@skrr-ai/cli 0.1.85 → 0.1.87

package/dist/lib/auth-storage.js

@@ -41,6 +41,7 @@ exports.readFromBackend = readFromBackend;
 exports.describeForeignCredential = describeForeignCredential;
 exports.writeToBackend = writeToBackend;
 exports.clearAllBackends = clearAllBackends;
+exports.takeResolvedKeychainRead = takeResolvedKeychainRead;
 exports.normalizeServerOrigin = normalizeServerOrigin;
 exports.__authFilePathForTest = __authFilePathForTest;
 /**
@@ -504,6 +505,11 @@ function unlinkQuietly(p) {
 function readFromKeychain() {
     if (!keychain.isAvailable())
         return null;
+    // One pass: the owner record is read once for the whole bundle, not once per
+    // secret plus once for itself (see `withKeychainReadPass`).
+    return keychain.withKeychainReadPass(readFromKeychainInPass);
+}
+function readFromKeychainInPass() {
     const tokenEntry = keychain.readToken();
     if (!tokenEntry) {
         // Read came back empty despite "available" — don't cache a false
@@ -769,6 +775,7 @@ function describeForeignCredential(result) {
 function writeToBackend(bundle, options = {}) {
     if ((0, harness_context_1.isHarnessCliContext)())
         throw new harness_context_1.HarnessCredentialPersistRefused();
+    lastKeychainTokenRead = null;
     const requestedOrigin = options.serverOrigin ?? bundle.serverOrigin;
     let persistedBundle = bundle;
     if (requestedOrigin !== undefined) {
@@ -821,9 +828,34 @@ function writeToBackend(bundle, options = {}) {
  * auth-failure cleanup). Idempotent.
  */
 function clearAllBackends() {
+    lastKeychainTokenRead = null;
     clearKeychainBackend();
     deleteFileBackend();
 }
+/**
+ * The Keychain read the credential resolver just made, for the ONE caller that
+ * reads the same bundle again a moment later: `BaseCommand.init()` resolves the
+ * credential and then asks `ensureFreshCliCredential` whether it needs a
+ * refresh, which re-read every slot (another six `security` spawns, ~100ms) to
+ * learn the expiry the first read already had.
+ *
+ * Handed out at most once, only for the credential that read produced, only
+ * for the same server origin, and dropped by any write or clear in this
+ * process. It never stands in for the re-read under the auth lock: a refresh
+ * still reads the store fresh before it spends a refresh token.
+ */
+let lastKeychainTokenRead = null;
+function takeResolvedKeychainRead(credential, expectedServerOrigin) {
+    const read = lastKeychainTokenRead;
+    lastKeychainTokenRead = null;
+    if (!read?.bundle || credential.source !== 'keychain')
+        return null;
+    if (!credential.token || read.bundle.token !== credential.token)
+        return null;
+    if (read.expectedServerOrigin !== normalizeServerOrigin(expectedServerOrigin))
+        return null;
+    return read;
+}
 /**
  * The low-level backends, exposed for the credential resolver's
  * `readKeychainToken` / `readFileToken` slots. Internal callers should
@@ -847,6 +879,7 @@ exports.backends = {
     readKeychainToken(expectedServerOrigin) {
         const read = readKeychainAssessed();
         const result = assessBundleOrigin(read.bundle, 'keychain', expectedServerOrigin);
+        lastKeychainTokenRead = result.bundle && result.originStatus === 'matched' ? result : null;
         return result.bundle?.token ?? null;
     },
     readFileToken(expectedServerOrigin) {

package/dist/lib/keychain.d.ts

@@ -38,6 +38,7 @@ export declare function isAvailable(): boolean;
  * masquerade as "keychain always available" across the process lifetime.
  */
 export declare function resetAvailability(): void;
+export declare function withKeychainReadPass<T>(fn: () => T): T;
 export interface KeychainEntry {
     token: string;
     expiresAt?: number;

package/dist/lib/keychain.js

@@ -43,6 +43,7 @@ exports.isLegacySlotCurrent = isLegacySlotCurrent;
 exports.__currentServiceForTest = __currentServiceForTest;
 exports.isAvailable = isAvailable;
 exports.resetAvailability = resetAvailability;
+exports.withKeychainReadPass = withKeychainReadPass;
 exports.readToken = readToken;
 exports.writeToken = writeToken;
 exports.readRefreshToken = readRefreshToken;
@@ -256,17 +257,56 @@ function isSecretAccount(account) {
     return account === ACCOUNT_TOKEN || account === ACCOUNT_REFRESH;
 }
 /**
- * `raw` returns the stored string exactly, with no envelope transform — for
- * copying another config's item, which may be sealed under a key we lack.
+ * One synchronous read of a bundle, memoised per (service, account).
+ *
+ * Every `security` call is a process spawn costing ~15-20ms, and a bundle read
+ * used to make eight of them for six items: each secret's envelope decrypt
+ * re-read the owner record (`foreignOwnerRootAt`), and the bundle read it a
+ * third time for itself. Measured on `skrr agents show`, that was 17 serial
+ * spawns and ~280ms before the first request could leave.
+ *
+ * A pass is SYNCHRONOUS by construction (`execFileSync` throughout, and the
+ * callback is not awaited), so nothing else in this process can interleave a
+ * write; a write made inside the pass drops the memo for that item. Another
+ * process's write is no more or less visible than before — the eight separate
+ * reads were never one atomic snapshot either. Outside a pass nothing is
+ * memoised: a later read always reaches the Keychain, which is what the
+ * refresh path's re-read under the auth lock depends on.
  */
-function readSlot(account, service = currentService(), raw_ = false) {
-    let raw;
+let readPassMemo = null;
+function withKeychainReadPass(fn) {
+    if (readPassMemo)
+        return fn();
+    readPassMemo = new Map();
+    try {
+        return fn();
+    }
+    finally {
+        readPassMemo = null;
+    }
+}
+function memoKey(service, account) {
+    return `${service}\u0000${account}`;
+}
+function forgetSlotInPass(account, service) {
+    readPassMemo?.delete(memoKey(service, account));
+}
+/** The stored string exactly as `security` returns it, or null. */
+function readRawSlot(account, service) {
+    const key = memoKey(service, account);
+    if (readPassMemo?.has(key))
+        return readPassMemo.get(key) ?? null;
+    const value = execReadSlot(account, service);
+    readPassMemo?.set(key, value);
+    return value;
+}
+function execReadSlot(account, service) {
     try {
         const out = (0, node_child_process_1.execFileSync)('security', ['find-generic-password', '-s', service, '-a', account, '-w'], { stdio: ['ignore', 'pipe', 'ignore'], encoding: 'utf-8' });
         const trimmed = out.replace(/\n$/, '');
         if (trimmed.length === 0)
             return null;
-        raw = trimmed;
+        return trimmed;
     }
     catch (err) {
         const status = err.status;
@@ -280,6 +320,15 @@ function readSlot(account, service = currentService(), raw_ = false) {
         }
         return null;
     }
+}
+/**
+ * `raw` returns the stored string exactly, with no envelope transform — for
+ * copying another config's item, which may be sealed under a key we lack.
+ */
+function readSlot(account, service = currentService(), raw_ = false) {
+    const raw = readRawSlot(account, service);
+    if (raw === null)
+        return null;
     if (raw_ || !isSecretAccount(account))
         return raw;
     // L12 — route secret slots through the envelope.
@@ -339,6 +388,7 @@ function quoteForSecurityInteractive(v) {
     return '"' + v.replace(/\\/g, '\\\\').replace(/"/g, '\\"') + '"';
 }
 function writeSlot(account, value, service = currentService(), raw = false) {
+    forgetSlotInPass(account, service);
     try {
         // L12 — wrap secret-bearing slots through the envelope when active.
         // Empty / non-secret slots are passthrough, and so is a raw copy.
@@ -364,6 +414,7 @@ function writeSlot(account, value, service = currentService(), raw = false) {
     }
 }
 function deleteSlot(account, service = currentService()) {
+    forgetSlotInPass(account, service);
     try {
         (0, node_child_process_1.execFileSync)('security', ['delete-generic-password', '-s', service, '-a', account], {
             stdio: ['ignore', 'ignore', 'ignore'],
@@ -484,15 +535,17 @@ function readBundleAt(slot) {
     if (!isAvailable())
         return null;
     const service = serviceForSlot(slot);
-    const token = readEntryAt(service, ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
-    if (!token)
-        return null;
-    return {
-        token,
-        refresh: readEntryAt(service, ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES),
-        serverOrigin: readSlot(ACCOUNT_SERVER_ORIGIN, service) || null,
-        owner: readSlot(ACCOUNT_OWNER, service) || null,
-    };
+    return withKeychainReadPass(() => {
+        const token = readEntryAt(service, ACCOUNT_TOKEN, ACCOUNT_EXPIRES);
+        if (!token)
+            return null;
+        return {
+            token,
+            refresh: readEntryAt(service, ACCOUNT_REFRESH, ACCOUNT_REFRESH_EXPIRES),
+            serverOrigin: readSlot(ACCOUNT_SERVER_ORIGIN, service) || null,
+            owner: readSlot(ACCOUNT_OWNER, service) || null,
+        };
+    });
 }
 const BUNDLE_ACCOUNTS = [
     ACCOUNT_TOKEN,

