@botbuddy/cli 1.59.7 → 1.59.8

package/src/daemon/profile-delivery.mjs

@@ -0,0 +1,332 @@
+// BOT-2057: the requester-side handoff for a private daemon profile. Secrets
+// enter this module only as the encoded stdin payload; the destination, sudo
+// user and daemon argument vector are all independently validated and fixed.
+import { spawn as realSpawn } from "node:child_process";
+import { createHash } from "node:crypto";
+
+import {
+  encodeDaemonProfileInstallArtifact,
+  encodeDaemonProfileInstallFromBootstrapIdentityArtifact,
+  encodeDaemonProfileInstallFromHelperIdentityArtifact,
+  DaemonEnrollmentError,
+} from "./enrollment.mjs";
+import { assertSshHost } from "./installer.mjs";
+
+const SSH_OPTIONS = Object.freeze([
+  "-o", "BatchMode=yes",
+  "-o", "ForwardAgent=no",
+  "-o", "StrictHostKeyChecking=yes",
+]);
+const SAFE_ABSOLUTE_PATH = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+const SAFE_SERVICE_USER = /^[a-z_][a-z0-9_-]*$/i;
+const DAEMON_HOST_KEY_RE = /^bbh-[0-9a-f]{24}$/;
+const P256_SPKI_PREFIX = Buffer.from("3059301306072a8648ce3d020106082a8648ce3d030107034200", "hex");
+const MAX_OUTPUT_BYTES = 16 * 1024;
+const DEFAULT_TIMEOUT_MS = 30_000;
+
+const invalid = () => new DaemonEnrollmentError("daemon_profile_delivery_invalid");
+const failed = () => new DaemonEnrollmentError("daemon_profile_delivery_failed");
+
+function safeTransport({ sshHost, sshBin, spawnImpl, env, timeoutMs }) {
+  try { assertSshHost(sshHost); } catch { throw invalid(); }
+  if (
+    typeof sshBin !== "string" || sshBin.length === 0 ||
+    typeof spawnImpl !== "function" || !env || typeof env !== "object" ||
+    !Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 60_000
+  ) throw invalid();
+}
+
+function safeInputs({ sshHost, serviceUser, daemonBinary, profilePath, expectedHostKey, sshBin, spawnImpl, env, timeoutMs, directInstall }) {
+  safeTransport({ sshHost, sshBin, spawnImpl, env, timeoutMs });
+  if (
+    typeof serviceUser !== "string" || !SAFE_SERVICE_USER.test(serviceUser) ||
+    typeof daemonBinary !== "string" || !SAFE_ABSOLUTE_PATH.test(daemonBinary) ||
+    typeof profilePath !== "string" || !SAFE_ABSOLUTE_PATH.test(profilePath) || !profilePath.endsWith("/profile.json") ||
+    typeof expectedHostKey !== "string" || !DAEMON_HOST_KEY_RE.test(expectedHostKey) ||
+    typeof directInstall !== "boolean"
+  ) throw invalid();
+}
+
+function safeHelperIdentityInputs({ sshHost, serviceUser, daemonBinary, expectedHostKey, sshBin, spawnImpl, env, timeoutMs, directInstall }) {
+  safeTransport({ sshHost, sshBin, spawnImpl, env, timeoutMs });
+  if (
+    typeof serviceUser !== "string" || !SAFE_SERVICE_USER.test(serviceUser) ||
+    typeof daemonBinary !== "string" || !SAFE_ABSOLUTE_PATH.test(daemonBinary) ||
+    typeof expectedHostKey !== "string" || !DAEMON_HOST_KEY_RE.test(expectedHostKey) ||
+    typeof directInstall !== "boolean"
+  ) throw invalid();
+}
+
+function safeBootstrapIdentityInputs({ sshHost, serviceUser, daemonBinary, sshBin, spawnImpl, env, timeoutMs, directInstall }) {
+  safeTransport({ sshHost, sshBin, spawnImpl, env, timeoutMs });
+  if (
+    typeof serviceUser !== "string" || !SAFE_SERVICE_USER.test(serviceUser) ||
