@skrr-ai/cli 0.1.51 → 0.1.53

package/dist/lib/refresh.js

@@ -27,6 +27,7 @@ Object.defineProperty(exports, "PermanentAuthFailure", { enumerable: true, get:
 Object.defineProperty(exports, "TransientAuthFailure", { enumerable: true, get: function () { return auth_core_1.TransientAuthFailure; } });
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
+const cli_id_1 = require("./cli-id");
 const credential_resolver_1 = require("./credential-resolver");
 const device_identity_1 = require("./device-identity");
 exports.CLI_REFRESH_EARLY_MS = 5 * 60 * 1000;
@@ -182,7 +183,10 @@ async function ensureFreshCliCredential(opts = {}) {
  */
 async function refreshCliToken() {
     const cfg = (0, config_1.loadConfig)();
-    if (!cfg.cliId) {
+    // The id the stored credential was minted under — the machine id, or this
+    // profile's own (OSK-12156). One resolver, so refresh cannot disagree with login.
+    const cliId = (0, cli_id_1.resolveCliId)(cfg);
+    if (!cliId) {
         throw new CliRefreshUnavailableError('No CLI identity persisted (cliId). Run `skrr login` to initialize.');
     }
     const origin = getCliOrigin();
@@ -195,7 +199,7 @@ async function refreshCliToken() {
         if (!bundle?.refreshToken) {
             throw new CliRefreshUnavailableError('No refresh token available — sign in with `skrr login`.');
         }
-        const pair = await (0, auth_core_1.refreshDaemonToken)(serverUrl, bundle.refreshToken, cfg.cliId, 
+        const pair = await (0, auth_core_1.refreshDaemonToken)(serverUrl, bundle.refreshToken, cliId, 
         // L11 Phase 3 — attach a device-identity proof to every refresh.
         // The signer returns null when device identity isn't initialized
         // (Phase 1 binary, KEK rotation hot path), and the server's lenient

package/dist/lib/tasks.js

@@ -587,14 +587,24 @@ async function resolveTaskCreateScope(payload, opts = {}) {
             payload.spaceId = parentSpaceId;
     }
     const projectId = stringValue(payload.projectId);
-    if (projectId && !stringValue(payload.spaceId)) {
+    // A Mongo `_id` is resolved even beside --space: the server addresses a
+    // project by its `id` or its ref only, so passing the `_id` through would
+    // fail there with less to say about it (OSK-12054).
+    if (projectId && (!stringValue(payload.spaceId) || looksLikeStorageId(projectId))) {
         const project = await getCachedProject(projectId, opts.projectCache);
         resolution.project = project;
-        const projectSpaceId = stringValue(project.spaceId);
-        if (!projectSpaceId) {
-            throw new Error(`Project ${projectId} did not return an owning space`);
+        // Accepting a second spelling obliges returning the canonical one: the
+        // write carries `id`, never whatever the caller happened to paste.
+        const canonicalId = stringValue(project.id);
+        if (canonicalId && canonicalId !== projectId)
+            payload.projectId = canonicalId;
+        if (!stringValue(payload.spaceId)) {
+            const projectSpaceId = stringValue(project.spaceId);
+            if (!projectSpaceId) {
+                throw new Error(`Project ${projectId} did not return an owning space`);
+            }
+            payload.spaceId = projectSpaceId;
         }
-        payload.spaceId = projectSpaceId;
     }
     return resolution;
 }
@@ -894,21 +904,36 @@ async function getCachedTask(taskIdValue, cache) {
     }
     return cache.get(taskIdValue);
 }
+/** A 24-hex Mongo ObjectId — the storage `_id` entity JSON prints beside `id`. */
+const STORAGE_ID_RE = /^[0-9a-f]{24}$/i;
+function looksLikeStorageId(value) {
+    return STORAGE_ID_RE.test(value);
+}
+/**
+ * Entity JSON prints both `id` (canonical) and `_id` (storage) with nothing
+ * saying which one commands take, so a pasted `_id` is accepted as the same
+ * project rather than refused as unknown (OSK-12054). The caller then writes
+ * the canonical `id` — see `resolveTaskCreateScope`.
+ */
+function projectMatchesId(project, ref) {
+    return String(project.id ?? '') === ref || String(project._id ?? '') === ref;
+}
 async function getCachedProject(projectId, cache) {
     const load = async () => {
         const filtered = await projects_1.projectApi.search({ q: projectId, limit: 20 });
-        let exact = (0, projects_1.projectsFrom)(filtered).filter((project) => String(project.id ?? project._id ?? '') === projectId);
+        let exact = (0, projects_1.projectsFrom)(filtered).filter((project) => projectMatchesId(project, projectId));
         // The cross-space endpoint's `q` contract covers title/description/ref,
         // not UUID. Fall back to the bounded visible project catalog so canonical
         // IDs still resolve without inventing a second project read endpoint.
         if (exact.length === 0) {
             const catalog = await projects_1.projectApi.search({ limit: 200 });
-            exact = (0, projects_1.projectsFrom)(catalog).filter((project) => String(project.id ?? project._id ?? '') === projectId);
+            exact = (0, projects_1.projectsFrom)(catalog).filter((project) => projectMatchesId(project, projectId));
         }
         if (exact.length !== 1) {
             throw new Error(exact.length > 1
                 ? `Project id ${projectId} matched multiple projects`
-                : `Project id ${projectId} was not found; pass a canonical project id or add --space`);
+                : `Project ${projectId} was not found among the projects you can see. Pass the ` +
+                    "project's `id` (the uuid `projects list` prints), or its ref (OSK-P-5) together with --space");
         }
         return exact[0];
     };

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.d.ts

@@ -141,7 +141,19 @@ export interface ReadTransformResult {
      *  path is active — caller should re-write to upgrade. */
     needsMigration: boolean;
 }
-export declare function maybeDecryptOnRead(stored: string): ReadTransformResult;
+/** What the caller knows about the stored value that the envelope does not. */
+export interface DecryptOnReadOptions {
+    /**
+     * Replaces the default `decrypt_failed` hint. The default says a re-login
+     * rebuilds the credential, which is true only of THIS config's own value. A
+     * caller reading a value another config sealed under its own key knows the
+     * failure is expected and a re-login here changes nothing (OSK-12135).
+     */
+    unreadableHint?: string;
+}
+/** The `decrypt_failed` hint when the caller has no better explanation. */
+export declare const DEFAULT_UNREADABLE_CREDENTIAL_HINT = "stored credential is unreadable on this machine \u2014 signing in again rebuilds it";
+export declare function maybeDecryptOnRead(stored: string, options?: DecryptOnReadOptions): ReadTransformResult;
 /** @internal Test seam — wrapped-DEK path resolver. */
 export declare function __wrappedDekFilePathForTest(profile: string): string;
 export {};

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -3,6 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = void 0;
 exports.__setStateForTest = __setStateForTest;
 exports.__getStateForTest = __getStateForTest;
 exports.__clearWarnDedupeForTest = __clearWarnDedupeForTest;
@@ -165,7 +166,10 @@ function emit(eventName, success, metadata) {
         metadata: { event: eventName, ...metadata },
     });
     if (!success) {
-        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}`;
+        // The hint is part of the signature: the same crypto failure on this
+        // config's own credential and on another config's is two different facts,
+        // and the second must not swallow the first (OSK-12135).
+        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}:${metadata.hint ?? ''}`;
         if (!warnedSignatures.has(signature)) {
             if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
                 warnedSignatures.clear();
@@ -755,7 +759,9 @@ function wrapIfActiveOrPassthrough(plaintext) {
         return plaintext;
     }
 }
-function maybeDecryptOnRead(stored) {
+/** The `decrypt_failed` hint when the caller has no better explanation. */
+exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = 'stored credential is unreadable on this machine — signing in again rebuilds it';
+function maybeDecryptOnRead(stored, options = {}) {
     if (typeof stored !== 'string' || stored.length === 0) {
         return { plaintext: stored, needsMigration: false };
     }
@@ -787,7 +793,7 @@ function maybeDecryptOnRead(stored) {
                 // The crypto error alone reads as a crash; the actionable truth is
                 // that this stored credential is unreadable by THIS binary (usually
                 // a signing-identity or profile drift) and re-login rebuilds it.
-                hint: 'stored credential is unreadable on this machine — signing in again rebuilds it',
+                hint: options.unreadableHint ?? exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT,
             });
             return { plaintext: null, needsMigration: false };
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.d.ts

@@ -27,7 +27,7 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
-export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
+export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/index.js

@@ -24,9 +24,9 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateVerifier = exports.invalidateHeadersHelperCache = exports.runHeadersHelper = exports.SENTINEL_TRIGGERING_FAILURES = exports.__resetAuthHelperFailureReasonForTest = exports.getLastAuthHelperFailureReason = exports.getDefaultHelperTtlMs = exports.invokeAuthHelper = exports.AuthHelperUnavailableError = exports.AuthHelperUntrustedError = exports.CI_TOKEN_PREFIX = exports.classifyTokenKind = exports.invalidateAuthHelperCache = exports.__resetCredentialResolverForTest = exports.CREDENTIAL_PRECEDENCE = exports.CredentialResolver = exports.__setFdReaderForTest = exports.readAuthFromFd = exports.createRefreshScheduler = exports.UNKNOWN_401_BUDGET = exports.__resetUnknown401StreaksForTest = exports.__refreshDiagnostics = exports.installLockExitHandlers = exports.clearReauthState = exports.needsReauthState = exports.persistReauthState = exports.withAuthLock = exports.revokeDaemonRefreshSession = exports.refreshDaemonToken = exports.classifyRefreshResponse = exports.EXIT_NEEDS_REAUTH = exports.reauthCommand = exports.formatReauthMessage = exports.handleMidStreamAuthExpiry = exports.isAuthExpiredSseEvent = exports.decodeJwtPayload = exports.decodeJwtExpiry = exports.TransientAuthFailure = exports.PermanentAuthFailure = exports.emitAuthTelemetry = exports.getAuthBinaryName = exports.getAuthKillSwitches = exports.getAuthConfigDir = exports.getAuthLogger = exports.configureAuthCore = exports.OAUTH_CLI_SCOPE = exports.isDaemonScope = exports.VALID_DAEMON_SCOPE_SET = exports.ALL_DAEMON_SCOPES = exports.SCOPES = void 0;
 exports.publicJwkFromX = exports.normalizeHtu = exports.jwkThumbprint = exports.generateDeviceKeyPair = exports.buildDeviceProof = exports.zeroizeKekCaches = exports.WindowsKek = exports.registerZeroizeHook = exports.MacosKek = exports.LinuxKek = exports.KekUnavailableError = exports.UnavailableKek = exports.InMemoryKek = exports.getKekStrategy = exports.__setKekStrategyForTest = exports.credEnvelopeWrap = exports.credEnvelopeUnwrap = exports.credEnvelopeSerialize = exports.credSealBuffer = exports.credOpenBuffer = exports.CRED_KEY_LEN = exports.isCredEnvelopeString = exports.generateDek = exports.CRED_ENVELOPE_MAGIC = exports.credEnvelopeEncrypt = exports.credEnvelopeDeserialize = exports.credEnvelopeDecrypt = exports.buildCredentialAad = exports.isValidRecoveryCode = exports.normalizeRecoveryCode = exports.parseRecoveryCode = exports.formatRecoveryCode = exports.MAX_TTL_DAYS = exports.MIN_TTL_DAYS = exports.parseTtlDays = exports.LoginExchangeError = exports.LoginInitError = exports.loginWithLocalhost = exports.LocalCallbackMalformedError = exports.LocalCallbackDeniedError = exports.LocalCallbackStateMismatchError = exports.LocalCallbackTimeoutError = exports.LocalCallbackBindError = exports.LocalCallbackError = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.startLocalCallback = exports.verifyChallenge = exports.safeEqual = exports.generateState = exports.challenge = void 0;
-exports.parsePairBundle = exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
-exports.MAX_SIGS = exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = void 0;
-exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = void 0;
+exports.openPairBundleBase64 = exports.generatePairKeyPair = exports.buildPairUrl = exports.buildPairAad = exports.pairBase64UrlToUint8Array = exports.pairBase64ToUint8Array = exports.assemblePairBundleBase64 = exports.PairBundleError = exports.PAIR_SECRET_LEN = exports.PAIR_PUBKEY_LEN = exports.PAIR_NONCE_LEN = exports.PAIR_BUNDLE_MAX_BASE64_LEN = exports.PAIR_AAD_MAX_LEN = exports.PAIR_AAD_PREFIX = exports.__resetCachedDaemonIdForTest = exports.legacyDaemonUuids = exports.ensureMachineDaemonId = exports.__resetMachineUuidCacheForTest = exports.HOSTED_RUNTIME_MACHINE_SOURCES = exports.hostedRuntimeIdOverride = exports.getMachineUuid = exports.__getDeviceIdentityStateForTest = exports.__setDeviceIdentityStateForTest = exports.__enrollmentBackoffPathForTest = exports.__enrollmentMarkerPathForTest = exports.__privateKeyPathForTest = exports.__publicKeyPathForTest = exports.describeDeviceIdentityState = exports.getDevicePublicKey = exports.isDeviceIdentityActive = exports.clearEnrollmentMarker = exports.enrollWithServer = exports.signServerRequest = exports.resetDeviceIdentity = exports.initDeviceIdentity = exports.__resetShutdownGuardForTest = exports.__getCredEnvelopeStateForTest = exports.__setCredEnvelopeStateForTest = exports.__wrappedDekFilePathForTest = exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = exports.maybeDecryptOnRead = exports.maybeEncryptForWrite = exports.describeCredEnvelopeState = exports.hasCredEnvelopePathConflict = exports.isCredEnvelopeActive = exports.shutdownCredEnvelope = exports.resetCredEnvelope = exports.initCredEnvelope = exports.verifyDeviceProof = exports.tokenHash = void 0;
+exports.OVERSKY_RELEASE_PUBLIC_KEYS = exports.resolveFirstPartyHarnessChannel = exports.resolveChannelManifestUrl = exports.isFirstPartyHarnessChannel = exports.firstPartyHarnessFeedCandidates = exports.firstPartyHarnessFeedBase = exports.firstPartyHarnessChannelPrefix = exports.FIRST_PARTY_HARNESS_CHANNELS = exports.DEFAULT_FIRST_PARTY_HARNESS_CHANNEL = exports.migrateFirstPartyHarnessHome = exports.linkFirstPartyHarnessAliases = exports.firstPartyHarnessInstalledBinaryPath = exports.firstPartyHarnessHomeDir = exports.firstPartyHarnessBinDir = exports.FIRST_PARTY_HARNESS_PROVENANCE_SUFFIX = exports.FIRST_PARTY_HARNESS_PREVIOUS_SUFFIX = exports.describeLegacyState = exports.findLegacyLocalState = exports.DEFAULT_BINARY_NAME = exports.LEGACY_NATIVE_ID_PREFIXES = exports.NATIVE_ID_PREFIX = exports.LEGACY_CONFIG_DIR_NAMES = exports.CONFIG_DIR_NAME = exports.LOOPBACK_DEFAULT_MAX_BODY_BYTES = exports.LoopbackTargetRefusedError = exports.isLoopbackAddress = exports.isLoopbackHostname = exports.assertLoopbackHttpUrl = exports.loopbackFetch = exports.withLoopbackNoProxy = exports.envHasProxy = exports.LOOPBACK_NO_PROXY_HOSTS = exports.SENSITIVE_ENV_PREFIX_EXCEPTIONS = exports.SENSITIVE_ENV_NAME_TOKENS = exports.SENSITIVE_ENV_SUFFIXES = exports.SENSITIVE_ENV_PREFIXES = exports.SENSITIVE_ENV_VARS = exports.sanitizeSpawnEnv = exports.harnessLoadsClaudeSkillsLayout = exports.claudeSkillsLayoutEvidence = exports.HARNESSES_LOADING_CLAUDE_SKILLS_LAYOUT = exports.tierPermitsConfiguredAutoMode = exports.credentialPolicyForTier = exports.getHarnessTier = exports.HARNESS_TIERS = exports.pairUint8ArrayToBase64Url = exports.pairUint8ArrayToBase64 = exports.parsePairUrl = exports.parsePairPlaintext = exports.parsePairBundle = void 0;
+exports.consolidateProfileState = exports.profileStateFilePathsToClear = exports.profileStateFileLocations = exports.resolveProfileStateFile = exports.resolveProfileStateDir = exports.legacyProfileStateDir = exports.profileStateDir = exports.SUPERSEDED_COPY_SUFFIX = exports.SUPERSEDED_MARKER_SUFFIX = exports.PROFILES_SEGMENT = exports.isConfigRootOverridden = exports.configRootPath = exports.resolveConfigRoot = exports.verifyManifest = exports.verifyArtifact = exports.isTrustedArtifactOrigin = exports.getDeltaFor = exports.buildManifestMessage = exports.buildArtifactMessage = exports.TRUSTED_FEED_ORIGINS = exports.MAX_SIGS = void 0;
 // Daemon scope vocabulary — single source of truth for non-Mongoose tiers
 // (daemon, desktop, cli). Schema-bound canonical lives in
 // `@skrr-ai/data-schemas/common/daemonScopes`; the two are kept byte-equal
@@ -234,6 +234,7 @@ Object.defineProperty(exports, "hasCredEnvelopePathConflict", { enumerable: true
 Object.defineProperty(exports, "describeCredEnvelopeState", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.describeCredEnvelopeState; } });
 Object.defineProperty(exports, "maybeEncryptForWrite", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.maybeEncryptForWrite; } });
 Object.defineProperty(exports, "maybeDecryptOnRead", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.maybeDecryptOnRead; } });
+Object.defineProperty(exports, "DEFAULT_UNREADABLE_CREDENTIAL_HINT", { enumerable: true, get: function () { return credentialEnvelopeBridge_js_1.DEFAULT_UNREADABLE_CREDENTIAL_HINT; } });
 // Test seams — `__`-prefixed so consumers don't import them in
 // production code paths. Re-exported here so CLI/daemon spec files
 // can resolve the wrapped-DEK path against the same module instance.

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.d.ts

@@ -141,7 +141,19 @@ export interface ReadTransformResult {
      *  path is active — caller should re-write to upgrade. */
     needsMigration: boolean;
 }
-export declare function maybeDecryptOnRead(stored: string): ReadTransformResult;
+/** What the caller knows about the stored value that the envelope does not. */
+export interface DecryptOnReadOptions {
+    /**
+     * Replaces the default `decrypt_failed` hint. The default says a re-login
+     * rebuilds the credential, which is true only of THIS config's own value. A
+     * caller reading a value another config sealed under its own key knows the
+     * failure is expected and a re-login here changes nothing (OSK-12135).
+     */
+    unreadableHint?: string;
+}
+/** The `decrypt_failed` hint when the caller has no better explanation. */
+export declare const DEFAULT_UNREADABLE_CREDENTIAL_HINT = "stored credential is unreadable on this machine \u2014 signing in again rebuilds it";
+export declare function maybeDecryptOnRead(stored: string, options?: DecryptOnReadOptions): ReadTransformResult;
 /** @internal Test seam — wrapped-DEK path resolver. */
 export declare function __wrappedDekFilePathForTest(profile: string): string;
 export {};

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -146,7 +146,10 @@ function emit(eventName, success, metadata) {
         metadata: { event: eventName, ...metadata },
     });
     if (!success) {
-        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}`;
+        // The hint is part of the signature: the same crypto failure on this
+        // config's own credential and on another config's is two different facts,
+        // and the second must not swallow the first (OSK-12135).
+        const signature = `${eventName}:${metadata.kekId ?? ''}:${metadata.kekKind ?? ''}:${metadata.message ?? ''}:${metadata.hint ?? ''}`;
         if (!warnedSignatures.has(signature)) {
             if (warnedSignatures.size >= MAX_WARNED_SIGNATURES)
                 warnedSignatures.clear();
@@ -736,7 +739,9 @@ export function wrapIfActiveOrPassthrough(plaintext) {
         return plaintext;
     }
 }
-export function maybeDecryptOnRead(stored) {
+/** The `decrypt_failed` hint when the caller has no better explanation. */
+export const DEFAULT_UNREADABLE_CREDENTIAL_HINT = 'stored credential is unreadable on this machine — signing in again rebuilds it';
+export function maybeDecryptOnRead(stored, options = {}) {
     if (typeof stored !== 'string' || stored.length === 0) {
         return { plaintext: stored, needsMigration: false };
     }
@@ -768,7 +773,7 @@ export function maybeDecryptOnRead(stored) {
                 // The crypto error alone reads as a crash; the actionable truth is
                 // that this stored credential is unreadable by THIS binary (usually
                 // a signing-identity or profile drift) and re-login rebuilds it.
-                hint: 'stored credential is unreadable on this machine — signing in again rebuilds it',
+                hint: options.unreadableHint ?? DEFAULT_UNREADABLE_CREDENTIAL_HINT,
             });
             return { plaintext: null, needsMigration: false };
         }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -27,7 +27,7 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
-export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
+export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
 export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -108,7 +108,7 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 // Daemon and CLI consume these; the underlying primitives live above.
 export { 
 // credEnvelope bridge
-initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, 
+initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
 // Test seams — `__`-prefixed so consumers don't import them in
 // production code paths. Re-exported here so CLI/daemon spec files
 // can resolve the wrapped-DEK path against the same module instance.

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {