@skrr-ai/cli 0.1.122 → 0.1.124

package/dist/lib/auth-core-init.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CliCredentialInitializationError = exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = exports.CREDENTIAL_KEY_CHANGED_NOTICE = void 0;
 exports.plainCredentialEnvelopeWarning = plainCredentialEnvelopeWarning;
+exports.deviceKeyRecoveryRequiredNotice = deviceKeyRecoveryRequiredNotice;
 exports.createCredentialEnvelopeWarningPresenter = createCredentialEnvelopeWarningPresenter;
 exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
 exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
@@ -38,10 +39,12 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
 const auth_core_1 = require("@skrr-ai/auth-core");
+const cli_handoff_wire_1 = require("@skrr-ai/auth-core/cli-handoff-wire");
 const cred_envelope_1 = require("./cred-envelope");
 const device_identity_1 = require("./device-identity");
 const auth_storage_1 = require("./auth-storage");
 const keychain_1 = require("./keychain");
+const daemon_command_hint_1 = require("./daemon-command-hint");
 function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'TRUE';
@@ -117,13 +120,33 @@ const DEVICE_KEY_DECRYPT_FAILED = '[deviceIdentity] private_key_decrypt_failed';
 const DEVICE_KEY_RECOVERY_REQUIRED = '[deviceIdentity] recovery_required';
 /**
  * The one line an unreadable device key prints when no credential-key change
- * explains it. The CLI never enrolls or requires a device key (OSK-12063), so
- * this degrades a proof, not access — say exactly that.
+ * explains it (OSK-20506).
+ *
+ * The CLI never enrolls or requires a device key (OSK-12063), so this degrades a
+ * proof, not a sign-in: say exactly that. What it must not do is point at
+ * `skrr login`. That signs this CLI in on its own and never creates or replaces a
+ * device key, so a person who followed it would be told the same thing on the next
+ * command. Only an interactive daemon sign-in mints a key and re-pins it, and which
+ * one depends on who runs the daemon, so this uses the sentence the hand-off
+ * refusals use for the same repair (`daemonSignInRemedy`) rather than a second
+ * spelling.
+ *
+ * `profile` names the command for a non-default profile: a bare `skrr daemon login`
+ * signs the default daemon in and leaves this one as it was (OSK-16435).
  */
-exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = "warning: this machine's stored device key could not be read, so skrr sends requests " +
-    'without a device proof until the local daemon signs in again. (DEBUG=1 shows the underlying error.)';
+function deviceKeyRecoveryRequiredNotice(profile = keychain_1.DEFAULT_PROFILE) {
+    const loginCommand = (0, daemon_command_hint_1.daemonCommandHint)('login', { profile });
+    return ("warning: this machine's stored device key could not be read, so skrr sends requests " +
+        `without a device proof. To replace it, ${(0, cli_handoff_wire_1.daemonSignInRemedy)({ repinsDeviceKey: true, loginCommand })}. ` +
+        '(DEBUG=1 shows the underlying error.)');
+}
+/** The notice for the default profile. */
+exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = deviceKeyRecoveryRequiredNotice(keychain_1.DEFAULT_PROFILE);
 function createCredentialEnvelopeWarningPresenter() {
     let keyChanged = false;
+    // auth-core named a failure as the DEVICE key's (see below): the person has one
+    // line to read for it, and it is not the credential line.
+    let deviceKeyUnreadable = false;
     return (args) => {
         const [message, metadata] = args;
         const event = typeof message === 'string' && message.startsWith('[credEnvelope] ')
@@ -157,10 +180,28 @@ function createCredentialEnvelopeWarningPresenter() {
             (message === DEVICE_KEY_DECRYPT_FAILED || message === DEVICE_KEY_RECOVERY_REQUIRED)) {
             return '';
         }
+        // No key change in THIS process, yet the device key will not open (the
+        // credential key changed in an earlier one, or the file is damaged).
+        // auth-core's device identity labels that read with its own hint, so the
+        // producer says WHAT failed and this decides what a person reads. The
+        // generic line would say "signing in again rebuilds it", and `skrr login`
+        // does not rebuild a device key. Print nothing for it, and nothing for the
+        // device identity's own echo of the same failure: `recovery_required`
+        // follows and carries the one line (OSK-20506). The flag is set by that
+        // hint alone, so another credential that will not open still gets its own
+        // line below.
+        if (event === 'cred_envelope.read.decrypt_failed' &&
+            meta.hint === auth_core_1.DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT) {
+            deviceKeyUnreadable = true;
+            return '';
+        }
+        if (deviceKeyUnreadable && message === DEVICE_KEY_DECRYPT_FAILED)
+            return '';
         // Without a key change an unreadable device key is a real fault: one
         // plain line instead of an object dump.
-        if (message === DEVICE_KEY_RECOVERY_REQUIRED)
-            return exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE;
+        if (message === DEVICE_KEY_RECOVERY_REQUIRED) {
+            return deviceKeyRecoveryRequiredNotice((0, keychain_1.getActiveProfile)());
+        }
         return plainCredentialEnvelopeWarning(args);
     };
 }

package/dist/lib/auth-failure.js

@@ -98,6 +98,18 @@ function describeRefreshRefusal(refusal, opts) {
                 `server treats that as possible theft and revokes the whole family. ${relogin}`,
         };
     }
+    // The server wanted a device proof and this machine had no key to sign one
+    // with. `skrr login` signs the CLI in on its own and never creates a device
+    // key, so naming it here sends the person round the same loop (OSK-20472): the
+    // daemon's interactive sign-in is what mints a key and re-pins the server to it.
+    if (code === 'DEVICE_KEY_UNAVAILABLE') {
+        return {
+            code,
+            message: `This sign-in could not be renewed${said}. This machine's device key is missing or ` +
+                `unreadable, so requests carry no device proof. \`${bin} login\` cannot create one; ` +
+                `sign the background service in again with \`${bin} daemon login\`.`,
+        };
+    }
     return {
         code,
         message: `This sign-in could not be renewed${said}. ${relogin}`,

package/dist/lib/command-hygiene.js

@@ -453,6 +453,35 @@ const AGENT_CRITICAL_COMMANDS = [
     'agent:message:send',
     'tasks:complete',
 ];
+/**
+ * The text of a command file, with a pure re-export alias read as its target.
+ *
+ * `export { default } from '../search/tasks';` is a second spelling of another
+ * command: oclif loads the same class, so the alias has the target's flags,
+ * description and args. Reading the alias's own few lines reports a missing
+ * `--json` and a missing description that the command in fact has, and the only
+ * way to silence that would be to copy the description into the alias, where
+ * the two spellings could drift apart.
+ *
+ * One hop, and only when the re-export is the whole module (comments aside), so
+ * a file that adds its own code is still audited as itself.
+ */
+function readCommandSource(file) {
+    const source = fs.readFileSync(file, 'utf8');
+    const code = source
+        .replace(/\/\*[\s\S]*?\*\//g, '')
+        .replace(/\/\/.*$/gm, '')
+        .trim();
+    const alias = code.match(/^export\s*\{\s*default\s*\}\s*from\s*['"](\.{1,2}\/[^'"]+)['"]\s*;?$/);
+    if (!alias)
+        return source;
+    const target = path.resolve(path.dirname(file), alias[1]);
+    for (const candidate of [`${target}.ts`, path.join(target, 'index.ts')]) {
+        if (fs.existsSync(candidate))
+            return fs.readFileSync(candidate, 'utf8');
+    }
+    return source;
+}
 function auditCommands({ rootDir, manifest, }) {
     const issues = [];
     const commands = manifest?.commands ?? {};
@@ -512,7 +541,7 @@ function auditCommands({ rootDir, manifest, }) {
         sourceCommandFiles = files.length;
         for (const file of files) {
             const rel = path.relative(sourceRoot, file);
-            const source = fs.readFileSync(file, 'utf8');
+            const source = readCommandSource(file);
             const command = commandIdFromRelativePath(rel);
             sourceCommandIds.add(command);
             const hasFromJson = /['"]from-json['"]/.test(source);