+    typeof daemonBinary !== "string" || !SAFE_ABSOLUTE_PATH.test(daemonBinary) ||
+    typeof directInstall !== "boolean"
+  ) throw invalid();
+}
+
+function remoteDaemonCommand({ serviceUser, daemonBinary, directInstall, args }) {
+  return directInstall ? [daemonBinary, ...args] : ["sudo", "-n", "-u", serviceUser, "--", daemonBinary, ...args];
+}
+
+function fixedSsh({ sshHost, sshBin, spawnImpl, env, timeoutMs, command, stdin = Buffer.alloc(0) }) {
+  return new Promise((resolve, reject) => {
+    let child;
+    let settled = false;
+    let timer;
+    let stdout = Buffer.alloc(0);
+    let stderr = Buffer.alloc(0);
+    const finish = (result, value) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      result(value);
+    };
+    const refuse = () => finish(reject, failed());
+    const terminate = () => {
+      try { child?.kill("SIGTERM"); } catch { /* process may already be gone */ }
+    };
+    const append = (current, chunk) => {
+      const next = Buffer.concat([current, Buffer.from(chunk)]);
+      if (next.length > MAX_OUTPUT_BYTES) {
+        terminate();
+        refuse();
+        return null;
+      }
+      return next;
+    };
+    try {
+      child = spawnImpl(sshBin, [...SSH_OPTIONS, sshHost, ...command], {
+        stdio: ["pipe", "pipe", "pipe"], shell: false, windowsHide: true, env,
+      });
+    } catch {
+      refuse();
+      return;
+    }
+    if (!child || !child.stdin || !child.stdout || !child.stderr || typeof child.on !== "function") {
+      terminate();
+      refuse();
+      return;
+    }
+    timer = setTimeout(() => { terminate(); refuse(); }, timeoutMs);
+    child.stdout.on("data", (chunk) => { const next = append(stdout, chunk); if (next) stdout = next; });
+    child.stderr.on("data", (chunk) => { const next = append(stderr, chunk); if (next) stderr = next; });
+    child.stdin.on("error", refuse);
+    child.on("error", refuse);
+    child.on("close", (code) => {
+      if (code !== 0 || stderr.length !== 0) {
+        refuse();
+        return;
+      }
+      finish(resolve, stdout);
+    });
+    try { child.stdin.end(stdin); } catch { terminate(); refuse(); }
+  });
+}
+
+function parseUid(output) {
+  const text = Buffer.from(output).toString("utf8");
+  if (!/^[1-9][0-9]{0,9}\n?$/.test(text)) throw failed();
+  const uid = Number.parseInt(text, 10);
+  if (!Number.isSafeInteger(uid) || uid > 2_147_483_647) throw failed();
+  return uid;
+}
+
+function parseBootstrapIdentityReceipt(output) {
+  const text = Buffer.from(output).toString("utf8");
+  let metadata;
+  try { metadata = JSON.parse(text); } catch { throw failed(); }
+  if (
+    !metadata || typeof metadata !== "object" || Array.isArray(metadata) ||
+    Object.keys(metadata).length !== 3 || metadata.version !== 1 ||
+    typeof metadata.host_key !== "string" || !DAEMON_HOST_KEY_RE.test(metadata.host_key) ||
+    typeof metadata.public_key_spki_base64 !== "string" ||
+    !/^[A-Za-z0-9+/]+={0,2}$/.test(metadata.public_key_spki_base64) ||
+    metadata.public_key_spki_base64.length % 4 !== 0
+  ) throw failed();
+  if (text !== `${JSON.stringify(metadata)}\n`) throw failed();
+  let spki;
+  try { spki = Buffer.from(metadata.public_key_spki_base64, "base64"); } catch { throw failed(); }
+  if (
+    spki.toString("base64") !== metadata.public_key_spki_base64 ||
+    spki.length !== P256_SPKI_PREFIX.length + 65 ||
+    !spki.subarray(0, P256_SPKI_PREFIX.length).equals(P256_SPKI_PREFIX) ||
+    spki[P256_SPKI_PREFIX.length] !== 0x04
+  ) throw failed();
+  const derivedHostKey = `bbh-${createHash("sha256").update(spki).digest("hex").slice(0, 24)}`;
+  if (derivedHostKey !== metadata.host_key) throw failed();
+  return {
+    version: metadata.version,
+    host_key: metadata.host_key,
+    public_key_spki_base64: metadata.public_key_spki_base64,
+  };
+}
+
+/**
+ * Read both remote UIDs over fixed, non-privileged SSH argv before OAuth is
+ * requested. The caller may choose direct installation only on an observed
+ * same-UID result; a JSON enrollment spec cannot claim that privilege.
+ */
+export async function verifyRemoteServiceIdentity({
+  sshHost,
+  serviceUser,
+  sshBin = "ssh",
+  spawnImpl = realSpawn,
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+} = {}) {
+  safeTransport({ sshHost, sshBin, spawnImpl, env, timeoutMs });
+  if (typeof serviceUser !== "string" || !SAFE_SERVICE_USER.test(serviceUser)) throw invalid();
+  const sshUid = parseUid(await fixedSsh({ sshHost, sshBin, spawnImpl, env, timeoutMs, command: ["id", "-u"] }));
+  const serviceUid = parseUid(await fixedSsh({ sshHost, sshBin, spawnImpl, env, timeoutMs, command: ["id", "-u", serviceUser] }));
+  return { directInstall: sshUid === serviceUid };
+}
+
+async function remoteBootstrapIdentity({
+  operation,
+  sshHost,
+  serviceUser,
+  daemonBinary,
+  directInstall,
+  sshBin = "ssh",
+  spawnImpl = realSpawn,
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+} = {}) {
+  safeBootstrapIdentityInputs({ sshHost, serviceUser, daemonBinary, directInstall, sshBin, spawnImpl, env, timeoutMs });
+  if (operation !== "create" && operation !== "inspect") throw invalid();
+  const command = remoteDaemonCommand({
+    serviceUser, daemonBinary, directInstall,
+    args: [`--${operation}-bootstrap-identity`],
+  });
+  return parseBootstrapIdentityReceipt(await fixedSsh({ sshHost, sshBin, spawnImpl, env, timeoutMs, command }));
+}
+
+// Creation is fresh-only on the target. It returns exactly the target's public
+// metadata DTO; no key bytes, profile, approval, or registration are involved.
+export async function createRemoteBootstrapIdentity(options = {}) {
+  return remoteBootstrapIdentity({ ...options, operation: "create" });
+}
+
+export async function inspectRemoteBootstrapIdentity(options = {}) {
+  return remoteBootstrapIdentity({ ...options, operation: "inspect" });
+}
+
+// This runs before device authorization. It never accepts a source path: the
+// target daemon resolves the one canonical Swift Helper identity under its own
+// UID and replies with a fixed, secret-free receipt.
+export async function verifyRemoteHelperIdentity({
+  sshHost,
+  serviceUser,
+  daemonBinary,
+  expectedHostKey,
+  directInstall,
+  sshBin = "ssh",
+  spawnImpl = realSpawn,
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+} = {}) {
+  safeHelperIdentityInputs({ sshHost, serviceUser, daemonBinary, expectedHostKey, directInstall, sshBin, spawnImpl, env, timeoutMs });
+  const command = remoteDaemonCommand({
+    serviceUser, daemonBinary, directInstall,
+    args: ["--check-helper-identity", "--expected-host-key", expectedHostKey],
+  });
+  const stdout = await fixedSsh({ sshHost, sshBin, spawnImpl, env, timeoutMs, command });
+  if (!stdout.equals(Buffer.from('{"identity":"verified"}\n'))) throw failed();
+}
+
+async function deliverDaemonProfileWithInstaller({
+  artifact,
+  sshHost,
+  serviceUser,
+  daemonBinary,
+  profilePath,
+  expectedHostKey,
+  sshBin,
+  spawnImpl,
+  env,
+  timeoutMs,
+  directInstall,
+  encodeArtifact,
+  installFlag,
+}) {
+  safeInputs({ sshHost, serviceUser, daemonBinary, profilePath, expectedHostKey, sshBin, spawnImpl, env, timeoutMs, directInstall });
+  let payload;
+  try { payload = encodeArtifact(artifact); } catch { throw invalid(); }
+  const command = remoteDaemonCommand({
+    serviceUser, daemonBinary, directInstall,
+    args: [installFlag, "--profile", profilePath, "--expected-host-key", expectedHostKey],
+  });
+  const stdout = await fixedSsh({ sshHost, sshBin, spawnImpl, env, timeoutMs, command, stdin: payload });
+  if (!stdout.equals(Buffer.from('{"installed":true}\n'))) throw failed();
+  return { installed: true };
+}
+
+/**
+ * Feed a verified, bounded artifact to the public daemon installer over a
+ * fixed SSH argv. This intentionally returns no remote diagnostics: SSH and
+ * installer output can contain attacker-controlled text or credential values.
+ */
+export async function deliverDaemonProfileOverSSH({
+  artifact,
+  sshHost,
+  serviceUser,
+  daemonBinary,
+  profilePath,
+  expectedHostKey,
+  sshBin = "ssh",
+  spawnImpl = realSpawn,
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  directInstall = false,
+} = {}) {
+  return deliverDaemonProfileWithInstaller({
+    artifact, sshHost, serviceUser, daemonBinary, profilePath, expectedHostKey,
+    sshBin, spawnImpl, env, timeoutMs, directInstall,
+    encodeArtifact: encodeDaemonProfileInstallArtifact,
+    installFlag: "--install-profile",
+  });
+}
+
+export async function deliverDaemonProfileFromHelperIdentityOverSSH({
+  artifact,
+  sshHost,
+  serviceUser,
+  daemonBinary,
+  profilePath,
+  expectedHostKey,
+  sshBin = "ssh",
+  spawnImpl = realSpawn,
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  directInstall = false,
+} = {}) {
+  return deliverDaemonProfileWithInstaller({
+    artifact, sshHost, serviceUser, daemonBinary, profilePath, expectedHostKey,
+    sshBin, spawnImpl, env, timeoutMs, directInstall,
+    encodeArtifact: encodeDaemonProfileInstallFromHelperIdentityArtifact,
+    installFlag: "--install-profile-from-helper",
+  });
+}
+
+export async function deliverDaemonProfileFromBootstrapIdentityOverSSH({
+  artifact,
+  sshHost,
+  serviceUser,
+  daemonBinary,
+  profilePath,
+  expectedHostKey,
+  sshBin = "ssh",
+  spawnImpl = realSpawn,
+  env = process.env,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+  directInstall = false,
+} = {}) {
+  return deliverDaemonProfileWithInstaller({
+    artifact, sshHost, serviceUser, daemonBinary, profilePath, expectedHostKey,
+    sshBin, spawnImpl, env, timeoutMs, directInstall,
+    encodeArtifact: encodeDaemonProfileInstallFromBootstrapIdentityArtifact,
+    installFlag: "--install-profile-from-bootstrap-identity",
+  });
+}

