@skrr-ai/cli 0.1.57 → 0.1.59

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/credentialEnvelopeBridge.js

@@ -46,7 +46,8 @@ import path from 'node:path';
 import lockfile from 'proper-lockfile';
 import { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, isEnvelopeString as isCredEnvelopeString, generateDek, serialize as credEnvelopeSerialize, } from './credentialEnvelope.js';
 import { getKekStrategy, zeroizeKekCaches } from './kek/index.js';
-import { consolidateProfileState, profileStateDir, profileStateFilePathsToClear, resolveProfileStateFile, } from './profileStateDir.js';
+import { consolidateProfileState, profileStateDir, profileStateFilePathsToClear, resolveProfileStateFile, RETIRED_COPY_SUFFIX, } from './profileStateDir.js';
+import { needsReauthState } from './refresh.js';
 import { emitAuthTelemetry, getAuthLogger, getCredEnvelopeFailClosed } from './runtime.js';
 /**
  * Account name the wrapped DEK lives under (file fallback). Keeping the
@@ -239,6 +240,20 @@ async function withCredEnvelopeLock(profile, body) {
  * auth-core's to do), so being loud about it IS the remedy.
  */
 let _pathConflict = null;
+/**
+ * DEKs this profile used before a converging consolidation retired them
+ * (OSK-12462). Read-only: nothing is ever sealed under one again. A value that
+ * only a retired DEK opens is returned with `needsMigration: true`, the same
+ * signal a legacy plaintext value carries, so every consumer that already
+ * upgrades plaintext in place re-seals it under the active DEK on its own
+ * schedule. auth-core does not need to know where the consumer keeps it.
+ */
+let _retiredDeks = [];
+/**
+ * Set when THIS process converged a split profile onto the legacy key. For the
+ * status surface and tests; the on-disk marker is the durable record.
+ */
+let _convergedFrom = null;
 /**
  * Identity of a wrapped DEK: the SHA-256 of the key it unwraps to.
  *
@@ -277,18 +292,48 @@ async function wrappedDekIdentity(target, kek, aad) {
  * Never fatal. A migration that cannot run leaves the process exactly where it
  * was, which is the state it has been operating in all along.
  */
+/**
+ * Whether a split profile may be converged onto the legacy (daemon) key.
+ *
+ * Only the daemon ever has a legacy location, so only the daemon runs this, and
+ * the legacy key is the one it signs with. Since OSK-12063 the CLI enrolls no
+ * device key and only an interactive daemon login re-pins, so the key the server
+ * pins for this machine is the daemon's, UNLESS the daemon has itself been
+ * refused over its device key. That is the one fact that proves otherwise, and
+ * then nothing here knows which key the server holds, so it refuses as before.
+ *
+ * Why converging matters (OSK-12462): a CLI credential brokered by the daemon
+ * is tied to the daemon's machine row, and the server checks its refresh proof
+ * against the key pinned there. A CLI signing with a different key has that
+ * refresh refused as DEVICE_PROOF_THUMBPRINT_MISMATCH at its first renewal.