package/dist/lib/refresh.d.ts

@@ -38,6 +38,13 @@ export interface EnsureFreshCliCredentialOptions {
     force?: boolean;
     /** Respect `--bare`: do not mutate persisted credentials in bare mode. */
     bareMode?: boolean;
+    /**
+     * `credential` was produced by the resolver a moment ago; decide from the
+     * Keychain read it made rather than reading every slot again
+     * (`takeResolvedKeychainRead`). Falls back to a fresh read whenever that read
+     * does not describe exactly this credential.
+     */
+    reuseResolvedRead?: boolean;
 }
 export interface EnsureFreshCliCredentialResult {
     credential: ResolvedCredential;

package/dist/lib/refresh.js

@@ -133,7 +133,8 @@ async function ensureFreshCliCredential(opts = {}) {
         return { credential, refreshed: false, skippedReason: 'external_source' };
     }
     const cfg = (0, config_1.loadConfig)();
-    const read = (0, auth_storage_1.readFromBackend)(cfg.baseURL);
+    const read = (opts.reuseResolvedRead ? (0, auth_storage_1.takeResolvedKeychainRead)(credential, cfg.baseURL) : null) ??
+        (0, auth_storage_1.readFromBackend)(cfg.baseURL);
     // If a sibling process already rotated the stored access token, adopt it
     // instead of needlessly consuming the latest refresh token again.
     if (read.bundle?.token && read.bundle.token !== credential.token) {

package/dist/lib/store-acquisition.js

@@ -3,6 +3,16 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.describeAcquisitionRequestLines = describeAcquisitionRequestLines;
 exports.describeAcquisitionRequestRow = describeAcquisitionRequestRow;
 const data_provider_1 = require("@skrr-ai/data-provider");
+function describeBuyerTerms(request) {
+    if (request.buyerTerms) {
+        return `${request.buyerTerms.termsVersion} — ${request.buyerTerms.artifactUri}`;
+    }
+    if (request.invalidReason === 'buyer_terms_missing') {
+        // Stored before OSK-13520 refused to open a request without terms.
+        return 'missing — this request was recorded without buyer terms, so it can only be declined';
+    }
+    return 'not configured, so this purchase cannot be approved';
+}
 /**
  * A purchase an agent asked to make, as the lines a terminal shows (OSK-12240).
  *
@@ -22,9 +32,7 @@ function describeAcquisitionRequestLines(request) {
         `  Status:       ${status.label}${status.detail ? ` — ${status.detail}` : ''}`,
         `  Price:        ${(0, data_provider_1.formatStoreAcquisitionPrice)(request.price)} ${request.currency}`,
         `  Refunds:      ${(0, data_provider_1.describeStoreAcquisitionRefundTerms)(request.refundTerms)}`,
-        `  Buyer terms:  ${request.buyerTerms
-            ? `${request.buyerTerms.termsVersion} — ${request.buyerTerms.artifactUri}`
-            : 'not configured, so this purchase cannot be approved'}`,
+        `  Buyer terms:  ${describeBuyerTerms(request)}`,
         `  Offer:        ${request.offerVersionId}`,
         `  Capabilities: ${(0, data_provider_1.describeStoreAcquisitionCapabilities)(request.capabilities, request.capabilityCount)}`,
     ];

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.12",
+  "version": "0.4.13",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {