@stravica-ai/digital-operator-pa 0.1.60 → 0.1.61

package/dist/engineering-pa-cli/src/secrets/commands/backup.mjs

@@ -1,13 +1,30 @@
 // backup — render an HTML file containing the master key as a QR code
-// and open it in the default browser. Cleans up the temp HTML after 30s.
+// and open it in the default browser.
 //
 // The QR-generation JS is the same minified generator used in
 // onboarding.html, so the output looks identical. No browser automation,
 // no npm deps.
+//
+// The page holds the age secret key in plaintext, so the file lives on
+// disk only until the browser has read it (w-2026-10-17-dave-004). The
+// old cleanup was an unref()ed 30s timer, which never fired because
+// main() calls process.exit straight after the command returns: every
+// run left a `dave-key-backup-*` directory with the key in the OS temp
+// root. Now the command waits for the operator to confirm the page is
+// showing (Enter on a TTY), capped at BACKUP_FILE_MAX_LIFETIME_MS, then
+// wipes the file synchronously: overwrite with zeros of its own length,
+// fsync, unlink, remove the directory. The same wipe runs from the
+// finally block, a process 'exit' listener and SIGINT/SIGTERM/SIGHUP
+// handlers, so a throw, an early Ctrl+C or a process.exit anywhere in
+// the flow cannot leave the key behind. Only SIGKILL or a crash of the
+// host can.
 
-import { mkdtempSync, writeFileSync, existsSync, unlinkSync, readFileSync } from 'node:fs';
+import {
+  mkdtempSync, writeFileSync, existsSync, unlinkSync, readFileSync,
+  openSync, fstatSync, writeSync, fsyncSync, closeSync, rmSync,
+} from 'node:fs';
 import { join } from 'node:path';
-import { tmpdir } from 'node:os';
+import { tmpdir, constants as osConstants } from 'node:os';
 import { spawn } from 'node:child_process';
 import { defaultPaths, secretKeyFromKeyFile, VaultError } from '../vault.mjs';
 import { HTML_HEAD, QR_JS, HTML_TAIL } from './backup-template.mjs';
@@ -25,10 +42,105 @@ export function buildBackupHtml(secretKey, publicKey) {
   return HTML_HEAD + QR_JS + dataScript + HTML_TAIL;
 }
 
+// Hard cap on how long backup.html stays on disk when nobody confirms
+// the page is showing. The browser needs the file only for its first
+// read; the loaded page keeps working once the file is gone.
+export const BACKUP_FILE_MAX_LIFETIME_MS = 60_000;
+
+const WIPE_SIGNALS = ['SIGINT', 'SIGTERM', 'SIGHUP'];
+
+/**
+ * Wipe the backup file and its directory, synchronously. Each step runs
+ * whatever the previous one did, so a missing file (a throw before the
+ * write) still removes the directory.
+ */
+export function wipeBackupDir(dir, htmlPath) {
+  try {
+    const fd = openSync(htmlPath, 'r+');
+    try {
+      const { size } = fstatSync(fd);
+      if (size > 0) {
+        const zeros = Buffer.alloc(size);
+        let written = 0;
+        while (written < size) written += writeSync(fd, zeros, written, size - written, written);
+        fsyncSync(fd);
+      }
+    } finally {
+      closeSync(fd);
+    }
+  } catch { /* never written, or already gone */ }
+  try { unlinkSync(htmlPath); } catch { /* already gone */ }
+  try { rmSync(dir, { recursive: true, force: true }); } catch { /* already gone */ }
+}
+
+/**
+ * Register the wipe on every way out of the process and return it. The
+ * returned function is idempotent and deregisters the listeners, so the
+ * finally block, the 'exit' listener and a signal can all call it.
+ */
+function armWipe(dir, htmlPath) {
+  let wiped = false;
+  const signalHandlers = new Map();
+  const wipe = () => {
+    if (wiped) return;
+    wiped = true;
+    process.removeListener('exit', wipe);
+    for (const [sig, handler] of signalHandlers) process.removeListener(sig, handler);
+    wipeBackupDir(dir, htmlPath);
+  };
+  process.on('exit', wipe);
+  for (const sig of WIPE_SIGNALS) {
+    const handler = () => {
+      wipe();
+      process.exit(128 + (osConstants.signals[sig] || 0));
+    };
+    signalHandlers.set(sig, handler);
+    process.on(sig, handler);
+  }
+  return wipe;
+}
+
+/**
+ * Hold the file until the operator says the page is showing (Enter, or
+ * end of input, on a TTY) or the cap passes. Without a TTY there is no
+ * one to confirm, so the cap alone applies. The timer is deliberately
+ * NOT unref()ed: the process must stay alive to run the wipe.
+ */
+function defaultWaitForBrowser({ maxLifetimeMs, stdin = process.stdin }) {
+  const interactive = Boolean(stdin && stdin.isTTY);
+  const seconds = Math.ceil(maxLifetimeMs / 1000);
+  if (interactive) {
+    console.log(`Press Enter as soon as the page is showing. That wipes the file from disk; the open page keeps working (do not reload it). The file is wiped after ${seconds}s either way.`);
+  } else {
+    console.log(`The file is wiped from disk in ${seconds}s; the open page keeps working (do not reload it).`);
+  }
+  return new Promise((resolve) => {
+    let timer = null;
+    const finish = () => {
+      clearTimeout(timer);
+      if (interactive) {
+        stdin.removeListener('data', finish);
+        stdin.removeListener('end', finish);
+        stdin.pause();
+      }
+      resolve();
+    };
+    timer = setTimeout(finish, maxLifetimeMs);
+    if (interactive) {
+      stdin.once('data', finish);
+      stdin.once('end', finish);
+      stdin.resume();
+    }
+  });
+}
+
 export async function runBackup(overrides = {}) {
   const paths = overrides.paths || defaultPaths(overrides);
   const opener = overrides.opener || defaultOpener;
-  const scheduleCleanup = overrides.scheduleCleanup ?? true;
+  const waitForBrowser = overrides.waitForBrowser || defaultWaitForBrowser;
+  const maxLifetimeMs = overrides.maxLifetimeMs ?? BACKUP_FILE_MAX_LIFETIME_MS;
+  // process.stdin is only touched by the default waiter, and only then.
+  const stdin = overrides.stdin;
 
   if (!existsSync(paths.keyFile)) {
     // Missing key is an operational failure (exit 2), not an "uninitialised"
@@ -53,19 +165,20 @@ export async function runBackup(overrides = {}) {
   const html = buildBackupHtml(secretKey, publicKey);
   const dir = mkdtempSync(join(tmpdir(), 'dave-key-backup-'));
   const htmlPath = join(dir, 'backup.html');
-  writeFileSync(htmlPath, html);
-
-  console.log('Opening master key backup in browser...');
-  console.log('IMPORTANT: Back up the key shown, then close the browser tab.');
+  // Armed before the first byte of key material reaches disk.
+  const wipe = armWipe(dir, htmlPath);
+  try {
+    writeFileSync(htmlPath, html, { mode: 0o600 });
 
-  opener(htmlPath);
+    console.log('Opening master key backup in browser...');
+    console.log('IMPORTANT: Back up the key shown, then close the browser tab.');
 
-  if (scheduleCleanup) {
-    // Detach a lightweight cleaner so the CLI can exit.
-    setTimeout(() => {
-      try { unlinkSync(htmlPath); } catch { /* ignore */ }
-    }, 30000).unref?.();
+    opener(htmlPath);
+    await waitForBrowser({ htmlPath, maxLifetimeMs, stdin });
+  } finally {
+    wipe();
   }
+  console.log('Backup file wiped from disk.');
 
   return { htmlPath, html };
 }

package/dist/engineering-pa-cli/src/secrets/vault.mjs

@@ -11,7 +11,7 @@
 
 import { spawn } from 'node:child_process';
 import { homedir } from 'node:os';
-import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, unlinkSync, chmodSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync, chmodSync, rmSync } from 'node:fs';
 import { join, dirname, resolve, basename, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { mkdtempSync } from 'node:fs';
@@ -1155,8 +1155,8 @@ export async function sopsEncrypt(paths, pubKey, obj) {
   // the vault's own .sops.yaml matches (path_regex: \.enc\.json$). If the
   // suffix doesn't match, sops errors with "no matching creation rules".
   const tmpFile = join(tmp, 'secrets.enc.json');
-  writeFileSync(tmpFile, JSON.stringify(obj, null, 2) + '\n');
   try {
+    writeFileSync(tmpFile, JSON.stringify(obj, null, 2) + '\n');
     // --config pins the sops config to the vault's own .sops.yaml so sops
     // doesn't walk up from CWD and hit an unrelated ambient .sops.yaml
     // (e.g. an older vault's config at a higher directory).
@@ -1168,7 +1168,10 @@ export async function sopsEncrypt(paths, pubKey, obj) {
     }
     writeFileSync(paths.secretsFile, stdout);
   } finally {
-    try { unlinkSync(tmpFile); } catch { /* ignore */ }
+    // Remove the whole mkdtemp directory, not just the plaintext file:
+    // unlinking the file alone left one empty vault-XXXXXX directory under
+    // the OS temp root per encrypt (w-2026-10-15-dave-013).
+    try { rmSync(tmp, { recursive: true, force: true }); } catch { /* ignore */ }
   }
 }
 
@@ -1224,8 +1227,8 @@ export async function decryptStoreForWrite(paths) {
 export async function sopsEncryptScoped(paths, obj) {
   const tmp = mkdtempSync(join(tmpdir(), 'vault-'));
   const tmpFile = join(tmp, basename(paths.secretsFile));
-  writeFileSync(tmpFile, JSON.stringify(obj, null, 2) + '\n');
   try {
+    writeFileSync(tmpFile, JSON.stringify(obj, null, 2) + '\n');
     const { code, stdout, stderr } = await runCmd('sops', ['--config', paths.sopsConfig, '--encrypt', tmpFile], {
       env: { SOPS_AGE_KEY_FILE: paths.keyFile },
     });
@@ -1234,7 +1237,8 @@ export async function sopsEncryptScoped(paths, obj) {
     }
     writeFileSync(paths.secretsFile, stdout);
   } finally {
-    try { unlinkSync(tmpFile); } catch { /* ignore */ }
+    // Same as sopsEncrypt: the directory goes too, on every path.
+    try { rmSync(tmp, { recursive: true, force: true }); } catch { /* ignore */ }
   }
 }
 

package/dist/engineering-pa-core/docs/tools/distill.md

@@ -56,14 +56,16 @@ any file changes distill produced.
 
 ### Model selection
 
-The sweep passes `--model claude-opus-4-7` explicitly (operator ruling
-2026-07-29). Before the pin, no `--model` was passed and the Librarian
+The sweep passes `--model claude-opus-5-5` explicitly (operator ruling
+2026-07-29 for the pin). Before the pin, no `--model` was passed and the Librarian
 inherited whatever the host CLI defaulted to -- so the model running the
 sweep was an accident of host configuration, and a host-side default bump
 silently changed sweep behaviour across the estate. The pin makes the
-choice deliberate. The reasoning behind 4.7 specifically: it follows
-briefs better than 4.8/5 in estate experience, and brief-following
-matters more for a scripted sweep than raw capability.
+choice deliberate. The pinned model follows the estate model ladder:
+`claude-opus-5-5` is the base model from the 2026-10-16 operator ruling.
+It replaced `claude-opus-4-7` (now deprecated), which was first picked
+because it followed briefs better than 4.8/5 in estate experience, and
+brief-following matters more for a scripted sweep than raw capability.
 
 Override per host or per run with the `DISTILL_MODEL` environment
 variable:

package/dist/engineering-pa-core/src/distill/prompt.mjs

@@ -81,13 +81,16 @@ export const DISTILL_PROMPT = buildDistillPrompt();
 // 2026-07-29). Before this pin, claudeArgs passed no `--model`, so the
 // Librarian inherited whatever the host CLI happened to default to -- the
 // model choice was an accident of host config, and a host-side default bump
-// silently changed sweep behaviour. The pin makes the choice deliberate:
-// claude-opus-4-7 follows briefs better than 4.8/5 in estate experience,
-// which matters more for a scripted sweep than raw capability.
+// silently changed sweep behaviour. The pin makes the choice deliberate.
+// The pinned model follows the estate model ladder: claude-opus-5-5 is the
+// base model from the 2026-10-16 operator ruling. It replaced claude-opus-4-7
+// (now deprecated), which was first picked because it followed briefs better
+// than 4.8/5, and brief-following matters more for a scripted sweep than raw
+// capability.
 //
 // Override per host or per run via the DISTILL_MODEL environment variable
 // (documented in docs/tools/distill.md).
-export const DEFAULT_DISTILL_MODEL = 'claude-opus-4-7';
+export const DEFAULT_DISTILL_MODEL = 'claude-opus-5-5';
 
 export function resolveDistillModel(env = process.env) {
   const override = env.DISTILL_MODEL;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.60",
+  "version": "0.1.61",
   "description": "Digital Operator PA: single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",