@skrr-ai/cli 0.1.123 → 0.1.124

package/dist/commands/agents/delete.d.ts

@@ -8,6 +8,14 @@ import { BaseCommand } from '../../base-command';
 export declare function agentRemovalQuestion(agentId: string, kind: AgentRemovalKind | null): string;
 /** What happened, read from the server's response rather than predicted. */
 export declare function agentRemovalReport(agentId: string, response: DeleteAgentResponse | undefined): string;
+/**
+ * What became of the agent's Personal Context data, read from the same response
+ * (OSK-20112). The agent row is gone as soon as the delete returns, but data
+ * derived from its connected sources is erased separately: `Deleted agent` must
+ * never stand in for "erased". Nothing is printed when the server reported
+ * nothing (an older server, or an uninstall, which erases nothing).
+ */
+export declare function agentErasureReport(response: DeleteAgentResponse | undefined): string[];
 export default class AgentsDelete extends BaseCommand {
     static description: string;
     static examples: string[];

package/dist/commands/agents/delete.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.agentRemovalQuestion = agentRemovalQuestion;
 exports.agentRemovalReport = agentRemovalReport;
+exports.agentErasureReport = agentErasureReport;
 const core_1 = require("@oclif/core");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const base_command_1 = require("../../base-command");
@@ -38,6 +39,19 @@ function agentRemovalReport(agentId, response) {
             return `Deleted agent ${agentId}`;
     }
 }
+/**
+ * What became of the agent's Personal Context data, read from the same response
+ * (OSK-20112). The agent row is gone as soon as the delete returns, but data
+ * derived from its connected sources is erased separately: `Deleted agent` must
+ * never stand in for "erased". Nothing is printed when the server reported
+ * nothing (an older server, or an uninstall, which erases nothing).
+ */
+function agentErasureReport(response) {
+    if ((0, data_provider_1.agentRemovalKind)(response) !== 'deleted')
+        return [];
+    const erasure = response && 'erasure' in response ? response.erasure : undefined;
+    return (0, data_provider_1.describePersonalContextErasure)(erasure)?.lines ?? [];
+}
 class AgentsDelete extends base_command_1.BaseCommand {
     static description = 'Delete an agent you created (irreversible), or uninstall one installed from the store (reinstalling restores it)';
     static examples = [
@@ -89,6 +103,8 @@ class AgentsDelete extends base_command_1.BaseCommand {
             this.handleApiError(err);
         }
         this.log(agentRemovalReport(args.id, response));
+        for (const line of agentErasureReport(response))
+            this.log(line);
     }
 }
 exports.default = AgentsDelete;

package/dist/commands/context.js

@@ -64,6 +64,13 @@ class Context extends base_command_1.BaseCommand {
                 path: (0, config_1.getConfigPath)(),
                 cliId: (0, cli_id_1.resolveCliId)(this.cliConfig) ?? null,
             },
+            // Silent about the DAEMON's device key on purpose (OSK-20507). This is the CLI's
+            // own sign-in, and the CLI never requires a device key (OSK-12063), so an
+            // unreadable one changes nothing an agent reading this can do. The daemon's
+            // account of its key is `skrr daemon status` (`problems`, from `/health`
+            // `deviceIdentity`), and the one line a `skrr` process prints about it is the
+            // notice in `lib/auth-core-init.ts`. Adding it here would put a machine fact
+            // beside a per-process one and read as this credential's state.
             auth: {
                 signedIn: Boolean(this.resolvedCredential?.token),
                 tokenSource: this.credentialSourceLabel(),

package/dist/commands/search/workspace.js

@@ -104,7 +104,7 @@ class SearchWorkspace extends base_command_1.BaseCommand {
             url: `${(0, web_url_1.webOrigin)(this.cliConfig.baseURL)}${item.href}`,
         }));
         if (flags.json) {
-            this.log(JSON.stringify({ ...response, results }, null, 2));
+            this.printJsonResult({ ...response, results });
             return;
         }
         for (const diagnostic of new Set(response.diagnostics || []))