package/dist/lib/daemonBrokerRefusal.js

@@ -30,6 +30,10 @@ function isAnsweredBrokerRefusal(outcome) {
 /** Codes whose repair is signing the DAEMON in again (laptop only). */
 const DAEMON_RELOGIN_CODES = new Set([
     'DEVICE_PROOF_PIN_MISMATCH',
+    // The daemon's device key could not be read, so it sent no proof (OSK-20506). Only an
+    // interactive daemon login creates and pins a key; waiting never does, which is why
+    // the daemon's own mint hold treats it as credential-bound (`CREDENTIAL_BOUND_CODES`).
+    'DEVICE_PROOF_MISSING',
     'SESSION_REVOKED',
     'PRINCIPAL_UNRESOLVED',
     'DAEMON_NOT_AUTHED',
@@ -88,7 +92,7 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
                 `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id). ` +
                 guestReissueRemedy(bin, 'If it stays refused');
     }
-    else if (code === 'DEVICE_PROOF_PIN_MISMATCH') {
+    else if (code === 'DEVICE_PROOF_PIN_MISMATCH' || code === 'DEVICE_PROOF_MISSING') {
         remedy =
             `Run \`${(0, daemon_command_hint_1.daemonCommandHint)('login', { bin })}\` to sign the background service in again — an interactive daemon login re-pins its device key — then retry. ` +
                 `\`${bin} login\` signs this CLI in on its own instead.`;

package/dist/lib/exec-runtime-binary.d.ts

@@ -65,6 +65,15 @@ export declare function normalizeRuntimeGlobalArgs(args: readonly string[]): str
  * part of a copy sweep.
  */
 export declare function notInstalledMessage(): string;
+/**
+ * Marks the `skrrd` process that `skrr daemon …` launches, so the daemon can print its recovery
+ * commands in the spelling the person can run: `skrr daemon login`, not `skrrd login`. The
+ * daemon lives in `~/.skrr/bin`, which this wrapper finds by itself and nothing puts on PATH.
+ * Spelled the same in `daemon/src/auth/login-hint.ts`; `scripts/__tests__/invoked-via-parity.spec.js`
+ * holds the two together.
+ */
+export declare const INVOKED_VIA_ENV = "SKRR_INVOKED_VIA";
+export declare const INVOKED_VIA_CLI = "skrr-cli";
 /**
  * Spawn `oversky <args>` with stdio inherited. Resolves with the child's
  * exit code so the caller can `process.exit()` with the same code,

package/dist/lib/exec-runtime-binary.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.RUNTIME_BINARY_NAMES = void 0;
+exports.INVOKED_VIA_CLI = exports.INVOKED_VIA_ENV = exports.RUNTIME_BINARY_NAMES = void 0;
 exports.forwardedFlagsNote = forwardedFlagsNote;
 exports.findRuntimeBinary = findRuntimeBinary;
 exports.isCurrentRuntimeBinary = isCurrentRuntimeBinary;
@@ -206,6 +206,18 @@ function notInstalledMessage() {
         'Once installed, re-run your command.',
     ].join('\n');
 }
+/**
+ * Marks the `skrrd` process that `skrr daemon …` launches, so the daemon can print its recovery
+ * commands in the spelling the person can run: `skrr daemon login`, not `skrrd login`. The
+ * daemon lives in `~/.skrr/bin`, which this wrapper finds by itself and nothing puts on PATH.
+ * Spelled the same in `daemon/src/auth/login-hint.ts`; `scripts/__tests__/invoked-via-parity.spec.js`
+ * holds the two together.
+ */
+exports.INVOKED_VIA_ENV = 'SKRR_INVOKED_VIA';
+exports.INVOKED_VIA_CLI = 'skrr-cli';
+function runtimeEnv() {
+    return { ...process.env, [exports.INVOKED_VIA_ENV]: exports.INVOKED_VIA_CLI };
+}
 /**
  * Spawn `oversky <args>` with stdio inherited. Resolves with the child's
  * exit code so the caller can `process.exit()` with the same code,
@@ -230,6 +242,7 @@ function execRuntimeBinary(args, opts = {}) {
         const isWinShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(bin);
         const child = (0, node_child_process_1.spawn)(bin, normalizeRuntimeGlobalArgs(args), {
             stdio: 'inherit',
+            env: runtimeEnv(),
             ...(isWinShim ? { shell: true } : {}),
         });
         child.on('error', reject);
@@ -261,6 +274,7 @@ function execRuntimeBinaryCapture(args, opts = {}) {
         const isWinShim = process.platform === 'win32' && /\.(cmd|bat)$/i.test(bin);
         const child = (0, node_child_process_1.spawn)(bin, normalizeRuntimeGlobalArgs(args), {
             stdio: ['ignore', 'pipe', 'pipe'],
+            env: runtimeEnv(),
             ...(isWinShim ? { shell: true } : {}),
         });
         let stdout = '';

package/dist/lib/followups.d.ts

@@ -49,6 +49,8 @@ export interface FollowUpRow {
     kind?: string;
     form?: string | null;
     producer?: string;
+    /** The producer in words (`describeFollowUpProducer`), so no surface prints a bare enum. */
+    producerLabel?: string;
     why?: string;
     /** A reminder's own words. */
     content?: string | null;
@@ -86,7 +88,18 @@ export interface FollowUpCreateResponse {
     proposal?: boolean;
     budget?: Json;
     fallbackTriggerId?: string | null;
+    /**
+     * Set when the credential could not carry the producer the request claimed: the
+     * server recorded `recorded` instead (never a higher one) and says why.
+     */
+    producerDowngraded?: {
+        requested: string;
+        recorded: string;
+        note: string;
+    };
 }
+/** One line telling a person the follow-up was recorded with weaker provenance than claimed. */
+export declare function producerDowngradeNotice(response: FollowUpCreateResponse): string | undefined;
 export interface FollowUpObservability {
     generatedAt?: string;
     agents?: Array<{

package/dist/lib/followups.js

@@ -4,6 +4,7 @@ exports.followupsApi = exports.FOLLOWUP_SUBJECT_FLAG_HELP = exports.FOLLOWUP_SUB
 exports.whenFlagProblem = whenFlagProblem;
 exports.settledLine = settledLine;
 exports.recipeWatchBoundsRefusal = recipeWatchBoundsRefusal;
+exports.producerDowngradeNotice = producerDowngradeNotice;
 exports.resolveFollowUpAgent = resolveFollowUpAgent;
 exports.parseSubjectRef = parseSubjectRef;
 exports.followupSummaryLine = followupSummaryLine;
@@ -127,6 +128,13 @@ function recipeWatchBoundsRefusal(waitKind, passed) {
             : 'A recipe watch ends through its --wait.',
     ].join(' ');
 }
+/** One line telling a person the follow-up was recorded with weaker provenance than claimed. */
+function producerDowngradeNotice(response) {
+    const downgraded = response.producerDowngraded;
+    if (!downgraded)
+        return undefined;
+    return `Note: recorded as ${downgraded.recorded}, not ${downgraded.requested}. ${downgraded.note}`;
+}
 /**
  * A trigger subject becomes a durable concurrency key, so it cannot be prose.
  * Keep this grammar aligned with TriggerEngine's subject validation and the

package/dist/lib/keychain.js

@@ -609,7 +609,9 @@ function deleteRefreshToken() {
  * prints service names and does not prompt for or reveal any secret.
  *
  * Filtered to `LEGACY_NATIVE_ID_PREFIXES` followed by a dot, so a third-party
- * item that merely starts with the same letters is never in scope.
+ * item that merely starts with the same letters is never in scope. That is the
+ * SCOPE of the sweep and nothing more: which of these services it deletes is
+ * decided by `isRetiredBrandSweepTarget`, by name.
  */
 function discoverLegacyBrandServices() {
     let dump;
@@ -639,6 +641,12 @@ function discoverLegacyBrandServices() {
  * because a delete that never reports "not found" would otherwise spin.
  */
 function deleteEntireService(service) {
+    // The sweep can name key material (`--all-devices` selects the retired KEKs), so it is the one
+    // CLI mutator behind the guard. The CLI's own login slots are not: `ai.skrr.cli.<profile>`
+    // carries no hash of the home, so a sandbox and the account give the SAME name and the guard
+    // could not tell a faked `security` from the real one. A test's protection there is its
+    // sandbox home, under which macOS finds no default keychain to write to.
+    (0, auth_core_1.assertMayMutateLiveKeychain)(service, `delete every Keychain item in ${service}`);
     let removedAny = false;
     for (let i = 0; i < 32; i += 1) {
         try {
@@ -680,9 +688,38 @@ function deleteEntireService(service) {
 function deleteLegacyBrandEntries(options = {}) {
     if (!isAvailable())
         return [];
-    return discoverLegacyBrandServices()
-        .filter((service) => options.includeMachineCredentials === true || /^(?:ai|com)\.oversky\.cli\./.test(service))
-        .filter((service) => deleteEntireService(service));
+    const includeMachineCredentials = options.includeMachineCredentials === true;
+    const inScope = discoverLegacyBrandServices();
+    const targets = inScope.filter((service) => isRetiredBrandSweepTarget(service, includeMachineCredentials));
+    if (process.env.DEBUG) {
+        for (const service of inScope) {
+            if (!targets.includes(service)) {
+                console.error(`[cli/keychain] legacy sweep left unclassified service ${service}`);
+            }
+        }
+    }
+    return targets.filter((service) => deleteEntireService(service));
+}
+/**
+ * A CLI slot the previous brand wrote: `<previous prefix>.cli.<profile>`, under either of the
+ * two previous prefixes. Positive on the whole name, so the bare `.cli` word alone, or a
+ * service that merely begins with these words, is not one.
+ */
+const RETIRED_CLI_SERVICE_PATTERN = new RegExp(`^(?:${auth_core_1.LEGACY_NATIVE_ID_PREFIXES.map((prefix) => prefix.replace(/\./g, '\\.')).join('|')})` +
+    '\\.cli\\.[A-Za-z0-9][A-Za-z0-9._-]*$');
+/**
+ * Whether the legacy sweep deletes this previous-brand service. Named, not matched by prefix:
+ * a retired CLI slot always; and, only for `--all-devices` (`includeMachineCredentials`), the
+ * daemon services the shared grammar in `@skrr-ai/auth-core` classifies (sessions, the person's
+ * own provider keys, and the retired KEKs, which the stolen-laptop case is for). A previous-brand
+ * service nobody classified is left in place. The current brand is out of scope entirely.
+ */
+function isRetiredBrandSweepTarget(service, includeMachineCredentials) {
+    if (!auth_core_1.LEGACY_NATIVE_ID_PREFIXES.some((prefix) => service.startsWith(`${prefix}.`)))
+        return false;
+    if (RETIRED_CLI_SERVICE_PATTERN.test(service))
+        return true;
+    return includeMachineCredentials && (0, auth_core_1.classifyDaemonKeychainService)(service) !== 'unclassified';
 }
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.

package/dist/lib/profile-machine-identity-guard.js

@@ -5,6 +5,7 @@ exports.describeLegacySharedProfile = describeLegacySharedProfile;
 const machine_uuid_1 = require("@skrr-ai/auth-core/machine-uuid");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const keychain_1 = require("./keychain");
+const daemon_command_hint_1 = require("./daemon-command-hint");
 /** An old profile may still share the default machine row and its device pin. */
 function legacyProfileSharesDefaultMachine() {
     const profile = (0, keychain_1.getActiveProfile)();
@@ -47,6 +48,6 @@ function describeLegacySharedProfile(profile) {
             `computer the same machine identity, and it still has it. ${why}Signing in here would replace the default ` +
             "profile's device-key pin and sign the default daemon out. Nothing was changed.",
         `Use a new profile name instead: skrr login --profile ${next}`,
-        `(For the background service alone: skrrd --profile ${next} login)`,
+        `(For the background service alone: ${(0, daemon_command_hint_1.daemonCommandHint)('login', { profile: next })})`,
     ];
 }

package/dist/lib/runtime-start-verification.js

@@ -49,7 +49,12 @@ function parseRuntimeStartStatus(value, fallbackProfile) {
     return {
         profile: asString(profile?.name) ?? fallbackProfile,
         serverUrl: asString(root.serverUrl),
-        cwd: asString(root.cwd),
+        // `root.cwd` is where THIS `status` ran from (the person's shell), not where
+        // the daemon runs. The recovery command binds a login to its `--cwd`, and
+        // `skrrd status` itself prints `effectiveCwd` (live daemon, then installed
+        // service, then the stored binding) for exactly that. A runtime binary that
+        // predates `effectiveCwd` only has `cwd`.
+        cwd: asString(root.effectiveCwd) ?? asString(root.cwd),
         reauth: {
             needed: reauth?.needed === true,
             reason: asString(reauth?.reason),

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.d.ts

@@ -161,7 +161,11 @@ export type DaemonSupervisor = 'desktop' | 'service';
 export declare function daemonSignInRemedy(opts?: {
     /** How the daemon is run; absent when the caller cannot tell. */
     supervisor?: DaemonSupervisor;
-    /** The exact `skrrd … login` for this profile, when the daemon knows it. */
+    /**
+     * The exact login command for this profile (`skrrd … login`, or
+     * `skrr daemon login --profile …`), when the caller knows it. Used when the
+     * supervisor is `service` or unknown; a desktop-hosted daemon is never told one.
+     */
     loginCommand?: string;
     /** The refusal was DEVICE_PROOF_PIN_MISMATCH: say that a sign-in re-pins. */
     repinsDeviceKey?: boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.js

@@ -132,7 +132,7 @@ function daemonSignInRemedy(opts = {}) {
     const login = opts.loginCommand ? `\`${opts.loginCommand}\`` : "`skrr daemon login`";
     return `run ${login}${repin ? " \u2014 an interactive login re-pins the device key" : ""}`;
   }
-  return "sign the daemon in again on the machine running it: if the Skrr desktop app runs it, quit and reopen the app; otherwise run `skrr daemon login`" + (repin ? " (either one re-pins the device key)" : "");
+  return `sign the daemon in again on the machine running it: if the Skrr desktop app runs it, quit and reopen the app; otherwise run \`${opts.loginCommand ?? "skrr daemon login"}\`` + (repin ? " (either one re-pins the device key)" : "");
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -55,8 +55,10 @@ var import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
 var import_credentialEnvelope = require("./credentialEnvelope.js");
 var import_kek = require("./kek/index.js");
 var import_profileStateDir = require("./profileStateDir.js");
+var import_liveState = require("./liveState.js");
 var import_refresh = require("./refresh.js");
 var import_runtime = require("./runtime.js");
+var import_stateFiles = require("./stateFiles.js");
 const ACCOUNT_CRED_DEK_WRAPPED = "cred-dek-wrapped";
 let _state = { kind: "uninit" };
 let _kekRotationDetected = false;
@@ -71,28 +73,6 @@ function __getStateForTest() {
 function wrappedDekFilePath(profile) {
   return (0, import_profileStateDir.resolveProfileStateFile)(profile, ACCOUNT_CRED_DEK_WRAPPED).path;
 }
-function atomicWrite0600(target, value) {
-  const dir = import_node_path.default.dirname(target);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-  const fd = import_node_fs.default.openSync(tmp, "w", 384);
-  try {
-    import_node_fs.default.writeSync(fd, value);
-    import_node_fs.default.fsyncSync(fd);
-  } finally {
-    import_node_fs.default.closeSync(fd);
-  }
-  import_node_fs.default.renameSync(tmp, target);
-  try {
-    const dirFd = import_node_fs.default.openSync(dir, "r");
-    try {
-      import_node_fs.default.fsyncSync(dirFd);
-    } finally {
-      import_node_fs.default.closeSync(dirFd);
-    }
-  } catch {
-  }
-}
 const warnedSignatures = /* @__PURE__ */ new Set();
 const MAX_WARNED_SIGNATURES = 64;
 function __clearWarnDedupeForTest() {
@@ -124,9 +104,9 @@ function credEnvelopeLockPath(profile) {
 async function withCredEnvelopeLock(profile, body) {
   const lockPath = credEnvelopeLockPath(profile);
   const dir = import_node_path.default.dirname(lockPath);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  (0, import_stateFiles.ensureStateDir)(dir, `take the credential envelope lock for profile ${profile}`);
   if (!import_node_fs.default.existsSync(lockPath)) {
-    import_node_fs.default.writeFileSync(lockPath, "", { mode: 384 });
+    (0, import_stateFiles.writeStateFile)(lockPath, "", { mode: 384 }, "create the credential envelope lock");
   }
   const acquireStart = Date.now();
   const release = await import_proper_lockfile.default.lock(lockPath, {
@@ -202,6 +182,7 @@ async function consolidateWrappedDek(profile, kek, aad) {
       onEvent: (name, success, meta) => emit(`cred_envelope.${name}`, success, meta)
     }));
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     emit("cred_envelope.path_consolidation.failed", false, {
       profile,
       message: err?.message ?? "unknown"
@@ -242,6 +223,8 @@ async function loadRetiredDeks(profile, kek, aad, active) {
         dek.fill(0);
       }
     } catch {
+      if (import_node_path.default.basename(target).startsWith(UNREADABLE_DEK_COPY_PREFIX))
+        continue;
       emit("cred_envelope.retired_dek.unreadable", false, {
         profile,
         file: import_node_path.default.basename(target)
@@ -249,6 +232,41 @@ async function loadRetiredDeks(profile, kek, aad, active) {
     }
   }
 }
+const UNREADABLE_DEK_COPY_PREFIX = `${ACCOUNT_CRED_DEK_WRAPPED}${import_profileStateDir.RETIRED_COPY_SUFFIX}.unreadable-`;
+const MAX_UNREADABLE_DEK_COPIES = 8;
+function isKekUnavailableError(err) {
+  return err instanceof import_kek.KekUnavailableError || err?.name === "KekUnavailableError";
+}
+function keepUnreadableWrappedDek(profile, wrapped) {
+  try {
+    const dir = (0, import_profileStateDir.profileStateDir)(profile);
+    const existing = import_node_fs.default.existsSync(dir) ? import_node_fs.default.readdirSync(dir).filter((entry) => entry.startsWith(UNREADABLE_DEK_COPY_PREFIX)).sort() : [];
+    for (const entry of existing) {
+      try {
+        if (import_node_fs.default.readFileSync(import_node_path.default.join(dir, entry)).equals(wrapped))
+          return entry;
+      } catch {
+      }
+    }
+    const name = `${UNREADABLE_DEK_COPY_PREFIX}${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
+    (0, import_stateFiles.atomicWrite0600)(import_node_path.default.join(dir, name), wrapped, "keep the unreadable wrapped DEK");
+    const kept = [...existing, name].sort();
+    for (const stale of kept.slice(0, Math.max(0, kept.length - MAX_UNREADABLE_DEK_COPIES))) {
+      try {
+        (0, import_stateFiles.removeStateFile)(import_node_path.default.join(dir, stale), "prune a kept wrapped DEK");
+      } catch {
+      }
+    }
+    return name;
+  } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
+    emit("cred_envelope.unreadable_dek_copy_failed", false, {
+      profile,
+      message: err?.message ?? "unknown"
+    });
+    return null;
+  }
+}
 function retiredDekFiles(profile) {
   const dir = (0, import_profileStateDir.profileStateDir)(profile);
   const prefix = `${ACCOUNT_CRED_DEK_WRAPPED}${import_profileStateDir.RETIRED_COPY_SUFFIX}.`;
@@ -359,6 +377,7 @@ async function initNewIndependentCredEnvelope(profile) {
   const dek = (0, import_credentialEnvelope.generateDek)();
   let temp;
   try {
+    (0, import_liveState.assertMayMutateLiveState)(dir, `enroll the wrapped DEK for background profile ${profile}`);
     const wrapped = await kek.wrap(dek, (0, import_credentialEnvelope.buildCredentialAad)(profile));
     if (paths.some(present))
       return await initExistingCredEnvelope(profile);
@@ -466,6 +485,8 @@ async function initCredEnvelope(profile) {
   }
   let dek = null;
   let unwrapAttemptedAndFailed = false;
+  let kekUnreadable = null;
+  let unreadableWrapped = null;
   await withCredEnvelopeLock(profile, async () => {
     let wrappedBytes = null;
     try {
@@ -489,6 +510,7 @@ async function initCredEnvelope(profile) {
             kekKind: captureKind()
           });
           unwrapAttemptedAndFailed = true;
+          unreadableWrapped = wrappedBytes;
         } else {
           dek = candidate;
         }
@@ -499,15 +521,33 @@ async function initCredEnvelope(profile) {
           kekKind: captureKind(),
           message: err?.message ?? "unknown"
         });
-        unwrapAttemptedAndFailed = true;
+        if (isKekUnavailableError(err)) {
+          kekUnreadable = err;
+        } else {
+          unwrapAttemptedAndFailed = true;
+          unreadableWrapped = wrappedBytes;
+        }
       }
     }
+    if (kekUnreadable !== null) {
+      _state = { kind: "disabled", reason: "kek_unavailable" };
+      emit("cred_envelope.kek_unavailable", false, {
+        kekId: kek.id,
+        profile,
+        phase: "unwrap",
+        describe: kek.describe(),
+        message: kekUnreadable?.message ?? "unknown"
+      });
+      return;
+    }
     if (unwrapAttemptedAndFailed && dek === null) {
       _kekRotationDetected = true;
+      const keptAs = unreadableWrapped ? keepUnreadableWrappedDek(profile, unreadableWrapped) : null;
       emit("cred_envelope.kek_rotated", false, {
         kekId: kek.id,
         kekKind: captureKind(),
         profile,
+        ...keptAs ? { previousWrappedDekKeptAs: keptAs } : {},
         message: "wrapped DEK present but unwrap failed under available KEK; treating as rotation and re-enrolling"
       });
     }
@@ -515,7 +555,7 @@ async function initCredEnvelope(profile) {
       try {
         dek = (0, import_credentialEnvelope.generateDek)();
         const wrapped = await kek.wrap(dek, aad);
-        atomicWrite0600(targetPath, wrapped);
+        (0, import_stateFiles.atomicWrite0600)(targetPath, wrapped, `write the wrapped DEK for profile ${profile}`);
         emit("cred_envelope.dek_enrolled", true, {
           kekId: kek.id,
           kekKind: captureKind(),
@@ -523,6 +563,7 @@ async function initCredEnvelope(profile) {
           ...unwrapAttemptedAndFailed ? { reEnrolledAfterRotation: true } : {}
         });
       } catch (err) {
+        (0, import_liveState.rethrowIfLiveStateRefusal)(err);
         _state = { kind: "disabled", reason: "init_failed" };
         emit("cred_envelope.init_failed", false, {
           reason: "enrollment_failed",
@@ -556,8 +597,9 @@ async function resetCredEnvelope(opts) {
       ...retiredDekFiles(opts.profile)
     ]) {
       try {
-        import_node_fs.default.unlinkSync(target);
+        (0, import_stateFiles.removeStateFile)(target, `delete the wrapped DEK file ${import_node_path.default.basename(target)}`);
       } catch (err) {
+        (0, import_liveState.rethrowIfLiveStateRefusal)(err);
         if (err.code !== "ENOENT") {
           emit("cred_envelope.clear_failed", false, {
             profile: opts.profile,