@askexenow/exe-os 0.9.7 → 0.9.9

package/dist/lib/db-daemon-client.js

@@ -3,21 +3,42 @@ import net from "net";
 import os2 from "os";
 import { spawn } from "child_process";
 import { randomUUID } from "crypto";
-import { existsSync as existsSync2, unlinkSync, readFileSync as readFileSync2, openSync, closeSync, statSync } from "fs";
-import path2 from "path";
+import { existsSync as existsSync4, unlinkSync, readFileSync as readFileSync3, openSync, closeSync, statSync } from "fs";
+import path3 from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/config.ts
-import { readFile, writeFile, mkdir, chmod } from "fs/promises";
-import { readFileSync, existsSync, renameSync } from "fs";
+import { readFile, writeFile } from "fs/promises";
+import { readFileSync, existsSync as existsSync2, renameSync } from "fs";
 import path from "path";
 import os from "os";
+
+// src/lib/secure-files.ts
+import { chmodSync, existsSync, mkdirSync } from "fs";
+import { chmod, mkdir } from "fs/promises";
+var PRIVATE_DIR_MODE = 448;
+var PRIVATE_FILE_MODE = 384;
+function ensurePrivateDirSync(dirPath) {
+  mkdirSync(dirPath, { recursive: true, mode: PRIVATE_DIR_MODE });
+  try {
+    chmodSync(dirPath, PRIVATE_DIR_MODE);
+  } catch {
+  }
+}
+function enforcePrivateFileSync(filePath) {
+  try {
+    if (existsSync(filePath)) chmodSync(filePath, PRIVATE_FILE_MODE);
+  } catch {
+  }
+}
+
+// src/lib/config.ts
 function resolveDataDir() {
   if (process.env.EXE_OS_DIR) return process.env.EXE_OS_DIR;
   if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
   const newDir = path.join(os.homedir(), ".exe-os");
   const legacyDir = path.join(os.homedir(), ".exe-mem");
-  if (!existsSync(newDir) && existsSync(legacyDir)) {
+  if (!existsSync2(newDir) && existsSync2(legacyDir)) {
     try {
       renameSync(legacyDir, newDir);
       process.stderr.write(`[exe-os] Migrated data directory: ~/.exe-mem \u2192 ~/.exe-os
@@ -92,13 +113,43 @@ var DEFAULT_CONFIG = {
   }
 };
 
+// src/lib/daemon-auth.ts
+import crypto from "crypto";
+import path2 from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2, writeFileSync } from "fs";
+var DAEMON_TOKEN_PATH = path2.join(EXE_AI_DIR, "exed.token");
+function normalizeToken(token) {
+  if (!token) return null;
+  const trimmed = token.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+function readDaemonToken() {
+  try {
+    if (!existsSync3(DAEMON_TOKEN_PATH)) return null;
+    return normalizeToken(readFileSync2(DAEMON_TOKEN_PATH, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function ensureDaemonToken(seed) {
+  const existing = readDaemonToken();
+  if (existing) return existing;
+  const token = normalizeToken(seed) ?? crypto.randomBytes(32).toString("hex");
+  ensurePrivateDirSync(EXE_AI_DIR);
+  writeFileSync(DAEMON_TOKEN_PATH, `${token}
+`, "utf8");
+  enforcePrivateFileSync(DAEMON_TOKEN_PATH);
+  return token;
+}
+
 // src/lib/exe-daemon-client.ts
-var SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path2.join(EXE_AI_DIR, "exed.sock");
-var PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path2.join(EXE_AI_DIR, "exed.pid");
-var SPAWN_LOCK_PATH = path2.join(EXE_AI_DIR, "exed-spawn.lock");
+var SOCKET_PATH = process.env.EXE_DAEMON_SOCK ?? process.env.EXE_EMBED_SOCK ?? path3.join(EXE_AI_DIR, "exed.sock");
+var PID_PATH = process.env.EXE_DAEMON_PID ?? process.env.EXE_EMBED_PID ?? path3.join(EXE_AI_DIR, "exed.pid");
+var SPAWN_LOCK_PATH = path3.join(EXE_AI_DIR, "exed-spawn.lock");
 var SPAWN_LOCK_STALE_MS = 3e4;
 var CONNECT_TIMEOUT_MS = 15e3;
 var REQUEST_TIMEOUT_MS = 3e4;
+var DAEMON_TOKEN_ENV = "EXE_DAEMON_TOKEN";
 var _socket = null;
 var _connected = false;
 var _buffer = "";
@@ -130,9 +181,9 @@ function handleData(chunk) {
   }
 }
 function cleanupStaleFiles() {
-  if (existsSync2(PID_PATH)) {
+  if (existsSync4(PID_PATH)) {
     try {
-      const pid = parseInt(readFileSync2(PID_PATH, "utf8").trim(), 10);
+      const pid = parseInt(readFileSync3(PID_PATH, "utf8").trim(), 10);
       if (pid > 0) {
         try {
           process.kill(pid, 0);
@@ -153,11 +204,11 @@ function cleanupStaleFiles() {
   }
 }
 function findPackageRoot() {
-  let dir = path2.dirname(fileURLToPath(import.meta.url));
-  const { root } = path2.parse(dir);
+  let dir = path3.dirname(fileURLToPath(import.meta.url));
+  const { root } = path3.parse(dir);
   while (dir !== root) {
-    if (existsSync2(path2.join(dir, "package.json"))) return dir;
-    dir = path2.dirname(dir);
+    if (existsSync4(path3.join(dir, "package.json"))) return dir;
+    dir = path3.dirname(dir);
   }
   return null;
 }
@@ -183,16 +234,17 @@ function spawnDaemon() {
     process.stderr.write("[exed-client] WARN: cannot find package root\n");
     return;
   }
-  const daemonPath = path2.join(pkgRoot, "dist", "lib", "exe-daemon.js");
-  if (!existsSync2(daemonPath)) {
+  const daemonPath = path3.join(pkgRoot, "dist", "lib", "exe-daemon.js");
+  if (!existsSync4(daemonPath)) {
     process.stderr.write(`[exed-client] WARN: daemon script not found at ${daemonPath}
 `);
     return;
   }
   const resolvedPath = daemonPath;
+  const daemonToken = ensureDaemonToken(process.env[DAEMON_TOKEN_ENV] ?? null);
   process.stderr.write(`[exed-client] Spawning daemon: ${resolvedPath}
 `);
-  const logPath = path2.join(path2.dirname(SOCKET_PATH), "exed.log");
+  const logPath = path3.join(path3.dirname(SOCKET_PATH), "exed.log");
   let stderrFd = "ignore";
   try {
     stderrFd = openSync(logPath, "a");
@@ -210,7 +262,8 @@ function spawnDaemon() {
       TMUX_PANE: void 0,
       // Prevents resolveExeSession() from scoping to one session
       EXE_DAEMON_SOCK: SOCKET_PATH,
-      EXE_DAEMON_PID: PID_PATH
+      EXE_DAEMON_PID: PID_PATH,
+      [DAEMON_TOKEN_ENV]: daemonToken
     }
   });
   child.unref();
@@ -317,13 +370,14 @@ function sendDaemonRequest(payload, timeoutMs = REQUEST_TIMEOUT_MS) {
       return;
     }
     const id = randomUUID();
+    const token = process.env[DAEMON_TOKEN_ENV] ?? readDaemonToken();
     const timer = setTimeout(() => {
       _pending.delete(id);
       resolve({ error: "Request timeout" });
     }, timeoutMs);
     _pending.set(id, { resolve, timer });
     try {
-      _socket.write(JSON.stringify({ id, ...payload }) + "\n");
+      _socket.write(JSON.stringify({ id, token, ...payload }) + "\n");
     } catch {
       clearTimeout(timer);
       _pending.delete(id);