@skrr-ai/cli 0.1.54 → 0.1.55

package/dist/lib/auth-core-init.d.ts

@@ -1,3 +1,22 @@
+/**
+ * A credential-envelope failure that carries a hint, as ONE plain line
+ * (OSK-12180) — or null when the warning is anything else.
+ *
+ * An unreadable stored credential is reported on every command until someone
+ * signs in again, and auth-core's structured form is six lines of object dump
+ * ending in the raw CryptoKit/OpenSSL string (`Unsupported state or unable to
+ * authenticate data`). The person reading it needs the hint auth-core already
+ * wrote for exactly this, and what to do; the key id and the crypto message are
+ * for whoever is debugging, which is what `DEBUG` is for everywhere else in
+ * this logger. The daemon logs through its own logger and keeps the structured
+ * record.
+ *
+ * The remedy is added only to the DEFAULT hint, which is about this config's
+ * own credential. A caller that supplied its own hint knows the case better —
+ * another config's credential is not fixed by `skrr login` here, and its hint
+ * says so (OSK-12135).
+ */
+export declare function plainCredentialEnvelopeWarning(args: readonly unknown[]): string | null;
 type DedicatedGenerationPreparationOptions = {
     machineUuid?: string;
     configDir?: string;

package/dist/lib/auth-core-init.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CliCredentialInitializationError = void 0;
+exports.plainCredentialEnvelopeWarning = plainCredentialEnvelopeWarning;
 exports.prepareDedicatedRuntimeAuthGeneration = prepareDedicatedRuntimeAuthGeneration;
 exports.ensureAuthCoreConfigured = ensureAuthCoreConfigured;
 exports.prefetchCliAuth = prefetchCliAuth;
@@ -44,6 +45,36 @@ function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'TRUE';
 }
+/**
+ * A credential-envelope failure that carries a hint, as ONE plain line
+ * (OSK-12180) — or null when the warning is anything else.
+ *
+ * An unreadable stored credential is reported on every command until someone
+ * signs in again, and auth-core's structured form is six lines of object dump
+ * ending in the raw CryptoKit/OpenSSL string (`Unsupported state or unable to
+ * authenticate data`). The person reading it needs the hint auth-core already
+ * wrote for exactly this, and what to do; the key id and the crypto message are
+ * for whoever is debugging, which is what `DEBUG` is for everywhere else in
+ * this logger. The daemon logs through its own logger and keeps the structured
+ * record.
+ *
+ * The remedy is added only to the DEFAULT hint, which is about this config's
+ * own credential. A caller that supplied its own hint knows the case better —
+ * another config's credential is not fixed by `skrr login` here, and its hint
+ * says so (OSK-12135).
+ */
+function plainCredentialEnvelopeWarning(args) {
+    const [message, metadata] = args;
+    if (typeof message !== 'string' || !message.startsWith('[credEnvelope] '))
+        return null;
+    if (!metadata || typeof metadata !== 'object')
+        return null;
+    const hint = metadata.hint;
+    if (typeof hint !== 'string' || !hint.trim())
+        return null;
+    const remedy = hint === auth_core_1.DEFAULT_UNREADABLE_CREDENTIAL_HINT ? ' Run `skrr login`.' : '';
+    return `warning: ${hint.trim()}.${remedy} (DEBUG=1 shows the underlying error.)`;
+}
 const cliLogger = {
     // The CLI is a short-lived foreground process. Trace/debug get dropped
     // unless DEBUG is set so we don't spam terminal output.
@@ -55,7 +86,13 @@ const cliLogger = {
         if (process.env.DEBUG)
             console.error('[auth-core info]', ...args);
     },
-    warn: (...args) => console.error('[auth-core warn]', ...args),
+    warn: (...args) => {
+        const plain = process.env.DEBUG ? null : plainCredentialEnvelopeWarning(args);
+        if (plain)
+            console.error(plain);
+        else
+            console.error('[auth-core warn]', ...args);
+    },
     error: (...args) => console.error('[auth-core error]', ...args),
 };
 /**

package/dist/lib/cli-identity.js

@@ -74,7 +74,6 @@ const path = __importStar(require("node:path"));
 const auth_storage_1 = require("./auth-storage");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
-const device_id_1 = require("./device-id");
 const keychain_1 = require("./keychain");
 /**
  * A named profile's own identity. Deterministic in (host, user, config root,
@@ -127,7 +126,7 @@ function planLoginCliId(cfg, deps = {}) {
     const machine = cfg.cliId?.trim();
     if (machine)
         return { cliId: machine, source: 'machine' };
-    const cliId = (0, device_id_1.generateCliId)();
+    const cliId = (0, config_1.machineCliId)();
     return { cliId, source: 'machine', updatedConfig: { ...cfg, cliId } };
 }
 /**

