@skrr-ai/cli 0.1.58 → 0.1.59

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.js

@@ -32,7 +32,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, } from './deviceKey.js';
-import { hasCredEnvelopePathConflict, isCredEnvelopeActive, maybeDecryptOnRead, wrapIfActiveOrPassthrough, } from './credentialEnvelopeBridge.js';
+import { hasCredEnvelopePathConflict, isCredEnvelopeActive, maybeDecryptOnRead, splitKeyConvergencePolicy, wrapIfActiveOrPassthrough, } from './credentialEnvelopeBridge.js';
 import { consolidateProfileState, profileStateFilePathsToClear, resolveProfileStateDir, } from './profileStateDir.js';
 import { emitAuthTelemetry, getAuthLogger } from './runtime.js';
 const PUBLIC_KEY_FILENAME = 'device-public-key.jwk';
@@ -243,6 +243,37 @@ function deviceIdentityOf(dir) {
         return null;
     }
 }
+/**
+ * The device-key split, read from disk: the daemon (legacy directory, not yet
+ * consolidated) and the CLI (canonical directory) holding DIFFERENT keypairs
+ * for one profile. `null` when this process has no legacy location, when the
+ * legacy copy is consolidated, or when either side has no readable public key.
+ *
+ * This is the fact the server acts on (OSK-12462): a CLI credential brokered by
+ * the daemon is checked against the key pinned on the daemon's machine row, so
+ * while the thumbprints differ the CLI's refresh is refused. Reading it from
+ * the public JWKs, which are plaintext, needs no DEK and changes nothing.
+ */
+export function describeDeviceKeySplit(profile) {
+    try {
+        const resolved = resolveProfileStateDir(profile, PRIVATE_KEY_FILENAME);
+        if (!resolved.usingLegacy || resolved.legacyDir === null)
+            return null;
+        const daemonThumbprint = deviceIdentityOf(resolved.legacyDir);
+        const cliThumbprint = deviceIdentityOf(resolved.canonicalDir);
+        if (!daemonThumbprint || !cliThumbprint || daemonThumbprint === cliThumbprint)
+            return null;
+        return {
+            daemonThumbprint,
+            cliThumbprint,
+            daemonDir: resolved.legacyDir,
+            cliDir: resolved.canonicalDir,
+        };
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Run the OSK-10314 consolidation for this profile's device identity.
  *
@@ -257,11 +288,17 @@ async function consolidateDeviceIdentity(profile) {
         emit('path_consolidation.deferred', true, { profile, reason: 'cred_envelope_path_conflict' }, { logLevel: 'info' });
         return;
     }
+    // Two different keypairs under one DEK are converged the way two DEKs are:
+    // onto the daemon's, unless the daemon itself was refused over it. The CLI's
+    // keypair is set aside as `.retired`, not deleted (OSK-12462). Leaving them
+    // split is what had the CLI refresh refused as a device-key mismatch.
+    const policy = splitKeyConvergencePolicy();
     try {
         await consolidateProfileState(profile, {
             files: DEVICE_IDENTITY_FILES,
             primary: PRIVATE_KEY_FILENAME,
             identify: deviceIdentityOf,
+            onConflict: policy.converge ? 'adopt_legacy' : 'refuse',
             onEvent: (name, success, meta) => emit(name, success, meta),
         });
     }

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.d.ts

@@ -27,8 +27,8 @@ export { formatRecoveryCode, parseRecoveryCode, normalizeRecoveryCode, isValidRe
 export { buildCredentialAad, decrypt as credEnvelopeDecrypt, deserialize as credEnvelopeDeserialize, encrypt as credEnvelopeEncrypt, ENVELOPE_MAGIC as CRED_ENVELOPE_MAGIC, generateDek, isEnvelopeString as isCredEnvelopeString, KEY_LEN as CRED_KEY_LEN, openBuffer as credOpenBuffer, sealBuffer as credSealBuffer, serialize as credEnvelopeSerialize, unwrap as credEnvelopeUnwrap, wrap as credEnvelopeWrap, type SealedBlob as CredSealedBlob, } from './credentialEnvelope.js';
 export { __setKekStrategyForTest, getKekStrategy, InMemoryKek, UnavailableKek, KekUnavailableError, LinuxKek, MacosKek, registerZeroizeHook, WindowsKek, zeroizeKekCaches, type KekStrategy, } from './kek/index.js';
 export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, normalizeHtu, publicJwkFromX, tokenHash, verifyProof as verifyDeviceProof, type DeviceKeyPair, type DeviceProofClaims, type DeviceProofHeader, type Ed25519PrivateJwk, type Ed25519PublicJwk, type VerifyFailureReason as DeviceProofVerifyFailureReason, type VerifyFailure as DeviceProofVerifyFailure, type VerifyOptions as DeviceProofVerifyOptions, type VerifySuccess as DeviceProofVerifySuccess, } from './deviceKey.js';
-export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
-export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
+export { initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, type DecryptOnReadOptions, __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, type ReadTransformResult, } from './credentialEnvelopeBridge.js';
+export { initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, type EnrollmentResult, } from './deviceIdentityBridge.js';
 export { getMachineUuid, hostedRuntimeIdOverride, HOSTED_RUNTIME_MACHINE_SOURCES, __resetMachineUuidCacheForTest, } from './machineUuid.js';
 export { ensureMachineDaemonId, legacyDaemonUuids, __resetCachedDaemonIdForTest, } from './machineId.js';
 export { PAIR_AAD_PREFIX, PAIR_AAD_MAX_LEN, PAIR_BUNDLE_MAX_BASE64_LEN, PAIR_NONCE_LEN, PAIR_PUBKEY_LEN, PAIR_SECRET_LEN, PairBundleError, assemblePairBundleBase64, base64ToUint8Array as pairBase64ToUint8Array, base64UrlToUint8Array as pairBase64UrlToUint8Array, buildPairAad, buildPairUrl, generatePairKeyPair, openPairBundleBase64, parsePairBundle, parsePairPlaintext, parsePairUrl, uint8ArrayToBase64 as pairUint8ArrayToBase64, uint8ArrayToBase64Url as pairUint8ArrayToBase64Url, type AssembleBundleOptions as PairAssembleBundleOptions, type OpenBundleOptions as PairOpenBundleOptions, type PairBundle, type PairBundleErrorCode, type PairKeyPair, type PairPlaintextV1, type PairUrlFields, } from './daemonPair.js';

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/index.js

@@ -108,14 +108,14 @@ export { buildProof as buildDeviceProof, generateDeviceKeyPair, jwkThumbprint, n
 // Daemon and CLI consume these; the underlying primitives live above.
 export { 
 // credEnvelope bridge
-initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
+initCredEnvelope, resetCredEnvelope, shutdownCredEnvelope, isCredEnvelopeActive, hasCredEnvelopePathConflict, describeCredEnvelopeState, splitKeyConvergencePolicy, maybeEncryptForWrite, maybeDecryptOnRead, DEFAULT_UNREADABLE_CREDENTIAL_HINT, 
 // Test seams — `__`-prefixed so consumers don't import them in
 // production code paths. Re-exported here so CLI/daemon spec files
 // can resolve the wrapped-DEK path against the same module instance.
 __wrappedDekFilePathForTest, __setStateForTest as __setCredEnvelopeStateForTest, __getStateForTest as __getCredEnvelopeStateForTest, __resetShutdownGuardForTest, } from './credentialEnvelopeBridge.js';
 export { 
 // deviceIdentity bridge
-initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, 
+initDeviceIdentity, resetDeviceIdentity, signServerRequest, enrollWithServer, clearEnrollmentMarker, isDeviceIdentityActive, getDevicePublicKey, describeDeviceIdentityState, describeDeviceKeySplit, 
 // Test seams — file path resolvers + state setters for spec files.
 __publicKeyPathForTest, __privateKeyPathForTest, __enrollmentMarkerPathForTest, __enrollmentBackoffPathForTest, __setStateForTest as __setDeviceIdentityStateForTest, __getStateForTest as __getDeviceIdentityStateForTest, } from './deviceIdentityBridge.js';
 // Hardware machine identity sent as `machineUuid` (IOPlatformUUID /

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/profileStateDir.d.ts

@@ -11,6 +11,13 @@ export declare const SUPERSEDED_MARKER_SUFFIX = ".superseded.json";
  * canonical copy existed and was NOT usable — a usable one is never replaced.
  */
 export declare const SUPERSEDED_COPY_SUFFIX = ".superseded";
+/**
+ * Suffix for a USABLE canonical file set aside by a converging consolidation
+ * (`onConflict: 'adopt_legacy'`). Distinct from `SUPERSEDED_COPY_SUFFIX`, which
+ * names an unusable copy: a retired key still opens what was sealed under it,
+ * and the credential envelope reads these as its keyring (OSK-12462).
+ */
+export declare const RETIRED_COPY_SUFFIX = ".retired";
 /** The canonical directory for a profile's auth state. */
 export declare function profileStateDir(profile: string): string;
 /**
@@ -59,7 +66,12 @@ export type ConsolidationStatus =
 /** Canonical was present but unusable; replaced, and kept under `.superseded`. */
  | 'superseded'
 /** Both copies are usable and DIFFERENT. Refused — a human decides. */
- | 'conflict';
+ | 'conflict'
+/**
+ * Both copies were usable and DIFFERENT, and the caller chose the legacy one
+ * (`onConflict: 'adopt_legacy'`). The canonical copy is kept as `.retired`.
+ */
+ | 'converged';
 export interface ConsolidationOutcome {
     status: ConsolidationStatus;
     profile: string;
@@ -98,6 +110,14 @@ export interface ConsolidationSpec {
     identify?: (dir: string) => Promise<string | null> | string | null;
     /** Report what would happen and write nothing. */
     dryRun?: boolean;
+    /**
+     * What to do when both copies are usable and DIFFERENT. `refuse` (default)
+     * leaves both untouched and reports `conflict`. `adopt_legacy` sets the
+     * canonical copy aside as `<file>.retired.<stamp>` and adopts the legacy one,
+     * reporting `converged`. Only a caller that has decided which key must win
+     * may pass it — the files are kept, but nothing here can re-seal content.
+     */
+    onConflict?: 'refuse' | 'adopt_legacy';
     onEvent?: (name: string, success: boolean, meta: Record<string, unknown>) => void;
 }
 /**