package/dist/commands/store/gallery-admissions/approve.js

@@ -24,7 +24,7 @@ class StoreGalleryAdmissionsApprove extends base_command_1.BaseCommand {
                 revision: flags.revision, digest: flags.digest, imagesReviewed: true, ...(flags.note ? { note: flags.note } : {}),
             });
             if (flags.json)
-                this.log(JSON.stringify(result, null, 2));
+                this.printJsonResult(result);
             else
                 this.log(`Approved gallery revision ${flags.revision}.`);
         }

package/dist/commands/store/gallery-admissions/preview.js

@@ -36,7 +36,7 @@ class StoreGalleryAdmissionsPreview extends base_command_1.BaseCommand {
             await (0, promises_1.writeFile)(flags.output, bytes, { flag: 'wx', mode: 0o600 });
             const receipt = { requestId: args.id, kind, revision: review.revision, digest: review.digest, imageId: args.imageId, sha256: digest, path: flags.output, bytes: bytes.length };
             if (flags.json)
-                this.log(JSON.stringify(receipt));
+                this.printJsonResult(receipt);
             else
                 this.log(`Wrote ${bytes.length} bytes to ${flags.output} (sha256:${digest}). Review revision ${review.revision}, digest ${review.digest}.`);
         }

package/dist/commands/store/gallery-admissions/refuse.js

@@ -23,7 +23,7 @@ class StoreGalleryAdmissionsRefuse extends base_command_1.BaseCommand {
                 revision: flags.revision, digest: flags.digest, note: flags.note.trim(),
             });
             if (flags.json)
-                this.log(JSON.stringify(result, null, 2));
+                this.printJsonResult(result);
             else
                 this.log(`Refused gallery revision ${flags.revision}.`);
         }

package/dist/commands/store/gallery-admissions/show.js

@@ -16,7 +16,7 @@ class StoreGalleryAdmissionsShow extends base_command_1.BaseCommand {
         try {
             const result = await data_provider_1.dataService.getStoreGalleryAdmission(flags.kind, args.id);
             if (flags.json) {
-                this.log(JSON.stringify(result, null, 2));
+                this.printJsonResult(result);
                 return;
             }
             const r = result.review;

package/dist/lib/auth-core-init.d.ts

@@ -38,9 +38,22 @@ export declare function plainCredentialEnvelopeWarning(args: readonly unknown[])
 export declare const CREDENTIAL_KEY_CHANGED_NOTICE: string;
 /**
  * The one line an unreadable device key prints when no credential-key change
- * explains it. The CLI never enrolls or requires a device key (OSK-12063), so
- * this degrades a proof, not access — say exactly that.
+ * explains it (OSK-20506).
+ *
+ * The CLI never enrolls or requires a device key (OSK-12063), so this degrades a
+ * proof, not a sign-in: say exactly that. What it must not do is point at
+ * `skrr login`. That signs this CLI in on its own and never creates or replaces a
+ * device key, so a person who followed it would be told the same thing on the next
+ * command. Only an interactive daemon sign-in mints a key and re-pins it, and which
+ * one depends on who runs the daemon, so this uses the sentence the hand-off
+ * refusals use for the same repair (`daemonSignInRemedy`) rather than a second
+ * spelling.
+ *
+ * `profile` names the command for a non-default profile: a bare `skrr daemon login`
+ * signs the default daemon in and leaves this one as it was (OSK-16435).
  */
+export declare function deviceKeyRecoveryRequiredNotice(profile?: string): string;
+/** The notice for the default profile. */
 export declare const DEVICE_KEY_RECOVERY_REQUIRED_NOTICE: string;
 export declare function createCredentialEnvelopeWarningPresenter(): (args: readonly unknown[]) => string | null;
 type DedicatedGenerationPreparationOptions = {

package/dist/lib/auth-core-init.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CliCredentialInitializationError = exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = exports.CREDENTIAL_KEY_CHANGED_NOTICE = void 0;
 exports.plainCredentialEnvelopeWarning = plainCredentialEnvelopeWarning;
+exports.deviceKeyRecoveryRequiredNotice = deviceKeyRecoveryRequiredNotice;
 exports.createCredentialEnvelopeWarningPresenter = createCredentialEnvelopeWarningPresenter;
 exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
 exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
@@ -38,10 +39,12 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
 const auth_core_1 = require("@skrr-ai/auth-core");
+const cli_handoff_wire_1 = require("@skrr-ai/auth-core/cli-handoff-wire");
 const cred_envelope_1 = require("./cred-envelope");
 const device_identity_1 = require("./device-identity");
 const auth_storage_1 = require("./auth-storage");
 const keychain_1 = require("./keychain");
+const daemon_command_hint_1 = require("./daemon-command-hint");
 function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'TRUE';
@@ -117,13 +120,33 @@ const DEVICE_KEY_DECRYPT_FAILED = '[deviceIdentity] private_key_decrypt_failed';
 const DEVICE_KEY_RECOVERY_REQUIRED = '[deviceIdentity] recovery_required';
 /**
  * The one line an unreadable device key prints when no credential-key change
- * explains it. The CLI never enrolls or requires a device key (OSK-12063), so
- * this degrades a proof, not access — say exactly that.
+ * explains it (OSK-20506).
+ *
+ * The CLI never enrolls or requires a device key (OSK-12063), so this degrades a
+ * proof, not a sign-in: say exactly that. What it must not do is point at
+ * `skrr login`. That signs this CLI in on its own and never creates or replaces a
+ * device key, so a person who followed it would be told the same thing on the next
+ * command. Only an interactive daemon sign-in mints a key and re-pins it, and which
+ * one depends on who runs the daemon, so this uses the sentence the hand-off
+ * refusals use for the same repair (`daemonSignInRemedy`) rather than a second
+ * spelling.
+ *
+ * `profile` names the command for a non-default profile: a bare `skrr daemon login`
+ * signs the default daemon in and leaves this one as it was (OSK-16435).
  */
-exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = "warning: this machine's stored device key could not be read, so skrr sends requests " +
-    'without a device proof until the local daemon signs in again. (DEBUG=1 shows the underlying error.)';
+function deviceKeyRecoveryRequiredNotice(profile = keychain_1.DEFAULT_PROFILE) {
+    const loginCommand = (0, daemon_command_hint_1.daemonCommandHint)('login', { profile });
+    return ("warning: this machine's stored device key could not be read, so skrr sends requests " +
+        `without a device proof. To replace it, ${(0, cli_handoff_wire_1.daemonSignInRemedy)({ repinsDeviceKey: true, loginCommand })}. ` +
+        '(DEBUG=1 shows the underlying error.)');
+}
+/** The notice for the default profile. */
+exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE = deviceKeyRecoveryRequiredNotice(keychain_1.DEFAULT_PROFILE);
 function createCredentialEnvelopeWarningPresenter() {
     let keyChanged = false;
+    // auth-core named a failure as the DEVICE key's (see below): the person has one
+    // line to read for it, and it is not the credential line.
+    let deviceKeyUnreadable = false;
     return (args) => {
         const [message, metadata] = args;
         const event = typeof message === 'string' && message.startsWith('[credEnvelope] ')
@@ -157,10 +180,28 @@ function createCredentialEnvelopeWarningPresenter() {
             (message === DEVICE_KEY_DECRYPT_FAILED || message === DEVICE_KEY_RECOVERY_REQUIRED)) {
             return '';
         }
+        // No key change in THIS process, yet the device key will not open (the
+        // credential key changed in an earlier one, or the file is damaged).
+        // auth-core's device identity labels that read with its own hint, so the
+        // producer says WHAT failed and this decides what a person reads. The
+        // generic line would say "signing in again rebuilds it", and `skrr login`
+        // does not rebuild a device key. Print nothing for it, and nothing for the
+        // device identity's own echo of the same failure: `recovery_required`
+        // follows and carries the one line (OSK-20506). The flag is set by that
+        // hint alone, so another credential that will not open still gets its own
+        // line below.
+        if (event === 'cred_envelope.read.decrypt_failed' &&
+            meta.hint === auth_core_1.DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT) {
+            deviceKeyUnreadable = true;
+            return '';
+        }
+        if (deviceKeyUnreadable && message === DEVICE_KEY_DECRYPT_FAILED)
+            return '';
         // Without a key change an unreadable device key is a real fault: one
         // plain line instead of an object dump.
-        if (message === DEVICE_KEY_RECOVERY_REQUIRED)
-            return exports.DEVICE_KEY_RECOVERY_REQUIRED_NOTICE;
+        if (message === DEVICE_KEY_RECOVERY_REQUIRED) {
+            return deviceKeyRecoveryRequiredNotice((0, keychain_1.getActiveProfile)());
+        }
         return plainCredentialEnvelopeWarning(args);
     };
 }

package/dist/lib/command-hygiene.js

@@ -453,6 +453,35 @@ const AGENT_CRITICAL_COMMANDS = [
     'agent:message:send',
     'tasks:complete',
 ];
+/**
+ * The text of a command file, with a pure re-export alias read as its target.
+ *
+ * `export { default } from '../search/tasks';` is a second spelling of another
+ * command: oclif loads the same class, so the alias has the target's flags,
+ * description and args. Reading the alias's own few lines reports a missing
+ * `--json` and a missing description that the command in fact has, and the only
+ * way to silence that would be to copy the description into the alias, where
+ * the two spellings could drift apart.
+ *
+ * One hop, and only when the re-export is the whole module (comments aside), so
+ * a file that adds its own code is still audited as itself.
+ */
+function readCommandSource(file) {
+    const source = fs.readFileSync(file, 'utf8');
+    const code = source
+        .replace(/\/\*[\s\S]*?\*\//g, '')
+        .replace(/\/\/.*$/gm, '')
+        .trim();
+    const alias = code.match(/^export\s*\{\s*default\s*\}\s*from\s*['"](\.{1,2}\/[^'"]+)['"]\s*;?$/);
+    if (!alias)
+        return source;
+    const target = path.resolve(path.dirname(file), alias[1]);
+    for (const candidate of [`${target}.ts`, path.join(target, 'index.ts')]) {
+        if (fs.existsSync(candidate))
+            return fs.readFileSync(candidate, 'utf8');
+    }
+    return source;
+}
 function auditCommands({ rootDir, manifest, }) {
     const issues = [];
     const commands = manifest?.commands ?? {};
@@ -512,7 +541,7 @@ function auditCommands({ rootDir, manifest, }) {
         sourceCommandFiles = files.length;
         for (const file of files) {
             const rel = path.relative(sourceRoot, file);
-            const source = fs.readFileSync(file, 'utf8');
+            const source = readCommandSource(file);
             const command = commandIdFromRelativePath(rel);
             sourceCommandIds.add(command);
             const hasFromJson = /['"]from-json['"]/.test(source);

package/dist/lib/daemonBrokerRefusal.js

@@ -30,6 +30,10 @@ function isAnsweredBrokerRefusal(outcome) {
 /** Codes whose repair is signing the DAEMON in again (laptop only). */
 const DAEMON_RELOGIN_CODES = new Set([
     'DEVICE_PROOF_PIN_MISMATCH',
+    // The daemon's device key could not be read, so it sent no proof (OSK-20506). Only an
+    // interactive daemon login creates and pins a key; waiting never does, which is why
+    // the daemon's own mint hold treats it as credential-bound (`CREDENTIAL_BOUND_CODES`).
+    'DEVICE_PROOF_MISSING',
     'SESSION_REVOKED',
     'PRINCIPAL_UNRESOLVED',
     'DAEMON_NOT_AUTHED',
@@ -88,7 +92,7 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
                 `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id). ` +
                 guestReissueRemedy(bin, 'If it stays refused');
     }
-    else if (code === 'DEVICE_PROOF_PIN_MISMATCH') {
+    else if (code === 'DEVICE_PROOF_PIN_MISMATCH' || code === 'DEVICE_PROOF_MISSING') {
         remedy =
             `Run \`${(0, daemon_command_hint_1.daemonCommandHint)('login', { bin })}\` to sign the background service in again — an interactive daemon login re-pins its device key — then retry. ` +
                 `\`${bin} login\` signs this CLI in on its own instead.`;

package/dist/lib/keychain.js

@@ -609,7 +609,9 @@ function deleteRefreshToken() {
  * prints service names and does not prompt for or reveal any secret.
  *
  * Filtered to `LEGACY_NATIVE_ID_PREFIXES` followed by a dot, so a third-party
- * item that merely starts with the same letters is never in scope.
+ * item that merely starts with the same letters is never in scope. That is the
+ * SCOPE of the sweep and nothing more: which of these services it deletes is
+ * decided by `isRetiredBrandSweepTarget`, by name.
  */
 function discoverLegacyBrandServices() {
     let dump;
@@ -639,6 +641,12 @@ function discoverLegacyBrandServices() {
  * because a delete that never reports "not found" would otherwise spin.
  */
 function deleteEntireService(service) {
+    // The sweep can name key material (`--all-devices` selects the retired KEKs), so it is the one
+    // CLI mutator behind the guard. The CLI's own login slots are not: `ai.skrr.cli.<profile>`
+    // carries no hash of the home, so a sandbox and the account give the SAME name and the guard
+    // could not tell a faked `security` from the real one. A test's protection there is its
+    // sandbox home, under which macOS finds no default keychain to write to.
+    (0, auth_core_1.assertMayMutateLiveKeychain)(service, `delete every Keychain item in ${service}`);
     let removedAny = false;
     for (let i = 0; i < 32; i += 1) {
         try {
@@ -680,9 +688,38 @@ function deleteEntireService(service) {
 function deleteLegacyBrandEntries(options = {}) {
     if (!isAvailable())
         return [];
-    return discoverLegacyBrandServices()
-        .filter((service) => options.includeMachineCredentials === true || /^(?:ai|com)\.oversky\.cli\./.test(service))
-        .filter((service) => deleteEntireService(service));
+    const includeMachineCredentials = options.includeMachineCredentials === true;
+    const inScope = discoverLegacyBrandServices();
+    const targets = inScope.filter((service) => isRetiredBrandSweepTarget(service, includeMachineCredentials));
+    if (process.env.DEBUG) {
+        for (const service of inScope) {
+            if (!targets.includes(service)) {
+                console.error(`[cli/keychain] legacy sweep left unclassified service ${service}`);
+            }
+        }
+    }
+    return targets.filter((service) => deleteEntireService(service));
+}
+/**
+ * A CLI slot the previous brand wrote: `<previous prefix>.cli.<profile>`, under either of the
+ * two previous prefixes. Positive on the whole name, so the bare `.cli` word alone, or a
+ * service that merely begins with these words, is not one.
+ */
+const RETIRED_CLI_SERVICE_PATTERN = new RegExp(`^(?:${auth_core_1.LEGACY_NATIVE_ID_PREFIXES.map((prefix) => prefix.replace(/\./g, '\\.')).join('|')})` +
+    '\\.cli\\.[A-Za-z0-9][A-Za-z0-9._-]*$');
+/**
+ * Whether the legacy sweep deletes this previous-brand service. Named, not matched by prefix:
+ * a retired CLI slot always; and, only for `--all-devices` (`includeMachineCredentials`), the
+ * daemon services the shared grammar in `@skrr-ai/auth-core` classifies (sessions, the person's
+ * own provider keys, and the retired KEKs, which the stolen-laptop case is for). A previous-brand
+ * service nobody classified is left in place. The current brand is out of scope entirely.
+ */
+function isRetiredBrandSweepTarget(service, includeMachineCredentials) {
+    if (!auth_core_1.LEGACY_NATIVE_ID_PREFIXES.some((prefix) => service.startsWith(`${prefix}.`)))
+        return false;
+    if (RETIRED_CLI_SERVICE_PATTERN.test(service))
+        return true;
+    return includeMachineCredentials && (0, auth_core_1.classifyDaemonKeychainService)(service) !== 'unclassified';
 }
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.d.ts

@@ -161,7 +161,11 @@ export type DaemonSupervisor = 'desktop' | 'service';
 export declare function daemonSignInRemedy(opts?: {
     /** How the daemon is run; absent when the caller cannot tell. */
     supervisor?: DaemonSupervisor;
-    /** The exact `skrrd … login` for this profile, when the daemon knows it. */
+    /**
+     * The exact login command for this profile (`skrrd … login`, or
+     * `skrr daemon login --profile …`), when the caller knows it. Used when the
+     * supervisor is `service` or unknown; a desktop-hosted daemon is never told one.
+     */
     loginCommand?: string;
     /** The refusal was DEVICE_PROOF_PIN_MISMATCH: say that a sign-in re-pins. */
     repinsDeviceKey?: boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.js

@@ -132,7 +132,7 @@ function daemonSignInRemedy(opts = {}) {
     const login = opts.loginCommand ? `\`${opts.loginCommand}\`` : "`skrr daemon login`";
     return `run ${login}${repin ? " \u2014 an interactive login re-pins the device key" : ""}`;
   }
-  return "sign the daemon in again on the machine running it: if the Skrr desktop app runs it, quit and reopen the app; otherwise run `skrr daemon login`" + (repin ? " (either one re-pins the device key)" : "");
+  return `sign the daemon in again on the machine running it: if the Skrr desktop app runs it, quit and reopen the app; otherwise run \`${opts.loginCommand ?? "skrr daemon login"}\`` + (repin ? " (either one re-pins the device key)" : "");
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -55,8 +55,10 @@ var import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
 var import_credentialEnvelope = require("./credentialEnvelope.js");
 var import_kek = require("./kek/index.js");
 var import_profileStateDir = require("./profileStateDir.js");
+var import_liveState = require("./liveState.js");
 var import_refresh = require("./refresh.js");
 var import_runtime = require("./runtime.js");
+var import_stateFiles = require("./stateFiles.js");
 const ACCOUNT_CRED_DEK_WRAPPED = "cred-dek-wrapped";
 let _state = { kind: "uninit" };
 let _kekRotationDetected = false;
@@ -71,28 +73,6 @@ function __getStateForTest() {
 function wrappedDekFilePath(profile) {
   return (0, import_profileStateDir.resolveProfileStateFile)(profile, ACCOUNT_CRED_DEK_WRAPPED).path;
 }
-function atomicWrite0600(target, value) {
-  const dir = import_node_path.default.dirname(target);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-  const fd = import_node_fs.default.openSync(tmp, "w", 384);
-  try {
-    import_node_fs.default.writeSync(fd, value);
-    import_node_fs.default.fsyncSync(fd);
-  } finally {
-    import_node_fs.default.closeSync(fd);
-  }
-  import_node_fs.default.renameSync(tmp, target);
-  try {
-    const dirFd = import_node_fs.default.openSync(dir, "r");
-    try {
-      import_node_fs.default.fsyncSync(dirFd);
-    } finally {
-      import_node_fs.default.closeSync(dirFd);
-    }
-  } catch {
-  }
-}
 const warnedSignatures = /* @__PURE__ */ new Set();
 const MAX_WARNED_SIGNATURES = 64;
 function __clearWarnDedupeForTest() {
@@ -124,9 +104,9 @@ function credEnvelopeLockPath(profile) {
 async function withCredEnvelopeLock(profile, body) {
   const lockPath = credEnvelopeLockPath(profile);
   const dir = import_node_path.default.dirname(lockPath);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  (0, import_stateFiles.ensureStateDir)(dir, `take the credential envelope lock for profile ${profile}`);
   if (!import_node_fs.default.existsSync(lockPath)) {
-    import_node_fs.default.writeFileSync(lockPath, "", { mode: 384 });
+    (0, import_stateFiles.writeStateFile)(lockPath, "", { mode: 384 }, "create the credential envelope lock");
   }
   const acquireStart = Date.now();
   const release = await import_proper_lockfile.default.lock(lockPath, {
@@ -202,6 +182,7 @@ async function consolidateWrappedDek(profile, kek, aad) {
       onEvent: (name, success, meta) => emit(`cred_envelope.${name}`, success, meta)
     }));
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     emit("cred_envelope.path_consolidation.failed", false, {
       profile,
       message: err?.message ?? "unknown"
@@ -268,16 +249,17 @@ function keepUnreadableWrappedDek(profile, wrapped) {
       }
     }
     const name = `${UNREADABLE_DEK_COPY_PREFIX}${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
-    atomicWrite0600(import_node_path.default.join(dir, name), wrapped);
+    (0, import_stateFiles.atomicWrite0600)(import_node_path.default.join(dir, name), wrapped, "keep the unreadable wrapped DEK");
     const kept = [...existing, name].sort();
     for (const stale of kept.slice(0, Math.max(0, kept.length - MAX_UNREADABLE_DEK_COPIES))) {
       try {
-        import_node_fs.default.unlinkSync(import_node_path.default.join(dir, stale));
+        (0, import_stateFiles.removeStateFile)(import_node_path.default.join(dir, stale), "prune a kept wrapped DEK");
       } catch {
       }
     }
     return name;
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     emit("cred_envelope.unreadable_dek_copy_failed", false, {
       profile,
       message: err?.message ?? "unknown"
@@ -395,6 +377,7 @@ async function initNewIndependentCredEnvelope(profile) {
   const dek = (0, import_credentialEnvelope.generateDek)();
   let temp;
   try {
+    (0, import_liveState.assertMayMutateLiveState)(dir, `enroll the wrapped DEK for background profile ${profile}`);
     const wrapped = await kek.wrap(dek, (0, import_credentialEnvelope.buildCredentialAad)(profile));
     if (paths.some(present))
       return await initExistingCredEnvelope(profile);
@@ -572,7 +555,7 @@ async function initCredEnvelope(profile) {
       try {
         dek = (0, import_credentialEnvelope.generateDek)();
         const wrapped = await kek.wrap(dek, aad);
-        atomicWrite0600(targetPath, wrapped);
+        (0, import_stateFiles.atomicWrite0600)(targetPath, wrapped, `write the wrapped DEK for profile ${profile}`);
         emit("cred_envelope.dek_enrolled", true, {
           kekId: kek.id,
           kekKind: captureKind(),
@@ -580,6 +563,7 @@ async function initCredEnvelope(profile) {
           ...unwrapAttemptedAndFailed ? { reEnrolledAfterRotation: true } : {}
         });
       } catch (err) {
+        (0, import_liveState.rethrowIfLiveStateRefusal)(err);
         _state = { kind: "disabled", reason: "init_failed" };
         emit("cred_envelope.init_failed", false, {
           reason: "enrollment_failed",
@@ -613,8 +597,9 @@ async function resetCredEnvelope(opts) {
       ...retiredDekFiles(opts.profile)
     ]) {
       try {
-        import_node_fs.default.unlinkSync(target);
+        (0, import_stateFiles.removeStateFile)(target, `delete the wrapped DEK file ${import_node_path.default.basename(target)}`);
       } catch (err) {
+        (0, import_liveState.rethrowIfLiveStateRefusal)(err);
         if (err.code !== "ENOENT") {
           emit("cred_envelope.clear_failed", false, {
             profile: opts.profile,