@skrr-ai/cli 0.1.44 → 0.1.46

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/profileStateDir.js

@@ -0,0 +1,333 @@
+/**
+ * profileStateDir.ts — the ONE definition of where a profile's auth state lives
+ * on disk, and the migration for a machine that ended up with two.
+ *
+ * A profile is this product's unit of credential isolation, and its state has
+ * exactly one home:
+ *
+ *   <machine root>/profiles/<profile>/cred-dek-wrapped
+ *   <machine root>/profiles/<profile>/cred-envelope.lock
+ *   <machine root>/profiles/<profile>/device-private-key
+ *   …
+ *
+ * It lives here, next to `configRoot.ts`, for the same reason that file exists:
+ * both binaries need the same answer and neither owns it. `configRoot.ts` made
+ * "where is the skrr root" one function; this makes "where is a profile's auth
+ * state" one function, because the layer above it had the identical defect one
+ * level down.
+ *
+ * WHAT WENT WRONG (OSK-10314). `credentialEnvelopeBridge` and
+ * `deviceIdentityBridge` each wrote `path.join(getAuthConfigDir(), 'profiles',
+ * profile)` — two independent spellings of one rule — and `configDir` means
+ * different things to the two consumers:
+ *
+ *   - the CLI passes the MACHINE ROOT, so it landed on the layout above;
+ *   - the daemon passes `getConfigDir()`, which is ALREADY `<root>/profiles/<p>`,
+ *     so it landed on `<root>/profiles/<p>/profiles/<p>/…`.
+ *
+ * One profile therefore had two wrapped DEKs, two device keypairs and two
+ * lockfiles, and the lockfile the shared module exists to share served neither
+ * of the two processes it was meant to serialize. Nothing cross-read, so
+ * nothing broke — it was a split-brain waiting for the first cross-read.
+ *
+ * The fix is to derive the directory from `getAuthMachineConfigDir()`, which
+ * BOTH consumers already wire explicitly (daemon: `getMachineConfigDir()`; CLI:
+ * the skrr root). Note what is deliberately NOT done: the daemon is not asked to
+ * pass a different `configDir`. It has one knob and auth-core needs two answers
+ * from it — `refresh.ts` reads `getAuthConfigDir()` raw for `auth.lock` and
+ * `needs-reauth.json`, so repointing the daemon's `configDir` at the machine
+ * root would quietly move its reauth latch from per-profile to machine-wide and
+ * let one profile latch every profile. Profile-scoped and root-scoped artifacts
+ * are only distinguishable INSIDE auth-core, so that is where the line is drawn.
+ *
+ * WHY A BARE PATH SWAP IS NOT THE FIX. A daemon with a nested wrapped DEK has
+ * sealed real credentials under it. Pointing it at the canonical path hands it a
+ * DIFFERENT DEK and every one of those credentials stops decrypting — a silent,
+ * fleet-wide forced re-login, to repair a bug that had so far harmed nobody. So
+ * the resolver PREFERS THE FILE A PROCESS IS ALREADY USING until a migration has
+ * proved the canonical one is equivalent, and the migration COPIES.
+ *
+ * Resolution order for `<filename>` under `<profile>` (stateless — no ordering
+ * requirement between this and any init):
+ *
+ *   1. legacy dir IS the canonical dir (the CLI)      → canonical
+ *   2. no legacy copy of the file                      → canonical
+ *   3. a `<filename>.superseded.json` marker beside it → canonical (consolidated)
+ *   4. no canonical copy of the file                   → legacy (not yet consolidated)
+ *   5. both copies, no marker                          → legacy (unresolved: stay put)
+ *
+ * The migration writes the marker, never deletes, and refuses case 5 when both
+ * sides hold a usable and DIFFERENT key — because merging those would require
+ * re-sealing content that lives in the OS keychain and is not auth-core's to
+ * re-seal. A human resolves that one, and the loud signal is the deliverable.
+ *
+ * ROLLBACK. The legacy file is left exactly where it was, under its own name.
+ * Older code looks there, finds it, and works — no operator step. The marker is
+ * a sidecar older code never reads.
+ */
+import { createHash } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { getAuthConfigDir, getAuthMachineConfigDir } from './runtime.js';
+/** Directory segment that separates per-profile state from machine-scoped state. */
+export const PROFILES_SEGMENT = 'profiles';
+/**
+ * Sidecar written beside a legacy file once it has been consolidated. Its
+ * PRESENCE is what flips resolution to the canonical copy; its contents are for
+ * a human reading the directory afterwards.
+ */
+export const SUPERSEDED_MARKER_SUFFIX = '.superseded.json';
+/**
+ * Suffix for a canonical file moved aside to make room. Only used when the
+ * canonical copy existed and was NOT usable — a usable one is never replaced.
+ */
+export const SUPERSEDED_COPY_SUFFIX = '.superseded';
+/** The canonical directory for a profile's auth state. */
+export function profileStateDir(profile) {
+    assertProfile(profile);
+    return path.join(getAuthMachineConfigDir(), PROFILES_SEGMENT, profile);
+}
+/**
+ * Where a consumer whose `configDir` is already profile-scoped used to write.
+ *
+ * `null` when it resolves to the canonical directory — i.e. the consumer passes
+ * the machine root and never had a second location. Callers branch on `null`
+ * rather than comparing strings so the "one root" case costs one check.
+ */
+export function legacyProfileStateDir(profile) {
+    assertProfile(profile);
+    const legacy = path.join(getAuthConfigDir(), PROFILES_SEGMENT, profile);
+    const canonical = profileStateDir(profile);
+    return path.resolve(legacy) === path.resolve(canonical) ? null : legacy;
+}
+/**
+ * Resolve the directory holding `primaryFilename` for `profile`.
+ *
+ * `primaryFilename` is the file whose presence decides where a group of related
+ * files lives. Device identity has four files that must be read from ONE
+ * directory — a public JWK from one copy and a private key from the other is a
+ * keypair mismatch — so the group anchors on the private key rather than each
+ * file answering for itself.
+ */
+export function resolveProfileStateDir(profile, primaryFilename) {
+    const canonicalDir = profileStateDir(profile);
+    const legacyDir = legacyProfileStateDir(profile);
+    if (legacyDir === null) {
+        return { dir: canonicalDir, canonicalDir, legacyDir: null, usingLegacy: false };
+    }
+    const legacyFile = path.join(legacyDir, primaryFilename);
+    const stayOnLegacy = existsFile(legacyFile) && !existsFile(`${legacyFile}${SUPERSEDED_MARKER_SUFFIX}`);
+    return {
+        dir: stayOnLegacy ? legacyDir : canonicalDir,
+        canonicalDir,
+        legacyDir,
+        usingLegacy: stayOnLegacy,
+    };
+}
+/** `resolveProfileStateDir` for a single self-anchoring file. */
+export function resolveProfileStateFile(profile, filename) {
+    const resolved = resolveProfileStateDir(profile, filename);
+    return {
+        ...resolved,
+        path: path.join(resolved.dir, filename),
+        canonicalPath: path.join(resolved.canonicalDir, filename),
+        legacyPath: resolved.legacyDir === null ? null : path.join(resolved.legacyDir, filename),
+    };
+}
+/** Every location `filename` may occupy for `profile`, canonical first. */
+export function profileStateFileLocations(profile, filename) {
+    const canonicalDir = profileStateDir(profile);
+    const legacyDir = legacyProfileStateDir(profile);
+    const out = [path.join(canonicalDir, filename)];
+    if (legacyDir !== null)
+        out.push(path.join(legacyDir, filename));
+    return out;
+}
+/**
+ * Consolidate a profile's state onto the canonical path. Idempotent, additive,
+ * and refuses rather than guesses.
+ *
+ * The one case it will not decide is two usable, different keys for one profile:
+ * each side has sealed content under its own, that content lives in the OS
+ * keychain, and nothing here can re-seal it. Picking a winner there would
+ * destroy the loser's credentials silently, which is the exact failure this
+ * whole module exists to avoid.
+ */
+export async function consolidateProfileState(profile, spec) {
+    assertProfile(profile);
+    const dryRun = spec.dryRun === true;
+    const canonicalDir = profileStateDir(profile);
+    const legacyDir = legacyProfileStateDir(profile);
+    const base = { profile, canonicalDir, legacyDir, written: [], supersededAside: [], dryRun };
+    if (legacyDir === null)
+        return { ...base, status: 'not_applicable' };
+    const legacyPrimary = path.join(legacyDir, spec.primary);
+    if (!existsFile(legacyPrimary))
+        return { ...base, status: 'nothing_to_migrate' };
+    const markerPath = `${legacyPrimary}${SUPERSEDED_MARKER_SUFFIX}`;
+    if (existsFile(markerPath))
+        return { ...base, status: 'already_consolidated' };
+    const canonicalPrimary = path.join(canonicalDir, spec.primary);
+    if (!existsFile(canonicalPrimary)) {
+        const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
+        if (!dryRun)
+            writeMarker(markerPath, canonicalPrimary, 'adopted');
+        emitOutcome(spec, 'adopted', { profile, from: legacyDir, to: canonicalDir });
+        return { ...base, status: 'adopted', ...moved };
+    }
+    const identify = spec.identify ?? ((dir) => sha256OfFile(path.join(dir, spec.primary)));
+    const legacyIdentity = await identify(legacyDir);
+    const canonicalIdentity = await identify(canonicalDir);
+    const identities = { canonical: canonicalIdentity, legacy: legacyIdentity };
+    // Same state in both places, or the legacy copy is unreadable while the
+    // canonical one is fine. Either way the canonical copy is authoritative and
+    // the legacy one has nothing to contribute — record that and move on.
+    const sameState = legacyIdentity !== null && canonicalIdentity !== null && legacyIdentity === canonicalIdentity;
+    const legacyHasNothingToOffer = legacyIdentity === null && canonicalIdentity !== null;
+    const bothUnreadableButIdentical = legacyIdentity === null &&
+        canonicalIdentity === null &&
+        sha256OfFile(legacyPrimary) !== null &&
+        sha256OfFile(legacyPrimary) === sha256OfFile(canonicalPrimary);
+    if (sameState || legacyHasNothingToOffer || bothUnreadableButIdentical) {
+        if (!dryRun)
+            writeMarker(markerPath, canonicalPrimary, 'already_consolidated');
+        emitOutcome(spec, 'already_consolidated', { profile, identities });
+        return { ...base, status: 'already_consolidated', identities };
+    }
+    // The legacy copy is usable and the canonical one is not. Nothing is sealed
+    // under an unreadable key that was not already lost, so replacing it costs
+    // nothing — but keep it, because "unreadable here, today" is not "worthless".
+    if (legacyIdentity !== null && canonicalIdentity === null) {
+        const aside = dryRun
+            ? plannedAside(canonicalDir, spec.files)
+            : moveAside(canonicalDir, spec.files);
+        const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
+        if (!dryRun)
+            writeMarker(markerPath, canonicalPrimary, 'superseded');
+        emitOutcome(spec, 'superseded', { profile, identities, supersededAside: aside });
+        return {
+            ...base,
+            status: 'superseded',
+            written: moved.written,
+            supersededAside: aside,
+            identities,
+        };
+    }
+    emitOutcome(spec, 'conflict', { profile, identities, canonicalDir, legacyDir });
+    return { ...base, status: 'conflict', identities };
+}
+/**
+ * Every path a profile's copy of `filename` can occupy, plus its marker —
+ * what a genuine logout must remove. Deliberately separate from the migration:
+ * this module never deletes, and logout is the one caller that must.
+ */
+export function profileStateFilePathsToClear(profile, filename) {
+    const out = [];
+    for (const location of profileStateFileLocations(profile, filename)) {
+        out.push(location);
+        out.push(`${location}${SUPERSEDED_MARKER_SUFFIX}`);
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// internals
+// ---------------------------------------------------------------------------
+function assertProfile(profile) {
+    if (typeof profile !== 'string' || profile.length === 0) {
+        throw new Error('profileStateDir: profile must be a non-empty string');
+    }
+}
+function existsFile(target) {
+    try {
+        return fs.statSync(target).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function sha256OfFile(target) {
+    try {
+        return createHash('sha256').update(fs.readFileSync(target)).digest('hex');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * tmp + fsync + rename + dir-fsync, 0600. The same shape the two bridges
+ * already use, so a crash mid-migration leaves either the old file or the new
+ * one and never a half-written key.
+ */
+function atomicWrite0600(target, value) {
+    const dir = path.dirname(target);
+    fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+    const fd = fs.openSync(tmp, 'w', 0o600);
+    try {
+        fs.writeSync(fd, value);
+        fs.fsyncSync(fd);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+    fs.renameSync(tmp, target);
+    try {
+        const dirFd = fs.openSync(dir, 'r');
+        try {
+            fs.fsyncSync(dirFd);
+        }
+        finally {
+            fs.closeSync(dirFd);
+        }
+    }
+    catch {
+        /* best-effort — Windows / some BSDs reject dir fsync */
+    }
+}
+function adopt(fromDir, toDir, files, dryRun) {
+    const written = [];
+    for (const name of files) {
+        const source = path.join(fromDir, name);
+        if (!existsFile(source))
+            continue;
+        const target = path.join(toDir, name);
+        if (!dryRun)
+            atomicWrite0600(target, fs.readFileSync(source));
+        written.push(target);
+    }
+    return { written, supersededAside: [] };
+}
+function moveAside(dir, files) {
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const aside = [];
+    for (const name of files) {
+        const target = path.join(dir, name);
+        if (!existsFile(target))
+            continue;
+        fs.renameSync(target, `${target}${SUPERSEDED_COPY_SUFFIX}.${stamp}`);
+        aside.push(target);
+    }
+    return aside;
+}
+function plannedAside(dir, files) {
+    return files.map((name) => path.join(dir, name)).filter((target) => existsFile(target));
+}
+function writeMarker(markerPath, supersededBy, reason) {
+    const payload = {
+        supersededBy,
+        reason,
+        sha256: sha256OfFile(supersededBy),
+        at: new Date().toISOString(),
+        note: 'Kept deliberately. This file is the pre-consolidation copy (OSK-10314); ' +
+            'older binaries read it and it is the only rollback that needs no operator step. ' +
+            'Remove it only through logout.',
+    };
+    atomicWrite0600(markerPath, Buffer.from(`${JSON.stringify(payload, null, 2)}\n`, 'utf-8'));
+}
+function emitOutcome(spec, status, meta) {
+    spec.onEvent?.(`path_consolidation.${status}`, status !== 'conflict', {
+        ...meta,
+        primary: spec.primary,
+        ...(spec.dryRun === true ? { dryRun: true } : {}),
+    });
+}

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.0",
+  "version": "0.4.2",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {
@@ -33,6 +33,16 @@
         "types": "./dist/cjs/firstPartyHarness.d.ts",
         "default": "./dist/cjs/firstPartyHarness.js"
       }
+    },
+    "./harness-skill-layout": {
+      "import": {
+        "types": "./dist/esm/harnessSkillLayout.d.ts",
+        "default": "./dist/esm/harnessSkillLayout.js"
+      },
+      "require": {
+        "types": "./dist/cjs/harnessSkillLayout.d.ts",
+        "default": "./dist/cjs/harnessSkillLayout.js"
+      }
     }
   },
   "dependencies": {