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/profileStateDir.js

@@ -56,10 +56,14 @@
  *   4. no canonical copy of the file                   → legacy (not yet consolidated)
  *   5. both copies, no marker                          → legacy (unresolved: stay put)
  *
- * The migration writes the marker, never deletes, and refuses case 5 when both
- * sides hold a usable and DIFFERENT key — because merging those would require
- * re-sealing content that lives in the OS keychain and is not auth-core's to
- * re-seal. A human resolves that one, and the loud signal is the deliverable.
+ * The migration writes the marker and never deletes. Case 5 with a usable and
+ * DIFFERENT key on each side is refused by default. A caller that knows which
+ * key must win can pass `onConflict: 'adopt_legacy'`, which moves the canonical
+ * copy aside as `<file>.retired.<stamp>` (kept, never deleted) and adopts the
+ * legacy one. The credential envelope does that for the daemon's key, and keeps
+ * the retired DEK readable so nothing sealed under it is lost (OSK-12462): the
+ * refusal alone left the CLI signing with a key the server does not pin, which
+ * gets its refresh refused as a device-key mismatch.
  *
  * ROLLBACK. The legacy file is left exactly where it was, under its own name.
  * Older code looks there, finds it, and works — no operator step. The marker is
@@ -82,6 +86,13 @@ export const SUPERSEDED_MARKER_SUFFIX = '.superseded.json';
  * canonical copy existed and was NOT usable — a usable one is never replaced.
  */
 export const SUPERSEDED_COPY_SUFFIX = '.superseded';
+/**
+ * Suffix for a USABLE canonical file set aside by a converging consolidation
+ * (`onConflict: 'adopt_legacy'`). Distinct from `SUPERSEDED_COPY_SUFFIX`, which
+ * names an unusable copy: a retired key still opens what was sealed under it,
+ * and the credential envelope reads these as its keyring (OSK-12462).
+ */
+export const RETIRED_COPY_SUFFIX = '.retired';
 /** The canonical directory for a profile's auth state. */
 export function profileStateDir(profile) {
     assertProfile(profile);
@@ -213,6 +224,28 @@ export async function consolidateProfileState(profile, spec) {
             identities,
         };
     }
+    if (spec.onConflict === 'adopt_legacy') {
+        const aside = dryRun
+            ? plannedAside(canonicalDir, spec.files)
+            : moveAside(canonicalDir, spec.files, RETIRED_COPY_SUFFIX);
+        const moved = adopt(legacyDir, canonicalDir, spec.files, dryRun);
+        if (!dryRun)
+            writeMarker(markerPath, canonicalPrimary, 'converged');
+        emitOutcome(spec, 'converged', {
+            profile,
+            identities,
+            from: legacyDir,
+            to: canonicalDir,
+            retired: aside,
+        });
+        return {
+            ...base,
+            status: 'converged',
+            written: moved.written,
+            supersededAside: aside,
+            identities,
+        };
+    }
     emitOutcome(spec, 'conflict', { profile, identities, canonicalDir, legacyDir });
     return { ...base, status: 'conflict', identities };
 }
@@ -297,14 +330,14 @@ function adopt(fromDir, toDir, files, dryRun) {
     }
     return { written, supersededAside: [] };
 }
-function moveAside(dir, files) {
+function moveAside(dir, files, suffix = SUPERSEDED_COPY_SUFFIX) {
     const stamp = new Date().toISOString().replace(/[:.]/g, '-');
     const aside = [];
     for (const name of files) {
         const target = path.join(dir, name);
         if (!existsFile(target))
             continue;
-        fs.renameSync(target, `${target}${SUPERSEDED_COPY_SUFFIX}.${stamp}`);
+        fs.renameSync(target, `${target}${suffix}.${stamp}`);
         aside.push(target);
     }
     return aside;

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.7",
+  "version": "0.4.8",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {