passwd-sso-cli 0.4.50 → 0.4.56

package/dist/commands/agent-decrypt.js

@@ -12,7 +12,7 @@ import { join } from "node:path";
 import { z } from "zod";
 import { apiRequest, startBackgroundRefresh } from "../lib/api-client.js";
 import { decryptData, hexEncode } from "../lib/crypto.js";
-import { buildPersonalEntryAAD } from "../lib/crypto-aad.js";
+import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { getEncryptionKey, getUserId, getSecretKeyBytes, setEncryptionKey } from "../lib/vault-state.js";
 import { readPassphrase, unlockWithPassphrase } from "./unlock.js";
 import * as output from "../lib/output.js";
@@ -50,6 +50,14 @@ function prepareSocket(socketPath) {
         process.stderr.write(`Error: Socket directory ${dir} is owned by uid ${dirStat.uid}, expected ${uid}\n`);
         process.exit(1);
     }
+    // mkdirSync's mode applies only to a freshly-created dir; a pre-existing dir
+    // (e.g. a custom $XDG_RUNTIME_DIR) may be group/other-accessible. Re-stat the
+    // mode and reject anything other than 0700 (matches ssh-agent-socket.ts).
+    const dirMode = dirStat.mode & 0o7777;
+    if (dirMode !== 0o700) {
+        process.stderr.write(`Error: Socket directory ${dir} has mode ${dirMode.toString(8)}, expected 700\n`);
+        process.exit(1);
+    }
     // Remove stale socket if present, verify ownership first
     try {
         const sockStat = lstatSync(socketPath);
@@ -89,7 +97,7 @@ async function handleDecryptRequest(req) {
     const userId = getUserId();
     try {
         const aad = entry.aadVersion >= 1 && userId
-            ? buildPersonalEntryAAD(userId, entry.id)
+            ? buildPersonalEntryAAD(userId, entry.id, VAULT_TYPE.BLOB)
             : undefined;
         const plaintext = await decryptData(entry.encryptedBlob, encryptionKey, aad);
         const blob = JSON.parse(plaintext);

package/dist/commands/agent.d.ts

@@ -2,9 +2,14 @@
  * `passwd-sso agent` — Start an SSH agent backed by vault SSH keys.
  *
  * Usage:
- *   eval $(passwd-sso agent --eval)   # Set SSH_AUTH_SOCK
+ *   eval $(passwd-sso agent --eval)   # fork a detached daemon, set SSH_AUTH_SOCK
  *   ssh-add -l                         # List vault SSH keys
  *   ssh -T git@github.com              # Use via agent
+ *
+ * Without --eval the agent runs in the foreground (Ctrl+C to stop). With
+ * --eval it forks a detached child holding the vault key (mirrors the decrypt
+ * agent) and the parent prints the export commands and exits, so command
+ * substitution returns instead of blocking.
  */
 export interface AgentOptions {
     eval?: boolean;

