@agentdock/wire 0.0.90 → 0.0.91

package/dist/pairing.js

@@ -1,150 +1 @@
-/**
- * Pairing protocol schemas.
- *
- * Defines the wire format for device pairing:
- * - PairingRequest: CLI sends publicKey + optional PIN to server
- * - PairingResponse: Web sends encrypted payload back via server
- * - PairingStatus: Polling response — discriminated union on state
- *
- * Security: Uses NaCl Box (Curve25519 + XSalsa20-Poly1305) for key exchange.
- * PIN code provides iOS PWA fallback where QR scanning is unreliable.
- */
-// KNOWN-DEBT: KNOWN_DERIVATION_VERSIONS 预导出无跨包消费者 (see docs/ops/KNOWN-DEBT.md)
-import { z } from 'zod';
-/** 6-digit numeric PIN for iOS PWA fallback. */
-const PinSchema = z.string().regex(/^\d{6}$/, 'PIN must be exactly 6 digits');
-/** Pairing state machine. */
-export const PairingState = z.enum(['pending', 'exchange', 'authorized', 'expired']);
-/**
- * Validates that a string is a base64/base64url-encoded 32-byte Curve25519 public key.
- * Accepts both standard base64 (with padding) and base64url (without padding).
- */
-/**
- * Check if a base64/base64url string decodes to exactly `expectedBytes` bytes.
- * Uses string-length math: 4 base64 chars = 3 bytes.
- * No runtime decoding needed — just validate charset + length.
- */
-function isBase64OfLength(val, expectedBytes) {
-    // Must be non-empty and only valid base64/base64url characters
-    if (!/^[A-Za-z0-9+/\-_]+=*$/.test(val))
-        return false;
-    // Normalize base64url → standard base64
-    const b64 = val.replace(/-/g, '+').replace(/_/g, '/');
-    const padded = b64.padEnd(b64.length + ((4 - (b64.length % 4)) % 4), '=');
-    // Count padding
-    const paddingCount = (padded.match(/=+$/) ?? [''])[0].length;
-    const totalBytes = (padded.length / 4) * 3 - paddingCount;
-    return totalBytes === expectedBytes;
-}
-const Curve25519PublicKeySchema = z
-    .string()
-    .min(1)
-    .refine((val) => isBase64OfLength(val, 32), {
-    message: 'publicKey must be a base64-encoded 32-byte Curve25519 key',
-});
-/**
- * CLI → Server: initiate a pairing request.
- *
- * publicKey: base64-encoded Curve25519 public key (32 bytes)
- * pin: optional 6-digit PIN for manual entry (iOS PWA fallback)
- * label: optional human-readable device label
- */
-export const PairingRequestSchema = z.object({
-    publicKey: Curve25519PublicKeySchema,
-    pin: PinSchema.optional(),
-    label: z.string().max(100).optional(),
-    type: z.enum(['join', 'invite']).optional(),
-});
-/**
- * Web → Server: approve pairing with encrypted key material.
- *
- * publicKey: identifies which pairing request to respond to (32-byte Curve25519 key)
- * encryptedPayload: NaCl Box encrypted data (base64) containing the DEK
- */
-export const PairingResponseSchema = z.object({
-    publicKey: Curve25519PublicKeySchema,
-    encryptedPayload: z.string().min(1),
-});
-/**
- * New device → Server: submit device's temporary Curve25519 public key.
- * Used in invite flow when a new device joins an existing account.
- */
-export const PairingExchangeSchema = z.object({
-    daemonPublicKey: Curve25519PublicKeySchema,
-    devicePublicKey: Curve25519PublicKeySchema,
-});
-/**
- * Daemon → Server: deliver encrypted master secret to new device.
- * Requires Bearer auth. Encrypted via NaCl Box using device's public key.
- */
-export const PairingDeliverSchema = z.object({
-    publicKey: Curve25519PublicKeySchema,
-    encryptedPayload: z.string().min(1),
-});
-/**
- * Server → CLI: current pairing status (polled).
- * Discriminated union on `state`:
- * - pending: waiting for web approval
- * - authorized: web approved, encryptedPayload + token required
- * - expired: request timed out
- */
-const PairingStatusPending = z.object({
-    state: z.literal('pending'),
-    publicKey: z.string().min(1),
-});
-const PairingStatusExchange = z.object({
-    state: z.literal('exchange'),
-    publicKey: z.string().min(1),
-    devicePublicKey: z.string().min(1),
-});
-const PairingStatusAuthorized = z.object({
-    state: z.literal('authorized'),
-    publicKey: z.string().min(1),
-    encryptedPayload: z.string().min(1),
-    token: z.string().min(1),
-});
-const PairingStatusExpired = z.object({
-    state: z.literal('expired'),
-    publicKey: z.string().min(1),
-});
-export const PairingStatusSchema = z.discriminatedUnion('state', [
-    PairingStatusPending,
-    PairingStatusExchange,
-    PairingStatusAuthorized,
-    PairingStatusExpired,
-]);
-/** Known derivation versions (whitelist). */
-export const KNOWN_DERIVATION_VERSIONS = new Set([0, 1]);
-/**
- * Current derivation version for newly created identities.
- * 0 = legacy ('Happy EnCoder'), 1 = CCPark ('CCPark EnCoder').
- */
-export const CURRENT_DERIVATION_VERSION = 1;
-/**
- * Encode a master secret with its derivation version as a pairing payload.
- * Inverse of {@link parseVersionByte}: produces [version_byte, ...masterSecret] (33 bytes).
- */
-export function encodeVersionByte(masterSecret, version) {
-    const payload = new Uint8Array(1 + masterSecret.length);
-    payload[0] = version;
-    payload.set(masterSecret, 1);
-    return payload;
-}
-/**
- * Parse derivation version from decrypted pairing payload.
- * Version 1+: payload = [version_byte, ...masterSecret] (33 bytes)
- * Version 0 (legacy): payload = masterSecret (32 bytes, no prefix)
- * Returns null for unknown versions or unexpected lengths.
- */
-export function parseVersionByte(rawPayload) {
-    if (rawPayload.length === 33 && rawPayload[0] !== undefined) {
-        if (!KNOWN_DERIVATION_VERSIONS.has(rawPayload[0]))
-            return null;
-        return { masterSecret: rawPayload.slice(1), derivationVersion: rawPayload[0] };
-    }
-    if (rawPayload.length === 32) {
-        return { masterSecret: rawPayload, derivationVersion: 0 };
-    }
-    return null;
-}
-//# sourceMappingURL=pairing.js.map
+"use strict";import{z as e}from"zod";const o=e.string().regex(/^\d{6}$/,"PIN must be exactly 6 digits");export const PairingState=e.enum(["pending","exchange","authorized","expired"]);function a(t,r){if(!/^[A-Za-z0-9+/\-_]+=*$/.test(t))return!1;const n=t.replace(/-/g,"+").replace(/_/g,"/"),c=n.padEnd(n.length+(4-n.length%4)%4,"="),s=(c.match(/=+$/)??[""])[0].length;return c.length/4*3-s===r}const i=e.string().min(1).refine(t=>a(t,32),{message:"publicKey must be a base64-encoded 32-byte Curve25519 key"});export const PairingRequestSchema=e.object({publicKey:i,pin:o.optional(),label:e.string().max(100).optional(),type:e.enum(["join","invite"]).optional()}).strict(),PairingResponseSchema=e.object({publicKey:i,encryptedPayload:e.string().min(1)}).strict(),PairingExchangeSchema=e.object({daemonPublicKey:i,devicePublicKey:i}).strict(),PairingDeliverSchema=e.object({publicKey:i,encryptedPayload:e.string().min(1)}).strict();const g=e.object({state:e.literal("pending"),publicKey:e.string().min(1)}),l=e.object({state:e.literal("exchange"),publicKey:e.string().min(1),devicePublicKey:e.string().min(1)}),u=e.object({state:e.literal("authorized"),publicKey:e.string().min(1),encryptedPayload:e.string().min(1),token:e.string().min(1)}),p=e.object({state:e.literal("expired"),publicKey:e.string().min(1)});export const PairingStatusSchema=e.discriminatedUnion("state",[g,l,u,p]),KNOWN_DERIVATION_VERSIONS=new Set([0,1]),CURRENT_DERIVATION_VERSION=1;export function encodeVersionByte(t,r){const n=new Uint8Array(1+t.length);return n[0]=r,n.set(t,1),n}export function parseVersionByte(t){return t.length===33&&t[0]!==void 0?KNOWN_DERIVATION_VERSIONS.has(t[0])?{masterSecret:t.slice(1),derivationVersion:t[0]}:null:t.length===32?{masterSecret:t,derivationVersion:0}:null}

package/dist/permissionSubject.js

@@ -1,68 +1 @@
-// permission-subject — single source of truth for Bash-like command subject
-// extraction. Shared by the web rule generator (useInteraction.makeRuleIdentifier)
-// and the daemon matcher (permissionRuleStore.extractSubject).
-//
-// WHY HERE: web and daemon are the two consumers; wire is their only common
-// upstream (wire→…→web, wire→…→daemon). Doing the first-token/basename transform
-// in ONE place stops the two sides from drifting apart. When they drift:
-//   - front-end stores a rule the daemon can never match → "allow and don't ask
-//     again" silently keeps re-prompting (Bug 1), or
-//   - the subject degrades to '' and `x.startsWith('')` matches EVERY command,
-//     whitelisting all shell commands (Bug 2, a security hole).
-//
-// SCOPE: applies ONLY to the `command` field of Bash-like tools. path / url /
-// pattern subjects MUST keep their full prefix and are handled by the caller
-// (see permissionRuleStore.extractSubject field priority).
-/**
- * Raw agent tool names whose input carries a `command` field. These are the
- * ORIGINAL agent-emitted names (NOT normalized): Claude `Bash`, OpenCode/Hermes/
- * OpenClaw `execute`, Codex `shell`. The permission-request event and the danger
- * detector both see raw names, so this set is matched against raw names.
- */
-export const BASH_TOOL_NAMES = new Set(['Bash', 'bash', 'execute', 'shell']);
-/** True when `toolName` (a raw agent name) is a Bash-like command tool. */
-export function isBashToolName(toolName) {
-    return BASH_TOOL_NAMES.has(toolName);
-}
-/**
- * Extract the prefix subject from a Bash-like command string:
- *   trim → first token (quote-aware so `"C:\Program Files\..."` isn't split on
- *   spaces) → basename (`.../pwsh.exe` → `pwsh.exe`).
- *
- * Returns '' ONLY for an empty/blank command. When the first token ends in a
- * path separator its basename is empty; we fall back to the un-split token
- * rather than '' — an empty subject makes every command match
- * (`x.startsWith('')` is always true), the Bug 2 security hole.
- */
-export function extractCommandSubject(command) {
-    const trimmed = command.trim();
-    if (!trimmed)
-        return '';
-    let firstToken;
-    if (trimmed[0] === '"' || trimmed[0] === "'") {
-        const quote = trimmed[0];
-        const end = trimmed.indexOf(quote, 1);
-        firstToken = end > 0 ? trimmed.slice(1, end) : trimmed.slice(1);
-    }
-    else {
-        firstToken = trimmed.split(/\s+/)[0] ?? trimmed;
-    }
-    // Basename: "C:\...\pwsh.exe" → "pwsh.exe". A trailing separator yields ''
-    // from .pop(); '' is not nullish so '??' won't catch it — guard on truthiness
-    // and fall back to the full token so the subject never degrades to '' (Bug 2).
-    const base = firstToken.split(/[/\\]/).pop();
-    const clean = base ? base : firstToken;
-    // Strip quotes that survived token extraction — shell variable assignments
-    // like FILE="/path/to/tool" leave a trailing/leading quote in the basename.
-    return clean.replace(/^["']|["']$/g, '');
-}
-/**
- * Minimum length for a command subject to be used in a prefix rule.
- * Single-char subjects (e.g. `#` from a comment line, `.` from a dotfile)
- * are too broad — they effectively wildcard-match every command that starts
- * with that character.
- *
- * Used by the front-end to reject overly broad rules before they are stored.
- */
-export const MIN_SUBJECT_LENGTH = 2;
-//# sourceMappingURL=permissionSubject.js.map
+"use strict";export const BASH_TOOL_NAMES=new Set(["Bash","bash","execute","shell"]);export function isBashToolName(n){return BASH_TOOL_NAMES.has(n)}export function extractCommandSubject(n){const e=n.trim();if(!e)return"";let t;if(e[0]==='"'||e[0]==="'"){const c=e[0],o=e.indexOf(c,1);t=o>0?e.slice(1,o):e.slice(1)}else t=e.split(/\s+/)[0]??e;const s=t.split(/[/\\]/).pop();return(s||t).replace(/^["']|["']$/g,"")}export const MIN_SUBJECT_LENGTH=2;

package/dist/protocol.js

@@ -1,7 +1 @@
-/**
- * Wire protocol version.
- * Increment ONLY on breaking schema changes (new enum values, renamed events, required fields).
- * See RFC-021 for the full versioning strategy.
- */
-export const PROTOCOL_VERSION = 1;
-//# sourceMappingURL=protocol.js.map
+"use strict";export const PROTOCOL_VERSION=1;