@skrr-ai/cli 0.1.50 → 0.1.52

package/dist/lib/auth-core-init.js

@@ -9,7 +9,6 @@ exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
 exports.prefetchCliAuth = prefetchCliAuth;
 exports.waitForCliCredentialEnvelope = waitForCliCredentialEnvelope;
 exports.__resetPrefetchCliAuthForTest = __resetPrefetchCliAuthForTest;
-exports.shouldUseAccessTokenForEnrollment = shouldUseAccessTokenForEnrollment;
 /**
  * auth-core-init.ts — wire @skrr-ai/auth-core into the Sky CLI process.
  *
@@ -31,8 +30,8 @@ exports.shouldUseAccessTokenForEnrollment = shouldUseAccessTokenForEnrollment;
  *     share the daemon's on-disk artifacts (~/.skrr/profiles/<p>/...)
  *     so a single physical machine has ONE device identity that `skrr`
  *     and `oversky` both consume.
- *   - Fire-and-forget enrollment when an access token is already
- *     present — short-circuits silently on a fresh install before login.
+ *   - No server enrollment of the device key: that is the daemon login
+ *     path's job (OSK-12063 — see `ensureCliAuthPrefetchStarted`).
  */
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
@@ -41,7 +40,6 @@ const auth_core_1 = require("@skrr-ai/auth-core");
 const cred_envelope_1 = require("./cred-envelope");
 const device_identity_1 = require("./device-identity");
 const auth_storage_1 = require("./auth-storage");
-const config_1 = require("./config");
 function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'TRUE';
@@ -135,7 +133,6 @@ const PREFETCH_TIMEOUT_MS = 5_000;
 // with a 100–400 ms backoff (~20 s worst-case). Encrypted credentials get this
 // larger, still-finite budget so lock contention cannot masquerade as logout.
 const ENCRYPTED_CREDENTIAL_INIT_TIMEOUT_MS = 25_000;
-const PREFETCH_ENROLL_MIN_TTL_MS = 5 * 60 * 1000;
 let configured = false;
 function ensureAuthCoreConfigured() {
     if (configured)
@@ -247,31 +244,22 @@ function ensureCliAuthPrefetchStarted() {
         try {
             await envelopeInit;
             await (0, device_identity_1.initDeviceIdentity)(DEFAULT_PROFILE);
-            // Fire-and-forget enrollment. Only attempts when a token is on disk
-            // (i.e., the user has already logged in on this machine). A fresh
-            // install before first login simply skips this branch.
-            const cfg = (0, config_1.loadConfig)();
-            const authBundle = peekStoredAuthBundle(cfg.baseURL);
-            if (!authBundle?.token)
-                return;
-            if (!shouldUseAccessTokenForEnrollment(authBundle))
-                return;
-            if (!(0, device_identity_1.getDevicePublicKey)())
-                return;
-            // machineUuid: shared per-machine UUIDv7 minted by auth-core and
-            // persisted at `~/.skrr/daemon.id`. CLI and daemon both read
-            // and write the same file, so a single physical machine has ONE
-            // identifier across binaries. If the file doesn't exist when CLI
-            // runs first, CLI mints it; when the daemon later starts it
-            // reads the same value.
-            const machineUuid = (0, auth_core_1.ensureMachineDaemonId)();
-            (0, device_identity_1.enrollWithServer)({
-                serverUrl: cfg.baseURL,
-                accessToken: authBundle.token,
-                machineUuid,
-            }).catch(() => {
-                /* enrollment failure is non-fatal */
-            });
+            // The CLI deliberately does NOT enroll a device key with the server
+            // (OSK-12063). Enrollment pins the FIRST key presented on a machine's
+            // Daemon row, and every later refresh signed by a different key is
+            // refused. The CLI and the daemon of one profile can hold DIFFERENT
+            // keys (OSK-10314: the daemon stays on the legacy nested profile dir
+            // while consolidation is deferred), so a CLI enrollment could pin a
+            // key the daemon never signs with and lock the daemon out for good.
+            // Enrollment belongs to the daemon's own login path, which enrolls
+            // the key it will actually use.
+            //
+            // Until OSK-12063 this block did enroll, sending the minted UUIDv7
+            // from `~/.skrr/daemon.id` as `machineUuid`. The comment above it
+            // claimed that was the daemon's identifier too; it was not — the
+            // daemon sends the hardware UUID (`getMachineUuid()`), so every CLI
+            // enrollment 404'd DAEMON_NOT_FOUND and backed off. That 404 was the
+            // only thing keeping the pinning hazard above from firing.
         }
         catch (err) {
             if (process.env.DEBUG) {
@@ -292,15 +280,9 @@ function ensureCliAuthPrefetchStarted() {
  *      `isCredEnvelopeActive()` to decide whether to wrap the private
  *      key on persist.
  *   2. `initDeviceIdentity` second.
- *   3. Server enrollment is fire-and-forget; only attempts if a current
- *      access token is already on disk (peek via the file backend slot
- *      so a missing token short-circuits cleanly without creating a
- *      whole CredentialResolver chain here).
  *
- * The peek path uses `backends.readKeychainToken / readFileToken`
- * directly so we don't accidentally trigger an interactive prompt or
- * spawn the auth-helper when the user is unauthenticated. Mirrors the
- * daemon's `peekAuthAccessToken()` shape.
+ * The CLI never enrolls the device key with the server; see the comment
+ * in `ensureCliAuthPrefetchStarted` (OSK-12063).
  */
 async function prefetchCliAuth() {
     ensureCliAuthPrefetchStarted();
@@ -343,35 +325,6 @@ function __resetPrefetchCliAuthForTest() {
     _credEnvelopeInitPromise = null;
     _credEnvelopeInitStartedAt = 0;
 }
-/**
- * Read the access token from keychain/file backends WITHOUT firing the
- * full CredentialResolver chain. The full chain might prompt, spawn the
- * auth-helper, or have other side effects we don't want during a
- * prefetch-on-init pass.
- */
-function peekStoredAuthBundle(expectedServerOrigin) {
-    try {
-        return (0, auth_storage_1.readFromBackend)(expectedServerOrigin).bundle;
-    }
-    catch {
-        return null;
-    }
-}
-function shouldUseAccessTokenForEnrollment(bundle, nowMs = Date.now(), minTtlMs = PREFETCH_ENROLL_MIN_TTL_MS) {
-    if (!bundle?.token)
-        return false;
-    const expMs = accessExpiryMs(bundle);
-    if (expMs === undefined)
-        return true;
-    return expMs - nowMs > minTtlMs;
-}
-function accessExpiryMs(bundle) {
-    if (typeof bundle.expiresAt === 'number' && Number.isFinite(bundle.expiresAt)) {
-        return bundle.expiresAt;
-    }
-    const exp = (0, auth_core_1.decodeJwtExpiry)(bundle.token);
-    return typeof exp === 'number' && Number.isFinite(exp) ? exp * 1000 : undefined;
-}
 // Eager-configure on first import. Cheap and avoids ordering pitfalls in
 // any future command that calls auth-core helpers from outside a Command.
 ensureAuthCoreConfigured();

package/dist/lib/auth-failure.d.ts

@@ -0,0 +1,33 @@
+/**
+ * auth-failure.ts — say WHY a request was refused on authentication (OSK-12116).
+ *
+ * A 401 reaches the CLI after its own renewal has already failed: the access
+ * token expired, the refresh was refused, and the retry went out with the dead
+ * token. The server's answer to that retry is `TOKEN_EXPIRED`, which is true and
+ * useless — the expiry is routine, the refusal to RENEW is the fault, and it was
+ * visible only as an `[auth-core warn]` line on stderr.
+ *
+ * auth-core latches every permanent refresh refusal (`needs-reauth.json`, the
+ * same record `skrr whoami` prints as "Refresh state"). This module reads that
+ * latch and turns it into the sentence the error should have carried.
+ */
+export interface RefreshRefusal {
+    /** Permanent reason code the refresh latched (`REFRESH_INVALID`, `SESSION_REVOKED`, …). */
+    reason?: string;
+    /** The server's own message for the refusal, when auth-core recorded one. */
+    message?: string;
+}
+export interface DescribedAuthFailure {
+    message: string;
+    /** The code a script should key on: the refresh refusal when known. */
+    code: string;
+}
+/**
+ * Explain one refresh refusal in terms of what the reader can do about it.
+ * Returns null when there is no latched refusal, so the caller keeps its
+ * generic wording rather than inventing a cause.
+ */
+export declare function describeRefreshRefusal(refusal: RefreshRefusal | null | undefined, opts: {
+    bin: string;
+    cliId?: string;
+}): DescribedAuthFailure | null;

package/dist/lib/auth-failure.js

@@ -0,0 +1,68 @@
+"use strict";
+/**
+ * auth-failure.ts — say WHY a request was refused on authentication (OSK-12116).
+ *
+ * A 401 reaches the CLI after its own renewal has already failed: the access
+ * token expired, the refresh was refused, and the retry went out with the dead
+ * token. The server's answer to that retry is `TOKEN_EXPIRED`, which is true and
+ * useless — the expiry is routine, the refusal to RENEW is the fault, and it was
+ * visible only as an `[auth-core warn]` line on stderr.
+ *
+ * auth-core latches every permanent refresh refusal (`needs-reauth.json`, the
+ * same record `skrr whoami` prints as "Refresh state"). This module reads that
+ * latch and turns it into the sentence the error should have carried.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeRefreshRefusal = describeRefreshRefusal;
+/**
+ * Explain one refresh refusal in terms of what the reader can do about it.
+ * Returns null when there is no latched refusal, so the caller keeps its
+ * generic wording rather than inventing a cause.
+ */
+function describeRefreshRefusal(refusal, opts) {
+    if (!refusal?.reason)
+        return null;
+    const { bin } = opts;
+    const code = refusal.reason;
+    const said = refusal.message ? ` (${code}: ${refusal.message})` : ` (${code})`;
+    const relogin = `Run \`${bin} login\` to sign in again.`;
+    const message = refusal.message ?? '';
+    // The row the stored refresh token belongs to was minted for a different CLI
+    // identity than the one this config presents. The keychain slot is keyed by
+    // profile, while the CLI ID lives in the config directory — so a second skrr
+    // configuration on this machine (a different HOME or config dir sharing the
+    // same login Keychain) can write this profile's credential under its own ID.
+    // Observed: a token minted for `cli_devin_dogfood` sitting in the default
+    // profile's slot. Since OSK-12135 the slot is namespaced by config root and a
+    // read refuses a bundle bound to another cliId before presenting it, so this
+    // is now reached only when the server's binding disagrees with a token that
+    // carries no readable `did`.
+    if (/bound to a different daemon/i.test(message)) {
+        return {
+            code,
+            message: `This profile's stored sign-in could not be renewed${said}. The credential in its ` +
+                `Keychain slot was issued to a different CLI identity than this one` +
+                `${opts.cliId ? ` (${opts.cliId})` : ''} — usually another skrr configuration on this ` +
+                `machine (a different HOME or config directory) signed in and wrote over it. ${relogin}`,
+        };
+    }
+    if (code === 'SESSION_REVOKED') {
+        return {
+            code,
+            message: `This sign-in was revoked${said}. Signing out elsewhere revokes it, and so does ` +
+                `revoking a daemon that brokered it (\`${bin} login\` without a browser signs in ` +
+                `through this machine's daemon). ${relogin}`,
+        };
+    }
+    if (code === 'REFRESH_REUSED') {
+        return {
+            code,
+            message: `This sign-in was ended because its refresh token was presented twice${said}; the ` +
+                `server treats that as possible theft and revokes the whole family. ${relogin}`,
+        };
+    }
+    return {
+        code,
+        message: `This sign-in could not be renewed${said}. ${relogin}`,
+    };
+}

package/dist/lib/auth-storage.d.ts

@@ -6,14 +6,33 @@ export interface AuthBundle {
     refreshExpiresAt?: number;
     /** Normalized API origin that issued this access/refresh pair. */
     serverOrigin?: string;
+    /**
+     * The config that wrote this bundle, as stored. Filled on write from the
+     * current config; callers never need to set it.
+     */
+    owner?: CredentialOwner;
+}
+/** Which skrr config a credential belongs to. */
+export interface CredentialOwner {
+    /** Resolved config root (`~/.skrr`, or the `SKRR_CONFIG_DIR` override). */
+    configRoot?: string;
+    /** The CLI identity the server bound the refresh family to. */
+    cliId?: string;
 }
 export type CredentialOriginStatus = 'none' | 'unchecked' | 'matched' | 'unbound' | 'mismatch';
+/** `foreign`: the stored bundle belongs to another skrr config and was not used. */
+export type CredentialOwnerStatus = 'foreign';
 export interface ReadResult {
     bundle: AuthBundle | null;
     backend: AuthBackend;
     originStatus?: CredentialOriginStatus;
     storedServerOrigin?: string;
     expectedServerOrigin?: string;
+    ownerStatus?: CredentialOwnerStatus;
+    /** For `foreign`: who the stored bundle belongs to. */
+    storedOwner?: CredentialOwner;
+    /** For `foreign`: who this process is. */
+    expectedOwner?: CredentialOwner;
 }
 export interface WriteOptions {
     /** Bind/overwrite the bundle's issuing origin. Invalid origins are rejected. */
@@ -47,6 +66,11 @@ export declare function deleteFileBackend(): void;
  * function returns whatever is persisted.
  */
 export declare function readFromBackend(expectedServerOrigin?: string): ReadResult;
+/**
+ * One sentence naming whose credential was refused and why, for the surfaces
+ * that explain an absent sign-in (BaseCommand, `skrr doctor`).
+ */
+export declare function describeForeignCredential(result: ReadResult): string | null;
 export declare function writeToBackend(bundle: AuthBundle, options?: WriteOptions): AuthBackend;
 /**
  * Clear both backends. Called on `skrr logout` (and internally during