package/src/daemon/release.mjs

@@ -0,0 +1,81 @@
+// BOT-2055: verify the exact extracted universal CLI artifact before a native
+// service definition can name its Go daemon binary. Hashes provide integrity;
+// publication provenance is gated separately on the reviewed runtime source.
+
+import { createHash } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+
+const TARGETS = Object.freeze({
+  "darwin-arm64": { platform: "darwin", arch: "arm64", goos: "darwin", goarch: "arm64" },
+  "linux-x64": { platform: "linux", arch: "x64", goos: "linux", goarch: "amd64" },
+});
+const digest = (bytes) => createHash("sha256").update(bytes).digest("hex");
+const fail = (code) => { throw new Error(code); };
+
+function targetFor(platform, arch) {
+  return Object.entries(TARGETS).find(([, value]) => value.platform === platform && value.arch === arch);
+}
+
+async function safeDirectory(path) {
+  const stat = await lstat(path).catch(() => null);
+  if (!stat?.isDirectory() || stat.isSymbolicLink() || (stat.mode & 0o022) !== 0) fail("daemon_release_unsafe_directory");
+}
+
+async function safeFile(path, { executable = false } = {}) {
+  const stat = await lstat(path).catch(() => null);
+  if (!stat?.isFile() || stat.isSymbolicLink() || (stat.mode & 0o022) !== 0 || (executable && (stat.mode & 0o111) === 0)) fail("daemon_release_unsafe_file");
+  return stat;
+}
+
+async function safeDirectoryPath(root, directory) {
+  const relativePath = relative(root, directory);
+  if (relativePath.startsWith("..") || isAbsolute(relativePath)) fail("daemon_release_manifest_invalid");
+  let current = root;
+  await safeDirectory(current);
+  for (const segment of relativePath.split("/").filter(Boolean)) {
+    current = join(current, segment);
+    await safeDirectory(current);
+  }
+}
+
+function exactKeys(value, keys) {
+  return value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === keys.length && keys.every((key) => Object.hasOwn(value, key));
+}
+
+function validTarget(name, value) {
+  const expected = TARGETS[name];
+  return expected && exactKeys(value, ["goos", "goarch", "binary", "sha256", "mode"]) && value.goos === expected.goos && value.goarch === expected.goarch && value.binary === `daemon/bin/${name}/botbuddy-daemon` && /^[0-9a-f]{64}$/.test(value.sha256) && value.mode === "0755";
+}
+
+export function validateDaemonVersion(output, { releaseVersion, sourceCommit, target } = {}) {
+  let version;
+  try { version = JSON.parse(output); } catch { fail("daemon_release_version_invalid"); }
+  if (!exactKeys(version, ["version", "commit", "target"]) || version.version !== releaseVersion || version.commit !== sourceCommit || version.target !== target) fail("daemon_release_version_invalid");
+  return version;
+}
+
+export async function validateDaemonRelease({ releaseRoot } = {}, { platform = process.platform, arch = process.arch, read = readFile } = {}) {
+  if (typeof releaseRoot !== "string" || !isAbsolute(releaseRoot) || releaseRoot.includes("\0") || resolve(releaseRoot) !== releaseRoot) fail("daemon_release_invalid");
+  const selected = targetFor(platform, arch);
+  if (!selected) fail("daemon_release_target_unsupported");
+  const [targetName] = selected;
+  await safeDirectory(releaseRoot);
+  const manifestPath = join(releaseRoot, "daemon-release", "manifest.json");
+  await safeDirectoryPath(releaseRoot, join(releaseRoot, "daemon-release"));
+  await safeFile(manifestPath);
+  let manifest;
+  try { manifest = JSON.parse(await read(manifestPath, "utf8")); } catch { fail("daemon_release_manifest_invalid"); }
+  if (!exactKeys(manifest, ["schema_version", "release_version", "source_commit", "source_sha256", "targets"]) || manifest.schema_version !== 1 || !/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(manifest.release_version) || !/^[0-9a-f]{40}$/.test(manifest.source_commit) || !/^[0-9a-f]{64}$/.test(manifest.source_sha256) || !exactKeys(manifest.targets, Object.keys(TARGETS)) || !Object.entries(manifest.targets).every(([name, value]) => validTarget(name, value))) fail("daemon_release_manifest_invalid");
+  const target = manifest.targets[targetName];
+  const binary = join(releaseRoot, target.binary);
+  if (relative(releaseRoot, binary).startsWith("..")) fail("daemon_release_manifest_invalid");
+  await safeDirectoryPath(releaseRoot, join(releaseRoot, "daemon", "bin", targetName));
+  const stat = await safeFile(binary, { executable: true });
+  if ((stat.mode & 0o777) !== 0o755) fail("daemon_release_unsafe_file");
+  const bytes = await read(binary);
+  const afterRead = await safeFile(binary, { executable: true });
+  if (stat.dev !== afterRead.dev || stat.ino !== afterRead.ino || (afterRead.mode & 0o777) !== 0o755) fail("daemon_release_unsafe_file");
+  if (digest(bytes) !== target.sha256) fail("daemon_release_digest_invalid");
+  return { releaseRoot, releaseVersion: manifest.release_version, sourceCommit: manifest.source_commit, sourceSha256: manifest.source_sha256, target: targetName, sha256: target.sha256, binary, payload: bytes, manifestPath };
+}

package/src/daemon/runtime-config.mjs

@@ -0,0 +1,85 @@
+const fail = (code) => {
+  throw new Error(code);
+};
+const cleanAbsolute = (value) =>
+  typeof value === "string" &&
+  /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/.test(value);
+const identityFields = new Set([
+  "job_id",
+  "lease_id",
+  "project_id",
+  "bundle_path",
+  "bundle_sha256",
+  "stack_path",
+  "worktree_root",
+  "expected_job_id",
+  "expected_lease_id",
+  "expected_project_id",
+]);
+const fields = new Set([
+  "host_key",
+  "state_dir",
+  "docker_endpoint",
+  "expected_engine_id",
+  // This must be the host's enrolled hardware UUID (for example the macOS
+  // IOPlatformUUID collected by cli/src/machine-id.mjs), supplied by the
+  // installer/host policy. It is never generated, defaulted, or sourced from
+  // a requester because registration binds it to the remote host identity.
+  "machine_id",
+  "supabase_binary",
+  "docker_cli",
+  "host_credential_profile",
+  "device_consent",
+  "runtime_version",
+  "runtime_git_sha",
+  "runtime_protocol_version",
+]);
+
+// buildRuntimeConfig is the only supported CLI serializer for daemon host
+// policy. Dynamic claim authority is intentionally not representable here.
+export function buildRuntimeConfig(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    fail("daemon_runtime_config_invalid");
+  }
+  for (const key of Object.keys(input)) {
+    if (identityFields.has(key)) {
+      fail("daemon_runtime_config_dynamic_identity_forbidden");
+    }
+    if (!fields.has(key)) fail("daemon_runtime_config_unknown_field");
+  }
+  const config = {
+    host_key: input.host_key,
+    state_dir: input.state_dir,
+    docker_endpoint: input.docker_endpoint,
+    expected_engine_id: input.expected_engine_id,
+    machine_id: input.machine_id,
+    supabase_binary: input.supabase_binary,
+    docker_cli: input.docker_cli,
+    host_credential_profile: input.host_credential_profile,
+    device_consent: input.device_consent,
+    runtime_version: input.runtime_version,
+    runtime_protocol_version: input.runtime_protocol_version,
+  };
+  if (
+    typeof config.host_key !== "string" || !cleanAbsolute(config.state_dir) ||
+    typeof config.docker_endpoint !== "string" ||
+    !config.docker_endpoint.startsWith("unix:///") ||
+    typeof config.expected_engine_id !== "string" ||
+    typeof config.machine_id !== "string" || !config.machine_id.trim() ||
+    !cleanAbsolute(config.supabase_binary) ||
+    !cleanAbsolute(config.docker_cli) ||
+    !cleanAbsolute(config.host_credential_profile) ||
+    config.device_consent !== true ||
+    typeof config.runtime_version !== "string" || !config.runtime_version ||
+    !Number.isInteger(config.runtime_protocol_version) ||
+    config.runtime_protocol_version < 2
+  ) fail("daemon_runtime_config_invalid");
+  if (input.runtime_git_sha !== undefined) {
+    if (
+      typeof input.runtime_git_sha !== "string" ||
+      !/^[0-9a-f]{40}$/i.test(input.runtime_git_sha)
+    ) fail("daemon_runtime_config_invalid");
+    config.runtime_git_sha = input.runtime_git_sha;
+  }
+  return config;
+}