package/dist/lib/config.d.ts

@@ -190,6 +190,16 @@ export declare function isEnvAuthOverride(): boolean;
  * resolver and every existing install read it.
  */
 export declare function configRoot(env?: NodeJS.ProcessEnv): string;
+/**
+ * The machine cliId THIS config root mints when it has none stored
+ * (OSK-12179). The primary root keeps the historical (host, user) id; any other
+ * root gets one of its own, so two roots of one user are two server-side
+ * families and one root's hand-off confirm cannot retire the other's session.
+ *
+ * Mints nothing and reads nothing stored: callers persist it (`cli-identity.ts`)
+ * or present it only when nothing is stored (the daemon broker).
+ */
+export declare function machineCliId(): string;
 /**
  * The PRE-RENAME config root — the generation between `.sky` and `.skrr`.
  *

package/dist/lib/config.js

@@ -39,6 +39,7 @@ exports.describeDeployment = describeDeployment;
 exports.canonicalizeKnownBaseURL = canonicalizeKnownBaseURL;
 exports.isEnvAuthOverride = isEnvAuthOverride;
 exports.configRoot = configRoot;
+exports.machineCliId = machineCliId;
 exports.priorConfigDir = priorConfigDir;
 exports.loadConfig = loadConfig;
 exports.saveConfig = saveConfig;
@@ -54,6 +55,7 @@ const path = __importStar(require("node:path"));
 const keychain_1 = require("./keychain");
 const auth_core_1 = require("@skrr-ai/auth-core");
 const cli_id_1 = require("./cli-id");
+const device_id_1 = require("./device-id");
 const publicEndpoints_generated_1 = require("./publicEndpoints.generated");
 // Both from config/public-endpoints.json, the one domain contract, rather than a
 // fourth hand-copied pair. The CLI previously knew only about dev — there was no
@@ -269,6 +271,26 @@ function configRoot(env = process.env) {
 function newConfigDir() {
     return configRoot();
 }
+/** The root this machine uses when nothing relocates it (`~/.skrr`). */
+function defaultConfigRoot() {
+    return (0, auth_core_1.resolveConfigRoot)({});
+}
+/** Is this process on the primary root, however it was reached? */
+function isDefaultConfigRoot() {
+    return path.resolve(configRoot()) === path.resolve(defaultConfigRoot());
+}
+/**
+ * The machine cliId THIS config root mints when it has none stored
+ * (OSK-12179). The primary root keeps the historical (host, user) id; any other
+ * root gets one of its own, so two roots of one user are two server-side
+ * families and one root's hand-off confirm cannot retire the other's session.
+ *
+ * Mints nothing and reads nothing stored: callers persist it (`cli-identity.ts`)
+ * or present it only when nothing is stored (the daemon broker).
+ */
+function machineCliId() {
+    return (0, device_id_1.machineCliIdForRoot)(configRoot(), defaultConfigRoot());
+}
 /**
  * Fields that belong to the MACHINE, not to a profile.
  *
@@ -472,6 +494,13 @@ function loadConfig() {
             if (!fs.existsSync(carriedPath))
                 continue;
             const carried = migrateLegacyBaseURL(readJsonOrThrow(carriedPath));
+            // The ancestor lives under $HOME whatever root this is, so its `cliId`
+            // belongs to the PRIMARY root's sessions. A relocated root that adopted
+            // it would present the primary root's identity, and a hand-off confirm
+            // there retires the primary root's families (OSK-12179). It mints its own
+            // at first login instead (`machineCliId`).
+            if (!isDefaultConfigRoot())
+                delete carried.cliId;
             try {
                 saveConfig(carried);
             }

package/dist/lib/device-id.d.ts

@@ -12,3 +12,26 @@
  * 128-char + printable-ASCII guard.
  */
 export declare function generateCliId(): string;
+/**
+ * The machine cliId for ONE config root (OSK-12179).
+ *
+ * `generateCliId()` hashes only (host, user), so every root on the machine got
+ * the same id: a fresh `SKRR_CONFIG_DIR` root's default profile minted exactly
+ * the id the real `~/.skrr` root had been presenting. The server's
+ * `cli-handoff/confirm` retires every OTHER live family of (user, cliId), so a
+ * sign-in in the second root could end the first root's session. The Keychain
+ * slots were already separated by root (OSK-12135), and a named profile's own
+ * id already hashes its root (`profileScopedCliId`); this was the one identity
+ * that did not.
+ *
+ * The DEFAULT root keeps `generateCliId()` byte for byte. Every install already
+ * stores or re-derives that value, every live session is bound to it, and a
+ * refresh presenting another id is refused — so changing it would sign the
+ * primary root out. Only a root somewhere else gets its own id, deterministic in
+ * (host, user, root) so a root that loses its config file and signs in again
+ * presents the same id rather than scattering families.
+ *
+ * A root is the default one when it resolves to the default path, however it
+ * was reached: `SKRR_CONFIG_DIR=~/.skrr` is the primary root, not a second one.
+ */
+export declare function machineCliIdForRoot(root: string, defaultRoot: string): string;

package/dist/lib/device-id.js

@@ -1,11 +1,46 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.generateCliId = generateCliId;
+exports.machineCliIdForRoot = machineCliIdForRoot;
 const node_crypto_1 = require("node:crypto");
 const node_os_1 = __importDefault(require("node:os"));
+const path = __importStar(require("node:path"));
 /**
  * Derive a stable per-machine identifier the server will treat as a
  * "device" for the device-code flow. Mirrors the daemon's `generateDaemonId`
@@ -25,3 +60,36 @@ function generateCliId() {
     const digest = (0, node_crypto_1.createHash)('sha256').update(`${hostname}|${username}|cli`).digest('hex');
     return `cli_${digest.slice(0, 12)}`;
 }
+/**
+ * The machine cliId for ONE config root (OSK-12179).
+ *
+ * `generateCliId()` hashes only (host, user), so every root on the machine got
+ * the same id: a fresh `SKRR_CONFIG_DIR` root's default profile minted exactly
+ * the id the real `~/.skrr` root had been presenting. The server's
+ * `cli-handoff/confirm` retires every OTHER live family of (user, cliId), so a
+ * sign-in in the second root could end the first root's session. The Keychain
+ * slots were already separated by root (OSK-12135), and a named profile's own
+ * id already hashes its root (`profileScopedCliId`); this was the one identity
+ * that did not.
+ *
+ * The DEFAULT root keeps `generateCliId()` byte for byte. Every install already
+ * stores or re-derives that value, every live session is bound to it, and a
+ * refresh presenting another id is refused — so changing it would sign the
+ * primary root out. Only a root somewhere else gets its own id, deterministic in
+ * (host, user, root) so a root that loses its config file and signs in again
+ * presents the same id rather than scattering families.
+ *
+ * A root is the default one when it resolves to the default path, however it
+ * was reached: `SKRR_CONFIG_DIR=~/.skrr` is the primary root, not a second one.
+ */
+function machineCliIdForRoot(root, defaultRoot) {
+    const resolved = path.resolve(root);
+    if (resolved === path.resolve(defaultRoot))
+        return generateCliId();
+    const hostname = node_os_1.default.hostname();
+    const username = node_os_1.default.userInfo().username || 'unknown';
+    const digest = (0, node_crypto_1.createHash)('sha256')
+        .update(`${hostname}|${username}|cli|root:${resolved}`)
+        .digest('hex');
+    return `cli_${digest.slice(0, 12)}`;
+}

package/dist/lib/first-party-harness-broker.js

@@ -75,7 +75,6 @@ const auth_core_init_1 = require("./auth-core-init");
 const config_1 = require("./config");
 const cli_id_1 = require("./cli-id");
 const cred_envelope_1 = require("./cred-envelope");
-const device_id_1 = require("./device-id");
 const first_party_harness_1 = require("./first-party-harness");
 const first_party_harness_agent_1 = require("./first-party-harness-agent");
 const first_party_harness_managed_1 = require("./first-party-harness-managed");
@@ -862,8 +861,9 @@ function hasLocalCredential() {
  *
  * The id login and refresh present, read through `resolveCliId` (a named
  * profile may have its own, OSK-12156); regenerated deterministically as the
- * machine id when nothing is stored (same hostname+user always yields the same
- * value). Normalized to the `cli_` namespace the server requires,
+ * machine id of THIS config root when nothing is stored (the same host, user
+ * and root always yield the same value; a relocated root does not share the
+ * primary root's id, OSK-12179). Normalized to the `cli_` namespace the server requires,
  * because `OVERSKY_CLI_ID` is overlaid verbatim with no format check and a
  * hand-set value would otherwise come back as an opaque
  * `runtime-id-namespace-mismatch`.
@@ -879,7 +879,7 @@ function localRuntimeId() {
     })();
     if (configured?.startsWith('cli_'))
         return configured;
-    return (0, device_id_1.generateCliId)();
+    return (0, config_1.machineCliId)();
 }
 function errorCodeOf(err) {
     const code = err?.code;