package/dist/commands/agent.js

@@ -2,19 +2,29 @@
  * `passwd-sso agent` — Start an SSH agent backed by vault SSH keys.
  *
  * Usage:
- *   eval $(passwd-sso agent --eval)   # Set SSH_AUTH_SOCK
+ *   eval $(passwd-sso agent --eval)   # fork a detached daemon, set SSH_AUTH_SOCK
  *   ssh-add -l                         # List vault SSH keys
  *   ssh -T git@github.com              # Use via agent
+ *
+ * Without --eval the agent runs in the foreground (Ctrl+C to stop). With
+ * --eval it forks a detached child holding the vault key (mirrors the decrypt
+ * agent) and the parent prints the export commands and exits, so command
+ * substitution returns instead of blocking.
  */
+import { spawn } from "node:child_process";
 import { apiRequest } from "../lib/api-client.js";
-import { decryptData } from "../lib/crypto.js";
-import { buildPersonalEntryAAD } from "../lib/crypto-aad.js";
-import { getEncryptionKey, getUserId, isUnlocked } from "../lib/vault-state.js";
-import { autoUnlockIfNeeded } from "./unlock.js";
+import { decryptData, hexEncode } from "../lib/crypto.js";
+import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
+import { getEncryptionKey, getUserId, getSecretKeyBytes, setEncryptionKey, isUnlocked, } from "../lib/vault-state.js";
+import { autoUnlockIfNeeded, readPassphrase, unlockWithPassphrase, } from "./unlock.js";
 import { loadKey, clearKeys } from "../lib/ssh-key-agent.js";
-import { startAgent, stopAgent } from "../lib/ssh-agent-socket.js";
+import { startAgent, stopAgent, setAgentDeps } from "../lib/ssh-agent-socket.js";
+import { authorizeSign } from "../lib/ssh-sign-authorizer.js";
+import { confirmSign } from "../lib/ssh-confirm.js";
 import { decryptAgentCommand } from "./agent-decrypt.js";
 import * as output from "../lib/output.js";
+/** Env flag marking the forked daemon child process. */
+const SSH_DAEMON_ENV = "_PSSO_SSH_DAEMON";
 /**
  * Build an SSH public key blob from the stored public key string.
  * The public key is in OpenSSH format: "ssh-ed25519 AAAA... comment"
@@ -30,37 +40,32 @@ function parsePublicKeyBlob(publicKeyStr) {
         return null;
     }
 }
-export async function agentCommand(opts) {
-    if (opts.decrypt) {
-        return decryptAgentCommand({ eval: opts.eval });
-    }
-    if (!await autoUnlockIfNeeded()) {
-        output.error("Vault is locked. Run `passwd-sso unlock` first, or set PSSO_PASSPHRASE.");
-        process.exit(1);
-    }
+/**
+ * Fetch every SSH_KEY entry, decrypt it, and load it into the in-memory
+ * agent. Returns the number of keys loaded. Exits the process on a fatal
+ * condition (no encryption key, fetch failure, no keys, none loadable).
+ */
+async function loadSshKeys() {
     const encryptionKey = getEncryptionKey();
     if (!encryptionKey) {
         output.error("Encryption key not available.");
         process.exit(1);
     }
     const userId = getUserId();
-    // Fetch all SSH_KEY entries from the vault
     const res = await apiRequest("/api/passwords?type=SSH_KEY&include=blob");
     if (!res.ok) {
         output.error(`Failed to fetch SSH keys: HTTP ${res.status}`);
         process.exit(1);
     }
-    const entries = res.data;
-    if (entries.length === 0) {
+    if (res.data.length === 0) {
         output.error("No SSH keys found in vault.");
         process.exit(1);
     }
-    // Decrypt and load each SSH key
     let loadedCount = 0;
-    for (const entry of entries) {
+    for (const entry of res.data) {
         try {