package/src/daemon/service.mjs

@@ -0,0 +1,38 @@
+// BOT-2055: deterministic native service definitions for the standalone Go
+// daemon. These definitions are root-owned, but the daemon itself never runs
+// as root and has no Node/npm/launcher dependency.
+
+const safeUser = /^[a-z_][a-z0-9_-]*$/i;
+const safeAbsolutePath = /^\/(?:[A-Za-z0-9._-]+\/)*[A-Za-z0-9._-]+$/;
+// `assertSpec` admits only a constrained username and absolute path alphabet;
+// no caller-controlled value can introduce XML syntax into this plist.
+const xml = (value) => String(value);
+
+function validPath(value) {
+  return typeof value === "string" && safeAbsolutePath.test(value) && !value.includes("..") && !/[\s\r\n\0]/.test(value);
+}
+
+function assertSpec(spec) {
+  if (!spec || typeof spec !== "object" || typeof spec.user !== "string" || spec.user === "root" || !safeUser.test(spec.user) || ![spec.home, spec.binary, spec.config].every(validPath)) {
+    throw new Error("daemon_service_config_invalid");
+  }
+}
+
+export function renderMacDaemon(spec) {
+  assertSpec(spec);
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0"><dict>
+<key>Label</key><string>com.botbuddy.daemon</string>
+<key>UserName</key><string>${xml(spec.user)}</string>
+<key>ProgramArguments</key><array><string>${xml(spec.binary)}</string><string>--config</string><string>${xml(spec.config)}</string></array>
+<key>EnvironmentVariables</key><dict><key>HOME</key><string>${xml(spec.home)}</string><key>PATH</key><string>/usr/local/bin:/usr/bin:/bin</string></dict>
+<key>RunAtLoad</key><true/><key>KeepAlive</key><true/><key>ThrottleInterval</key><integer>5</integer>
+<key>ProcessType</key><string>Background</string>
+</dict></plist>\n`;
+}
+
+export function renderLinuxUnit(spec) {
+  assertSpec(spec);
+  return `[Unit]\nDescription=BotBuddy daemon\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=exec\nUser=${spec.user}\nEnvironment=HOME=${spec.home}\nEnvironment=PATH=/usr/local/bin:/usr/bin:/bin\nExecStart=${spec.binary} --config ${spec.config}\nRestart=on-failure\nRestartSec=5\n\n[Install]\nWantedBy=multi-user.target\n`;
+}

package/src/oauth-device.mjs

@@ -18,6 +18,10 @@ export const SLOW_DOWN_STEP_SEC = 5;
 export const DEFAULT_POLL_INTERVAL_SEC = 5;
 // The approval screen shows the requesting host; keep it short.
 export const REQUESTING_HOST_MAX = 80;
+// BOT-2057: this is deliberately only an optional device-authorization
+// attribute. The backend, not the requester, resolves it to a persisted,
+// consented P-256 host and carries that binding across refreshes.
+export const DAEMON_HOST_KEY_RE = /^bbh-[0-9a-f]{24}$/;
 
 const realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
 
@@ -57,6 +61,7 @@ export async function requestDeviceAuthorization({
   callerHarness = null,
   callerTicket = null,
   requestingHost = null,
+  daemonHostKey = null,
   fetch: fetchImpl = fetch,
 }) {
   const body = { client_id: clientId, scope };
@@ -75,6 +80,12 @@ export async function requestDeviceAuthorization({
   if (ticket) body.caller_ticket = ticket;
   const host = sanitizeCallerField(requestingHost, REQUESTING_HOST_MAX);
   if (host) body.requesting_host = host;
+  if (daemonHostKey !== null) {
+    if (typeof daemonHostKey !== "string" || !DAEMON_HOST_KEY_RE.test(daemonHostKey)) {
+      throw new OAuthCallbackError("daemon_host_key_invalid", "Daemon enrollment requires a valid enrolled host key");
+    }
+    body.host_key = daemonHostKey;
+  }
 
   const res = await fetchImpl(`${serverUrl}/device_authorization`, {
     method: "POST",

package/src/publish-native-guards.mjs

@@ -0,0 +1,44 @@
+#!/usr/bin/env node
+// BOT-2034: native daemon payloads are version-bound at build time. The normal
+// release path builds and verifies them for the package version before packing;
+// archive reconciliation and late package-version repair cannot safely recreate
+// that provenance from the CLI tree alone.
+
+import { readFileSync } from "node:fs";
+import { isMainModule } from "./daemon/entrypoint.mjs";
+
+export function hasNativeDaemonPayload(packageManifest) {
+  const files = packageManifest?.files;
+  return Array.isArray(files) && (files.includes("daemon/") || files.includes("daemon-release/"));
+}
+
+export function assertHistoricalNativeReconciliationSafe(packageManifest) {
+  if (hasNativeDaemonPayload(packageManifest)) {
+    throw new Error("native_daemon_historical_reconciliation_unavailable");
+  }
+}
+
+export function assertNativeVersionRepairSafe(packageManifest, { requestedVersion } = {}) {
+  if (!hasNativeDaemonPayload(packageManifest) || requestedVersion === packageManifest.version) return;
+  throw new Error("native_daemon_release_repair_unsupported");
+}
+
+function usage() {
+  console.error("usage: publish-native-guards.mjs --historical-reconcile <package.json> | --version-repair <package.json> <version>");
+}
+
+if (isMainModule(import.meta.url)) {
+  const [operation, packagePath, requestedVersion] = process.argv.slice(2);
+  try {
+    if (!packagePath || !["--historical-reconcile", "--version-repair"].includes(operation)) {
+      usage();
+      process.exit(2);
+    }
+    const packageManifest = JSON.parse(readFileSync(packagePath, "utf8"));
+    if (operation === "--historical-reconcile") assertHistoricalNativeReconciliationSafe(packageManifest);
+    else assertNativeVersionRepairSafe(packageManifest, { requestedVersion });
+  } catch (error) {
+    console.error(String(error?.message ?? error));
+    process.exit(1);
+  }
+}

package/src/wait-core.mjs

@@ -80,6 +80,7 @@ function managedAllocationFailureDetail(signal, condition) {
 // own-session terminal branch because its wait_session_id differs) would otherwise match
 // that raw event condition and exit an unrelated wait as an ordinary match (Codex P2).
 export const WAIT_SUPERSEDED_SIGNAL_TYPE = "wait_superseded";
+const HOST_APPROVAL_HOST_KEY_RE = /^bbh-[0-9a-f]{24}$/;
 
 // The USER-ARMABLE spine signal_type allowlist, for the `event:` escape hatch. The full
 // public.agent_signal_type enum is these PLUS the control types above
@@ -99,6 +100,11 @@ export const SIGNAL_TYPES = Object.freeze([
   "snapshot",
   "ticket_unblocked",
   "stack_lease",
+  // BOT-2324: emitted only once the exact public host approval predicate is
+  // true (owner-bound active settings + policy + live tenant subscription).
+  // It is intentionally consumed through the existing raw `event:` escape
+  // hatch rather than adding another parallel wait grammar.
+  "host_approval",
 ]);
 
 const LOCK_SUBTYPES = Object.freeze(["playwright_lane", "vite_port", "backend_port", "supabase_local"]);
@@ -406,7 +412,15 @@ const VALIDATORS = {
     if (!SIGNAL_TYPES.includes(p.type)) {
       throw new Error(`event type must be a known signal_type (${SIGNAL_TYPES.join(", ")})`);
     }
-    return { type: p.type, subject: p.subject !== undefined ? String(p.subject) : null };
+    const subject = p.subject !== undefined ? String(p.subject).trim() : null;
+    // BOT-2324: unlike the generic raw escape hatch, this approval condition
+    // has one narrow public identity grammar. The service independently checks
+    // it for direct JSON callers; keeping the CLI equally strict prevents an
+    // impossible-to-match wait from being armed locally.
+    if (p.type === "host_approval" && (!subject || !HOST_APPROVAL_HOST_KEY_RE.test(subject))) {
+      throw new Error("event:type=host_approval needs subject=<canonical bbh- host key>");
+    }
+    return { type: p.type, subject };
   },
 };
 
@@ -1237,10 +1251,13 @@ function conditionMatchesSignal(condition, signal, waitSessionId) {
 // wake the wrong workspace. This centralizes what BOT-1247's `unblocked` matcher did
 // per-type (that per-type check stays as belt-and-braces). Tenantless signals
 // (host-shared lock_availability/container_capacity, owner/recipient-scoped
-// chat/pr_state/test_run/guidance) are NEVER blocked — they keep today's semantics
-// for any session (AC-5). `sessionTenant === undefined` opts a caller out of the
-// central guard: a pure unit test asserting a per-type matcher in isolation. The CLI
-// always threads the server-resolved tenant, so the guard is live for every real wait.
+  // chat/pr_state/test_run/guidance) are NEVER blocked — they keep today's semantics
+  // for any session (AC-5). `host_approval` is the deliberate exception: it is
+  // owner-visible AND tenant-bound, so the relay stamps scope=owner_tenant and we
+  // retain this tenant fence after its owner gate. `sessionTenant === undefined`
+  // opts a caller out of the central guard: a pure unit test asserting a per-type
+  // matcher in isolation. The CLI always threads the server-resolved tenant, so
+  // the guard is live for every real wait.
 export function signalTenantBlocked(signal, sessionTenant) {
   if (sessionTenant === undefined) return false;
   if (signal.tenant_id == null) return false;