@skrr-ai/cli 0.1.123 → 0.1.125

package/dist/lib/daemonBrokerRefusal.js

@@ -30,6 +30,10 @@ function isAnsweredBrokerRefusal(outcome) {
 /** Codes whose repair is signing the DAEMON in again (laptop only). */
 const DAEMON_RELOGIN_CODES = new Set([
     'DEVICE_PROOF_PIN_MISMATCH',
+    // The daemon's device key could not be read, so it sent no proof (OSK-20506). Only an
+    // interactive daemon login creates and pins a key; waiting never does, which is why
+    // the daemon's own mint hold treats it as credential-bound (`CREDENTIAL_BOUND_CODES`).
+    'DEVICE_PROOF_MISSING',
     'SESSION_REVOKED',
     'PRINCIPAL_UNRESOLVED',
     'DAEMON_NOT_AUTHED',
@@ -88,7 +92,7 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
                 `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id). ` +
                 guestReissueRemedy(bin, 'If it stays refused');
     }
-    else if (code === 'DEVICE_PROOF_PIN_MISMATCH') {
+    else if (code === 'DEVICE_PROOF_PIN_MISMATCH' || code === 'DEVICE_PROOF_MISSING') {
         remedy =
             `Run \`${(0, daemon_command_hint_1.daemonCommandHint)('login', { bin })}\` to sign the background service in again — an interactive daemon login re-pins its device key — then retry. ` +
                 `\`${bin} login\` signs this CLI in on its own instead.`;

package/dist/lib/keychain.js

@@ -609,7 +609,9 @@ function deleteRefreshToken() {
  * prints service names and does not prompt for or reveal any secret.
  *
  * Filtered to `LEGACY_NATIVE_ID_PREFIXES` followed by a dot, so a third-party
- * item that merely starts with the same letters is never in scope.
+ * item that merely starts with the same letters is never in scope. That is the
+ * SCOPE of the sweep and nothing more: which of these services it deletes is
+ * decided by `isRetiredBrandSweepTarget`, by name.
  */
 function discoverLegacyBrandServices() {
     let dump;
@@ -639,6 +641,12 @@ function discoverLegacyBrandServices() {
  * because a delete that never reports "not found" would otherwise spin.
  */
 function deleteEntireService(service) {
+    // The sweep can name key material (`--all-devices` selects the retired KEKs), so it is the one
+    // CLI mutator behind the guard. The CLI's own login slots are not: `ai.skrr.cli.<profile>`
+    // carries no hash of the home, so a sandbox and the account give the SAME name and the guard
+    // could not tell a faked `security` from the real one. A test's protection there is its
+    // sandbox home, under which macOS finds no default keychain to write to.
+    (0, auth_core_1.assertMayMutateLiveKeychain)(service, `delete every Keychain item in ${service}`);
     let removedAny = false;
     for (let i = 0; i < 32; i += 1) {
         try {
@@ -680,9 +688,38 @@ function deleteEntireService(service) {
 function deleteLegacyBrandEntries(options = {}) {
     if (!isAvailable())
         return [];
-    return discoverLegacyBrandServices()
-        .filter((service) => options.includeMachineCredentials === true || /^(?:ai|com)\.oversky\.cli\./.test(service))
-        .filter((service) => deleteEntireService(service));
+    const includeMachineCredentials = options.includeMachineCredentials === true;
+    const inScope = discoverLegacyBrandServices();
+    const targets = inScope.filter((service) => isRetiredBrandSweepTarget(service, includeMachineCredentials));
+    if (process.env.DEBUG) {
+        for (const service of inScope) {
+            if (!targets.includes(service)) {
+                console.error(`[cli/keychain] legacy sweep left unclassified service ${service}`);
+            }
+        }
+    }
+    return targets.filter((service) => deleteEntireService(service));
+}
+/**
+ * A CLI slot the previous brand wrote: `<previous prefix>.cli.<profile>`, under either of the
+ * two previous prefixes. Positive on the whole name, so the bare `.cli` word alone, or a
+ * service that merely begins with these words, is not one.
+ */
+const RETIRED_CLI_SERVICE_PATTERN = new RegExp(`^(?:${auth_core_1.LEGACY_NATIVE_ID_PREFIXES.map((prefix) => prefix.replace(/\./g, '\\.')).join('|')})` +
+    '\\.cli\\.[A-Za-z0-9][A-Za-z0-9._-]*$');
+/**
+ * Whether the legacy sweep deletes this previous-brand service. Named, not matched by prefix:
+ * a retired CLI slot always; and, only for `--all-devices` (`includeMachineCredentials`), the
+ * daemon services the shared grammar in `@skrr-ai/auth-core` classifies (sessions, the person's
+ * own provider keys, and the retired KEKs, which the stolen-laptop case is for). A previous-brand
+ * service nobody classified is left in place. The current brand is out of scope entirely.
+ */
+function isRetiredBrandSweepTarget(service, includeMachineCredentials) {
+    if (!auth_core_1.LEGACY_NATIVE_ID_PREFIXES.some((prefix) => service.startsWith(`${prefix}.`)))
+        return false;
+    if (RETIRED_CLI_SERVICE_PATTERN.test(service))
+        return true;
+    return includeMachineCredentials && (0, auth_core_1.classifyDaemonKeychainService)(service) !== 'unclassified';
 }
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.d.ts

@@ -161,7 +161,11 @@ export type DaemonSupervisor = 'desktop' | 'service';
 export declare function daemonSignInRemedy(opts?: {
     /** How the daemon is run; absent when the caller cannot tell. */
     supervisor?: DaemonSupervisor;
-    /** The exact `skrrd … login` for this profile, when the daemon knows it. */
+    /**
+     * The exact login command for this profile (`skrrd … login`, or
+     * `skrr daemon login --profile …`), when the caller knows it. Used when the
+     * supervisor is `service` or unknown; a desktop-hosted daemon is never told one.
+     */
     loginCommand?: string;
     /** The refusal was DEVICE_PROOF_PIN_MISMATCH: say that a sign-in re-pins. */
     repinsDeviceKey?: boolean;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/cliHandoffWire.js

@@ -132,7 +132,7 @@ function daemonSignInRemedy(opts = {}) {
     const login = opts.loginCommand ? `\`${opts.loginCommand}\`` : "`skrr daemon login`";
     return `run ${login}${repin ? " \u2014 an interactive login re-pins the device key" : ""}`;
   }
-  return "sign the daemon in again on the machine running it: if the Skrr desktop app runs it, quit and reopen the app; otherwise run `skrr daemon login`" + (repin ? " (either one re-pins the device key)" : "");
+  return `sign the daemon in again on the machine running it: if the Skrr desktop app runs it, quit and reopen the app; otherwise run \`${opts.loginCommand ?? "skrr daemon login"}\`` + (repin ? " (either one re-pins the device key)" : "");
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -55,8 +55,10 @@ var import_proper_lockfile = __toESM(require("proper-lockfile"), 1);
 var import_credentialEnvelope = require("./credentialEnvelope.js");
 var import_kek = require("./kek/index.js");
 var import_profileStateDir = require("./profileStateDir.js");
+var import_liveState = require("./liveState.js");
 var import_refresh = require("./refresh.js");
 var import_runtime = require("./runtime.js");
+var import_stateFiles = require("./stateFiles.js");
 const ACCOUNT_CRED_DEK_WRAPPED = "cred-dek-wrapped";
 let _state = { kind: "uninit" };
 let _kekRotationDetected = false;
@@ -71,28 +73,6 @@ function __getStateForTest() {
 function wrappedDekFilePath(profile) {
   return (0, import_profileStateDir.resolveProfileStateFile)(profile, ACCOUNT_CRED_DEK_WRAPPED).path;
 }
-function atomicWrite0600(target, value) {
-  const dir = import_node_path.default.dirname(target);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-  const fd = import_node_fs.default.openSync(tmp, "w", 384);
-  try {
-    import_node_fs.default.writeSync(fd, value);
-    import_node_fs.default.fsyncSync(fd);
-  } finally {
-    import_node_fs.default.closeSync(fd);
-  }
-  import_node_fs.default.renameSync(tmp, target);
-  try {
-    const dirFd = import_node_fs.default.openSync(dir, "r");
-    try {
-      import_node_fs.default.fsyncSync(dirFd);
-    } finally {
-      import_node_fs.default.closeSync(dirFd);
-    }
-  } catch {
-  }
-}
 const warnedSignatures = /* @__PURE__ */ new Set();
 const MAX_WARNED_SIGNATURES = 64;
 function __clearWarnDedupeForTest() {
@@ -124,9 +104,9 @@ function credEnvelopeLockPath(profile) {
