@skrr-ai/cli 0.1.44 → 0.1.46

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/profileStateDir.js

@@ -0,0 +1,346 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = void 0;
+exports.profileStateDir = profileStateDir;
+exports.legacyProfileStateDir = legacyProfileStateDir;
+exports.resolveProfileStateDir = resolveProfileStateDir;
+exports.resolveProfileStateFile = resolveProfileStateFile;
+exports.profileStateFileLocations = profileStateFileLocations;
+exports.consolidateProfileState = consolidateProfileState;
+exports.profileStateFilePathsToClear = profileStateFilePathsToClear;
+/**
+ * profileStateDir.ts — the ONE definition of where a profile's auth state lives
+ * on disk, and the migration for a machine that ended up with two.
+ *
+ * A profile is this product's unit of credential isolation, and its state has
+ * exactly one home:
+ *
+ *   <machine root>/profiles/<profile>/cred-dek-wrapped
+ *   <machine root>/profiles/<profile>/cred-envelope.lock
+ *   <machine root>/profiles/<profile>/device-private-key
+ *   …
+ *
+ * It lives here, next to `configRoot.ts`, for the same reason that file exists:
+ * both binaries need the same answer and neither owns it. `configRoot.ts` made
+ * "where is the skrr root" one function; this makes "where is a profile's auth
+ * state" one function, because the layer above it had the identical defect one
+ * level down.
+ *
+ * WHAT WENT WRONG (OSK-10314). `credentialEnvelopeBridge` and
+ * `deviceIdentityBridge` each wrote `path.join(getAuthConfigDir(), 'profiles',
+ * profile)` — two independent spellings of one rule — and `configDir` means
+ * different things to the two consumers:
+ *
+ *   - the CLI passes the MACHINE ROOT, so it landed on the layout above;
+ *   - the daemon passes `getConfigDir()`, which is ALREADY `<root>/profiles/<p>`,
+ *     so it landed on `<root>/profiles/<p>/profiles/<p>/…`.
+ *
+ * One profile therefore had two wrapped DEKs, two device keypairs and two
+ * lockfiles, and the lockfile the shared module exists to share served neither
+ * of the two processes it was meant to serialize. Nothing cross-read, so
+ * nothing broke — it was a split-brain waiting for the first cross-read.
+ *
+ * The fix is to derive the directory from `getAuthMachineConfigDir()`, which
+ * BOTH consumers already wire explicitly (daemon: `getMachineConfigDir()`; CLI:
+ * the skrr root). Note what is deliberately NOT done: the daemon is not asked to
+ * pass a different `configDir`. It has one knob and auth-core needs two answers
+ * from it — `refresh.ts` reads `getAuthConfigDir()` raw for `auth.lock` and
+ * `needs-reauth.json`, so repointing the daemon's `configDir` at the machine
+ * root would quietly move its reauth latch from per-profile to machine-wide and
+ * let one profile latch every profile. Profile-scoped and root-scoped artifacts
+ * are only distinguishable INSIDE auth-core, so that is where the line is drawn.
+ *
+ * WHY A BARE PATH SWAP IS NOT THE FIX. A daemon with a nested wrapped DEK has
+ * sealed real credentials under it. Pointing it at the canonical path hands it a
+ * DIFFERENT DEK and every one of those credentials stops decrypting — a silent,
+ * fleet-wide forced re-login, to repair a bug that had so far harmed nobody. So
+ * the resolver PREFERS THE FILE A PROCESS IS ALREADY USING until a migration has
+ * proved the canonical one is equivalent, and the migration COPIES.
+ *
+ * Resolution order for `<filename>` under `<profile>` (stateless — no ordering
+ * requirement between this and any init):
+ *
+ *   1. legacy dir IS the canonical dir (the CLI)      → canonical
+ *   2. no legacy copy of the file                      → canonical
+ *   3. a `<filename>.superseded.json` marker beside it → canonical (consolidated)
+ *   4. no canonical copy of the file                   → legacy (not yet consolidated)
+ *   5. both copies, no marker                          → legacy (unresolved: stay put)
+ *
+ * The migration writes the marker, never deletes, and refuses case 5 when both
+ * sides hold a usable and DIFFERENT key — because merging those would require
+ * re-sealing content that lives in the OS keychain and is not auth-core's to
+ * re-seal. A human resolves that one, and the loud signal is the deliverable.
+ *
+ * ROLLBACK. The legacy file is left exactly where it was, under its own name.
+ * Older code looks there, finds it, and works — no operator step. The marker is
+ * a sidecar older code never reads.
+ */
+const node_crypto_1 = require("node:crypto");
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const runtime_js_1 = require("./runtime.js");
+/** Directory segment that separates per-profile state from machine-scoped state. */
+exports.PROFILES_SEGMENT = 'profiles';
+/**
+ * Sidecar written beside a legacy file once it has been consolidated. Its
+ * PRESENCE is what flips resolution to the canonical copy; its contents are for
+ * a human reading the directory afterwards.
+ */
+exports.SUPERSEDED_MARKER_SUFFIX = '.superseded.json';
+/**
+ * Suffix for a canonical file moved aside to make room. Only used when the
+ * canonical copy existed and was NOT usable — a usable one is never replaced.
+ */
+exports.SUPERSEDED_COPY_SUFFIX = '.superseded';
+/** The canonical directory for a profile's auth state. */
+function profileStateDir(profile) {
+    assertProfile(profile);
+    return node_path_1.default.join((0, runtime_js_1.getAuthMachineConfigDir)(), exports.PROFILES_SEGMENT, profile);
+}
+/**
+ * Where a consumer whose `configDir` is already profile-scoped used to write.
+ *
+ * `null` when it resolves to the canonical directory — i.e. the consumer passes
+ * the machine root and never had a second location. Callers branch on `null`
+ * rather than comparing strings so the "one root" case costs one check.
+ */
+function legacyProfileStateDir(profile) {
+    assertProfile(profile);
+    const legacy = node_path_1.default.join((0, runtime_js_1.getAuthConfigDir)(), exports.PROFILES_SEGMENT, profile);
+    const canonical = profileStateDir(profile);
+    return node_path_1.default.resolve(legacy) === node_path_1.default.resolve(canonical) ? null : legacy;
+}
+/**
+ * Resolve the directory holding `primaryFilename` for `profile`.
+ *
+ * `primaryFilename` is the file whose presence decides where a group of related
+ * files lives. Device identity has four files that must be read from ONE
+ * directory — a public JWK from one copy and a private key from the other is a
+ * keypair mismatch — so the group anchors on the private key rather than each
+ * file answering for itself.
+ */
+function resolveProfileStateDir(profile, primaryFilename) {
+    const canonicalDir = profileStateDir(profile);
+    const legacyDir = legacyProfileStateDir(profile);
+    if (legacyDir === null) {
+        return { dir: canonicalDir, canonicalDir, legacyDir: null, usingLegacy: false };
+    }
+    const legacyFile = node_path_1.default.join(legacyDir, primaryFilename);
+    const stayOnLegacy = existsFile(legacyFile) && !existsFile(`${legacyFile}${exports.SUPERSEDED_MARKER_SUFFIX}`);
+    return {
+        dir: stayOnLegacy ? legacyDir : canonicalDir,
+        canonicalDir,
+        legacyDir,
+        usingLegacy: stayOnLegacy,
+    };
+}
+/** `resolveProfileStateDir` for a single self-anchoring file. */
+function resolveProfileStateFile(profile, filename) {
+    const resolved = resolveProfileStateDir(profile, filename);
+    return {
+        ...resolved,
+        path: node_path_1.default.join(resolved.dir, filename),
+        canonicalPath: node_path_1.default.join(resolved.canonicalDir, filename),
+        legacyPath: resolved.legacyDir === null ? null : node_path_1.default.join(resolved.legacyDir, filename),
+    };
+}
+/** Every location `filename` may occupy for `profile`, canonical first. */
+function profileStateFileLocations(profile, filename) {
+    const canonicalDir = profileStateDir(profile);
+    const legacyDir = legacyProfileStateDir(profile);
+    const out = [node_path_1.default.join(canonicalDir, filename)];
+    if (legacyDir !== null)
+        out.push(node_path_1.default.join(legacyDir, filename));
+    return out;
+}
+/**
+ * Consolidate a profile's state onto the canonical path. Idempotent, additive,
+ * and refuses rather than guesses.
+ *
+ * The one case it will not decide is two usable, different keys for one profile:
+ * each side has sealed content under its own, that content lives in the OS
+ * keychain, and nothing here can re-seal it. Picking a winner there would
+ * destroy the loser's credentials silently, which is the exact failure this
+ * whole module exists to avoid.
+ */
+async function consolidateProfileState(profile, spec) {
+    assertProfile(profile);
+    const dryRun = spec.dryRun === true;
+    const canonicalDir = profileStateDir(profile);
+    const legacyDir = legacyProfileStateDir(profile);
+    const base = { profile, canonicalDir, legacyDir, written: [], supersededAside: [], dryRun };
+    if (legacyDir === null)
+        return { ...base, status: 'not_applicable' };
+    const legacyPrimary = node_path_1.default.join(legacyDir, spec.primary);
+    if (!existsFile(legacyPrimary))
+        return { ...base, status: 'nothing_to_migrate' };
+    const markerPath = `${legacyPrimary}${exports.SUPERSEDED_MARKER_SUFFIX}`;
+    if (existsFile(markerPath))
+        return { ...base, status: 'already_consolidated' };
+    const canonicalPrimary = node_path_1.default.join(canonicalDir, spec.primary);
+    if (!existsFile(canonicalPrimary)) {
+        const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
+        if (!dryRun)
+            writeMarker(markerPath, canonicalPrimary, 'adopted');
+        emitOutcome(spec, 'adopted', { profile, from: legacyDir, to: canonicalDir });
+        return { ...base, status: 'adopted', ...moved };
+    }
+    const identify = spec.identify ?? ((dir) => sha256OfFile(node_path_1.default.join(dir, spec.primary)));
+    const legacyIdentity = await identify(legacyDir);
+    const canonicalIdentity = await identify(canonicalDir);
+    const identities = { canonical: canonicalIdentity, legacy: legacyIdentity };
+    // Same state in both places, or the legacy copy is unreadable while the
+    // canonical one is fine. Either way the canonical copy is authoritative and
+    // the legacy one has nothing to contribute — record that and move on.
+    const sameState = legacyIdentity !== null && canonicalIdentity !== null && legacyIdentity === canonicalIdentity;
+    const legacyHasNothingToOffer = legacyIdentity === null && canonicalIdentity !== null;
+    const bothUnreadableButIdentical = legacyIdentity === null &&
+        canonicalIdentity === null &&
+        sha256OfFile(legacyPrimary) !== null &&
+        sha256OfFile(legacyPrimary) === sha256OfFile(canonicalPrimary);
+    if (sameState || legacyHasNothingToOffer || bothUnreadableButIdentical) {
+        if (!dryRun)
+            writeMarker(markerPath, canonicalPrimary, 'already_consolidated');
+        emitOutcome(spec, 'already_consolidated', { profile, identities });
+        return { ...base, status: 'already_consolidated', identities };
+    }
+    // The legacy copy is usable and the canonical one is not. Nothing is sealed
+    // under an unreadable key that was not already lost, so replacing it costs
+    // nothing — but keep it, because "unreadable here, today" is not "worthless".
+    if (legacyIdentity !== null && canonicalIdentity === null) {
+        const aside = dryRun
+            ? plannedAside(canonicalDir, spec.files)
+            : moveAside(canonicalDir, spec.files);
+        const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
+        if (!dryRun)
+            writeMarker(markerPath, canonicalPrimary, 'superseded');
+        emitOutcome(spec, 'superseded', { profile, identities, supersededAside: aside });
+        return {
+            ...base,
+            status: 'superseded',
+            written: moved.written,
+            supersededAside: aside,
+            identities,
+        };
+    }
+    emitOutcome(spec, 'conflict', { profile, identities, canonicalDir, legacyDir });
+    return { ...base, status: 'conflict', identities };
+}
+/**
+ * Every path a profile's copy of `filename` can occupy, plus its marker —
+ * what a genuine logout must remove. Deliberately separate from the migration:
+ * this module never deletes, and logout is the one caller that must.
+ */
+function profileStateFilePathsToClear(profile, filename) {
+    const out = [];
+    for (const location of profileStateFileLocations(profile, filename)) {
+        out.push(location);
+        out.push(`${location}${exports.SUPERSEDED_MARKER_SUFFIX}`);
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// internals
+// ---------------------------------------------------------------------------
+function assertProfile(profile) {
+    if (typeof profile !== 'string' || profile.length === 0) {
+        throw new Error('profileStateDir: profile must be a non-empty string');
+    }
+}
+function existsFile(target) {
+    try {
+        return node_fs_1.default.statSync(target).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+function sha256OfFile(target) {
+    try {
+        return (0, node_crypto_1.createHash)('sha256').update(node_fs_1.default.readFileSync(target)).digest('hex');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * tmp + fsync + rename + dir-fsync, 0600. The same shape the two bridges
+ * already use, so a crash mid-migration leaves either the old file or the new
+ * one and never a half-written key.
+ */
+function atomicWrite0600(target, value) {
+    const dir = node_path_1.default.dirname(target);
+    node_fs_1.default.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const tmp = `${target}.tmp.${process.pid}.${Date.now()}`;
+    const fd = node_fs_1.default.openSync(tmp, 'w', 0o600);
+    try {
+        node_fs_1.default.writeSync(fd, value);
+        node_fs_1.default.fsyncSync(fd);
+    }
+    finally {
+        node_fs_1.default.closeSync(fd);
+    }
+    node_fs_1.default.renameSync(tmp, target);
+    try {
+        const dirFd = node_fs_1.default.openSync(dir, 'r');
+        try {
+            node_fs_1.default.fsyncSync(dirFd);
+        }
+        finally {
+            node_fs_1.default.closeSync(dirFd);
+        }
+    }
+    catch {
+        /* best-effort — Windows / some BSDs reject dir fsync */
+    }
+}
+function adopt(fromDir, toDir, files, dryRun) {
+    const written = [];
+    for (const name of files) {
+        const source = node_path_1.default.join(fromDir, name);
+        if (!existsFile(source))
+            continue;
+        const target = node_path_1.default.join(toDir, name);
+        if (!dryRun)
+            atomicWrite0600(target, node_fs_1.default.readFileSync(source));
+        written.push(target);
+    }
+    return { written, supersededAside: [] };
+}
+function moveAside(dir, files) {
+    const stamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const aside = [];
+    for (const name of files) {
+        const target = node_path_1.default.join(dir, name);
+        if (!existsFile(target))
+            continue;
+        node_fs_1.default.renameSync(target, `${target}${exports.SUPERSEDED_COPY_SUFFIX}.${stamp}`);
+        aside.push(target);
+    }
+    return aside;
+}
+function plannedAside(dir, files) {
+    return files.map((name) => node_path_1.default.join(dir, name)).filter((target) => existsFile(target));
+}
+function writeMarker(markerPath, supersededBy, reason) {
+    const payload = {
+        supersededBy,
+        reason,
+        sha256: sha256OfFile(supersededBy),
+        at: new Date().toISOString(),
+        note: 'Kept deliberately. This file is the pre-consolidation copy (OSK-10314); ' +
+            'older binaries read it and it is the only rollback that needs no operator step. ' +
+            'Remove it only through logout.',
+    };
+    atomicWrite0600(markerPath, Buffer.from(`${JSON.stringify(payload, null, 2)}\n`, 'utf-8'));
+}
+function emitOutcome(spec, status, meta) {
+    spec.onEvent?.(`path_consolidation.${status}`, status !== 'conflict', {
+        ...meta,
+        primary: spec.primary,
+        ...(spec.dryRun === true ? { dryRun: true } : {}),
+    });
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.d.ts

@@ -36,6 +36,14 @@ export declare function initCredEnvelope(profile: string): Promise<void>;
  * Reset state. With `clearOnDisk` deletes the wrapped DEK file too —
  * used by `oversky logout` / `sky logout`. Zeroes the in-memory DEK
  * before dropping state for forward secrecy on the active credential.
+ *
+ * It deletes EVERY location this profile's key can occupy, plus the
+ * consolidation marker. `profileStateDir.ts` never deletes anything and says so;
+ * this is the one caller that must, and the reason is not symmetry — a logout
+ * that removed only the canonical copy would leave the pre-consolidation copy
+ * behind, and the next init would adopt it straight back. That is a deleted
+ * credential key resurrecting itself, which is a worse bug than the one this
+ * whole change is fixing.
  */
 export declare function resetCredEnvelope(opts?: {
     profile?: string;
@@ -49,6 +57,17 @@ export declare function __resetShutdownGuardForTest(): void;
  * predicate used by sync transforms; never throws.
  */
 export declare function isCredEnvelopeActive(): boolean;
+/**
+ * True while this profile holds two usable and different wrapped DEKs.
+ *
+ * Read by `deviceIdentityBridge` before it migrates anything of its own. The
+ * device private key is sealed with whichever DEK is active, so moving it to the
+ * canonical directory while the two binaries are still on DIFFERENT DEKs hands
+ * the other one a key it cannot open — it regenerates, overwrites, and the two
+ * processes then destroy each other's device identity on every start. Unresolved
+ * conflicts freeze the whole profile's layout, not just the DEK's.
+ */
+export declare function hasCredEnvelopePathConflict(): boolean;
 /**
  * Operator-readable summary of envelope state. Used by `oversky status`
  * and CLI debug commands. Never includes the DEK or any key material.
@@ -65,6 +84,16 @@ export declare function describeCredEnvelopeState(): {
     kekKind?: string | null;
     profile?: string;
     kekRotated?: boolean;
+    /**
+     * Set when this profile holds two usable and DIFFERENT wrapped DEKs and the
+     * consolidation refused to pick one (OSK-10314). The envelope is fully
+     * operational — this process reads the key it has always read — but the other
+     * binary is holding a different one and cannot read what this one seals.
+     */
+    pathConflict?: {
+        canonicalPath: string;
+        legacyPath: string;
+    };
 };
 /**
  * Sync write transform. Returns the wrapped serialized form when active.