             const aad = entry.aadVersion >= 1 && userId
-                ? buildPersonalEntryAAD(userId, entry.id)
+                ? buildPersonalEntryAAD(userId, entry.id, VAULT_TYPE.BLOB)
                 : undefined;
             const plaintext = await decryptData(entry.encryptedBlob, encryptionKey, aad);
             const blob = JSON.parse(plaintext);
@@ -69,7 +74,7 @@ export async function agentCommand(opts) {
             const publicKeyBlob = parsePublicKeyBlob(blob.publicKey);
             if (!publicKeyBlob)
                 continue;
-            await loadKey(entry.id, blob.privateKey, publicKeyBlob, blob.comment ?? blob.title ?? "", blob.passphrase);
+            await loadKey(entry.id, blob.privateKey, publicKeyBlob, blob.comment ?? blob.title ?? "", blob.passphrase, entry.requireReprompt);
             loadedCount++;
         }
         catch (err) {
@@ -80,23 +85,44 @@ export async function agentCommand(opts) {
         output.error("No valid SSH keys could be loaded.");
         process.exit(1);
     }
-    // Start the agent socket
-    const socketPath = startAgent();
-    if (opts.eval) {
-        // Output shell commands to set SSH_AUTH_SOCK
-        // The user runs: eval $(passwd-sso agent --eval)
-        console.log(`SSH_AUTH_SOCK=${socketPath}; export SSH_AUTH_SOCK;`);
-        console.log(`echo "Agent pid ${process.pid}";`);
+    return loadedCount;
+}
+export async function agentCommand(opts) {
+    if (opts.decrypt) {
+        return decryptAgentCommand({ eval: opts.eval });
+    }
+    // Internal daemon child (forked by --eval): receives the vault key via IPC.
+    if (process.env[SSH_DAEMON_ENV] === "1") {
+        return runDaemonChild();
+    }
+    // Unlock the vault in this (parent / foreground) process.
+    if (!(await autoUnlockIfNeeded())) {
+        if (opts.eval && process.stdin.isTTY) {
+            // Prompt on stderr so stdout stays clean for `eval $(...)` capture.
+            const passphrase = await readPassphrase("Master passphrase: ", { useStderr: true });
+            if (!passphrase || !(await unlockWithPassphrase(passphrase))) {
+                output.error("Vault unlock failed.");
+                process.exit(1);
+            }
+        }
+        else {
+            output.error("Vault is locked. Run `passwd-sso unlock` first, or set PSSO_PASSPHRASE.");
+            process.exit(1);
+        }
     }
-    else {
-        output.success(`SSH agent started with ${loadedCount} key(s).`);
-        output.info(`Socket: ${socketPath}`);
-        output.info("Set SSH_AUTH_SOCK:");
-        console.log(`  export SSH_AUTH_SOCK=${socketPath}`);
-        output.info("Or use:");
-        console.log(`  eval $(passwd-sso agent --eval)`);
+    if (opts.eval) {
+        return forkDaemon();
     }
-    // Keep process running until interrupted
+    // Foreground mode: load keys and serve in this process.
+    const loadedCount = await loadSshKeys();
+    setAgentDeps({ authorizeSign, confirmSign });
+    const socketPath = startAgent();
+    output.success(`SSH agent started with ${loadedCount} key(s).`);
+    output.info(`Socket: ${socketPath}`);
+    output.info("Set SSH_AUTH_SOCK:");
+    console.log(`  export SSH_AUTH_SOCK=${socketPath}`);
+    output.info("Or use:");
+    console.log(`  eval $(passwd-sso agent --eval)`);
     output.info("Press Ctrl+C to stop the agent.");
     // Handle vault lock → clear keys
     const checkLock = setInterval(() => {
@@ -113,4 +139,81 @@ export async function agentCommand(opts) {