+ */
+export function splitKeyConvergencePolicy() {
+    let reauthReason;
+    try {
+        const state = needsReauthState();
+        reauthReason = state.needed ? state.reason : undefined;
+    }
+    catch {
+        reauthReason = undefined;
+    }
+    return reauthReason === 'DEVICE_KEY_MISMATCH'
+        ? { converge: false, reason: 'daemon_key_refused' }
+        : { converge: true, reason: 'daemon_key_pinned' };
+}
 async function consolidateWrappedDek(profile, kek, aad) {
     const resolved = resolveProfileStateFile(profile, ACCOUNT_CRED_DEK_WRAPPED);
     if (!resolved.usingLegacy) {
         _pathConflict = null;
         return;
     }
+    const policy = splitKeyConvergencePolicy();
     let outcome;
     try {
         outcome = await withCredEnvelopeLock(profile, () => consolidateProfileState(profile, {
             files: [ACCOUNT_CRED_DEK_WRAPPED],
             primary: ACCOUNT_CRED_DEK_WRAPPED,
             identify: (dir) => wrappedDekIdentity(path.join(dir, ACCOUNT_CRED_DEK_WRAPPED), kek, aad),
+            onConflict: policy.converge ? 'adopt_legacy' : 'refuse',
             onEvent: (name, success, meta) => emit(`cred_envelope.${name}`, success, meta),
         }));
     }
@@ -299,6 +344,19 @@ async function consolidateWrappedDek(profile, kek, aad) {
         });
         return;
     }
+    if (outcome.status === 'converged') {
+        _pathConflict = null;
+        _convergedFrom = {
+            canonicalPath: path.join(outcome.canonicalDir, ACCOUNT_CRED_DEK_WRAPPED),
+            legacyPath: path.join(outcome.legacyDir ?? '', ACCOUNT_CRED_DEK_WRAPPED),
+        };
+        getAuthLogger().info(`[credEnvelope] profile "${profile}" had two different usable wrapped DEKs; ` +
+            `converged on the daemon's (${_convergedFrom.legacyPath}), which is the key the ` +
+            "server pins for this machine. The CLI's former key is kept beside it as " +
+            `${ACCOUNT_CRED_DEK_WRAPPED}${RETIRED_COPY_SUFFIX}.* and still opens what was ` +
+            'sealed under it; each value is re-sealed under the shared key on its next write.');
+        return;
+    }
     if (outcome.status !== 'conflict') {
         _pathConflict = null;
         return;
@@ -315,13 +373,62 @@ async function consolidateWrappedDek(profile, kek, aad) {
     // BINARY restarts and adopts its legacy key into the empty canonical slot,
     // and the CLI logs back in on it. Not `skrr daemon restart`: any `skrr`
     // command mints a fresh key into an empty slot before doing anything else.
-    getAuthLogger().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs; ` +
+    //
+    // Reached only when the daemon itself was refused over its device key
+    // (`splitKeyConvergencePolicy`); an ordinary split converges above.
+    getAuthLogger().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs, and ` +
+        "the server refused the daemon's key, so neither is known to be the pinned one; " +
         `refusing to choose. Keeping ${_pathConflict.legacyPath} and leaving ` +
         `${_pathConflict.canonicalPath} untouched. Each side can still read its own ` +
         "credentials, and neither can read the other's. Do not delete " +
         `${_pathConflict.legacyPath}: it is the key the daemon reads. To converge on it, ` +
         'run `skrr logout && skrrd restart && skrr login`.');
 }
+/**
+ * Load every retired DEK beside the canonical one (OSK-12462). Only files a
+ * converging consolidation set aside are read; the `.superseded.*` copy an
+ * UNUSABLE key leaves is not a key anything can open. Read-only unwrap, never
+ * fatal: a retired key that no longer opens is simply not in the ring.
+ */
+async function loadRetiredDeks(profile, kek, aad, active) {
+    for (const old of _retiredDeks)
+        old.fill(0);
+    _retiredDeks = [];
+    for (const target of retiredDekFiles(profile)) {
+        try {
+            if (!kek.unwrapExisting)
+                return;
+            const dek = await kek.unwrapExisting(fs.readFileSync(target), aad);
+            if (dek.length === 32 && !dek.equals(active)) {
+                _retiredDeks.push(dek);
+            }
+            else {
+                dek.fill(0);
+            }
+        }
+        catch {
+            emit('cred_envelope.retired_dek.unreadable', false, {
+                profile,
+                file: path.basename(target),
+            });
+        }
+    }
+}
+/** Retired wrapped DEKs for `profile`, oldest first. */
+function retiredDekFiles(profile) {
+    const dir = profileStateDir(profile);
+    const prefix = `${ACCOUNT_CRED_DEK_WRAPPED}${RETIRED_COPY_SUFFIX}.`;
+    try {
+        return fs
+            .readdirSync(dir)
+            .filter((name) => name.startsWith(prefix))
+            .sort()
+            .map((name) => path.join(dir, name));
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.
@@ -396,6 +503,7 @@ export async function initCredEnvelope(profile) {
         const wrappedBytes = fs.readFileSync(targetPath);
         const candidate = await kek.unwrapExisting(wrappedBytes, aad);
         if (candidate.length === 32) {
+            await loadRetiredDeks(profile, kek, aad, candidate);
             _state = {
                 kind: 'active',
                 dek: candidate,
@@ -503,6 +611,7 @@ export async function initCredEnvelope(profile) {
                 return;
             }
         }
+        await loadRetiredDeks(profile, kek, aad, dek);
         _state = {
             kind: 'active',
             dek: dek,
@@ -533,7 +642,12 @@ export async function initCredEnvelope(profile) {
  */
 export async function resetCredEnvelope(opts) {
     if (opts?.clearOnDisk && opts.profile) {
-        for (const target of profileStateFilePathsToClear(opts.profile, ACCOUNT_CRED_DEK_WRAPPED)) {
+        // A logout ends every key this profile held, the retired ones included: a
+        // retired DEK exists only to open values the logout is deleting anyway.
+        for (const target of [
+            ...profileStateFilePathsToClear(opts.profile, ACCOUNT_CRED_DEK_WRAPPED),
+            ...retiredDekFiles(opts.profile),
+        ]) {
             try {
                 fs.unlinkSync(target);
             }
@@ -554,6 +668,10 @@ export async function resetCredEnvelope(opts) {
     _state = { kind: 'uninit' };
     _kekRotationDetected = false;
     _pathConflict = null;
+    _convergedFrom = null;
+    for (const old of _retiredDeks)
+        old.fill(0);
+    _retiredDeks = [];
 }
 /**
  * Idempotent shutdown — must be called from the daemon's graceful-exit
@@ -592,6 +710,10 @@ export function shutdownCredEnvelope() {
     _state = { kind: 'uninit' };
     _kekRotationDetected = false;
     _pathConflict = null;
+    _convergedFrom = null;
+    for (const old of _retiredDeks)
+        old.fill(0);
+    _retiredDeks = [];
 }
 /** @internal Test seam — re-arm `shutdownCredEnvelope` so it can run again. */
 export function __resetShutdownGuardForTest() {
@@ -627,6 +749,10 @@ export function hasCredEnvelopePathConflict() {
  * `oversky status`; clears on the next clean `resetCredEnvelope`.
  */
 export function describeCredEnvelopeState() {
+    const extras = {
+        ...(_convergedFrom ? { convergedFrom: _convergedFrom } : {}),
+        ...(_retiredDeks.length > 0 ? { retiredKeys: _retiredDeks.length } : {}),
+    };
     if (_state.kind === 'disabled') {
         return {
             kind: 'disabled',
@@ -643,6 +769,7 @@ export function describeCredEnvelopeState() {
             profile: _state.profile,
             ...(_kekRotationDetected ? { kekRotated: true } : {}),
             ...(_pathConflict ? { pathConflict: _pathConflict } : {}),
+            ...extras,
         };
     }
     return { kind: 'uninit', ...(_pathConflict ? { pathConflict: _pathConflict } : {}) };
@@ -764,12 +891,28 @@ export function maybeDecryptOnRead(stored, options = {}) {
             });
             return { plaintext: null, needsMigration: false };
         }
+        const aad = buildCredentialAad(_state.profile);
         try {
-            const aad = buildCredentialAad(_state.profile);
             const pt = credEnvelopeDecrypt(sealed, _state.dek, aad).toString('utf-8');
             return { plaintext: pt, needsMigration: false };
         }
         catch (err) {
+            // Sealed before a converging consolidation retired its key (OSK-12462).
+            // Readable, and flagged for the in-place upgrade every consumer already
+            // performs for legacy plaintext, which re-seals it under the active DEK.
+            for (const retired of _retiredDeks) {
+                try {
+                    const pt = credEnvelopeDecrypt(sealed, retired, aad).toString('utf-8');
+                    emit('cred_envelope.read.retired_key', true, {
+                        kekId: _state.kekId,
+                        kekKind: _state.kekKind,
+                    });
+                    return { plaintext: pt, needsMigration: true };
+                }
+                catch {
+                    /* not this one */
+                }
+            }
             emit('cred_envelope.read.decrypt_failed', false, {
                 kekId: _state.kekId,
                 kekKind: _state.kekKind,

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -15,6 +15,23 @@ type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed';
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
 export declare function __getStateForTest(): DeviceIdentityState;
+/**
+ * The device-key split, read from disk: the daemon (legacy directory, not yet
+ * consolidated) and the CLI (canonical directory) holding DIFFERENT keypairs
+ * for one profile. `null` when this process has no legacy location, when the
+ * legacy copy is consolidated, or when either side has no readable public key.
+ *
+ * This is the fact the server acts on (OSK-12462): a CLI credential brokered by
+ * the daemon is checked against the key pinned on the daemon's machine row, so
+ * while the thumbprints differ the CLI's refresh is refused. Reading it from
+ * the public JWKs, which are plaintext, needs no DEK and changes nothing.
+ */
+export declare function describeDeviceKeySplit(profile: string): {
+    daemonThumbprint: string;
+    cliThumbprint: string;
+    daemonDir: string;
+    cliDir: string;
+} | null;
 /**
  * Initialize device identity. Idempotent.
  *

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -32,7 +32,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, } from './deviceKey.js';
-import { hasCredEnvelopePathConflict, isCredEnvelopeActive, maybeDecryptOnRead, wrapIfActiveOrPassthrough, } from './credentialEnvelopeBridge.js';
+import { hasCredEnvelopePathConflict, isCredEnvelopeActive, maybeDecryptOnRead, splitKeyConvergencePolicy, wrapIfActiveOrPassthrough, } from './credentialEnvelopeBridge.js';
 import { consolidateProfileState, profileStateFilePathsToClear, resolveProfileStateDir, } from './profileStateDir.js';
 import { emitAuthTelemetry, getAuthLogger } from './runtime.js';
 const PUBLIC_KEY_FILENAME = 'device-public-key.jwk';
@@ -243,6 +243,37 @@ function deviceIdentityOf(dir) {
         return null;
     }
 }
+/**
+ * The device-key split, read from disk: the daemon (legacy directory, not yet
+ * consolidated) and the CLI (canonical directory) holding DIFFERENT keypairs
+ * for one profile. `null` when this process has no legacy location, when the
+ * legacy copy is consolidated, or when either side has no readable public key.
+ *
+ * This is the fact the server acts on (OSK-12462): a CLI credential brokered by
+ * the daemon is checked against the key pinned on the daemon's machine row, so
+ * while the thumbprints differ the CLI's refresh is refused. Reading it from
+ * the public JWKs, which are plaintext, needs no DEK and changes nothing.
+ */
+export function describeDeviceKeySplit(profile) {
+    try {
+        const resolved = resolveProfileStateDir(profile, PRIVATE_KEY_FILENAME);
+        if (!resolved.usingLegacy || resolved.legacyDir === null)
+            return null;
+        const daemonThumbprint = deviceIdentityOf(resolved.legacyDir);
+        const cliThumbprint = deviceIdentityOf(resolved.canonicalDir);
+        if (!daemonThumbprint || !cliThumbprint || daemonThumbprint === cliThumbprint)
+            return null;
+        return {
+            daemonThumbprint,
+            cliThumbprint,
+            daemonDir: resolved.legacyDir,
+            cliDir: resolved.canonicalDir,
+        };
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Run the OSK-10314 consolidation for this profile's device identity.
  *
@@ -257,11 +288,17 @@ async function consolidateDeviceIdentity(profile) {
         emit('path_consolidation.deferred', true, { profile, reason: 'cred_envelope_path_conflict' }, { logLevel: 'info' });
         return;
     }
+    // Two different keypairs under one DEK are converged the way two DEKs are:
+    // onto the daemon's, unless the daemon itself was refused over it. The CLI's
+    // keypair is set aside as `.retired`, not deleted (OSK-12462). Leaving them
+    // split is what had the CLI refresh refused as a device-key mismatch.
+    const policy = splitKeyConvergencePolicy();
     try {
         await consolidateProfileState(profile, {
             files: DEVICE_IDENTITY_FILES,
             primary: PRIVATE_KEY_FILENAME,
             identify: deviceIdentityOf,
+            onConflict: policy.converge ? 'adopt_legacy' : 'refuse',
             onEvent: (name, success, meta) => emit(name, success, meta),
         });
     }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -27,8 +27,8 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
-export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -108,14 +108,14 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 // Daemon and CLI consume these; the underlying primitives live above.
 export { 
 // credEnvelope bridge
-initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
+initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
 // Test seams — `__`-prefixed so consumers don't import them in
 // production code paths. Re-exported here so CLI/daemon spec files
 // can resolve the wrapped-DEK path against the same module instance.
 __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, } from './credentialEnvelopeBridge.js';
 export { 
 // deviceIdentity bridge
-initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, 
+initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, 
 // Test seams — file path resolvers + state setters for spec files.
 __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
 // Hardware machine identity sent as `machineUuid` (IOPlatformUUID /

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/profileStateDir.d.ts

@@ -11,6 +11,13 @@ export declare const SUPERSEDED_MARKER_SUFFIX = ".superseded.json";
  * canonical copy existed and was NOT usable — a usable one is never replaced.
  */
 export declare const SUPERSEDED_COPY_SUFFIX = ".superseded";
+/**
+ * Suffix for a USABLE canonical file set aside by a converging consolidation
+ * (`onConflict: 'adopt_legacy'`). Distinct from `SUPERSEDED_COPY_SUFFIX`, which
+ * names an unusable copy: a retired key still opens what was sealed under it,
+ * and the credential envelope reads these as its keyring (OSK-12462).
+ */
+export declare const RETIRED_COPY_SUFFIX = ".retired";
 /** The canonical directory for a profile's auth state. */
 export declare function profileStateDir(profile: string): string;
 /**
@@ -59,7 +66,12 @@ export type ConsolidationStatus =
 /** Canonical was present but unusable; replaced, and kept under `.superseded`. */
  | 'superseded'
 /** Both copies are usable and DIFFERENT. Refused — a human decides. */
- | 'conflict';
+ | 'conflict'
+/**
+ * Both copies were usable and DIFFERENT, and the caller chose the legacy one
+ * (`onConflict: 'adopt_legacy'`). The canonical copy is kept as `.retired`.
+ */
+ | 'converged';
 export interface ConsolidationOutcome {
     status: ConsolidationStatus;
     profile: string;
@@ -98,6 +110,14 @@ export interface ConsolidationSpec {
     identify?: (dir: string) => Promise<string | null> | string | null;
     /** Report what would happen and write nothing. */
     dryRun?: boolean;
+    /**
+     * What to do when both copies are usable and DIFFERENT. `refuse` (default)
+     * leaves both untouched and reports `conflict`. `adopt_legacy` sets the
+     * canonical copy aside as `<file>.retired.<stamp>` and adopts the legacy one,
+     * reporting `converged`. Only a caller that has decided which key must win
+     * may pass it — the files are kept, but nothing here can re-seal content.
+     */
+    onConflict?: 'refuse' | 'adopt_legacy';
     onEvent?: (name: string, success: boolean, meta: Record<string, unknown>) => void;
 }
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/profileStateDir.js

@@ -56,10 +56,14 @@
  *   4. no canonical copy of the file                   → legacy (not yet consolidated)
  *   5. both copies, no marker                          → legacy (unresolved: stay put)
  *
- * The migration writes the marker, never deletes, and refuses case 5 when both
- * sides hold a usable and DIFFERENT key — because merging those would require
- * re-sealing content that lives in the OS keychain and is not auth-core's to
- * re-seal. A human resolves that one, and the loud signal is the deliverable.
+ * The migration writes the marker and never deletes. Case 5 with a usable and
+ * DIFFERENT key on each side is refused by default. A caller that knows which
+ * key must win can pass `onConflict: 'adopt_legacy'`, which moves the canonical
+ * copy aside as `<file>.retired.<stamp>` (kept, never deleted) and adopts the
+ * legacy one. The credential envelope does that for the daemon's key, and keeps
+ * the retired DEK readable so nothing sealed under it is lost (OSK-12462): the
+ * refusal alone left the CLI signing with a key the server does not pin, which
+ * gets its refresh refused as a device-key mismatch.
  *
  * ROLLBACK. The legacy file is left exactly where it was, under its own name.
  * Older code looks there, finds it, and works — no operator step. The marker is
@@ -82,6 +86,13 @@ export const SUPERSEDED_MARKER_SUFFIX = '.superseded.json';
  * canonical copy existed and was NOT usable — a usable one is never replaced.
  */
 export const SUPERSEDED_COPY_SUFFIX = '.superseded';
+/**
+ * Suffix for a USABLE canonical file set aside by a converging consolidation
+ * (`onConflict: 'adopt_legacy'`). Distinct from `SUPERSEDED_COPY_SUFFIX`, which
+ * names an unusable copy: a retired key still opens what was sealed under it,
+ * and the credential envelope reads these as its keyring (OSK-12462).
+ */
+export const RETIRED_COPY_SUFFIX = '.retired';
 /** The canonical directory for a profile's auth state. */
 export function profileStateDir(profile) {
     assertProfile(profile);
@@ -213,6 +224,28 @@ export async function consolidateProfileState(profile, spec) {
             identities,
         };
     }
+    if (spec.onConflict === 'adopt_legacy') {
+        const aside = dryRun
+            ? plannedAside(canonicalDir, spec.files)
+            : moveAside(canonicalDir, spec.files, RETIRED_COPY_SUFFIX);
+        const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
+        if (!dryRun)
+            writeMarker(markerPath, canonicalPrimary, 'converged');
+        emitOutcome(spec, 'converged', {
+            profile,
+            identities,
+            from: legacyDir,
+            to: canonicalDir,
+            retired: aside,
+        });
+        return {
+            ...base,
+            status: 'converged',
+            written: moved.written,
+            supersededAside: aside,
+            identities,
+        };
+    }
     emitOutcome(spec, 'conflict', { profile, identities, canonicalDir, legacyDir });
     return { ...base, status: 'conflict', identities };
 }
@@ -297,14 +330,14 @@ function adopt(fromDir, toDir, files, dryRun) {
     }
     return { written, supersededAside: [] };
 }
-function moveAside(dir, files) {
+function moveAside(dir, files, suffix = SUPERSEDED_COPY_SUFFIX) {
     const stamp = new Date().toISOString().replace(/[:.]/g, '-');
     const aside = [];
     for (const name of files) {
         const target = path.join(dir, name);
         if (!existsFile(target))
             continue;
-        fs.renameSync(target, `${target}${SUPERSEDED_COPY_SUFFIX}.${stamp}`);
+        fs.renameSync(target, `${target}${suffix}.${stamp}`);
         aside.push(target);
     }
     return aside;

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {