: "[redacted]";
 /** Fields are protocol-specific; preserve ordinary request ids, error codes and metrics. */
 export declare function isQrSignInSecretField(key: string): boolean;
+export declare function isOAuthQuerySecretField(key: string): boolean;
+export declare function isOAuthQueryContainerField(key: string): boolean;
+export declare function isGraphHandoffCookieField(key: string): boolean;
 /**
  * Replace every credential that travels in a URL with a marker: a Hosted Machine preview token with
  * {@link PREVIEW_TOKEN_REDACTION}, and a workspace invitation, platform invitation, member link or operator code with

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/telemetryRedaction.js

@@ -107,6 +107,21 @@ export function isQrSignInSecretField(key) {
     return QR_SECRET_FIELDS.has(leaf.replace(/[_-]/g, '').toLowerCase());
 }
 const QR_SECRET_ASSIGNMENT = /((?:["']?)(?:statusToken|claimToken|codeVerifier|codeChallenge|comparisonCode|status_token|claim_token|code_verifier|code_challenge|comparison_code)(?:["']?)\s*[:=]\s*["']?)([A-Za-z0-9._~%+-]+)/gi;
+// OAuth callback queries may be exported detached from their URL. Redact
+// sensitive parameter values even without path context, including when the
+// query separators were percent-encoded by an enclosing URL.
+const OAUTH_QUERY_SECRET = /(^|[?&]|%(?:25)*26)(code|state|error_description|handoff)(=|%(?:25)*3[dD])([^&#\s"'<>]*)/gi;
+export function isOAuthQuerySecretField(key) {
+    return ['code', 'state', 'error_description', 'handoff'].includes(key.toLowerCase());
+}
+export function isOAuthQueryContainerField(key) {
+    const leaf = (key.split('.').pop() || '').replace(/[_-]/g, '').toLowerCase();
+    return leaf === 'query' || leaf === 'querystring';
+}
+export function isGraphHandoffCookieField(key) {
+    return key.toLowerCase() === '__secure-pc-graph-handoff';
+}
+const GRAPH_HANDOFF_COOKIE = /((?:_|%(?:25)*5[fF]){2}secure(?:-|%(?:25)*2[dD])pc(?:-|%(?:25)*2[dD])graph(?:-|%(?:25)*2[dD])handoff(?:=|%(?:25)*3[dD]))([^;,&\s"'<>]+)/gi;
 function redactQrSignInText(value) {
     // Undici/Sentry may split url.query/query_string from its path. The QR's
     // direction vocabulary identifies that standalone query without treating an
@@ -124,7 +139,8 @@ const credentialMarker = (_match, prefix) => `${prefix}_[redacted]`;
 export function redactPreviewTokens(value) {
     if (typeof value !== 'string')
         return value;
-    const qrSafe = redactQrSignInText(value);
+    const qrSafe = redactQrSignInText(value).replace(OAUTH_QUERY_SECRET, '$1$2$3[redacted]')
+        .replace(GRAPH_HANDOFF_COOKIE, '$1[redacted]');
     if (!CREDENTIAL_HINTS.some((hint) => qrSafe.indexOf(hint) !== -1))
         return qrSafe;
     return qrSafe
@@ -153,7 +169,7 @@ export function redactPreviewTokensDeep(root, limits = {}) {
         let visited = 0;
         let complete = true;
         const rewrite = (holder, key, current) => {
-            const next = isQrSignInSecretField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
+            const next = isQrSignInSecretField(key) || isGraphHandoffCookieField(key) ? QR_SIGN_IN_REDACTION : redactPreviewTokens(current);
             if (next === current) {
                 return;
             }
@@ -195,7 +211,28 @@ export function redactPreviewTokensDeep(root, limits = {}) {
                     complete = false;
                     continue;
                 }
-                if (isQrSignInSecretField(key) || typeof child === 'string') {
+                if (isOAuthQueryContainerField(key) && Array.isArray(child)) {
+                    try {
+                        holder[key] = '[redacted]';
+                    }
+                    catch {
+                        complete = false;
+                    }
+                    if (holder[key] !== '[redacted]')
+                        complete = false;
+                    continue;
+                }
+                if (isOAuthQueryContainerField(key) && child && typeof child === 'object' && !Array.isArray(child)) {
+                    const query = child;
+                    for (const queryKey of Object.keys(query)) {
+                        if (isOAuthQuerySecretField(queryKey)) {
+                            query[queryKey] = '[redacted]';
+                            if (query[queryKey] !== '[redacted]')
+                                complete = false;
+                        }
+                    }
+                }
+                if (isQrSignInSecretField(key) || isGraphHandoffCookieField(key) || typeof child === 'string') {
                     rewrite(holder, key, child);
                 }
                 else if (child !== null && typeof child === 'object') {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/types.d.ts

@@ -67,6 +67,12 @@ export interface TokenPair {
  *                       (server code `DEVICE_PROOF_THUMBPRINT_MISMATCH`).
  *                       The daemon signs every retry with the same key, so
  *                       retrying can never succeed.
+ *   - DEVICE_KEY_UNAVAILABLE — the server demanded a device proof
+ *                       (`DEVICE_PROOF_MISSING`) and this process had none
+ *                       to send: the key is unreadable, never created, or no
+ *                       signer is wired. Unlike `DEVICE_KEY_MISMATCH` there is
+ *                       no second key to reconcile; the fix is an interactive
+ *                       daemon sign-in, which mints and re-pins a new one.
  *   - UNKNOWN_401     — server returned 401 with a code we don't
  *                       recognize. Treated as permanent (better to prompt
  *                       re-auth than to loop forever) but tagged
@@ -79,7 +85,7 @@ export interface TokenPair {
  * Without this, the client `describeAuthFailure` exhaustiveness check
  * was silently broken for the non-REFRESH branches.
  */
-export type PermanentAuthReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'TOKEN_INVALID' | 'TOKEN_EXPIRED' | 'UNKNOWN_401';
+export type PermanentAuthReason = 'REFRESH_INVALID' | 'REFRESH_REUSED' | 'REFRESH_EXPIRED' | 'SESSION_REVOKED' | 'DEVICE_KEY_MISMATCH' | 'DEVICE_KEY_UNAVAILABLE' | 'TOKEN_INVALID' | 'TOKEN_EXPIRED' | 'UNKNOWN_401';
 export declare class PermanentAuthFailure extends Error {
     readonly code: PermanentAuthReason;
     /**

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.32",
+  "version": "0.4.33",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {
@@ -294,6 +294,26 @@
         "default": "./dist/cjs/restartArtifact.js"
       }
     },
+    "./master-kek-service": {
+      "import": {
+        "types": "./dist/esm/kek/masterKekService.d.ts",
+        "default": "./dist/esm/kek/masterKekService.js"
+      },
+      "require": {
+        "types": "./dist/cjs/kek/masterKekService.d.ts",
+        "default": "./dist/cjs/kek/masterKekService.js"
+      }
+    },
+    "./live-state": {
+      "import": {
+        "types": "./dist/esm/liveState.d.ts",
+        "default": "./dist/esm/liveState.js"
+      },
+      "require": {
+        "types": "./dist/cjs/liveState.d.ts",
+        "default": "./dist/cjs/liveState.js"
+      }
+    },
     "./daemon-consent-proof": {
       "import": {
         "types": "./dist/esm/daemonConsentProof.d.ts",