         // Never resolves — process exits via signal handlers
     });
 }
+/**
+ * --eval mode: fork a detached child holding the vault key, print the
+ * SSH_AUTH_SOCK export commands, and exit so `eval $(...)` returns. Mirrors
+ * the decrypt agent's forkDaemon (agent-decrypt.ts).
+ */
+async function forkDaemon() {
+    const secretBytes = getSecretKeyBytes();
+    if (!secretBytes) {
+        output.error("Secret key bytes not available.");
+        process.exit(1);
+    }
+    // Send the raw secret bytes (not the derived CryptoKey) — the child derives
+    // the encryption key itself. Zero the source array after hex-encoding.
+    const secretHex = hexEncode(secretBytes);
+    secretBytes.fill(0);
+    const userId = getUserId();
+    // Reconstruct args for the child: drop --eval, preserve tsx loader flags.
+    const childArgs = [
+        ...process.execArgv.filter((a) => !a.startsWith("--eval")),
+        ...process.argv.slice(1).filter((a) => a !== "--eval"),
+    ];
+    const child = spawn(process.execPath, childArgs, {
+        detached: true,
+        stdio: ["ignore", "ignore", "inherit", "ipc"],
+        env: { ...process.env, [SSH_DAEMON_ENV]: "1" },
+    });
+    child.send({ secretHex, userId });
+    // Child reports the socket path once it is serving keys.
+    child.on("message", (msg) => {
+        console.log(`SSH_AUTH_SOCK='${msg.socketPath}'; export SSH_AUTH_SOCK;`);
+        console.log(`SSH_AGENT_PID='${child.pid}'; export SSH_AGENT_PID;`);
+        console.log(`trap 'kill ${child.pid} 2>/dev/null; rm -f ${msg.socketPath}' EXIT;`);
+        child.unref();
+        child.disconnect();
+        process.exit(0);
+    });
+    // Child exited before acknowledging (e.g., no loadable keys) → surface it.
+    child.on("exit", (code) => {
+        process.stderr.write(`Agent child exited unexpectedly with code ${code}\n`);
+        process.exit(1);
+    });
+    setTimeout(() => {
+        process.stderr.write("Error: Agent child did not respond within 10s.\n");
+        child.kill();
+        process.exit(1);
+    }, 10_000);
+}
+/**
+ * Internal daemon child: receives the vault secret via IPC, derives the
+ * encryption key, loads the SSH keys, starts the socket, and reports the
+ * socket path back to the parent. The listening socket keeps the process
+ * alive after the IPC channel is disconnected.
+ */
+function runDaemonChild() {
+    return new Promise((resolve) => {
+        process.on("message", async (msg) => {
+            try {
+                const { hexDecode, deriveEncryptionKey } = await import("../lib/crypto.js");
+                const secretBytes = hexDecode(msg.secretHex);
+                const key = await deriveEncryptionKey(secretBytes);
+                secretBytes.fill(0);
+                setEncryptionKey(key, msg.userId ?? undefined);
+                await loadSshKeys(); // exits(1) on no loadable keys → parent reports via "exit"
+                setAgentDeps({ authorizeSign, confirmSign });
+                const socketPath = startAgent();
+                process.send({ socketPath });
+                if (process.disconnect)
+                    process.disconnect();
+                resolve();
+            }
+            catch (err) {
+                process.stderr.write(`Daemon init error: ${err instanceof Error ? err.message : String(err)}\n`);
+                process.exit(1);
+            }
+        });
+    });
+}
 //# sourceMappingURL=agent.js.map

