@skrr-ai/cli 0.1.58 → 0.1.59

package/dist/lib/daemonBrokerRefusal.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isAnsweredBrokerRefusal = isAnsweredBrokerRefusal;
 exports.describeBrokerRefusal = describeBrokerRefusal;
+exports.describeGuestDaemonUnavailable = describeGuestDaemonUnavailable;
 /**
  * True when a daemon ANSWERED the hand-off and refused it — as opposed to no
  * daemon being there to ask (`no_bootstrap`, a stale descriptor nobody listens
@@ -81,8 +82,8 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
                 `if it persists, check the machine from your own computer with \`${bin} machines dedicated health-check <lease-id>\` ` +
                 `(\`${bin} machines dedicated list\` shows the lease id).`
             : 'Nobody signs in on a Dedicated Runtime: its daemon holds the account. From your own computer, run ' +
-                `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id), ` +
-                `and \`${bin} machines dedicated restart <lease-id>\` if the hand-off stays refused.`;
+                `\`${bin} machines dedicated health-check <lease-id>\` (\`${bin} machines dedicated list\` shows the lease id). ` +
+                guestReissueRemedy(bin, 'If it stays refused');
     }
     else if (code === 'DEVICE_PROOF_PIN_MISMATCH') {
         remedy =
@@ -125,3 +126,87 @@ function describeBrokerRefusal(failure, bin = 'skrr') {
         },
     };
 }
+/**
+ * The owner-side repair that issues a guest's daemon a fresh credential.
+ *
+ * `stop` then `start`, not `restart`: a restart keeps the instance, so its
+ * daemon re-enrolls through the attested re-issue, which the server refuses
+ * for a credential a person revoked (`REISSUE_REVOKE_REASON`). Observed on a
+ * revoked guest: `restart` sat in `restarting` for 16 minutes and ended
+ * `dedicated_runtime_guest_not_ready_after_restart`, while stop + start
+ * recovered it (OSK-12473).
+ */
+function guestReissueRemedy(bin, when) {
+    return (`${when}, \`${bin} machines dedicated stop <lease-id>\` then \`${bin} machines dedicated start <lease-id>\` ` +
+        'gives the machine a fresh credential (files under /workspace are kept; a restart does not re-issue one).');
+}
+/**
+ * What to tell a person on a Dedicated Runtime guest when NO daemon answered
+ * the hand-off at all (OSK-12473).
+ *
+ * `describeBrokerRefusal` speaks only for a daemon that answered. On a guest
+ * the realistic broken state is a daemon that is absent: its credential was
+ * revoked and it exited by design, or systemd is cycling it, or it crashed and
+ * left its descriptor behind. The CLI then saw `no_bootstrap` / `network`, and
+ * fell to "Not signed in. Run `skrr login` first." — a login nobody performs
+ * on a guest, and which would only put a personal credential on a machine the
+ * daemon is meant to hold the account for. Say the machine's service is not
+ * running and name the owner's repair instead.
+ *
+ * Returns null off a guest, or for a daemon that answered (that is
+ * `describeBrokerRefusal`'s case).
+ */
+function describeGuestDaemonUnavailable(failure, opts) {
+    const bin = opts.bin ?? 'skrr';
+    if (!opts.onGuest && failure?.dedicatedGuest !== true)
+        return null;
+    if (failure && isAnsweredBrokerRefusal(failure))
+        return null;
+    if (failure && (failure.reason === 'base_url_mismatch' || failure.reason === 'rate_limited')) {
+        return null;
+    }
+    const who = `This Dedicated Runtime's skrr service${failure?.daemonId ? ` (daemon ${failure.daemonId})` : ''}`;
+    let headline;
+    let transient = false;
+    const reason = failure?.reason ?? 'no_bootstrap';
+    if (reason === 'network') {
+        headline = `${who} is not running: its sign-in hand-off names a port nothing is listening on.`;
+    }
+    else if (reason === 'bootstrap_parse') {
+        headline = `${who} is not available: its sign-in hand-off file could not be read.`;
+    }
+    else if (reason === 'stale_bootstrap') {
+        // An uncoded 401 on the descriptor secret: the service rotated it, which
+        // it does when it restarts. Re-reading the file next time heals it.
+        headline = `${who} refused this CLI's hand-off secret, which it rotates when it restarts.`;
+        transient = true;
+    }
+    else if (opts.descriptorPresent) {
+        headline = `${who} is not running: its sign-in hand-off was left behind by a process that has exited.`;
+    }
+    else {
+        headline = `${who} is not running, so nothing on this machine can sign this CLI in.`;
+    }
+    const remedy = transient
+        ? 'Retry in a moment. Nobody signs in on a Dedicated Runtime, so `' +
+            `${bin} login\` is not the fix; if it persists, the machine's owner can run ` +
+            `\`${bin} machines dedicated health-check <lease-id>\` from their own computer.`
+        : `Nobody signs in on a Dedicated Runtime — its service holds the account — so \`${bin} login\` is not the fix. ` +
+            "If the machine is still starting, retry in a minute. Otherwise, from the owner's own computer: " +
+            `\`${bin} machines dedicated health-check <lease-id>\` shows why (\`${bin} machines dedicated list\` shows the lease id). ` +
+            guestReissueRemedy(bin, 'If the service stays down');
+    return {
+        headline,
+        remedy,
+        transient,
+        dedicatedGuest: true,
+        broker: {
+            reason,
+            ...(typeof failure?.status === 'number' ? { status: failure.status } : {}),
+            ...(failure?.code ? { code: failure.code } : {}),
+            ...(failure?.detail ? { detail: failure.detail } : {}),
+            ...(failure?.descriptorPath ? { descriptorPath: failure.descriptorPath } : {}),
+            ...(failure?.daemonId ? { daemonId: failure.daemonId } : {}),
+        },
+    };
+}

package/dist/lib/dedicated-guest.d.ts

@@ -0,0 +1,13 @@
+/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
+export declare const GUEST_SERVICE_SOCKET_PATH = "/run/skrr-dedicated-runtime/service-propose/service-propose.sock";
+/**
+ * True when this process is running on a Dedicated Runtime guest — the
+ * workload-uid test, or the guest markers the image/daemon own. An SSH
+ * session may not carry the wrapper's env stamp, so the filesystem markers
+ * count too; the socket itself remains the authority.
+ */
+export declare function runningOnDedicatedRuntimeGuest(env?: NodeJS.ProcessEnv, getuid?: (() => number) | undefined, paths?: {
+    socketPath?: string;
+    attestationPath?: string;
+    runtimeDir?: string;
+}): boolean;

package/dist/lib/dedicated-guest.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GUEST_SERVICE_SOCKET_PATH = void 0;
+exports.runningOnDedicatedRuntimeGuest = runningOnDedicatedRuntimeGuest;
+const node_fs_1 = require("node:fs");
+const first_party_harness_1 = require("./first-party-harness");
+/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
+exports.GUEST_SERVICE_SOCKET_PATH = '/run/skrr-dedicated-runtime/service-propose/service-propose.sock';
+/**
+ * True when this process is running on a Dedicated Runtime guest — the
+ * workload-uid test, or the guest markers the image/daemon own. An SSH
+ * session may not carry the wrapper's env stamp, so the filesystem markers
+ * count too; the socket itself remains the authority.
+ */
+function runningOnDedicatedRuntimeGuest(env = process.env, getuid = process.getuid?.bind(process), paths = {}) {
+    if ((0, first_party_harness_1.isDedicatedRuntimeWorkload)(env, getuid))
+        return true;
+    const socketPath = paths.socketPath ?? exports.GUEST_SERVICE_SOCKET_PATH;
+    const attestation = paths.attestationPath ?? '/etc/skrr-dedicated-runtime/attestation.json';
+    const runtimeDir = paths.runtimeDir ?? '/run/skrr-dedicated-runtime';
+    return (0, node_fs_1.existsSync)(socketPath) || (0, node_fs_1.existsSync)(attestation) || (0, node_fs_1.existsSync)(runtimeDir);
+}

package/dist/lib/dedicated-machines.js

@@ -1280,7 +1280,23 @@ function describeRefusalReasons(err, context = {}) {
     if (spend)
         return spend;
     const sentences = (0, harnesses_1.describeHealthReasonSentences)(details?.reasons, details?.state);
-    return sentences ? ` Reasons: ${sentences}` : '';
+    // A refusal whose public `reasons` came back empty used to print the bare
+    // sentence, which reads as "no reason" when the server said more: that it
+    // withheld reasons it does not publish, or that its own check did not finish
+    // (OSK-12473). Say which, so the person knows whether to retry.
+    const extra = [];
+    const incomplete = Array.isArray(details?.checkIncompleteReasons)
+        ? details.checkIncompleteReasons.length
+        : 0;
+    if (details?.checkIncomplete === true || incomplete > 0) {
+        extra.push('skrr could not finish checking the machine, so run the check again.');
+    }
+    const omitted = Number(details?.omittedReasonCount);
+    if (Number.isInteger(omitted) && omitted > 0) {
+        extra.push(`${omitted} further reason${omitted === 1 ? ' was' : 's were'} not published by the server.`);
+    }
+    const tail = [sentences, ...extra].filter(Boolean).join(' ');
+    return tail ? ` Reasons: ${tail}` : '';
 }
 /**
  * The numbers behind a cap refusal: the cap, this month's spend so far, and

package/dist/lib/dedicated-service.d.ts

@@ -373,16 +373,4 @@ export declare function mergeServiceTemplate(template: DedicatedServiceTemplate,
  * guest-local status commands so both read the same shape.
  */
 export declare function serviceDetailText(detail: unknown): string | undefined;
-/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
-export declare const GUEST_SERVICE_SOCKET_PATH = "/run/skrr-dedicated-runtime/service-propose/service-propose.sock";
-/**
- * True when this process is running on a Dedicated Runtime guest — the
- * workload-uid test, or the guest markers the image/daemon own. An SSH
- * session may not carry the wrapper's env stamp, so the filesystem markers
- * count too; the socket itself remains the authority.
- */
-export declare function runningOnDedicatedRuntimeGuest(env?: NodeJS.ProcessEnv, getuid?: (() => number) | undefined, paths?: {
-    socketPath?: string;
-    attestationPath?: string;
-    runtimeDir?: string;
-}): boolean;
+export { GUEST_SERVICE_SOCKET_PATH, runningOnDedicatedRuntimeGuest } from './dedicated-guest';

package/dist/lib/dedicated-service.js

@@ -3,7 +3,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GUEST_SERVICE_SOCKET_PATH = exports.DedicatedServiceChannel = exports.DedicatedServiceError = exports.SERVICE_ACTIONS = exports.SERVICE_RESTART_POLICIES = exports.SERVICE_RESERVED_NAMES = exports.SERVICE_SECRET_NAME_PATTERN = exports.SERVICE_NAME_PATTERN = exports.SERVICE_CALL_TIMEOUT_MS = exports.DEDICATED_PERSISTENT_TERMINAL_CAPABILITY = exports.DEDICATED_TERMINAL_NAME_PATTERN = exports.DEDICATED_TERMINAL_EVENTS = exports.DEDICATED_SERVICE_EVENTS = void 0;
+exports.runningOnDedicatedRuntimeGuest = exports.GUEST_SERVICE_SOCKET_PATH = exports.DedicatedServiceChannel = exports.DedicatedServiceError = exports.SERVICE_ACTIONS = exports.SERVICE_RESTART_POLICIES = exports.SERVICE_RESERVED_NAMES = exports.SERVICE_SECRET_NAME_PATTERN = exports.SERVICE_NAME_PATTERN = exports.SERVICE_CALL_TIMEOUT_MS = exports.DEDICATED_PERSISTENT_TERMINAL_CAPABILITY = exports.DEDICATED_TERMINAL_NAME_PATTERN = exports.DEDICATED_TERMINAL_EVENTS = exports.DEDICATED_SERVICE_EVENTS = void 0;
 exports.isServiceUnsupportedCode = isServiceUnsupportedCode;
 exports.describeServiceRefusal = describeServiceRefusal;
 exports.describeTerminalRefusal = describeTerminalRefusal;
@@ -19,7 +19,6 @@ exports.serviceTemplatesDir = serviceTemplatesDir;
 exports.loadLocalServiceTemplate = loadLocalServiceTemplate;
 exports.mergeServiceTemplate = mergeServiceTemplate;
 exports.serviceDetailText = serviceDetailText;
-exports.runningOnDedicatedRuntimeGuest = runningOnDedicatedRuntimeGuest;
 const node_crypto_1 = require("node:crypto");
 const node_fs_1 = require("node:fs");
 const node_os_1 = require("node:os");
@@ -27,7 +26,6 @@ const node_path_1 = __importDefault(require("node:path"));
 const socket_io_client_1 = require("socket.io-client");
 const data_provider_1 = require("@skrr-ai/data-provider");
 const agentic_stream_1 = require("./agentic-stream");
-const first_party_harness_1 = require("./first-party-harness");
 const format_1 = require("./format");
 /**
  * Declared services on a Dedicated Runtime — the CLI half of
@@ -801,19 +799,9 @@ function serviceDetailText(detail) {
         parts.push(d.detail);
     return parts.join(', ') || undefined;
 }
-/** The daemon's workload-facing service socket on a Dedicated Runtime guest. */
-exports.GUEST_SERVICE_SOCKET_PATH = '/run/skrr-dedicated-runtime/service-propose/service-propose.sock';
-/**
- * True when this process is running on a Dedicated Runtime guest — the
- * workload-uid test, or the guest markers the image/daemon own. An SSH
- * session may not carry the wrapper's env stamp, so the filesystem markers
- * count too; the socket itself remains the authority.
- */
-function runningOnDedicatedRuntimeGuest(env = process.env, getuid = process.getuid?.bind(process), paths = {}) {
-    if ((0, first_party_harness_1.isDedicatedRuntimeWorkload)(env, getuid))
-        return true;
-    const socketPath = paths.socketPath ?? exports.GUEST_SERVICE_SOCKET_PATH;
-    const attestation = paths.attestationPath ?? '/etc/skrr-dedicated-runtime/attestation.json';
-    const runtimeDir = paths.runtimeDir ?? '/run/skrr-dedicated-runtime';
-    return (0, node_fs_1.existsSync)(socketPath) || (0, node_fs_1.existsSync)(attestation) || (0, node_fs_1.existsSync)(runtimeDir);
-}
+// Guest detection lives in its own light module so the auth path (base-command,
+// login) can ask "is this a guest?" without loading socket.io and the stream
+// client this module needs (OSK-12473). Re-exported for existing callers.
+var dedicated_guest_1 = require("./dedicated-guest");
+Object.defineProperty(exports, "GUEST_SERVICE_SOCKET_PATH", { enumerable: true, get: function () { return dedicated_guest_1.GUEST_SERVICE_SOCKET_PATH; } });
+Object.defineProperty(exports, "runningOnDedicatedRuntimeGuest", { enumerable: true, get: function () { return dedicated_guest_1.runningOnDedicatedRuntimeGuest; } });

package/dist/lib/login.js

@@ -37,6 +37,7 @@ const device_code_1 = require("./device-code");
 const device_identity_1 = require("./device-identity");
 const oauthLogin_1 = require("./oauthLogin");
 const daemonBroker_1 = require("./daemonBroker");
+const dedicated_guest_1 = require("./dedicated-guest");
 const daemonBrokerRefusal_1 = require("./daemonBrokerRefusal");
 /**
  * What a shell with no terminal can do instead (OSK-12117). The refusal used to
@@ -119,8 +120,16 @@ async function cliLogin(opts = {}) {
                 // — the token lives for this process and the next `skrr` re-redeems
                 // over loopback. An explicit PKCE/device-code login further down
                 // still writes a real user-owned family, unchanged.
+                //
+                // Only a Dedicated guest's hand-off is the PLATFORM's. A laptop
+                // daemon's island file advertises `access_token` too, and there this
+                // sentence claimed a platform-managed machine that does not exist —
+                // the logout half of the same bug was OSK-12467 (c951446486).
                 console.log('');
-                console.log("  This machine is signed in through the platform's managed hand-off.");
+                console.log((0, dedicated_guest_1.runningOnDedicatedRuntimeGuest)()
+                    ? "  This machine is signed in through the platform's managed hand-off."
+                    : '  Signed in through the skrr background service on this computer (no browser needed). ' +
+                        'It lends this CLI short-lived tokens, so nothing was stored for this profile.');
                 return {
                     token: brokerResult.accessToken,
                     ...(brokerResult.accessExpiresAt !== undefined

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.d.ts

@@ -23,6 +23,37 @@ export declare function __setStateForTest(next: CredEnvelopeState): CredEnvelope
 export declare function __getStateForTest(): CredEnvelopeState;
 /** @internal Test seam — each spec owns its warn-dedupe horizon. */
 export declare function __clearWarnDedupeForTest(): void;
+/**
+ * Run the OSK-10314 consolidation for this profile's wrapped DEK.
+ *
+ * Under the canonical lock, because the window it closes is real: a daemon
+ * copying its legacy DEK into an empty canonical slot must not race a CLI
+ * enrolling a fresh one there — the loser's key would be overwritten and
+ * anything already sealed under it lost. That is the same race the lock was
+ * introduced for, one layer up.
+ *
+ * Never fatal. A migration that cannot run leaves the process exactly where it
+ * was, which is the state it has been operating in all along.
+ */
+/**
+ * Whether a split profile may be converged onto the legacy (daemon) key.
+ *
+ * Only the daemon ever has a legacy location, so only the daemon runs this, and
+ * the legacy key is the one it signs with. Since OSK-12063 the CLI enrolls no
+ * device key and only an interactive daemon login re-pins, so the key the server
+ * pins for this machine is the daemon's, UNLESS the daemon has itself been
+ * refused over its device key. That is the one fact that proves otherwise, and
+ * then nothing here knows which key the server holds, so it refuses as before.
+ *
+ * Why converging matters (OSK-12462): a CLI credential brokered by the daemon
+ * is tied to the daemon's machine row, and the server checks its refresh proof
+ * against the key pinned there. A CLI signing with a different key has that
+ * refresh refused as DEVICE_PROOF_THUMBPRINT_MISMATCH at its first renewal.
+ */
+export declare function splitKeyConvergencePolicy(): {
+    converge: boolean;
+    reason: 'daemon_key_pinned' | 'daemon_key_refused';
+};
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.
@@ -96,6 +127,16 @@ export declare function describeCredEnvelopeState(): {
         canonicalPath: string;
         legacyPath: string;
     };
+    /**
+     * Set when THIS process converged a split profile onto the legacy (daemon)
+     * key (OSK-12462). `canonicalPath` held the key that is now retired.
+     */
+    convergedFrom?: {
+        canonicalPath: string;
+        legacyPath: string;
+    };
+    /** How many retired DEKs this process can still open old values with. */
+    retiredKeys?: number;
 };
 /**
  * Sync write transform. Returns the wrapped serialized form when active.

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/credentialEnvelopeBridge.js

@@ -7,6 +7,7 @@ exports.DEFAULT_UNREADABLE_CREDENTIAL_HINT = void 0;
 exports.__setStateForTest = __setStateForTest;
 exports.__getStateForTest = __getStateForTest;
 exports.__clearWarnDedupeForTest = __clearWarnDedupeForTest;
+exports.splitKeyConvergencePolicy = splitKeyConvergencePolicy;
 exports.initCredEnvelope = initCredEnvelope;
 exports.resetCredEnvelope = resetCredEnvelope;
 exports.shutdownCredEnvelope = shutdownCredEnvelope;
@@ -67,6 +68,7 @@ const proper_lockfile_1 = __importDefault(require("proper-lockfile"));
 const credentialEnvelope_js_1 = require("./credentialEnvelope.js");
 const index_js_1 = require("./kek/index.js");
 const profileStateDir_js_1 = require("./profileStateDir.js");
+const refresh_js_1 = require("./refresh.js");
 const runtime_js_1 = require("./runtime.js");
 /**
  * Account name the wrapped DEK lives under (file fallback). Keeping the
@@ -259,6 +261,20 @@ async function withCredEnvelopeLock(profile, body) {
  * auth-core's to do), so being loud about it IS the remedy.
  */
 let _pathConflict = null;
+/**
+ * DEKs this profile used before a converging consolidation retired them
+ * (OSK-12462). Read-only: nothing is ever sealed under one again. A value that
+ * only a retired DEK opens is returned with `needsMigration: true`, the same
+ * signal a legacy plaintext value carries, so every consumer that already
+ * upgrades plaintext in place re-seals it under the active DEK on its own
+ * schedule. auth-core does not need to know where the consumer keeps it.
+ */
+let _retiredDeks = [];
+/**
+ * Set when THIS process converged a split profile onto the legacy key. For the
+ * status surface and tests; the on-disk marker is the durable record.
+ */
+let _convergedFrom = null;
 /**
  * Identity of a wrapped DEK: the SHA-256 of the key it unwraps to.
  *
@@ -297,18 +313,48 @@ async function wrappedDekIdentity(target, kek, aad) {
  * Never fatal. A migration that cannot run leaves the process exactly where it
  * was, which is the state it has been operating in all along.
  */
+/**
+ * Whether a split profile may be converged onto the legacy (daemon) key.
+ *
+ * Only the daemon ever has a legacy location, so only the daemon runs this, and
+ * the legacy key is the one it signs with. Since OSK-12063 the CLI enrolls no
+ * device key and only an interactive daemon login re-pins, so the key the server
+ * pins for this machine is the daemon's, UNLESS the daemon has itself been
+ * refused over its device key. That is the one fact that proves otherwise, and
+ * then nothing here knows which key the server holds, so it refuses as before.
+ *
+ * Why converging matters (OSK-12462): a CLI credential brokered by the daemon
+ * is tied to the daemon's machine row, and the server checks its refresh proof
+ * against the key pinned there. A CLI signing with a different key has that
+ * refresh refused as DEVICE_PROOF_THUMBPRINT_MISMATCH at its first renewal.
+ */
+function splitKeyConvergencePolicy() {
+    let reauthReason;
+    try {
+        const state = (0, refresh_js_1.needsReauthState)();
+        reauthReason = state.needed ? state.reason : undefined;
+    }
+    catch {
+        reauthReason = undefined;
+    }
+    return reauthReason === 'DEVICE_KEY_MISMATCH'
+        ? { converge: false, reason: 'daemon_key_refused' }
+        : { converge: true, reason: 'daemon_key_pinned' };
+}
 async function consolidateWrappedDek(profile, kek, aad) {
     const resolved = (0, profileStateDir_js_1.resolveProfileStateFile)(profile, ACCOUNT_CRED_DEK_WRAPPED);
     if (!resolved.usingLegacy) {
         _pathConflict = null;
         return;
     }
+    const policy = splitKeyConvergencePolicy();
     let outcome;
     try {
         outcome = await withCredEnvelopeLock(profile, () => (0, profileStateDir_js_1.consolidateProfileState)(profile, {
             files: [ACCOUNT_CRED_DEK_WRAPPED],
             primary: ACCOUNT_CRED_DEK_WRAPPED,
             identify: (dir) => wrappedDekIdentity(node_path_1.default.join(dir, ACCOUNT_CRED_DEK_WRAPPED), kek, aad),
+            onConflict: policy.converge ? 'adopt_legacy' : 'refuse',
             onEvent: (name, success, meta) => emit(`cred_envelope.${name}`, success, meta),
         }));
     }
@@ -319,6 +365,19 @@ async function consolidateWrappedDek(profile, kek, aad) {
         });
         return;
     }
+    if (outcome.status === 'converged') {
+        _pathConflict = null;
+        _convergedFrom = {
+            canonicalPath: node_path_1.default.join(outcome.canonicalDir, ACCOUNT_CRED_DEK_WRAPPED),
+            legacyPath: node_path_1.default.join(outcome.legacyDir ?? '', ACCOUNT_CRED_DEK_WRAPPED),
+        };
+        (0, runtime_js_1.getAuthLogger)().info(`[credEnvelope] profile "${profile}" had two different usable wrapped DEKs; ` +
+            `converged on the daemon's (${_convergedFrom.legacyPath}), which is the key the ` +
+            "server pins for this machine. The CLI's former key is kept beside it as " +
+            `${ACCOUNT_CRED_DEK_WRAPPED}${profileStateDir_js_1.RETIRED_COPY_SUFFIX}.* and still opens what was ` +
+            'sealed under it; each value is re-sealed under the shared key on its next write.');
+        return;
+    }
     if (outcome.status !== 'conflict') {
         _pathConflict = null;
         return;
@@ -335,13 +394,62 @@ async function consolidateWrappedDek(profile, kek, aad) {
     // BINARY restarts and adopts its legacy key into the empty canonical slot,
     // and the CLI logs back in on it. Not `skrr daemon restart`: any `skrr`
     // command mints a fresh key into an empty slot before doing anything else.
-    (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs; ` +
+    //
+    // Reached only when the daemon itself was refused over its device key
+    // (`splitKeyConvergencePolicy`); an ordinary split converges above.
+    (0, runtime_js_1.getAuthLogger)().warn(`[credEnvelope] profile "${profile}" has two different usable wrapped DEKs, and ` +
+        "the server refused the daemon's key, so neither is known to be the pinned one; " +
         `refusing to choose. Keeping ${_pathConflict.legacyPath} and leaving ` +
         `${_pathConflict.canonicalPath} untouched. Each side can still read its own ` +
         "credentials, and neither can read the other's. Do not delete " +
         `${_pathConflict.legacyPath}: it is the key the daemon reads. To converge on it, ` +
         'run `skrr logout && skrrd restart && skrr login`.');
 }
+/**
+ * Load every retired DEK beside the canonical one (OSK-12462). Only files a
+ * converging consolidation set aside are read; the `.superseded.*` copy an
+ * UNUSABLE key leaves is not a key anything can open. Read-only unwrap, never
+ * fatal: a retired key that no longer opens is simply not in the ring.
+ */
+async function loadRetiredDeks(profile, kek, aad, active) {
+    for (const old of _retiredDeks)
+        old.fill(0);
+    _retiredDeks = [];
+    for (const target of retiredDekFiles(profile)) {
+        try {
+            if (!kek.unwrapExisting)
+                return;
+            const dek = await kek.unwrapExisting(node_fs_1.default.readFileSync(target), aad);
+            if (dek.length === 32 && !dek.equals(active)) {
+                _retiredDeks.push(dek);
+            }
+            else {
+                dek.fill(0);
+            }
+        }
+        catch {
+            emit('cred_envelope.retired_dek.unreadable', false, {
+                profile,
+                file: node_path_1.default.basename(target),
+            });
+        }
+    }
+}
+/** Retired wrapped DEKs for `profile`, oldest first. */
+function retiredDekFiles(profile) {
+    const dir = (0, profileStateDir_js_1.profileStateDir)(profile);
+    const prefix = `${ACCOUNT_CRED_DEK_WRAPPED}${profileStateDir_js_1.RETIRED_COPY_SUFFIX}.`;
+    try {
+        return node_fs_1.default
+            .readdirSync(dir)
+            .filter((name) => name.startsWith(prefix))
+            .sort()
+            .map((name) => node_path_1.default.join(dir, name));
+    }
+    catch {
+        return [];
+    }
+}
 /**
  * Initialize the envelope path. Idempotent — second call when state is
  * non-uninit returns immediately.
@@ -416,6 +524,7 @@ async function initCredEnvelope(profile) {
         const wrappedBytes = node_fs_1.default.readFileSync(targetPath);
         const candidate = await kek.unwrapExisting(wrappedBytes, aad);
         if (candidate.length === 32) {
+            await loadRetiredDeks(profile, kek, aad, candidate);
             _state = {
                 kind: 'active',
                 dek: candidate,
@@ -523,6 +632,7 @@ async function initCredEnvelope(profile) {
                 return;
             }
         }
+        await loadRetiredDeks(profile, kek, aad, dek);
         _state = {
             kind: 'active',
             dek: dek,
@@ -553,7 +663,12 @@ async function initCredEnvelope(profile) {
  */
 async function resetCredEnvelope(opts) {
     if (opts?.clearOnDisk && opts.profile) {
-        for (const target of (0, profileStateDir_js_1.profileStateFilePathsToClear)(opts.profile, ACCOUNT_CRED_DEK_WRAPPED)) {
+        // A logout ends every key this profile held, the retired ones included: a
+        // retired DEK exists only to open values the logout is deleting anyway.
+        for (const target of [
+            ...(0, profileStateDir_js_1.profileStateFilePathsToClear)(opts.profile, ACCOUNT_CRED_DEK_WRAPPED),
+            ...retiredDekFiles(opts.profile),
+        ]) {
             try {
                 node_fs_1.default.unlinkSync(target);
             }
@@ -574,6 +689,10 @@ async function resetCredEnvelope(opts) {
     _state = { kind: 'uninit' };
     _kekRotationDetected = false;
     _pathConflict = null;
+    _convergedFrom = null;
+    for (const old of _retiredDeks)
+        old.fill(0);
+    _retiredDeks = [];
 }
 /**
  * Idempotent shutdown — must be called from the daemon's graceful-exit
@@ -612,6 +731,10 @@ function shutdownCredEnvelope() {
     _state = { kind: 'uninit' };
     _kekRotationDetected = false;
     _pathConflict = null;
+    _convergedFrom = null;
+    for (const old of _retiredDeks)
+        old.fill(0);
+    _retiredDeks = [];
 }
 /** @internal Test seam — re-arm `shutdownCredEnvelope` so it can run again. */
 function __resetShutdownGuardForTest() {
@@ -647,6 +770,10 @@ function hasCredEnvelopePathConflict() {
  * `oversky status`; clears on the next clean `resetCredEnvelope`.
  */
 function describeCredEnvelopeState() {
+    const extras = {
+        ...(_convergedFrom ? { convergedFrom: _convergedFrom } : {}),
+        ...(_retiredDeks.length > 0 ? { retiredKeys: _retiredDeks.length } : {}),
+    };
     if (_state.kind === 'disabled') {
         return {
             kind: 'disabled',
@@ -663,6 +790,7 @@ function describeCredEnvelopeState() {
             profile: _state.profile,
             ...(_kekRotationDetected ? { kekRotated: true } : {}),
             ...(_pathConflict ? { pathConflict: _pathConflict } : {}),
+            ...extras,
         };
     }
     return { kind: 'uninit', ...(_pathConflict ? { pathConflict: _pathConflict } : {}) };
@@ -784,12 +912,28 @@ function maybeDecryptOnRead(stored, options = {}) {
             });
             return { plaintext: null, needsMigration: false };
         }
+        const aad = (0, credentialEnvelope_js_1.buildCredentialAad)(_state.profile);
         try {
-            const aad = (0, credentialEnvelope_js_1.buildCredentialAad)(_state.profile);
             const pt = (0, credentialEnvelope_js_1.decrypt)(sealed, _state.dek, aad).toString('utf-8');
             return { plaintext: pt, needsMigration: false };
         }
         catch (err) {
+            // Sealed before a converging consolidation retired its key (OSK-12462).
+            // Readable, and flagged for the in-place upgrade every consumer already
+            // performs for legacy plaintext, which re-seals it under the active DEK.
+            for (const retired of _retiredDeks) {
+                try {
+                    const pt = (0, credentialEnvelope_js_1.decrypt)(sealed, retired, aad).toString('utf-8');
+                    emit('cred_envelope.read.retired_key', true, {
+                        kekId: _state.kekId,
+                        kekKind: _state.kekKind,
+                    });
+                    return { plaintext: pt, needsMigration: true };
+                }
+                catch {
+                    /* not this one */
+                }
+            }
             emit('cred_envelope.read.decrypt_failed', false, {
                 kekId: _state.kekId,
                 kekKind: _state.kekKind,

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -15,6 +15,23 @@ type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed';
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
 export declare function __getStateForTest(): DeviceIdentityState;
+/**
+ * The device-key split, read from disk: the daemon (legacy directory, not yet
+ * consolidated) and the CLI (canonical directory) holding DIFFERENT keypairs
+ * for one profile. `null` when this process has no legacy location, when the
+ * legacy copy is consolidated, or when either side has no readable public key.
+ *
+ * This is the fact the server acts on (OSK-12462): a CLI credential brokered by
+ * the daemon is checked against the key pinned on the daemon's machine row, so
+ * while the thumbprints differ the CLI's refresh is refused. Reading it from
+ * the public JWKs, which are plaintext, needs no DEK and changes nothing.
+ */
+export declare function describeDeviceKeySplit(profile: string): {
+    daemonThumbprint: string;
+    cliThumbprint: string;
+    daemonDir: string;
+    cliDir: string;
+} | null;
 /**
  * Initialize device identity. Idempotent.
  *