@skrr-ai/cli 0.1.123 → 0.1.125

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/kek/masterKekService.js

@@ -20,18 +20,48 @@ var masterKekService_exports = {};
 __export(masterKekService_exports, {
   MASTER_KEK_KEYCHAIN_ACCOUNT: () => MASTER_KEK_KEYCHAIN_ACCOUNT,
   MASTER_KEK_KEYCHAIN_SERVICE: () => MASTER_KEK_KEYCHAIN_SERVICE,
-  isMasterKekKeychainService: () => isMasterKekKeychainService
+  classifyDaemonKeychainService: () => classifyDaemonKeychainService,
+  isMasterKekKeychainService: () => isMasterKekKeychainService,
+  isSessionKeychainService: () => isSessionKeychainService,
+  isUserOwnedSecretKeychainService: () => isUserOwnedSecretKeychainService
 });
 module.exports = __toCommonJS(masterKekService_exports);
 const MASTER_KEK_KEYCHAIN_SERVICE = "ai.skrr.daemon.kek";
 const MASTER_KEK_KEYCHAIN_ACCOUNT = "master-kek-v1";
-const MASTER_KEK_SERVICE_PATTERN = /^ai\.(?:skrr|oversky)\.daemon\.kek(?:\..*)?$/;
+const MASTER_KEK_SERVICE_PATTERN = /^(?:ai\.(?:skrr|oversky)|com\.oversky)\.daemon\.kek(?:\..*)?$/;
 function isMasterKekKeychainService(service) {
   return typeof service === "string" && MASTER_KEK_SERVICE_PATTERN.test(service);
 }
+const USER_OWNED_SECRET_SERVICE_PATTERN = /^ai\.(?:skrr|oversky)\.daemon\.byok(?:\..*)?$/;
+function isUserOwnedSecretKeychainService(service) {
+  return typeof service === "string" && USER_OWNED_SECRET_SERVICE_PATTERN.test(service);
+}
+const PROFILE_NAME = "[A-Za-z0-9][A-Za-z0-9._-]{0,63}";
+const CONFIG_DIR_HASH = "-[a-f0-9]{8}";
+const SESSION_SERVICE_PATTERNS = [
+  new RegExp(`^ai\\.skrr\\.daemon\\.${PROFILE_NAME}${CONFIG_DIR_HASH}$`),
+  new RegExp(`^ai\\.oversky\\.daemon(?:\\.${PROFILE_NAME}(?:${CONFIG_DIR_HASH})?)?$`)
+];
+function classifyDaemonKeychainService(service) {
+  if (typeof service !== "string")
+    return "unclassified";
+  if (isMasterKekKeychainService(service))
+    return "master_kek";
+  if (isUserOwnedSecretKeychainService(service))
+    return "user_secret";
+  if (SESSION_SERVICE_PATTERNS.some((pattern) => pattern.test(service)))
+    return "session";
+  return "unclassified";
+}
+function isSessionKeychainService(service) {
+  return classifyDaemonKeychainService(service) === "session";
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   MASTER_KEK_KEYCHAIN_ACCOUNT,
   MASTER_KEK_KEYCHAIN_SERVICE,
-  isMasterKekKeychainService
+  classifyDaemonKeychainService,
+  isMasterKekKeychainService,
+  isSessionKeychainService,
+  isUserOwnedSecretKeychainService
 });

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/liveState.d.ts

@@ -0,0 +1,154 @@
+import { CONFIG_DIR_NAME } from './localIdentity.js';
+/** Directory name of the state root inside a home directory. */
+export { CONFIG_DIR_NAME };
+/** Opt-in for a deliberate check against the machine's real state. */
+export declare const ALLOW_LIVE_STATE_ENV = "SKRR_TEST_ALLOW_LIVE_STATE";
+/** Set by every hermetic runner to the throwaway home it gave the process. */
+export declare const HERMETIC_HOME_ENV = "SKRR_TEST_HERMETIC_HOME";
+/** `LiveStateRefusedError.code`. Kept at its pre-consolidation value: scripts match on it. */
+export declare const LIVE_STATE_REFUSED_CODE = "SKRR_TEST_LIVE_STATE";
+/**
+ * Which signal says this is a test process, or `null`. The text names the signal so a false
+ * positive (a shell that exports `NODE_ENV=test`) diagnoses itself.
+ *
+ * `NODE_TEST_CONTEXT` is set by `node --test` in every file's child process and inherited by
+ * anything a test spawns. `--test` in `execArgv` covers `--test-isolation=none`, where tests run
+ * in the runner itself. A test file run DIRECTLY (`node file.test.ts`) has neither: node:test
+ * sets no marker for it, so the entry script's name is the only evidence. `JEST_WORKER_ID` is
+ * set in the real environment of every jest worker (and by `--runInBand`), so a child a spec
+ * spawns without `env` still carries it. `NODE_ENV=test` is what jest, vitest and `bun test`
+ * default to, and what custom scripts set by hand.
+ *
+ * `argv` is the process's own only when `env` is: a caller describing a hypothetical process
+ * (`{}`) describes all of it.
+ */
+export declare function testProcessSignal(env?: NodeJS.ProcessEnv, execArgv?: readonly string[], argv?: readonly string[]): string | null;
+/** Is this a test process? See `testProcessSignal` for what counts. */
+export declare function isTestProcess(env?: NodeJS.ProcessEnv, execArgv?: readonly string[], argv?: readonly string[]): boolean;
+/** Should a test process be refused access to the machine's real state? */
+export declare function refusesLiveStateInTest(env?: NodeJS.ProcessEnv, execArgv?: readonly string[], argv?: readonly string[]): boolean;
+/**
+ * The account's home directory from the user database. A test that points `HOME` somewhere else
+ * cannot move it, which is the point: it names where the INSTALLED product keeps its state,
+ * whatever this process believes.
+ *
+ * Node's `os.userInfo().homedir` reads the user database. Bun's returns `$HOME`, which is
+ * exactly what a test moves, so the compiled daemon asks the database itself — without that, a
+ * compiled binary spawned by a test with its own `HOME` saw that home as the live one and
+ * refused to start. `null` when it cannot be determined.
+ */
+export declare function accountHomeDir(): string | null;
+/**
+ * @internal Test seam — make `accountHomeDir()` answer `home` (`null`: "cannot be determined"),
+ * or restore the user-database lookup with `undefined`. It lets a spec stand a THROWAWAY
+ * directory in for the account's real home, so the guard can be exercised end to end — and its
+ * refusal removed, to prove the spec notices — without any path ever touching the real one.
+ * Never called from production code; `stateFileBoundary.spec.ts` fails if it is.
+ */
+export declare function __setAccountHomeForTest(home: string | null | undefined): void;
+/** The state root of the product installed for this account, when it can be known. */
+export declare function liveStateRoot(home?: string | null): string | null;
+/**
+ * What a guard decision is made against. Everything defaults to the running process; a spec
+ * injects a throwaway directory as `realHome` to prove the guard fires WITHOUT going near the
+ * machine's actual home.
+ */
+export interface LiveStateProbe {
+    env?: NodeJS.ProcessEnv;
+    execArgv?: readonly string[];
+    argv?: readonly string[];
+    /** The account's real home. `null` means "cannot be determined". Default: the user database. */
+    realHome?: string | null;
+}
+export declare class LiveStateRefusedError extends Error {
+    readonly code = "SKRR_TEST_LIVE_STATE";
+    /** What the mutation was aimed at: a path, or a Keychain service. */
+    readonly target: string;
+    /** Why this process was taken for a test. */
+    readonly signal: string;
+    constructor(what: string, target: string, signal: string, why: string, hint?: string);
+}
+/**
+ * Is `err` a live-state refusal? By name and code as well as by class: auth-core ships as both
+ * ESM and CJS, and two copies of it in one process (a farmed worktree) have two classes.
+ */
+export declare function isLiveStateRefusal(err: unknown): err is LiveStateRefusedError;
+/**
+ * First line of any `catch` that wraps a guarded mutation. A refusal swallowed into a telemetry
+ * event is a write that silently did not happen under a test that reports green, which is the
+ * "everything reads healthy" shape this repo has paid for before. A no-op outside a test
+ * process, where no refusal is ever constructed.
+ */
+export declare function rethrowIfLiveStateRefusal(err: unknown): void;
+/**
+ * Throw `LiveStateRefusedError` when a test process is about to mutate `target`, a path under
+ * the account's real home. Returns without reading anything else outside a test process.
+ *
+ * `what` completes "Refusing to …" (`replace the wrapped DEK`). `hint` replaces the default
+ * advice about how to run the test safely.
+ */
+export declare function assertMayMutateLiveState(target: string, what: string, probe?: LiveStateProbe, hint?: string): void;
+/** Service name prefix of the daemon's credential slots; always followed by `.<profile>`. */
+export declare const DAEMON_KEYCHAIN_SERVICE_BASE = "ai.skrr.daemon";
+/**
+ * Separate Keychain service for local BYOK secrets.
+ *
+ * Keeping provider keys out of the daemon-auth service prevents a broad "export daemon
+ * credentials" operation from accidentally including them and lets the user remove a provider
+ * key without disturbing their login.
+ */
+export declare const DAEMON_BYOK_KEYCHAIN_SERVICE_BASE = "ai.skrr.daemon.byok";
+/**
+ * The PRE-RENAME, pre-Phase-K service name. Read ONLY by the daemon's migration helper.
+ *
+ * It must NOT equal `DAEMON_KEYCHAIN_SERVICE_BASE`, and it held that value until a fix: the
+ * skrr rename swept the string like any other, and the two became identical. Nothing failed,
+ * because the failure is an absence — `migrateLegacyServiceToProfile` read a service nothing had
+ * ever written, found no slots, and reported success. Pre-rename credentials stayed where they
+ * were and the user silently re-authenticated. Written as a literal on purpose.
+ */
+export declare const LEGACY_DAEMON_KEYCHAIN_SERVICE = "ai.oversky.daemon";
+/** The profile the installed daemon runs when nothing selects another. */
+export declare const LIVE_DEFAULT_PROFILE = "default";
+/**
+ * `-<sha256(dir)[0:8]>`, the suffix of every per-profile Keychain service name. The input is the
+ * absolute, trailing-slash-stripped config directory, so two OS users running the daemon under
+ * their own `~/.skrr/` get distinct names and cannot read each other's tokens.
+ */
+export declare function keychainSuffixForDir(dir: string): string;
+/**
+ * Keychain services that belong to the product installed on this machine: the master KEK
+ * (current brand and the ones before it), the default profile's credential and BYOK slots under
+ * the account's real home, and the legacy names the daemon migrates from on start — a write to
+ * one of those is adopted by the next restart instead of the next read.
+ *
+ * The per-profile names are derived from the ACCOUNT's home, which no `HOME` override can reach.
+ * When the home is unknown only the names that need no home are returned; see
+ * `isLiveKeychainService` for what is done about the rest.
+ */
+export declare function liveKeychainServices(probe?: Pick<LiveStateProbe, 'realHome'>): ReadonlySet<string>;
+/**
+ * Does `service` name an item of the installed product? When the real home is unknown, a
+ * default-profile slot with a hash suffix is assumed live: its hash cannot be checked, and the
+ * guard fails closed.
+ */
+export declare function isLiveKeychainService(service: string, probe?: Pick<LiveStateProbe, 'realHome'>): boolean;
+/** Would a mutation of Keychain `service` be refused in a process with this shape? */
+export declare function refusesLiveKeychainMutation(service: string, probe?: LiveStateProbe): boolean;
+/** What a Keychain guard decision is made against. */
+export interface LiveKeychainProbe extends LiveStateProbe {
+    /**
+     * The keychain FILE the write is aimed at, when the caller knows it (macOS passes the login
+     * keychain it resolved). A keychain outside the real home is not the account's, so nothing
+     * the installed product reads can be in it, whatever the service is called: a throwaway
+     * keychain file, or a fake `security` that answers with a path of its own. Without it, the
+     * service name alone decides.
+     */
+    keychainFile?: string;
+}
+/**
+ * Throw `LiveStateRefusedError` when a test process is about to write or delete an item in a
+ * Keychain service the installed product reads. Callers that can be handed a fake `security`
+ * binary call this only when the real one would run: a mocked write touches nothing.
+ */
+export declare function assertMayMutateLiveKeychain(service: string, what: string, probe?: LiveKeychainProbe, hint?: string): void;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/liveState.js

@@ -0,0 +1,281 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var liveState_exports = {};
+__export(liveState_exports, {
+  ALLOW_LIVE_STATE_ENV: () => ALLOW_LIVE_STATE_ENV,
+  CONFIG_DIR_NAME: () => import_localIdentity.CONFIG_DIR_NAME,
+  DAEMON_BYOK_KEYCHAIN_SERVICE_BASE: () => DAEMON_BYOK_KEYCHAIN_SERVICE_BASE,
+  DAEMON_KEYCHAIN_SERVICE_BASE: () => DAEMON_KEYCHAIN_SERVICE_BASE,
+  HERMETIC_HOME_ENV: () => HERMETIC_HOME_ENV,
+  LEGACY_DAEMON_KEYCHAIN_SERVICE: () => LEGACY_DAEMON_KEYCHAIN_SERVICE,
+  LIVE_DEFAULT_PROFILE: () => LIVE_DEFAULT_PROFILE,
+  LIVE_STATE_REFUSED_CODE: () => LIVE_STATE_REFUSED_CODE,
+  LiveStateRefusedError: () => LiveStateRefusedError,
+  __setAccountHomeForTest: () => __setAccountHomeForTest,
+  accountHomeDir: () => accountHomeDir,
+  assertMayMutateLiveKeychain: () => assertMayMutateLiveKeychain,
+  assertMayMutateLiveState: () => assertMayMutateLiveState,
+  isLiveKeychainService: () => isLiveKeychainService,
+  isLiveStateRefusal: () => isLiveStateRefusal,
+  isTestProcess: () => isTestProcess,
+  keychainSuffixForDir: () => keychainSuffixForDir,
+  liveKeychainServices: () => liveKeychainServices,
+  liveStateRoot: () => liveStateRoot,
+  refusesLiveKeychainMutation: () => refusesLiveKeychainMutation,
+  refusesLiveStateInTest: () => refusesLiveStateInTest,
+  rethrowIfLiveStateRefusal: () => rethrowIfLiveStateRefusal,
+  testProcessSignal: () => testProcessSignal
+});
+module.exports = __toCommonJS(liveState_exports);
+var import_node_child_process = require("node:child_process");
+var import_node_crypto = require("node:crypto");
+var import_node_fs = __toESM(require("node:fs"), 1);
+var import_node_os = __toESM(require("node:os"), 1);
+var import_node_path = __toESM(require("node:path"), 1);
+var import_masterKekService = require("./kek/masterKekService.js");
+var import_localIdentity = require("./localIdentity.js");
+const ALLOW_LIVE_STATE_ENV = "SKRR_TEST_ALLOW_LIVE_STATE";
+const HERMETIC_HOME_ENV = "SKRR_TEST_HERMETIC_HOME";
+const LIVE_STATE_REFUSED_CODE = "SKRR_TEST_LIVE_STATE";
+const TEST_FILE_RE = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+function testProcessSignal(env = process.env, execArgv = process.execArgv, argv = env === process.env ? process.argv : []) {
+  if (env.NODE_TEST_CONTEXT)
+    return "NODE_TEST_CONTEXT is set (node --test)";
+  if (env.JEST_WORKER_ID)
+    return "JEST_WORKER_ID is set (jest)";
+  if (env.VITEST || env.VITEST_WORKER_ID)
+    return "VITEST is set (vitest)";
+  if (env[HERMETIC_HOME_ENV])
+    return `${HERMETIC_HOME_ENV} is set (a hermetic test runner)`;
+  if (env.NODE_ENV === "test")
+    return "NODE_ENV=test";
+  if (execArgv.includes("--test"))
+    return "node was started with --test";
+  const entry = argv[1];
+  if (typeof entry === "string" && TEST_FILE_RE.test(entry)) {
+    return `the entry script ${import_node_path.default.basename(entry)} is a test file`;
+  }
+  return null;
+}
+function isTestProcess(env = process.env, execArgv = process.execArgv, argv) {
+  return testProcessSignal(env, execArgv, argv) !== null;
+}
+function refusesLiveStateInTest(env = process.env, execArgv = process.execArgv, argv) {
+  return isTestProcess(env, execArgv, argv) && env[ALLOW_LIVE_STATE_ENV] !== "1";
+}
+let cachedAccountHome;
+function userDatabaseHome() {
+  const probe = (command, args) => (0, import_node_child_process.execFileSync)(command, args, {
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 5e3
+  });
+  try {
+    if (process.platform === "darwin") {
+      const out = probe("dscl", [
+        ".",
+        "-read",
+        `/Users/${import_node_os.default.userInfo().username}`,
+        "NFSHomeDirectory"
+      ]);
+      const home = out.replace(/^NFSHomeDirectory:\s*/, "").trim();
+      return home || null;
+    }
+    if (process.platform === "linux" && typeof process.getuid === "function") {
+      const home = probe("getent", ["passwd", String(process.getuid())]).trim().split(":")[5];
+      return home || null;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function accountHomeDir() {
+  if (cachedAccountHome !== void 0)
+    return cachedAccountHome;
+  if (typeof process.versions.bun === "string") {
+    cachedAccountHome = userDatabaseHome();
+  } else {
+    try {
+      cachedAccountHome = import_node_os.default.userInfo().homedir || null;
+    } catch {
+      cachedAccountHome = null;
+    }
+  }
+  return cachedAccountHome;
+}
+function __setAccountHomeForTest(home) {
+  cachedAccountHome = home;
+}
+function liveStateRoot(home = accountHomeDir()) {
+  return home ? import_node_path.default.resolve(home, import_localIdentity.CONFIG_DIR_NAME) : null;
+}
+function probeHome(probe) {
+  const home = probe.realHome === void 0 ? accountHomeDir() : probe.realHome;
+  if (!home || import_node_path.default.parse(import_node_path.default.resolve(home)).root === import_node_path.default.resolve(home))
+    return null;
+  return home;
+}
+function canonicalise(target) {
+  const absolute = import_node_path.default.resolve(target);
+  let head = absolute;
+  const tail = [];
+  for (; ; ) {
+    try {
+      const real = import_node_fs.default.realpathSync.native(head);
+      return tail.length === 0 ? real : import_node_path.default.join(real, ...tail.reverse());
+    } catch {
+      const parent = import_node_path.default.dirname(head);
+      if (parent === head)
+        return absolute;
+      tail.push(import_node_path.default.basename(head));
+      head = parent;
+    }
+  }
+}
+function isWithin(child, parent) {
+  const rel = import_node_path.default.relative(parent, child);
+  return rel !== ".." && !rel.startsWith(`..${import_node_path.default.sep}`) && !import_node_path.default.isAbsolute(rel);
+}
+class LiveStateRefusedError extends Error {
+  code = LIVE_STATE_REFUSED_CODE;
+  /** What the mutation was aimed at: a path, or a Keychain service. */
+  target;
+  /** Why this process was taken for a test. */
+  signal;
+  constructor(what, target, signal, why, hint) {
+    super(`Refusing to ${what}: ${why}. This process looks like a test (${signal}), and the target belongs to the Skrr daemon, CLI and desktop app installed on this machine. ` + (hint ?? "Run the suite through its own test script (`npm test`, or `npm run test:file -- <path>` in daemon/), which gives every test process a home of its own, or point HOME at a throwaway directory for the run (HOME=$(mktemp -d) \u2026). ") + `Set ${ALLOW_LIVE_STATE_ENV}=1 only for a deliberate check against the real state.`);
+    this.name = "LiveStateRefusedError";
+    this.target = target;
+    this.signal = signal;
+  }
+}
+function isLiveStateRefusal(err) {
+  return err instanceof LiveStateRefusedError || err?.name === "LiveStateRefusedError" && err.code === LIVE_STATE_REFUSED_CODE;
+}
+function rethrowIfLiveStateRefusal(err) {
+  if (isLiveStateRefusal(err))
+    throw err;
+}
+function pathRefusal(target, probe, env) {
+  const resolved = canonicalise(target);
+  const home = probeHome(probe);
+  if (home === null) {
+    const sandbox = env[HERMETIC_HOME_ENV];
+    if (sandbox && isWithin(resolved, canonicalise(sandbox)))
+      return null;
+    return `${target} cannot be shown to be outside the real home, because the account's home directory could not be determined`;
+  }
+  return isWithin(resolved, canonicalise(home)) ? `${target} is inside the real home ${home}` : null;
+}
+function assertMayMutateLiveState(target, what, probe = {}, hint) {
+  const env = probe.env ?? process.env;
+  const signal = testProcessSignal(env, probe.execArgv ?? process.execArgv, probe.argv);
+  if (signal === null || env[ALLOW_LIVE_STATE_ENV] === "1")
+    return;
+  const why = pathRefusal(target, probe, env);
+  if (why !== null)
+    throw new LiveStateRefusedError(what, target, signal, why, hint);
+}
+const DAEMON_KEYCHAIN_SERVICE_BASE = `${import_localIdentity.NATIVE_ID_PREFIX}.daemon`;
+const DAEMON_BYOK_KEYCHAIN_SERVICE_BASE = `${import_localIdentity.NATIVE_ID_PREFIX}.daemon.byok`;
+const LEGACY_DAEMON_KEYCHAIN_SERVICE = "ai.oversky.daemon";
+const LIVE_DEFAULT_PROFILE = "default";
+function keychainSuffixForDir(dir) {
+  const resolved = import_node_path.default.resolve(dir.replace(/\/+$/, ""));
+  return `-${(0, import_node_crypto.createHash)("sha256").update(resolved).digest("hex").toLowerCase().slice(0, 8)}`;
+}
+const UNVERIFIABLE_DEFAULT_SLOT_RE = new RegExp(`^(?:${DAEMON_KEYCHAIN_SERVICE_BASE.replace(/\./g, "\\.")}|${DAEMON_BYOK_KEYCHAIN_SERVICE_BASE.replace(/\./g, "\\.")})\\.${LIVE_DEFAULT_PROFILE}-[0-9a-f]{8}$`);
+function liveKeychainServices(probe = {}) {
+  const services = /* @__PURE__ */ new Set([
+    import_masterKekService.MASTER_KEK_KEYCHAIN_SERVICE,
+    ...import_localIdentity.LEGACY_NATIVE_ID_PREFIXES.map((prefix) => `${prefix}.daemon.kek`),
+    `${DAEMON_KEYCHAIN_SERVICE_BASE}.${LIVE_DEFAULT_PROFILE}`,
+    DAEMON_KEYCHAIN_SERVICE_BASE,
+    LEGACY_DAEMON_KEYCHAIN_SERVICE
+  ]);
+  const root = liveStateRoot(probeHome(probe));
+  if (root) {
+    const suffix = keychainSuffixForDir(import_node_path.default.resolve(root, "profiles", LIVE_DEFAULT_PROFILE));
+    services.add(`${DAEMON_KEYCHAIN_SERVICE_BASE}.${LIVE_DEFAULT_PROFILE}${suffix}`);
+    services.add(`${DAEMON_BYOK_KEYCHAIN_SERVICE_BASE}.${LIVE_DEFAULT_PROFILE}${suffix}`);
+  }
+  return services;
+}
+function isLiveKeychainService(service, probe = {}) {
+  if (liveKeychainServices(probe).has(service))
+    return true;
+  return probeHome(probe) === null && UNVERIFIABLE_DEFAULT_SLOT_RE.test(service);
+}
+function refusesLiveKeychainMutation(service, probe = {}) {
+  const env = probe.env ?? process.env;
+  return refusesLiveStateInTest(env, probe.execArgv ?? process.execArgv, probe.argv) && isLiveKeychainService(service, probe);
+}
+function assertMayMutateLiveKeychain(service, what, probe = {}, hint) {
+  const env = probe.env ?? process.env;
+  const signal = testProcessSignal(env, probe.execArgv ?? process.execArgv, probe.argv);
+  if (signal === null || env[ALLOW_LIVE_STATE_ENV] === "1")
+    return;
+  if (!isLiveKeychainService(service, probe))
+    return;
+  let where = "";
+  if (probe.keychainFile !== void 0) {
+    const why = pathRefusal(probe.keychainFile, probe, env);
+    if (why === null)
+      return;
+    where = `, in a keychain that is not shown to be anyone else's (${why})`;
+  }
+  throw new LiveStateRefusedError(what, service, signal, `the Keychain service ${service} is one the installed product reads${where}`, hint);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ALLOW_LIVE_STATE_ENV,
+  CONFIG_DIR_NAME,
+  DAEMON_BYOK_KEYCHAIN_SERVICE_BASE,
+  DAEMON_KEYCHAIN_SERVICE_BASE,
+  HERMETIC_HOME_ENV,
+  LEGACY_DAEMON_KEYCHAIN_SERVICE,
+  LIVE_DEFAULT_PROFILE,
+  LIVE_STATE_REFUSED_CODE,
+  LiveStateRefusedError,
+  __setAccountHomeForTest,
+  accountHomeDir,
+  assertMayMutateLiveKeychain,
+  assertMayMutateLiveState,
+  isLiveKeychainService,
+  isLiveStateRefusal,
+  isTestProcess,
+  keychainSuffixForDir,
+  liveKeychainServices,
+  liveStateRoot,
+  refusesLiveKeychainMutation,
+  refusesLiveStateInTest,
+  rethrowIfLiveStateRefusal,
+  testProcessSignal
+});

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineId.js

@@ -37,7 +37,9 @@ var import_node_crypto = __toESM(require("node:crypto"), 1);
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_os = __toESM(require("node:os"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
+var import_liveState = require("./liveState.js");
 var import_runtime = require("./runtime.js");
+var import_stateFiles = require("./stateFiles.js");
 const DAEMON_ID_FILENAME = "daemon.id";
 const PROFILES_DIRNAME = "profiles";
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
@@ -67,14 +69,14 @@ function isUuidLike(raw) {
 }
 function writeDaemonIdFile(target, id) {
   const dir = import_node_path.default.dirname(target);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+  (0, import_stateFiles.ensureStateDir)(dir, "create the machine id directory");
   const tmp = `${target}.tmp.${process.pid}.${Math.random().toString(36).slice(2, 10)}`;
-  import_node_fs.default.writeFileSync(tmp, id + "\n", { encoding: "utf-8", mode: 384 });
+  (0, import_stateFiles.writeStateFile)(tmp, id + "\n", { encoding: "utf-8", mode: 384 }, "write the machine id");
   try {
     import_node_fs.default.chmodSync(tmp, 384);
   } catch {
   }
-  import_node_fs.default.renameSync(tmp, target);
+  (0, import_stateFiles.renameStateFile)(tmp, target, "write the machine id");
 }
 function defaultMachineUuidFallback() {
   const host = import_node_os.default.hostname() || "unknown-host";
@@ -118,6 +120,7 @@ function ensureMachineDaemonId(machineUuidFallback) {
     cachedStableDaemonId = fresh;
     return fresh;
   } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
     log.warn(`[machineIdentity] persist ${target} failed: ${err.message} \u2014 using fallback`);
     const fallback = `fallback-${fallbackFn()}`;
     cachedStableDaemonId = fallback;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/machineUuid.js

@@ -47,6 +47,8 @@ var import_node_os = __toESM(require("node:os"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_node_child_process = require("node:child_process");
 var import_configRoot = require("./configRoot.js");
+var import_liveState = require("./liveState.js");
+var import_stateFiles = require("./stateFiles.js");
 const HOSTED_RUNTIME_MACHINE_SOURCES = /* @__PURE__ */ new Set([
   "hosted-machine",
   "cloud-coding",
@@ -152,7 +154,7 @@ function readPersistedChoice(file, hardware, profile, requireProfile = false) {
 }
 function persistChoice(dir, file, hardware, machineUuid, reason, profile, evidence) {
   try {
-    import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
+    (0, import_stateFiles.ensureStateDir)(dir, "create the machine identity directory");
     const tmp = `${file}.${process.pid}.${Date.now()}.tmp`;
     const body = {
       version: 1,
@@ -168,10 +170,11 @@ function persistChoice(dir, file, hardware, machineUuid, reason, profile, eviden
       ...evidence && evidence.length > 0 ? { evidence: [...evidence] } : {},
       decidedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
-    import_node_fs.default.writeFileSync(tmp, `${JSON.stringify(body)}
-`, { mode: 384 });
-    import_node_fs.default.renameSync(tmp, file);
-  } catch {
+    (0, import_stateFiles.writeStateFile)(tmp, `${JSON.stringify(body)}
+`, { mode: 384 }, "write the machine identity");