package/dist/commands/env.js

@@ -12,7 +12,7 @@ import { getEncryptionKey, getUserId } from "../lib/vault-state.js";
 import { autoUnlockIfNeeded } from "./unlock.js";
 import { getToken } from "../lib/api-client.js";
 import { decryptData } from "../lib/crypto.js";
-import { buildPersonalEntryAAD } from "../lib/crypto-aad.js";
+import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { BLOCKED_KEYS } from "../lib/blocked-keys.js";
 import * as output from "../lib/output.js";
 export async function envCommand(opts) {
@@ -72,7 +72,7 @@ export async function envCommand(opts) {
         const data = (await res.json());
         let additionalData;
         if (data.aadVersion && data.aadVersion >= 1 && userId) {
-            additionalData = buildPersonalEntryAAD(userId, data.id);
+            additionalData = buildPersonalEntryAAD(userId, data.id, VAULT_TYPE.BLOB);
         }
         const decrypted = await decryptData(data.encryptedBlob, encryptionKey, additionalData);
         const blob = JSON.parse(decrypted);

package/dist/commands/export.js

@@ -6,7 +6,8 @@ import { existsSync, lstatSync } from "node:fs";
 import { apiRequest } from "../lib/api-client.js";
 import { getEncryptionKey, getUserId } from "../lib/vault-state.js";
 import { decryptData } from "../lib/crypto.js";
-import { buildPersonalEntryAAD } from "../lib/crypto-aad.js";
+import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
+import { writeSecretFile } from "../lib/secure-file.js";
 import * as output from "../lib/output.js";
 function escapeCSV(value) {
     if (value.includes(",") || value.includes('"') || value.includes("\n")) {
@@ -50,7 +51,7 @@ export async function exportCommand(options) {
     for (const entry of entries) {
         try {
             const aad = entry.aadVersion >= 1 && userId
-                ? buildPersonalEntryAAD(userId, entry.id)
+                ? buildPersonalEntryAAD(userId, entry.id, VAULT_TYPE.BLOB)
                 : undefined;
             const plaintext = await decryptData(entry.encryptedBlob, key, aad);
             decrypted.push(JSON.parse(plaintext));
@@ -65,8 +66,7 @@ export async function exportCommand(options) {
     if (format === "json") {
         const out = JSON.stringify(decrypted, null, 2);
         if (outputPath) {
-            const { writeFileSync } = await import("node:fs");
-            writeFileSync(outputPath, out, { encoding: "utf-8", mode: 0o600 });
+            writeSecretFile(outputPath, out);
             output.success(`Exported ${decrypted.length} entries to ${outputPath}`);
         }
         else {
@@ -87,8 +87,7 @@ export async function exportCommand(options) {
         }
         const csvOut = csvRows.join("\n");
         if (outputPath) {
-            const { writeFileSync } = await import("node:fs");
-            writeFileSync(outputPath, csvOut, { encoding: "utf-8", mode: 0o600 });
+            writeSecretFile(outputPath, csvOut);
             output.success(`Exported ${decrypted.length} entries to ${outputPath}`);
         }
         else {

package/dist/commands/get.js

@@ -4,7 +4,7 @@
 import { apiRequest } from "../lib/api-client.js";
 import { getEncryptionKey, getUserId } from "../lib/vault-state.js";
 import { decryptData } from "../lib/crypto.js";
-import { buildPersonalEntryAAD } from "../lib/crypto-aad.js";
+import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { copyToClipboard } from "../lib/clipboard.js";
 import * as output from "../lib/output.js";
 export async function getCommand(id, options) {
@@ -22,7 +22,7 @@ export async function getCommand(id, options) {
     const entry = res.data;
     try {
         const aad = entry.aadVersion >= 1 && userId
-            ? buildPersonalEntryAAD(userId, entry.id)
+            ? buildPersonalEntryAAD(userId, entry.id, VAULT_TYPE.BLOB)
             : undefined;
         const plaintext = await decryptData(entry.encryptedBlob, key, aad);
         const blob = JSON.parse(plaintext);

package/dist/commands/list.js

@@ -4,7 +4,7 @@
 import { apiRequest } from "../lib/api-client.js";
 import { getEncryptionKey, getUserId } from "../lib/vault-state.js";
 import { decryptData } from "../lib/crypto.js";
-import { buildPersonalEntryAAD } from "../lib/crypto-aad.js";
+import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import * as output from "../lib/output.js";
 export async function listCommand(options) {
     const key = getEncryptionKey();
@@ -27,7 +27,7 @@ export async function listCommand(options) {
     for (const entry of entries) {
         try {
             const aad = entry.aadVersion >= 1 && userId
-                ? buildPersonalEntryAAD(userId, entry.id)
+                ? buildPersonalEntryAAD(userId, entry.id, VAULT_TYPE.OVERVIEW)
                 : undefined;
             const plaintext = await decryptData(entry.encryptedOverview, key, aad);
             const overview = JSON.parse(plaintext);

package/dist/commands/run.js

@@ -10,7 +10,7 @@ import { getEncryptionKey, getUserId } from "../lib/vault-state.js";
 import { autoUnlockIfNeeded } from "./unlock.js";
 import { getToken } from "../lib/api-client.js";
 import { decryptData } from "../lib/crypto.js";
-import { buildPersonalEntryAAD } from "../lib/crypto-aad.js";
+import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import * as output from "../lib/output.js";
 import { BLOCKED_KEYS } from "../lib/blocked-keys.js";
 export async function runCommand(opts) {
@@ -74,7 +74,7 @@ export async function runCommand(opts) {
         const data = (await res.json());
         let additionalData;
         if (data.aadVersion && data.aadVersion >= 1 && userId) {
-            additionalData = buildPersonalEntryAAD(userId, data.id);
+            additionalData = buildPersonalEntryAAD(userId, data.id, VAULT_TYPE.BLOB);
         }
         const decrypted = await decryptData(data.encryptedBlob, encryptionKey, additionalData);
         const blob = JSON.parse(decrypted);

package/dist/commands/totp.js

@@ -4,7 +4,7 @@
 import { apiRequest } from "../lib/api-client.js";
 import { getEncryptionKey, getUserId } from "../lib/vault-state.js";
 import { decryptData } from "../lib/crypto.js";
-import { buildPersonalEntryAAD } from "../lib/crypto-aad.js";
+import { buildPersonalEntryAAD, VAULT_TYPE } from "../lib/crypto-aad.js";
 import { generateTOTPCode } from "../lib/totp.js";
 import { copyToClipboard } from "../lib/clipboard.js";
 import * as output from "../lib/output.js";
@@ -22,7 +22,7 @@ export async function totpCommand(id, options) {
     }
     try {
         const aad = res.data.aadVersion >= 1 && userId
-            ? buildPersonalEntryAAD(userId, res.data.id)
+            ? buildPersonalEntryAAD(userId, res.data.id, VAULT_TYPE.BLOB)
             : undefined;
         const plaintext = await decryptData(res.data.encryptedBlob, key, aad);
         const blob = JSON.parse(plaintext);

package/dist/lib/config.js

@@ -6,8 +6,9 @@
  *
  * Legacy ~/.passwd-sso/ is auto-migrated on first access.
  */
-import { existsSync, mkdirSync, readFileSync, writeFileSync, lstatSync, openSync, writeSync, closeSync, unlinkSync, constants as fsConstants, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, lstatSync, unlinkSync, } from "node:fs";
 import { getConfigDir, getDataDir, getConfigFilePath, getCredentialsFilePath, } from "./paths.js";
+import { writeSecretFile, readSecretFile } from "./secure-file.js";
 import { migrateIfNeeded } from "./migrate.js";
 const DEFAULT_CONFIG = {
     serverUrl: "",
@@ -49,21 +50,10 @@ export function saveConfig(config) {
 export function saveCredentials(creds) {
     ensureDataDir();
     const dataDir = getDataDir();
-    const stat = lstatSync(dataDir);
-    if (stat.isSymbolicLink()) {
+    if (lstatSync(dataDir).isSymbolicLink()) {
         throw new Error("Data directory is a symlink — refusing to write credentials.");
     }
-    const credPath = getCredentialsFilePath();
-    const fd = openSync(credPath, fsConstants.O_WRONLY |
-        fsConstants.O_CREAT |
-        fsConstants.O_TRUNC |
-        (fsConstants.O_NOFOLLOW ?? 0), 0o600);
-    try {
-        writeSync(fd, JSON.stringify(creds)); // codeql[js/network-data-written-to-file] OAuth tokens are intentionally persisted for session continuity
-    }
-    finally {
-        closeSync(fd);
-    }
+    writeSecretFile(getCredentialsFilePath(), JSON.stringify(creds));
 }
 /**
  * Load stored credentials. Returns null if the file does not exist,
@@ -73,7 +63,14 @@ export function saveCredentials(creds) {
 export function loadCredentials() {
     migrateIfNeeded();
     try {
-        const raw = readFileSync(getCredentialsFilePath(), "utf-8").trim();
+        // Mirror saveCredentials' symlink hardening on the read side: refuse a
+        // symlinked data dir, and open the file with O_NOFOLLOW so a pre-planted
+        // symlink at the credentials path cannot redirect the read elsewhere.
+        const dataDir = getDataDir();
+        if (existsSync(dataDir) && lstatSync(dataDir).isSymbolicLink()) {
+            return null;
+        }
+        const raw = readSecretFile(getCredentialsFilePath()).trim();
         let parsed;
         try {
             parsed = JSON.parse(raw);

package/dist/lib/crypto-aad.d.ts

@@ -2,4 +2,9 @@
  * AAD (Additional Authenticated Data) builders for AES-256-GCM encryption.
  * Ported from src/lib/crypto-aad.ts for CLI compatibility.
  */
-export declare function buildPersonalEntryAAD(userId: string, entryId: string): Uint8Array;
+export declare const VAULT_TYPE: {
+    readonly BLOB: "blob";
+    readonly OVERVIEW: "overview";
+};
+export type VaultType = (typeof VAULT_TYPE)[keyof typeof VAULT_TYPE];
+export declare function buildPersonalEntryAAD(userId: string, entryId: string, vaultType: VaultType): Uint8Array;

package/dist/lib/crypto-aad.js

@@ -38,7 +38,13 @@ function buildAADBytes(scope, expectedFieldCount, fields) {
     }
     return bytes;
 }
-export function buildPersonalEntryAAD(userId, entryId) {
-    return buildAADBytes(SCOPE_PERSONAL, 2, [userId, entryId]);
+// Mirror of src/lib/crypto/crypto-aad.ts VAULT_TYPE. Keep in sync —
+// any change to the wire string values would break decrypt interop.
+export const VAULT_TYPE = {
+    BLOB: "blob",
+    OVERVIEW: "overview",
+};
+export function buildPersonalEntryAAD(userId, entryId, vaultType) {
+    return buildAADBytes(SCOPE_PERSONAL, 3, [userId, entryId, vaultType]);
 }
 //# sourceMappingURL=crypto-aad.js.map

package/dist/lib/oauth.js

@@ -9,7 +9,7 @@ import { createServer, } from "node:http";
 import { spawn } from "node:child_process";
 const CALLBACK_TIMEOUT_MS = 120_000; // 2 minutes
 const CLI_CLIENT_NAME = "passwd-sso-cli";
-const CLI_SCOPES = "credentials:list credentials:use vault:status vault:unlock-data passwords:read passwords:write";
+const CLI_SCOPES = "credentials:list credentials:use vault:status vault:unlock-data passwords:read passwords:write ssh:sign";
 const MCP_TOKEN_ENDPOINT = "/api/mcp/token";
 // ─── PKCE helpers ─────────────────────────────────────────────────────────────
 export function generateCodeVerifier() {

package/dist/lib/secure-file.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Symlink-safe file I/O for secret material (credentials, decrypted exports).
+ *
+ * O_NOFOLLOW refuses to follow a symlink at the final path component, closing
+ * the symlink / check-then-write TOCTOU window that plain writeFileSync/
+ * readFileSync leave open. Used wherever the CLI persists or reads secrets.
+ *
+ * MIRROR: e2e/helpers/secure-file.ts holds the same O_NOFOLLOW logic (the cli
+ * package and the e2e tree compile under separate tsconfigs and cannot share a
+ * module). Keep the O_NOFOLLOW semantics in sync. This copy adds an `encoding`
+ * param + codeql annotation the e2e copy intentionally omits.
+ */
+/** Write `data` to `path` with O_NOFOLLOW + the given mode (default 0600). */
+export declare function writeSecretFile(path: string, data: string, mode?: number): void;
+/** Read `path` with O_NOFOLLOW (refuses a symlinked final component). */
+export declare function readSecretFile(path: string, encoding?: BufferEncoding): string;

