@skrr-ai/cli 0.1.66 → 0.1.67

package/dist/commands/logout.js

@@ -35,9 +35,6 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.shouldSkipLocalLogout = shouldSkipLocalLogout;
 const core_1 = require("@oclif/core");
-const fs = __importStar(require("node:fs"));
-const os = __importStar(require("node:os"));
-const path = __importStar(require("node:path"));
 const base_command_1 = require("../base-command");
 const config_1 = require("../lib/config");
 const first_party_harness_managed_1 = require("../lib/first-party-harness-managed");
@@ -112,21 +109,6 @@ function shouldSkipLocalLogout(input) {
 function platformManagedHandoff() {
     return (0, dedicated_service_1.runningOnDedicatedRuntimeGuest)() && Boolean((0, daemonBroker_1.findBrokeredHandoffDescriptor)());
 }
-/**
- * Whether this computer has a configured skrr background service — the file
- * `skrr daemon install` writes, which a logout deliberately does not remove
- * (the service's OWN credential is what becomes unreadable; OSK-12483).
- * The daemon's profile dir is `~/.skrr/profiles/<name>` for every profile,
- * including `default`.
- */
-function daemonConfigPresent(profile) {
-    try {
-        return fs.existsSync(path.join(os.homedir(), '.skrr', 'profiles', profile, 'daemon.json'));
-    }
-    catch {
-        return false;
-    }
-}
 const SIGN_IN_AGAIN = 'To sign in again, run `skrr login`.';
 class Logout extends base_command_1.BaseCommand {
     static description = 'Sign out and clear locally-stored tokens. ' +
@@ -214,39 +196,36 @@ class Logout extends base_command_1.BaseCommand {
         (0, auth_storage_1.clearAllBackends)();
         // Sweep the credentials this product wrote under its PREVIOUS brand.
         //
-        // Without this, logout removed only the current service and still reported
-        // an unqualified "Signed out." — leaving the pre-rename CLI credential, the
-        // pre-rename daemon credentials and BOTH KEKs on the machine, so the sealed
-        // envelope and the key that unwraps it were both still there. `--all-devices`
-        // is documented for "a stolen-laptop incident", which is precisely when that
-        // is the wrong outcome.
-        //
-        // Reported rather than silent: this destroys credentials, and one of them
-        // may belong to a still-installed `oversky` binary.
-        const sweptLegacy = keychain.deleteLegacyBrandEntries();
-        // L11/L12 — also wipe shared device-identity + envelope artifacts.
-        // These files live under ~/.skrr/profiles/default/ and are shared
-        // with the daemon, so a `skrr logout` here also rotates the daemon's
-        // identity on the next start. Each call is wrapped so a single
-        // cleanup failure (permissions, transient fs error) doesn't break
-        // the local logout — the user already saw "Signed out" intent.
-        try {
-            await (0, device_identity_1.resetDeviceIdentity)({ profile: 'default', clearOnDisk: true });
-        }
-        catch {
-            /* best-effort */
-        }
-        try {
-            (0, device_identity_1.clearEnrollmentMarker)('default');
-        }
-        catch {
-            /* best-effort */
-        }
-        try {
-            await (0, cred_envelope_1.resetCredEnvelope)({ profile: 'default', clearOnDisk: true });
-        }
-        catch {
-            /* best-effort */
+        // Ordinary logout clears retired CLI slots only. The explicit
+        // all-devices operation also clears retired daemon credentials and KEKs.
+        // Removing those during a CLI-only logout would break a running daemon's
+        // next restart or refresh (OSK-12483).
+        const sweptLegacy = keychain.deleteLegacyBrandEntries({
+            includeMachineCredentials: flags['all-devices'],
+        });
+        // Device identity and the wrapped DEK belong to the daemon as well as the
+        // CLI. Preserve both for a CLI-only logout. An explicit all-devices logout
+        // revokes daemon sessions and may then clear this profile's machine keys.
+        if (flags['all-devices']) {
+            const profile = keychain.getActiveProfile();
+            try {
+                await (0, device_identity_1.resetDeviceIdentity)({ profile, clearOnDisk: true });
+            }
+            catch {
+                /* best-effort */
+            }
+            try {
+                (0, device_identity_1.clearEnrollmentMarker)(profile);
+            }
+            catch {
+                /* best-effort */
+            }
+            try {
+                await (0, cred_envelope_1.resetCredEnvelope)({ profile, clearOnDisk: true });
+            }
+            catch {
+                /* best-effort */
+            }
         }
         // Strip any stray token/refreshToken from cli-config.json too —
         // `migrateAuthOutOfConfig` should have done this at init time, but
@@ -300,18 +279,8 @@ class Logout extends base_command_1.BaseCommand {
         }
         else {
             this.log(SIGN_IN_AGAIN);
-            // OSK-12483 — the shared envelope wipe above also orphans THIS machine's
-            // daemon credential (it is sealed under the DEK just deleted). The
-            // running daemon keeps working on its in-memory copy, but its next start
-            // cannot read the stored one and needs `skrr daemon login` — a plain
-            // `skrr login` mints a cli-scope credential and does not re-enroll it.
-            // Say that now, while the person is still looking at a screen; otherwise
-            // the daemon simply never comes back and nothing anywhere names why.
-            // `daemon.json` is written when the service is installed/configured and
-            // survives this logout.
-            if (daemonConfigPresent(keychain.getActiveProfile())) {
-                this.log("This also signs out this computer's skrr background service — it will need " +
-                    '`skrr daemon login` before it runs again.');
+            if (!flags['all-devices']) {
+                this.log('The skrr background service keeps its own sign-in and may provide CLI access.');
             }
         }
         if (sweptLegacy.length > 0) {

package/dist/commands/store/admissions/approve.js

@@ -13,6 +13,7 @@ class StoreAdmissionsApprove extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> store admissions approve ar_abc123',
         '<%= config.bin %> store admissions approve skill_abc123 --kind skill',
+        '<%= config.bin %> store admissions approve store_release_abc123 --kind artifact',
         '<%= config.bin %> store admissions approve store_release_abc123 --artifact',
     ];
     static args = {
@@ -25,8 +26,8 @@ class StoreAdmissionsApprove extends base_command_1.BaseCommand {
     static flags = {
         artifact: core_1.Flags.boolean({ description: 'The id is a Skill or Action artifact release' }),
         kind: core_1.Flags.string({
-            description: 'The id is a listing, not a release',
-            options: ['skill', 'action'],
+            description: 'The id is a skill/action listing or a Store artifact release',
+            options: ['skill', 'action', 'artifact'],
         }),
         note: core_1.Flags.string({ description: 'Decision note' }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
@@ -35,9 +36,10 @@ class StoreAdmissionsApprove extends base_command_1.BaseCommand {
         this.requireAuth();
         const { args, flags } = await this.parse(StoreAdmissionsApprove);
         try {
-            if (flags.artifact && flags.kind)
-                this.error('Use either --artifact or --kind');
-            const result = flags.artifact
+            if (flags.artifact && flags.kind && flags.kind !== 'artifact') {
+                this.error('Use either --artifact or a listing --kind');
+            }
+            const result = flags.artifact || flags.kind === 'artifact'
                 ? await data_provider_1.dataService.approveStoreArtifactAdmission(args.id, flags.note)
                 : flags.kind
                     ? await data_provider_1.dataService.approveStoreListingAdmission(flags.kind, args.id, flags.note)

