lazycodex-ai 5.1.61 → 5.1.63

package/dist/cli/service-auth/keychain-helper/signature.d.ts

@@ -0,0 +1,17 @@
+export declare const KEYCHAIN_HELPER_REQUIREMENT: string;
+export type SignatureVerdict = "valid" | "invalid" | "missing";
+/** Checks one file against a designated requirement. Injected in tests; production uses `verifyWithSecurityFramework`. */
+export type RequirementCheck = (path: string, requirement: string) => Promise<boolean>;
+export declare function signatureBackend(): Promise<"ffi" | "codesign">;
+/** bun:ffi first, `/usr/bin/codesign --verify --strict -R=<DR>` when the framework cannot be loaded. */
+export declare const verifyWithSecurityFramework: RequirementCheck;
+/**
+ * One verdict per file identity (dev, inode, size, mtime, ctime) per process (design 1, "Checking the helper"): a
+ * replaced or rewritten file is checked again, an unchanged one is not. ctime moves on every write and cannot be set
+ * back with utimes. The file is stat'ed before AND after the check, and a verdict is stored only when both agree, so it
+ * is never recorded under the identity of a file that changed while it was being checked (that answers "invalid").
+ */
+export type SignatureChecker = (path: string) => Promise<SignatureVerdict>;
+export declare function createSignatureChecker(check?: RequirementCheck, requirement?: string): SignatureChecker;
+/** The one checker of this process: its verdict cache is shared by every resolution and every spawn. */
+export declare const processSignatureChecker: () => SignatureChecker;

package/dist/cli/service-auth/keychain-helper/store-binding.d.ts

@@ -0,0 +1,46 @@
+import type { SecretApi } from "../keystore";
+import type { HelperLease } from "./client";
+import { type DarwinBackend, type KeychainHelperOptions } from "./darwin-backend";
+import type { WriteIntent } from "./darwin-store";
+/** The session-lock view of a store (#11262 design 3.3, 3.4, 3.6): every keychain change inside one locked section. */
+export type LockedStore<T> = {
+    readonly read: () => Promise<T | null>;
+    readonly write: (value: T, intent?: WriteIntent, beforeRetire?: () => Promise<void>) => Promise<void>;
+    readonly clear: () => Promise<void>;
+    readonly recover: () => Promise<void>;
+    readonly settle: () => Promise<void>;
+};
+export type HelperBinding = {
+    /** The secrets every non-helper path of this store uses: gated when the store is helper-eligible, else as given. */
+    readonly secrets: SecretApi;
+    readonly eligible: boolean;
+    readonly backend: () => Promise<DarwinBackend | null>;
+    readonly reader: (backend: DarwinBackend) => SecretApi;
+    readonly isHelperReader: (api: SecretApi) => boolean;
+    readonly guardHelperless: () => Promise<void>;
+};
+/**
+ * Only the real macOS store of the sign-in item gets the signed helper (or a store a test hands helper options to);
+ * Windows, Linux, the other namespaces and injected stores keep exactly today's path.
+ */
+export declare function bindKeychainHelper(input: {
+    readonly platform: NodeJS.Platform;
+    readonly namespace: string;
+    readonly secrets: SecretApi;
+    readonly key: {
+        readonly service: string;
+        readonly name: string;
+    };
+    readonly background: boolean;
+    readonly origin: string;
+    readonly notice: (message: string) => void;
+    readonly pending: (message: string) => Error;
+    readonly options?: KeychainHelperOptions;
+}): HelperBinding;
+/** Adapts the helper's locked view to the store's value type; every error is mapped once and the shared read reset. */
+export declare function lockedStoreView<T>(helper: DarwinBackend, lease: HelperLease, codec: {
+    readonly parse: (text: string) => T;
+    readonly serialize: (value: T) => string;
+    /** Assigns derived fields (the credential generation) from the item as a read started now finds it. */
+    readonly amend?: (previous: string | null, next: T) => T;
+}, mapError: (error: unknown) => unknown, done: () => void): LockedStore<T>;

package/dist/cli/service-auth/keystore.d.ts

@@ -1,5 +1,9 @@
 import type { z } from "zod";
 import { type Credentials, SignInError } from "./protocol";
+import type { HelperLease } from "./keychain-helper/client";
+import { type KeychainHelperOptions } from "./keychain-helper/darwin-backend";
+import { type WriteIntent } from "./keychain-helper/darwin-store";
+import { type LockedStore } from "./keychain-helper/store-binding";
 import { type SecretServiceLockProbe } from "./secret-service-lock";
 type SecretKey = {
     readonly service: string;
@@ -12,12 +16,23 @@ export type SecretApi = {
     }) => Promise<void>;
     readonly delete: (key: SecretKey) => Promise<boolean>;
 };
+export type { LockedStore };
 export type SealedStore<T> = {
     readonly read: () => Promise<T | null>;
     /** A read started now that never joins a coalesced read begun earlier; credential transactions use it under the lock. */
     readonly readAuthoritative: () => Promise<T | null>;
-    readonly write: (value: T) => Promise<void>;
+    /**
+     * `intent` matters only to the keychain helper: row 8b retires an unreadable item only on a fresh sign-in, and runs
+     * `beforeRetire` first so the caller can report that discard.
+     */
+    readonly write: (value: T, intent?: WriteIntent, beforeRetire?: () => Promise<void>) => Promise<void>;
     readonly clear: () => Promise<void>;
+    /** Before the session lock: settles any approval, so no access dialog is ever open while the lock is held. */
+    readonly prepare?: () => Promise<void>;
+    /** The helper's view for this locked section (recovered first), or null when this store has no helper. */
+    readonly underLock?: (lease: HelperLease) => Promise<LockedStore<T> | null>;
+    /** True while the last read came from an item the helper does not own yet: the token path then takes the lock once. */
+    readonly migrationPending?: () => Promise<boolean>;
 };
 export type CredentialStore = SealedStore<Credentials>;
 export declare class CredentialStoreError extends SignInError {
@@ -59,6 +74,6 @@ export declare function createCredentialStore(api: string, options?: {
     readonly notice?: (message: string) => void;
     readonly wait?: CredentialReadWait;
     readonly home?: string;
+    readonly keychainHelper?: KeychainHelperOptions;
 }): CredentialStore;
-export declare function createSealedStore<T>(api: string, namespace: "omo-cli" | "omo-cli-v2" | "omo-cli-revocations-v2", schema: z.ZodType<T>, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void, wait?: CredentialReadWait, amendWrite?: (previous: T | null, next: T) => T): SealedStore<T>;
-export {};
+export declare function createSealedStore<T>(api: string, namespace: "omo-cli" | "omo-cli-v2" | "omo-cli-revocations-v2", schema: z.ZodType<T>, secrets?: SecretApi | null, platform?: NodeJS.Platform, lockProbe?: SecretServiceLockProbe, notice?: (message: string) => void, wait?: CredentialReadWait, amendWrite?: (previous: T | null, next: T) => T, keychainHelper?: KeychainHelperOptions): SealedStore<T>;

package/dist/cli/service-auth/session.d.ts

@@ -1,20 +1,42 @@
-import { type CredentialStore } from "./keystore";
+import type { CredentialOwner } from "./credential-owner";
+import { type CredentialStore, type LockedStore } from "./keystore";
 import { type ChooseDevice, type Credentials, SignInError } from "./protocol";
 export declare class SessionEnded extends SignInError {
     readonly deviceRevoked: boolean;
     readonly code: string;
     constructor(message: string, deviceRevoked: boolean, code: string);
 }
+/**
+ * A stored principal whose private keys are about to be discarded (#12280), or a stored item that
+ * could not be read when a save replaced it. The hook retires that principal's memory-sync pin; it
+ * never throws, so a failure to retire never blocks the discard.
+ */
+export type DiscardedCredential = {
+    readonly kind: "credential";
+    readonly deviceId: string;
+    readonly accountId: string | undefined;
+    readonly owner: CredentialOwner | undefined;
+    readonly cause: "refused" | "forget" | "logout" | "replaced";
+} | {
+    readonly kind: "unreadable";
+};
+export type BeforeKeysDiscarded = ((discarded: DiscardedCredential) => Promise<void>) & {
+    /** Whether a sign-in that names no account should have it read before logout revokes the device. */
+    readonly wantsAccount?: () => Promise<boolean>;
+};
+export declare const discardedOf: (credentials: Credentials, cause: "refused" | "forget" | "logout" | "replaced") => DiscardedCredential;
 export declare function createSession(options: {
     readonly api: string;
     readonly store: CredentialStore;
     readonly home?: string;
     readonly signal?: AbortSignal;
     readonly now?: () => number;
+    /** Runs inside the credential lock immediately before a stored principal's keys are discarded. */
+    readonly beforeKeysDiscarded: BeforeKeysDiscarded;
 }): {
     request: (path: string, init: RequestInit) => Promise<unknown>;
     signal: AbortSignal | undefined;
-    transaction: <T>(action: () => Promise<T>) => Promise<T>;
+    transaction: <T>(action: (view: LockedStore<Credentials> | null) => Promise<T>) => Promise<T>;
     ready(): Promise<void>;
     save(value: Credentials): Promise<void>;
     /** The marker an explicit `omo logout` left, or null; only an empty store makes it meaningful. */
@@ -26,6 +48,11 @@ export declare function createSession(options: {
     update<T>(action: (current: Credentials | null) => Promise<T>, options?: {
         readonly replaceInvalid?: boolean;
     }): Promise<T>;
+    /**
+     * Deletes the item without reading it (a corrupt or locked item must still be removable, with one
+     * native call), so it cannot name the account whose pin to retire: `omo account forget --device`
+     * and `logout` read first and retire; this one leaves the pin (a stale pin is harmless for keys).
+     */
     forget(): Promise<void>;
     accessSnapshot: () => Promise<Credentials | null>;
     logout(): Promise<boolean>;

package/dist/cli/service-auth/sync-pin-retire.d.ts

@@ -0,0 +1,7 @@
+import type { BeforeKeysDiscarded } from "./session";
+export declare function retireSyncPinOnDiscard(options: {
+    /** The trust-pin directory of the memory root the caller already resolves. */
+    readonly pinDir: () => string;
+    /** The caller's own logger; one line per pin it could not retire. */
+    readonly log: (line: string) => void;
+}): BeforeKeysDiscarded;