package/dist/lib/secure-file.js

@@ -0,0 +1,41 @@
+/**
+ * Symlink-safe file I/O for secret material (credentials, decrypted exports).
+ *
+ * O_NOFOLLOW refuses to follow a symlink at the final path component, closing
+ * the symlink / check-then-write TOCTOU window that plain writeFileSync/
+ * readFileSync leave open. Used wherever the CLI persists or reads secrets.
+ *
+ * MIRROR: e2e/helpers/secure-file.ts holds the same O_NOFOLLOW logic (the cli
+ * package and the e2e tree compile under separate tsconfigs and cannot share a
+ * module). Keep the O_NOFOLLOW semantics in sync. This copy adds an `encoding`
+ * param + codeql annotation the e2e copy intentionally omits.
+ */
+import { openSync, writeSync, closeSync, readFileSync, constants as fsConstants, } from "node:fs";
+/** Write `data` to `path` with O_NOFOLLOW + the given mode (default 0600). */
+export function writeSecretFile(path, data, mode = 0o600) {
+    const fd = openSync(path, fsConstants.O_WRONLY |
+        fsConstants.O_CREAT |
+        fsConstants.O_TRUNC |
+        (fsConstants.O_NOFOLLOW ?? 0), mode);
+    try {
+        // Intentional persistence of the caller's own secrets (OAuth tokens /
+        // decrypted export) to a 0600 O_NOFOLLOW file. CodeQL js/http-to-file-access
+        // is excluded for this in .github/codeql/codeql-config.yml (inline
+        // // codeql[...] suppression is not honored by GitHub code scanning here).
+        writeSync(fd, data);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Read `path` with O_NOFOLLOW (refuses a symlinked final component). */
+export function readSecretFile(path, encoding = "utf-8") {
+    const fd = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));
+    try {
+        return readFileSync(fd, encoding);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+//# sourceMappingURL=secure-file.js.map

package/dist/lib/ssh-agent-protocol.d.ts

@@ -2,15 +2,20 @@
  * SSH agent protocol constants and framing helpers.
  *
  * Implements the subset of the SSH agent protocol needed for key listing
- * and signing operations. Reference: draft-miller-ssh-agent.
+ * and signing operations. Reference: RFC 9987 (SSH Agent Protocol).
  */
 /** Client → Agent */
 export declare const SSH2_AGENTC_REQUEST_IDENTITIES = 11;
 export declare const SSH2_AGENTC_SIGN_REQUEST = 13;
+export declare const SSH_AGENTC_REMOVE_ALL_IDENTITIES = 19;
+export declare const SSH_AGENTC_EXTENSION = 27;
 /** Agent → Client */
 export declare const SSH2_AGENT_FAILURE = 5;
+export declare const SSH_AGENT_SUCCESS = 6;
 export declare const SSH2_AGENT_IDENTITIES_ANSWER = 12;
 export declare const SSH2_AGENT_SIGN_RESPONSE = 14;
+export declare const SSH_AGENT_EXTENSION_FAILURE = 28;
+export declare const SSH_AGENT_EXTENSION_RESPONSE = 29;
 export declare const SSH_AGENT_RSA_SHA2_256 = 2;
 export declare const SSH_AGENT_RSA_SHA2_512 = 4;
 /**
@@ -54,3 +59,23 @@ export declare function buildIdentitiesAnswer(keys: {
  * Build an SSH2_AGENT_SIGN_RESPONSE.
  */
 export declare function buildSignResponse(signature: Buffer): Buffer;
+/**
+ * Build an SSH_AGENT_SUCCESS response (RFC 9987 §4.1).
+ */
+export declare function buildSuccess(): Buffer;
+/**
+ * Build an SSH_AGENT_EXTENSION_RESPONSE (RFC 9987 §4.7).
+ *
+ * @param payload The extension-specific response payload bytes
+ */
+export declare function buildExtensionResponse(payload: Buffer): Buffer;
+/**
+ * Parse an SSH_AGENTC_EXTENSION message buffer.
+ *
+ * @param msgBuf The full message body (msgBuf[0] is the SSH_AGENTC_EXTENSION type byte).
+ * @returns The extension name (utf-8) and the remaining bytes after the name string.
+ */
+export declare function readExtensionRequest(msgBuf: Buffer): {
+    extName: string;
+    rest: Buffer;
+};