package/dist/commands/store/admissions/list.js

@@ -9,7 +9,7 @@ const base_command_1 = require("../../../base-command");
  * not the publisher.
  */
 class StoreAdmissionsList extends base_command_1.BaseCommand {
-    static description = 'List releases and listings awaiting capability-tiered review (store_curation)';
+    static description = 'List Agent releases, artifact releases and listings awaiting capability-tiered review (store_curation)';
     static examples = [
         '<%= config.bin %> store admissions list',
         '<%= config.bin %> store admissions list --state refused --json',
@@ -28,8 +28,22 @@ class StoreAdmissionsList extends base_command_1.BaseCommand {
             const result = await data_provider_1.dataService.getStoreReleaseAdmissions({
                 state: flags.state === 'refused' ? 'refused' : 'pending_review',
             });
+            const artifacts = [...(result.artifacts || [])];
+            let after = result.artifactNextCursor;
+            const seen = new Set();
+            while (after) {
+                if (seen.has(after))
+                    throw new Error('Artifact admission queue returned a repeated cursor');
+                seen.add(after);
+                const page = await data_provider_1.dataService.getStoreReleaseAdmissions({
+                    state: flags.state === 'refused' ? 'refused' : 'pending_review',
+                    artifactAfter: after,
+                });
+                artifacts.push(...(page.artifacts || []));
+                after = page.artifactNextCursor;
+            }
             if (flags.json) {
-                this.log(JSON.stringify(result, null, 2));
+                this.log(JSON.stringify({ ...result, artifacts, artifactNextCursor: null }, null, 2));
                 return;
             }
             const rows = [
@@ -45,7 +59,7 @@ class StoreAdmissionsList extends base_command_1.BaseCommand {
                     name: l.name || '',
                     facets: (l.admission?.facets || []).join(','),
                 })),
-                ...(result.artifacts || []).map((a) => ({
+                ...artifacts.map((a) => ({
                     kind: `${a.entityType} artifact`,
                     id: a.releaseId,
                     name: `${a.entityId} v${a.versionLabel}`,

package/dist/commands/store/admissions/refuse.js

@@ -12,6 +12,7 @@ class StoreAdmissionsRefuse extends base_command_1.BaseCommand {
     static examples = [
         '<%= config.bin %> store admissions refuse ar_abc123 --note "unbounded network egress"',
         '<%= config.bin %> store admissions refuse act_abc123 --kind action --note "reason"',
+        '<%= config.bin %> store admissions refuse store_release_abc123 --kind artifact --note "reason"',
         '<%= config.bin %> store admissions refuse store_release_abc123 --artifact --note "reason"',
     ];
     static args = {
@@ -24,8 +25,8 @@ class StoreAdmissionsRefuse extends base_command_1.BaseCommand {
     static flags = {
         artifact: core_1.Flags.boolean({ description: 'The id is a Skill or Action artifact release' }),
         kind: core_1.Flags.string({
-            description: 'The id is a listing, not a release',
-            options: ['skill', 'action'],
+            description: 'The id is a skill/action listing or a Store artifact release',
+            options: ['skill', 'action', 'artifact'],
         }),
         note: core_1.Flags.string({ description: 'Why the refusal — required', required: true }),
         json: core_1.Flags.boolean({ description: 'Output as JSON' }),
@@ -34,9 +35,10 @@ class StoreAdmissionsRefuse extends base_command_1.BaseCommand {
         this.requireAuth();
         const { args, flags } = await this.parse(StoreAdmissionsRefuse);
         try {
-            if (flags.artifact && flags.kind)
-                this.error('Use either --artifact or --kind');
-            const result = flags.artifact
+            if (flags.artifact && flags.kind && flags.kind !== 'artifact') {
+                this.error('Use either --artifact or a listing --kind');
+            }
+            const result = flags.artifact || flags.kind === 'artifact'
                 ? await data_provider_1.dataService.refuseStoreArtifactAdmission(args.id, flags.note || '')
                 : flags.kind
                     ? await data_provider_1.dataService.refuseStoreListingAdmission(flags.kind, args.id, flags.note || '')

package/dist/commands/store/install.js

@@ -60,18 +60,18 @@ class StoreInstall extends base_command_1.BaseCommand {
         // The server still refuses a second install of a listing you own — this is
         // the friendly read that says so before a quote or a prompt (OSK-12287:
         // `installs` is the read model; `purchased` answers membership cheaply).
+        let alreadyInstalled = false;
         try {
             const owned = await data_provider_1.dataService.getPurchasedAgents();
-            if ((owned?.purchasedAgentIds ?? []).includes(args.agentId)) {
-                this.error(`${args.agentId} is already installed. See it: skrr store updates, or update it: skrr store update ${args.agentId}`, { exit: 1 });
-            }
+            alreadyInstalled = (owned?.purchasedAgentIds ?? []).includes(args.agentId);
         }
         catch (err) {
             // A read failure must not block an install — the server re-checks anyway.
-            if (err.exit)
-                throw err;
             this.warn(`Could not check what you own (${err.message}); continuing.`);
         }
+        if (alreadyInstalled) {
+            this.error(`${args.agentId} is already installed. See it: skrr store updates, or update it: skrr store update ${args.agentId}`, { exit: 1 });
+        }
         // What installing would charge NOW, resolved by the server the way the
         // install resolves it (OSK-12240). The install then pins what was shown, so
         // a listing whose price moved in between is refused rather than charged.

package/dist/lib/auth-core-init.js

@@ -17,11 +17,10 @@ exports.__resetPrefetchCliAuthForTest = __resetPrefetchCliAuthForTest;
  * Runs as a side-effect import from base-command.ts so every command path
  * (including future ones) gets the same DI setup. Idempotent and cheap.
  *
- * Phase A scope:
+ * Runtime scope:
  *   - Logger: a thin shim over `console`. CLI is a one-shot process; we
  *     don't ship winston for this.
- *   - configDir: still ~/.sky/ in Phase A. Phase D will repoint to
- *     ~/.skrr/ with a one-shot read-shim migration.
+ *   - configDir: the shared ~/.skrr/ root, with profile state below it.
  *   - Kill switches: respect OVERSKY_DISABLE_REFRESH_SCHEDULER for parity
  *     with the daemon's rollback knob.
  *   - binaryName: 'skrr' so reauth banners say `skrr login` not `oversky login`.
@@ -42,6 +41,7 @@ const auth_core_1 = require("@skrr-ai/auth-core");
 const cred_envelope_1 = require("./cred-envelope");
 const device_identity_1 = require("./device-identity");
 const auth_storage_1 = require("./auth-storage");
+const keychain_1 = require("./keychain");
 function envFlag(name) {
     const v = process.env[name];
     return v === '1' || v === 'true' || v === 'TRUE';
@@ -165,12 +165,6 @@ const cliLogger = {
     },
     error: (...args) => console.error('[auth-core error]', ...args),
 };
-/**
- * Profile name in shared on-disk paths. Pre-Phase-K every consumer
- * resolves to `'default'`; matches `daemon/src/auth.ts:DEFAULT_PROFILE`
- * so cross-binary file paths align byte-for-byte.
- */
-const DEFAULT_PROFILE = 'default';
 const DEDICATED_AUTH_GENERATION_MARKER = 'dedicated-runtime-auth-generation';
 /**
  * A Dedicated Runtime's workspace survives replacement but `/etc/machine-id`
@@ -192,7 +186,11 @@ async function prepareDedicatedRuntimeAuthGeneration(options = {}) {
         return false;
     const configDir = options.configDir ?? (0, auth_core_1.resolveConfigRoot)();
     node_fs_1.default.mkdirSync(configDir, { recursive: true, mode: 0o700 });
-    const markerPath = node_path_1.default.join(configDir, DEDICATED_AUTH_GENERATION_MARKER);
+    const profile = (0, keychain_1.getActiveProfile)();
+    const markerName = profile === keychain_1.DEFAULT_PROFILE
+        ? DEDICATED_AUTH_GENERATION_MARKER
+        : `${DEDICATED_AUTH_GENERATION_MARKER}.${profile}`;
+    const markerPath = node_path_1.default.join(configDir, markerName);
     const release = await proper_lockfile_1.default.lock(configDir, {
         lockfilePath: `${markerPath}.lock`,
         realpath: false,
@@ -212,12 +210,12 @@ async function prepareDedicatedRuntimeAuthGeneration(options = {}) {
         (options.clearStoredAuth ?? auth_storage_1.clearAllBackends)();
         await (options.clearDeviceIdentity ??
             (() => (0, device_identity_1.resetDeviceIdentity)({
-                profile: DEFAULT_PROFILE,
+                profile,
                 clearOnDisk: true,
             })))();
         await (options.clearCredentialEnvelope ??
             (() => (0, cred_envelope_1.resetCredEnvelope)({
-                profile: DEFAULT_PROFILE,
+                profile,
                 clearOnDisk: true,
             })))();
         const temporary = `${markerPath}.tmp.${process.pid}.${Date.now()}`;
@@ -298,6 +296,7 @@ function ensureAuthCoreConfigured() {
 let _prefetchPromise = null;
 let _credEnvelopeInitPromise = null;
 let _credEnvelopeInitStartedAt = 0;
+let _prefetchProfile = null;
 class CliCredentialInitializationError extends Error {
     code = 'CREDENTIAL_INITIALIZATION_UNAVAILABLE';
     exitCode = 75;
@@ -342,15 +341,21 @@ function encryptedCredentialInitError(timedOut, cause) {
         'The credential remains protected; unlock or repair the OS credential store and retry.');
 }
 function ensureCliAuthPrefetchStarted() {
-    if (_prefetchPromise)
+    const profile = (0, keychain_1.getActiveProfile)();
+    if (_prefetchPromise) {
+        if (_prefetchProfile !== profile) {
+            throw new CliCredentialInitializationError(`Credential initialization already belongs to profile ${_prefetchProfile}; start a new skrr process for profile ${profile}.`);
+        }
         return;
+    }
+    _prefetchProfile = profile;
     _credEnvelopeInitStartedAt = Date.now();
-    const envelopeInit = (0, cred_envelope_1.initCredEnvelope)(DEFAULT_PROFILE);
+    const envelopeInit = (0, cred_envelope_1.initCredEnvelope)(profile);
     _credEnvelopeInitPromise = envelopeInit;
     _prefetchPromise = (async () => {
         try {
             await envelopeInit;
-            await (0, device_identity_1.initDeviceIdentity)(DEFAULT_PROFILE);
+            await (0, device_identity_1.initDeviceIdentity)(profile);
             // The CLI deliberately does NOT enroll a device key with the server
             // (OSK-12063). Enrollment pins the FIRST key presented on a machine's
             // Daemon row, and every later refresh signed by a different key is
@@ -431,6 +436,7 @@ function __resetPrefetchCliAuthForTest() {
     _prefetchPromise = null;
     _credEnvelopeInitPromise = null;
     _credEnvelopeInitStartedAt = 0;
+    _prefetchProfile = null;
 }
 // Eager-configure on first import. Cheap and avoids ordering pitfalls in
 // any future command that calls auth-core helpers from outside a Command.

package/dist/lib/keychain.d.ts

@@ -1,4 +1,4 @@
-/** Pre-Phase-K namespace; reserved for a future migration helper. */
+/** Default profile when no profile flag or environment override is present. */
 export declare const DEFAULT_PROFILE = "default";
 export declare function setActiveProfile(profile: string): void;
 /**
@@ -102,11 +102,13 @@ export declare function deleteRefreshToken(): void;
  * Returns the services it actually removed something from, so the caller can
  * say what happened instead of destroying credentials silently.
  *
- * NOTE this also signs out the retired `oversky` binary, if one is still
- * installed. That is the intent — same account, same machine — and the cutover
- * runbook already lists these items for removal.
+ * Ordinary logout removes only retired CLI slots. Machine credentials and
+ * KEKs are shared with the daemon and are removed only by --all-devices.
+ * That broader mode also signs out an installed retired `oversky` daemon.
  */
-export declare function deleteLegacyBrandEntries(): string[];
+export declare function deleteLegacyBrandEntries(options?: {
+    includeMachineCredentials?: boolean;
+}): string[];
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.
  * Safe to call on a clean system — missing items are not an error.

package/dist/lib/keychain.js

@@ -67,10 +67,8 @@ exports.resolveProfileFromArgv = resolveProfileFromArgv;
  * Mirrors `daemon/src/keychain.ts` but simpler:
  *   - No prefetch: the CLI is a short-lived foreground process; parallelizing
  *     the keychain probe with other startup work isn't worth the code.
- *   - Namespaced `ai.skrr.cli.<profile>` from day one. Before Phase K
- *     ships profile switching, `<profile>` is always `default`, but baking
- *     the suffix in now makes the future migration a rename instead of a
- *     schema change.
+ *   - Namespaced `ai.skrr.cli.<profile>` so each selected profile keeps
+ *     its own CLI refresh family.
  *   - Distinct service from the daemon (`ai.skrr.cli.*` vs.
  *     `ai.skrr.daemon.*`). The CLI holds `scope: 'cli'` tokens; the
  *     daemon holds `scope: 'daemon'`. They must never read each other's
@@ -121,7 +119,7 @@ const cred_envelope_1 = require("./cred-envelope");
 const auth_core_1 = require("@skrr-ai/auth-core");
 /** Service-name prefix. Always followed by `.<profile>`. */
 const SERVICE_BASE = 'ai.skrr.cli';
-/** Pre-Phase-K namespace; reserved for a future migration helper. */
+/** Default profile when no profile flag or environment override is present. */
 exports.DEFAULT_PROFILE = 'default';
 const ACCOUNT_TOKEN = 'cli-token';
 const ACCOUNT_EXPIRES = 'cli-token-expires';
@@ -619,14 +617,16 @@ function deleteEntireService(service) {
  * Returns the services it actually removed something from, so the caller can
  * say what happened instead of destroying credentials silently.
  *
- * NOTE this also signs out the retired `oversky` binary, if one is still
- * installed. That is the intent — same account, same machine — and the cutover
- * runbook already lists these items for removal.
+ * Ordinary logout removes only retired CLI slots. Machine credentials and
+ * KEKs are shared with the daemon and are removed only by --all-devices.
+ * That broader mode also signs out an installed retired `oversky` daemon.
  */
-function deleteLegacyBrandEntries() {
+function deleteLegacyBrandEntries(options = {}) {
     if (!isAvailable())
         return [];
-    return discoverLegacyBrandServices().filter((service) => deleteEntireService(service));
+    return discoverLegacyBrandServices()
+        .filter((service) => options.includeMachineCredentials === true || /^(?:ai|com)\.oversky\.cli\./.test(service))
+        .filter((service) => deleteEntireService(service));
 }
 /**
  * Remove every CLI keychain slot for the active profile. Used by `skrr logout`.

package/dist/lib/refresh.d.ts

@@ -45,6 +45,8 @@ export interface EnsureFreshCliCredentialResult {
     /** True when we adopted a fresher token another process already wrote. */
     adoptedStoredToken?: boolean;
     pair?: TokenPair;
+    /** Stable diagnostic code; never contains token or server response text. */
+    refreshFailureCode?: string;
     skippedReason?: 'no_token' | 'ci_token' | 'external_source' | 'env_override' | 'bare_mode' | 'fresh' | 'no_refresh_token' | 'refresh_failed';
 }
 /**

package/dist/lib/refresh.js

@@ -58,6 +58,7 @@ class CliRefreshUnavailableError extends Error {
 }
 exports.CliRefreshUnavailableError = CliRefreshUnavailableError;
 let ensureInFlight = null;
+let reportedPermanentRefreshFailure = false;
 function expiryFromToken(token) {
     if (!token)
         return undefined;
@@ -158,8 +159,25 @@ async function ensureFreshCliCredential(opts = {}) {
                 pair,
             };
         }
-        catch {
-            return { credential, refreshed: false, skippedReason: 'refresh_failed' };
+        catch (err) {
+            const refreshFailureCode = err instanceof auth_core_1.PermanentAuthFailure
+                ? err.code
+                : err instanceof auth_core_1.TransientAuthFailure
+                    ? 'TRANSIENT_REFRESH_FAILURE'
+                    : err instanceof CliRefreshUnavailableError
+                        ? 'LOCAL_REFRESH_UNAVAILABLE'
+                        : 'LOCAL_REFRESH_ERROR';
+            if (err instanceof auth_core_1.PermanentAuthFailure && !reportedPermanentRefreshFailure) {
+                reportedPermanentRefreshFailure = true;
+                console.error(`[skrr/auth] Stored CLI session refresh was rejected (${refreshFailureCode}). ` +
+                    'The background service may still provide access; run `skrr login` if it cannot.');
+            }
+            return {
+                credential,
+                refreshed: false,
+                skippedReason: 'refresh_failed',
+                refreshFailureCode,
+            };
         }
         finally {
             ensureInFlight = null;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.d.ts

@@ -10,7 +10,7 @@ type DeviceIdentityState = {
     profile: string;
     envelopeProtected: boolean;
 };
-type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed';
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key';
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
@@ -42,11 +42,13 @@ export declare function describeDeviceKeySplit(profile: string): {
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */
-export declare function initDeviceIdentity(profile: string): Promise<void>;
+export declare function initDeviceIdentity(profile: string, options?: {
+    recoverUnreadable?: boolean;
+}): Promise<void>;
 /**
- * Reset state. With `clearOnDisk=true` deletes both keypair files —
- * used by `oversky logout` / `sky logout` so a freshly-logged-in user
- * gets a fresh device identity that the daemon will see on its next start.
+ * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.
+ * Machine-wide sign-out may use that option; ordinary CLI sign-out preserves
+ * the daemon's pinned identity.
  */
 export declare function resetDeviceIdentity(opts?: {
     profile?: string;

package/dist/node_modules/@skrr-ai/auth-core/dist/cjs/deviceIdentityBridge.js

@@ -100,6 +100,26 @@ function publicKeyPath(profile) {
 function privateKeyPath(profile) {
     return node_path_1.default.join(profileConfigDir(profile), PRIVATE_KEY_FILENAME);
 }
+function storedKeyMaterialExists(profile) {
+    let files;
+    try {
+        files = [publicKeyPath(profile), privateKeyPath(profile), enrollmentMarkerPath(profile)];
+    }
+    catch {
+        return true;
+    }
+    for (const file of files) {
+        try {
+            node_fs_1.default.lstatSync(file);
+            return true;
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                return true;
+        }
+    }
+    return false;
+}
 function enrollmentMarkerPath(profile) {
     return node_path_1.default.join(profileConfigDir(profile), ENROLLMENT_MARKER_FILENAME);
 }
@@ -339,7 +359,7 @@ async function consolidateDeviceIdentity(profile) {
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */
-async function initDeviceIdentity(profile) {
+async function initDeviceIdentity(profile, options = {}) {
     if (_state.kind !== 'uninit')
         return;
     if (typeof profile !== 'string' || profile.length === 0) {
@@ -374,6 +394,18 @@ async function initDeviceIdentity(profile) {
         });
         return;
     }
+    // A first install has neither file. If either file already exists, a null
+    // load is a lost, corrupt or temporarily unreadable identity. Replacing it
+    // during ordinary boot would make the next refresh sign with a key the
+    // server has never pinned, turning a local read failure into an unexpected
+    // DEVICE_KEY_MISMATCH. Only an explicit interactive login may replace it;
+    // that login proves the new key and re-pins it before issuing credentials.
+    const hasStoredKey = storedKeyMaterialExists(profile);
+    if (hasStoredKey && !options.recoverUnreadable) {
+        _state = { kind: 'disabled', reason: 'unreadable_key' };
+        emit('recovery_required', false, { profile, reason: 'stored_key_unreadable' });
+        return;
+    }
     let fresh;
     try {
         fresh = (0, deviceKey_js_1.generateDeviceKeyPair)();
@@ -413,9 +445,9 @@ async function initDeviceIdentity(profile) {
     });
 }
 /**
- * Reset state. With `clearOnDisk=true` deletes both keypair files —
- * used by `oversky logout` / `sky logout` so a freshly-logged-in user
- * gets a fresh device identity that the daemon will see on its next start.
+ * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.
+ * Machine-wide sign-out may use that option; ordinary CLI sign-out preserves
+ * the daemon's pinned identity.
  */
 async function resetDeviceIdentity(opts) {
     if (opts?.clearOnDisk && opts.profile) {

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/deviceIdentityBridge.d.ts

@@ -10,7 +10,7 @@ type DeviceIdentityState = {
     profile: string;
     envelopeProtected: boolean;
 };
-type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed';
+type DisabledReason = 'init_failed' | 'load_failed' | 'persist_failed' | 'unreadable_key';
 /** @internal Test seam — force-set state. */
 export declare function __setStateForTest(next: DeviceIdentityState): DeviceIdentityState;
 /** @internal Test seam — read state. */
@@ -42,11 +42,13 @@ export declare function describeDeviceKeySplit(profile: string): {
  *   2. Generate fresh keypair and persist. Failure to persist is a hard
  *      error landing in disabled+persist_failed.
  */
-export declare function initDeviceIdentity(profile: string): Promise<void>;
+export declare function initDeviceIdentity(profile: string, options?: {
+    recoverUnreadable?: boolean;
+}): Promise<void>;
 /**
- * Reset state. With `clearOnDisk=true` deletes both keypair files —
- * used by `oversky logout` / `sky logout` so a freshly-logged-in user
- * gets a fresh device identity that the daemon will see on its next start.
+ * Reset in-memory state. With `clearOnDisk=true` deletes both keypair files.
+ * Machine-wide sign-out may use that option; ordinary CLI sign-out preserves
+ * the daemon's pinned identity.
  */
 export declare function resetDeviceIdentity(opts?: {
     profile?: string;