 async function withCredEnvelopeLock(profile, body) {
   const lockPath = credEnvelopeLockPath(profile);
   const dir = import_node_path.default.dirname(lockPath);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  (0, import_stateFiles.ensureStateDir)(dir, `take the credential envelope lock for profile ${profile}`);
   if (!import_node_fs.default.existsSync(lockPath)) {
-    import_node_fs.default.writeFileSync(lockPath, "", { mode: 384 });
+    (0, import_stateFiles.writeStateFile)(lockPath, "", { mode: 384 }, "create the credential envelope lock");
   }
   const acquireStart = Date.now();
   const release = await import_proper_lockfile.default.lock(lockPath, {
@@ -202,6 +182,7 @@ async function consolidateWrappedDek(profile, kek, aad) {
       onEvent: (name, success, meta) => emit(`cred_envelope.${name}`, success, meta)
     }));
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     emit("cred_envelope.path_consolidation.failed", false, {
       profile,
       message: err?.message ?? "unknown"
@@ -268,16 +249,17 @@ function keepUnreadableWrappedDek(profile, wrapped) {
       }
     }
     const name = `${UNREADABLE_DEK_COPY_PREFIX}${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`;
-    atomicWrite0600(import_node_path.default.join(dir, name), wrapped);
+    (0, import_stateFiles.atomicWrite0600)(import_node_path.default.join(dir, name), wrapped, "keep the unreadable wrapped DEK");
     const kept = [...existing, name].sort();
     for (const stale of kept.slice(0, Math.max(0, kept.length - MAX_UNREADABLE_DEK_COPIES))) {
       try {
-        import_node_fs.default.unlinkSync(import_node_path.default.join(dir, stale));
+        (0, import_stateFiles.removeStateFile)(import_node_path.default.join(dir, stale), "prune a kept wrapped DEK");
       } catch {
       }
     }
     return name;
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     emit("cred_envelope.unreadable_dek_copy_failed", false, {
       profile,
       message: err?.message ?? "unknown"
@@ -395,6 +377,7 @@ async function initNewIndependentCredEnvelope(profile) {
   const dek = (0, import_credentialEnvelope.generateDek)();
   let temp;
   try {
+    (0, import_liveState.assertMayMutateLiveState)(dir, `enroll the wrapped DEK for background profile ${profile}`);
     const wrapped = await kek.wrap(dek, (0, import_credentialEnvelope.buildCredentialAad)(profile));
     if (paths.some(present))
       return await initExistingCredEnvelope(profile);
@@ -572,7 +555,7 @@ async function initCredEnvelope(profile) {
       try {
         dek = (0, import_credentialEnvelope.generateDek)();
         const wrapped = await kek.wrap(dek, aad);
-        atomicWrite0600(targetPath, wrapped);
+        (0, import_stateFiles.atomicWrite0600)(targetPath, wrapped, `write the wrapped DEK for profile ${profile}`);
         emit("cred_envelope.dek_enrolled", true, {
           kekId: kek.id,
           kekKind: captureKind(),
@@ -580,6 +563,7 @@ async function initCredEnvelope(profile) {
           ...unwrapAttemptedAndFailed ? { reEnrolledAfterRotation: true } : {}
         });
       } catch (err) {
+        (0, import_liveState.rethrowIfLiveStateRefusal)(err);
         _state = { kind: "disabled", reason: "init_failed" };
         emit("cred_envelope.init_failed", false, {
           reason: "enrollment_failed",
@@ -613,8 +597,9 @@ async function resetCredEnvelope(opts) {
       ...retiredDekFiles(opts.profile)
     ]) {
       try {
-        import_node_fs.default.unlinkSync(target);
+        (0, import_stateFiles.removeStateFile)(target, `delete the wrapped DEK file ${import_node_path.default.basename(target)}`);
       } catch (err) {
+        (0, import_liveState.rethrowIfLiveStateRefusal)(err);
         if (err.code !== "ENOENT") {
           emit("cred_envelope.clear_failed", false, {
             profile: opts.profile,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -1,4 +1,34 @@
-import { type DeviceKeyPair, type Ed25519PublicJwk } from './deviceKey.js';
+import { type DeviceKeyAlg, type DevicePublicJwk } from './deviceKey.js';
+import { type DeviceKeyCustody, type DeviceKeyHandle } from './deviceKeyHandle.js';
+import { type HardwareKeyCapability, type HardwareKeyRecord } from './deviceKeyHardware.js';
+/**
+ * The `cred_envelope.read.decrypt_failed` hint for the device PRIVATE key
+ * (OSK-20506).
+ *
+ * The envelope's default hint says "signing in again rebuilds it", which is true
+ * of a credential and false of this: `skrr login` never creates or replaces a
+ * device key, and only an interactive daemon sign-in does (it re-pins the new key
+ * on the server). `loadKeypair` hands this to `maybeDecryptOnRead` so the
+ * producer says WHAT failed; a presenter that already prints one device-key line
+ * (the CLI's `recovery_required` notice) recognises it by identity and prints
+ * nothing for the decrypt failure, instead of two lines with two remedies. A
+ * logger that prints every warning, the daemon's, shows this one as written.
+ *
+ * Compared by value by the CLI presenter: change the text and the CLI prints the
+ * credential line again, which `auth-core-init.device-key.spec.ts` catches.
+ */
+export declare const DEVICE_KEY_UNREADABLE_CREDENTIAL_HINT = "stored device key is unreadable on this machine \u2014 only an interactive daemon sign-in replaces it";
+/**
+ * `key` is a handle, never a keypair: nothing in this module (or any caller of
+ * it) can read a private scalar once a key is active, which is what lets a
+ * hardware key stand in for a software one without a second code path.
+ *
+ * `envelopeProtected` is about the PRIVATE KEY FILE being sealed under the
+ * credential envelope. A hardware record is deliberately not sealed (it is
+ * useless off this machine, and sealing it would tie the device identity's life
+ * to the envelope key again), so it is always `false` for hardware and says
+ * nothing about how well that key is protected: read `key.custody` for that.
+ */
 type DeviceIdentityState = {
     kind: 'uninit';
 } | {
@@ -6,7 +36,7 @@ type DeviceIdentityState = {
     reason: DisabledReason;
 } | {
     kind: 'active';
-    keypair: DeviceKeyPair;
+    key: DeviceKeyHandle;
     profile: string;
     envelopeProtected: boolean;
 };
@@ -69,6 +99,69 @@ export declare function resetDeviceIdentity(opts?: {
     profile?: string;
     clearOnDisk?: boolean;
 }): Promise<void>;
+/**
+ * A hardware key that exists only in memory. It is not this machine's identity
+ * until `commitDeviceKeyCandidate`, and it leaves nothing behind if it is
+ * dropped: a Secure Enclave key lives in the blob and nowhere else.
+ *
+ * That is the whole safety argument for an upgrade. The server learns the new key
+ * from a proof signed with it (an interactive sign-in re-pins the row), so the
+ * order has to be: create the candidate, sign the sign-in with it, and only after
+ * the server has accepted that sign-in make it the identity. The software key
+ * stays on disk, untouched and active, through every step before the last one.
+ */
+export interface DeviceKeyCandidate {
+    readonly key: DeviceKeyHandle;
+    /** @internal what `commitDeviceKeyCandidate` persists. */
+    readonly record: HardwareKeyRecord;
+}
+export type DeviceKeyCandidateResult = {
+    ok: true;
+    candidate: DeviceKeyCandidate;
+} | {
+    ok: false;
+    reason: 'already_hardware' | 'independent_profile' | 'unavailable' | 'create_failed';
+    capability?: HardwareKeyCapability;
+    message?: string;
+};
+/**
+ * Create a hardware key candidate if this machine can hold one and does not
+ * already. Never throws and never touches disk, so an interactive sign-in can
+ * call it unconditionally and fall back to the key it has on any answer but ok.
+ */
+export declare function prepareHardwareKeyCandidate(profile: string): Promise<DeviceKeyCandidateResult>;
+/** Sign a request with a candidate (the upgrade's sign-in proof). Null on failure, like `signServerRequest`. */
+export declare function signWithCandidate(candidate: DeviceKeyCandidate, opts: {
+    method: string;
+    url: string;
+    refreshToken?: string;
+    accessToken?: string;
+}): Promise<string | null>;
+/**
+ * Make a candidate this profile's device identity. Call it only after the
+ * server has accepted a sign-in proven with `candidate`: until then the software
+ * key is the identity the server pins, and replacing it early is the failure
+ * this API exists to prevent.
+ *
+ * Under the identity lock, in the order that survives a crash: retire the old
+ * key, write the hardware record (authoritative), then the public file, then
+ * clear the enrollment marker (it records the OLD thumbprint and would otherwise
+ * short-circuit every later enrollment as already done).
+ */
+export declare function commitDeviceKeyCandidate(profile: string, candidate: DeviceKeyCandidate): Promise<void>;
+/** A sign-in that takes longer than this has been abandoned; its pending key is not committed. */
+export declare const PENDING_HARDWARE_KEY_MAX_AGE_MS: number;
+/** Park a candidate so a later process can commit or discard it. Replaces any earlier one. */
+export declare function persistPendingHardwareKey(profile: string, candidate: DeviceKeyCandidate): Promise<void>;
+export type PendingHardwareKeyOutcome = 'committed' | 'no_pending' | 'mismatch' | 'expired' | 'unreadable';
+/**
+ * Make the parked candidate this profile's identity, if it is the one the caller
+ * proved the sign-in with (`thumbprint`) and it is not stale. Anything else
+ * commits nothing: the software key stays the identity, and the answer says why.
+ */
+export declare function commitPendingHardwareKey(profile: string, thumbprint: string): Promise<PendingHardwareKeyOutcome>;
+/** Drop the parked candidate (the sign-in failed or was refused). Idempotent. */
+export declare function discardPendingHardwareKey(profile: string): Promise<void>;
 /** True iff init has completed and a keypair is in memory. */
 export declare function isDeviceIdentityActive(): boolean;
 /**
@@ -77,8 +170,10 @@ export declare function isDeviceIdentityActive(): boolean;
  * on the in-flight request.
  */
 export declare function getDevicePublicKey(): {
-    jwk: Ed25519PublicJwk;
+    jwk: DevicePublicJwk;
     thumbprint: string;
+    alg: DeviceKeyAlg;
+    custody: DeviceKeyCustody;
 } | null;
 /**
  * Operator-readable summary of device-identity state. Used by
@@ -90,13 +185,47 @@ export declare function describeDeviceIdentityState(): {
     thumbprint?: string;
     profile?: string;
     envelopeProtected?: boolean;
+    alg?: DeviceKeyAlg;
+    /** Whether the private half can be copied off this machine. Absent unless active. */
+    custody?: DeviceKeyCustody;
+    /**
+     * For a hardware key: can THIS process sign with it right now? False means the
+     * key exists and is intact but the helper that signs with it is not installed
+     * where this process can find it (a CLI without the desktop app's helper, an
+     * app update that has not landed). It is a different fact from an unreadable
+     * key, and it must never lead to replacing the key.
+     */
+    canSign?: boolean;
+};
+export type StoredDeviceKeyDescription = {
+    stored: false;
+} | {
+    stored: true;
+    alg: DeviceKeyAlg;
+    custody: DeviceKeyCustody;
+    thumbprint: string;
+    /** A hardware key needs the helper to sign; a software key never does. */
+    canSign: boolean;
 };
+/**
+ * What a profile's device key IS, read from its plaintext public record alone. For
+ * `status`, which is a different process from the daemon and may run while the
+ * daemon is stopped: it opens nothing, needs no envelope key and writes nothing, so
+ * it answers even when the private half is unreadable. Not evidence the key can be
+ * used (only `describeDeviceIdentityState` in the process that loaded it says that);
+ * evidence of what kind of key the profile has, which nothing else showed.
+ */
+export declare function describeStoredDeviceKey(profile: string): StoredDeviceKeyDescription;
 /**
  * Sign an outgoing request with the device key. Returns the JWS Compact
  * Serialization, or null when device identity is not active. NEVER
  * throws — a failed sign returns null and emits a telemetry event so
  * the caller can fall back to bearer-only auth without an outage.
  *
+ * Asynchronous because a hardware key signs in a helper process. A software key
+ * resolves on the next microtask, so a caller that awaits pays nothing it can
+ * measure; a caller that could not await could not have a hardware key.
+ *
  * Shape matches `DeviceProofSigner` from `./refresh.ts` so the function
  * passes directly into `refreshDaemonToken`'s `signRequestProof` slot.
  */
@@ -105,7 +234,7 @@ export declare function signServerRequest(opts: {
     url: string;
     refreshToken?: string;
     accessToken?: string;
-}): string | null;
+}): Promise<string | null>;
 /** @internal Test seams — file path resolvers. */
 export declare function __publicKeyPathForTest(profile: string): string;
 export declare function __privateKeyPathForTest(profile: string): string;