+    (0, import_stateFiles.renameStateFile)(tmp, file, "write the machine identity");
+  } catch (err) {
+    (0, import_liveState.rethrowIfLiveStateRefusal)(err);
   }
 }
 function recoveryChoicePath(profile) {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/profileStateDir.js

@@ -45,6 +45,7 @@ var import_node_crypto = require("node:crypto");
 var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_runtime = require("./runtime.js");
+var import_stateFiles = require("./stateFiles.js");
 const PROFILES_SEGMENT = "profiles";
 const SUPERSEDED_MARKER_SUFFIX = ".superseded.json";
 const SUPERSEDED_COPY_SUFFIX = ".superseded";
@@ -190,28 +191,6 @@ function sha256OfFile(target) {
     return null;
   }
 }
-function atomicWrite0600(target, value) {
-  const dir = import_node_path.default.dirname(target);
-  import_node_fs.default.mkdirSync(dir, { recursive: true, mode: 448 });
-  const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
-  const fd = import_node_fs.default.openSync(tmp, "w", 384);
-  try {
-    import_node_fs.default.writeSync(fd, value);
-    import_node_fs.default.fsyncSync(fd);
-  } finally {
-    import_node_fs.default.closeSync(fd);
-  }
-  import_node_fs.default.renameSync(tmp, target);
-  try {
-    const dirFd = import_node_fs.default.openSync(dir, "r");
-    try {
-      import_node_fs.default.fsyncSync(dirFd);
-    } finally {
-      import_node_fs.default.closeSync(dirFd);
-    }
-  } catch {
-  }
-}
 function adopt(fromDir, toDir, files, dryRun) {
   const written = [];
   for (const name of files) {
@@ -219,8 +198,9 @@ function adopt(fromDir, toDir, files, dryRun) {
     if (!existsFile(source))
       continue;
     const target = import_node_path.default.join(toDir, name);
-    if (!dryRun)
-      atomicWrite0600(target, import_node_fs.default.readFileSync(source));
+    if (!dryRun) {
+      (0, import_stateFiles.atomicWrite0600)(target, import_node_fs.default.readFileSync(source), `adopt ${name} into ${toDir}`);
+    }
     written.push(target);
   }
   return { written, supersededAside: [] };
@@ -232,7 +212,7 @@ function moveAside(dir, files, suffix = SUPERSEDED_COPY_SUFFIX) {
     const target = import_node_path.default.join(dir, name);
     if (!existsFile(target))
       continue;
-    import_node_fs.default.renameSync(target, `${target}${suffix}.${stamp}`);
+    (0, import_stateFiles.renameStateFile)(target, `${target}${suffix}.${stamp}`, `set aside ${target}`);
     aside.push(target);
   }
   return aside;
@@ -248,8 +228,8 @@ function writeMarker(markerPath, supersededBy, reason) {
     at: (/* @__PURE__ */ new Date()).toISOString(),
     note: "Kept deliberately. This file is the pre-consolidation copy (OSK-10314); older binaries read it and it is the only rollback that needs no operator step. Remove it only through logout."
   };
-  atomicWrite0600(markerPath, Buffer.from(`${JSON.stringify(payload, null, 2)}
-`, "utf-8"));
+  (0, import_stateFiles.atomicWrite0600)(markerPath, Buffer.from(`${JSON.stringify(payload, null, 2)}
+`, "utf-8"), `write the consolidation marker ${markerPath}`);
 }
 function emitOutcome(spec, status, meta) {
   spec.onEvent?.(`path_consolidation.${status}`, status !== "conflict", {

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/refresh.d.ts

@@ -231,7 +231,7 @@ export type DeviceProofSigner = (params: {
     method: string;
     url: string;
     refreshToken: string;
-}) => string | null | undefined;
+}) => string | null | undefined | Promise<string | null | undefined>;
 export declare function refreshDaemonToken(serverUrl: string, currentRefreshToken: string, daemonId: string, options?: {
     machineUuid?: string;
     origin?: string;