fix(cli): reuse vault connections across commands and sessions

[nkavian]

Summary

Reduce repeated vault preparation and connection overhead in CLI commands and MCP sessions across macOS, Linux, and Windows.

• Reuse verified connections with bounded requests, explicit cleanup, and reconnect handling.
• Preserve lock, logout, reset, and credential replacement behavior for retained clients.
• Update the InFlow SDK dependencies and resolve saved API keys per request.
• Use explicitly advertised OpenAPI URLs without probing conventional locations.
• Build the signed macOS native module separately from development artifacts.

Validation

Passed: pnpm typecheck, pnpm lint, pnpm test, pnpm coverage:changed, pnpm typedoc, pnpm format:check, INFLOW_WEB_STAGING=0 pnpm build, and git diff --check.

Signed macOS and installed Linux/Windows candidates exercised connection reuse and credential lifecycle scenarios. Live command checks included discovery, OpenAPI operations, and existing AEP enrollment. The final OpenAPI correction was validated locally and against a live advertised document; it was not rebuilt into the Linux/Windows candidates.

Physical sleep/resume remains unverified. Successful TAP-signing timing and a matched token-refresh performance comparison were not measured. The AEP retry found an active enrollment, so it did not exercise approval cancellation.

Scope

Signed macOS packaging left the development CLI and native-module fingerprints unchanged; both builds ran afterward without a repair build. The packaged vault smoke passed, including tamper rejection.

Linux MCP lifecycle checks run against the installed package in CI, alongside the installed inspection checks. Development-mode runs retain the macOS checks.

No release or deployment. Hosted checks must pass before merge.

[codecov]

Codecov Report

❌ Patch coverage is 96.91265% with 41 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
packages/core/src/secure-storage/vault-socket.ts	94.85%	7 Missing and 2 partials ⚠️
...s/core/src/secure-storage/vault-windows-service.ts	97.23%	7 Missing ⚠️
packages/cli/src/commands/vault/index.ts	92.20%	5 Missing and 1 partial ⚠️
...ore/src/secure-storage/vault-control-connection.ts	97.71%	4 Missing and 1 partial ⚠️
...core/src/secure-storage/vault-sync-secret-store.ts	97.17%	5 Missing ⚠️
...core/src/secure-storage/vault-windows-transport.ts	96.77%	5 Missing ⚠️
packages/core/src/secure-storage/vault-client.ts	95.23%	2 Missing ⚠️
...kages/core/src/secure-storage/vault-broker-auth.ts	90.00%	0 Missing and 1 partial ⚠️
packages/core/src/utils/storage.ts	96.96%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!