@botbuddy/cli 1.60.5 → 1.60.7

package/src/staging-pool/launchd.mjs

@@ -0,0 +1,92 @@
+// BOT-2084 (lifted from supplyspark-ent ENT-5120 launchd.mjs): the human-owned
+// launchd job (a per-user LaunchAgent; label from the repo binding).
+// Node-stdlib-only; launchctl and the filesystem are injected.
+
+const xmlEscape = (value) =>
+  String(value).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+
+const string = (value) => `<string>${xmlEscape(value)}</string>`;
+
+export function buildLaunchAgentPlist({
+  label,
+  programArguments,
+  environment,
+  stdoutPath,
+  stderrPath,
+  workingDirectory,
+  intervalSeconds,
+  runAtLoad = true,
+  secretValues = [],
+}) {
+  if (!label || !Array.isArray(programArguments) || programArguments.length === 0) {
+    throw new Error("A LaunchAgent needs a label and program arguments.");
+  }
+  for (const [name, value] of Object.entries(environment ?? {})) {
+    if (/password|secret|token|key/i.test(name) || /SeedPass|eyJ|bb_sess_|bb_mcp_|bb_cli_|sb_secret_/.test(String(value))) {
+      throw new Error(`Refusing to write a secret-looking environment variable (${name}) into a plist.`);
+    }
+  }
+  // No argument or environment value may carry a known secret (e.g. a persona password).
+  const known = secretValues.filter((secret) => typeof secret === "string" && secret.length >= 6);
+  for (const value of [...programArguments, ...Object.values(environment ?? {})]) {
+    if (known.some((secret) => String(value).includes(secret)) || /eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\./.test(String(value))) {
+      throw new Error("Refusing to write a secret value into a plist.");
+    }
+  }
+  const lines = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    "<dict>",
+    `  <key>Label</key>${string(label)}`,
+    "  <key>ProgramArguments</key>",
+    "  <array>",
+    ...programArguments.map((arg) => `    ${string(arg)}`),
+    "  </array>",
+  ];
+  if (environment && Object.keys(environment).length > 0) {
+    lines.push("  <key>EnvironmentVariables</key>", "  <dict>");
+    for (const [name, value] of Object.entries(environment)) {
+      lines.push(`    <key>${xmlEscape(name)}</key>${string(value)}`);
+    }
+    lines.push("  </dict>");
+  }
+  if (workingDirectory) lines.push(`  <key>WorkingDirectory</key>${string(workingDirectory)}`);
+  if (Number.isInteger(intervalSeconds)) lines.push(`  <key>StartInterval</key><integer>${intervalSeconds}</integer>`);
+  lines.push(`  <key>RunAtLoad</key><${runAtLoad ? "true" : "false"}/>`);
+  lines.push("  <key>ProcessType</key><string>Background</string>");
+  lines.push("  <key>Umask</key><integer>63</integer>"); // 077: files the job creates are owner-only
+  if (stdoutPath) lines.push(`  <key>StandardOutPath</key>${string(stdoutPath)}`);
+  if (stderrPath) lines.push(`  <key>StandardErrorPath</key>${string(stderrPath)}`);
+  lines.push("</dict>", "</plist>", "");
+  return lines.join("\n");
+}
+
+export function createLaunchctl({ exec, uid }) {
+  const domain = `gui/${uid}`;
+  return {
+    domain,
+    async bootout(label) {
+      try {
+        await exec("/bin/launchctl", ["bootout", `${domain}/${label}`]);
+        return true;
+      } catch {
+        return false; // not loaded
+      }
+    },
+    async bootstrap(plistPath) {
+      await exec("/bin/launchctl", ["bootstrap", domain, plistPath]);
+    },
+    async kickstart(label) {
+      await exec("/bin/launchctl", ["kickstart", `${domain}/${label}`]);
+    },
+    async isLoaded(label) {
+      try {
+        await exec("/bin/launchctl", ["print", `${domain}/${label}`]);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+  };
+}

package/src/staging-pool/password-source.mjs

@@ -0,0 +1,65 @@
+// BOT-2084: the seeded persona's password, read by the human-installed job at
+// mint time from the binding's env file (e.g. ~/.config/botbuddy-web/.env.local.shared).
+//
+// Node-stdlib-only and self-contained. The value is returned to the sign-in
+// adapter only: it is never logged, written to a plist (launchd.mjs refuses), put
+// in a receipt or passed on argv. The file must be a regular file owned by this
+// user and not readable by group/others (0600 or stricter).
+
+import { readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export class PasswordSourceError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "PasswordSourceError";
+    this.code = code;
+  }
+}
+
+export function expandHome(path, home = homedir()) {
+  return String(path).startsWith("~/") ? join(home, String(path).slice(2)) : String(path);
+}
+
+export function parseEnvFile(text) {
+  const env = {};
+  for (const line of String(text).split(/\r?\n/)) {
+    const match = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)=(.*)$/.exec(line);
+    if (!match) continue;
+    let value = match[2].trim();
+    if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) value = value.slice(1, -1);
+    env[match[1]] = value;
+  }
+  return env;
+}
+
+export function createEnvFilePasswordSource({
+  envFile,
+  personas,
+  home = homedir(),
+  read = readFileSync,
+  stat = statSync,
+  uid = typeof process.getuid === "function" ? process.getuid() : null,
+} = {}) {
+  if (!envFile) throw new PasswordSourceError("config_missing", "The binding names no password_env_file.");
+  const path = expandHome(envFile, home);
+  return async function passwordFor({ persona }) {
+    const entry = Object.values(personas ?? {}).find((candidate) => candidate.email === persona);
+    if (!entry) throw new PasswordSourceError("persona_not_allowed", `No password_env is configured for ${persona}.`);
+    let info;
+    try {
+      info = stat(path);
+    } catch (error) {
+      throw new PasswordSourceError("password_source_missing", `Password env file ${path} is missing (${error?.code ?? "error"}); the human restores it (never commit it).`);
+    }
+    if (!info.isFile()) throw new PasswordSourceError("password_source_invalid", `Password env file ${path} is not a regular file.`);
+    if ((info.mode & 0o077) !== 0) throw new PasswordSourceError("password_source_permissions", `Password env file ${path} is readable by group/others; the human runs chmod 600 on it.`);
+    if (uid !== null && info.uid !== uid) throw new PasswordSourceError("password_source_permissions", `Password env file ${path} is not owned by this user.`);
+    const value = parseEnvFile(read(path, "utf8"))[entry.passwordEnv];
+    if (typeof value !== "string" || value.length < 8) {
+      throw new PasswordSourceError("password_source_missing", `Password env file ${path} has no ${entry.passwordEnv} value.`);
+    }
+    return value;
+  };
+}

package/src/staging-pool/policy.mjs

@@ -0,0 +1,186 @@
+// BOT-2084 (lifted from supplyspark-ent ENT-5120 scripts/staging-session-pool/policy.mjs):
+// who may mint, against what, for whom.
+//
+// Node-stdlib-only and self-contained (the human-installed job runs a copy of
+// this directory). The mint target and persona allowlist come ONLY from the
+// repository's committed `.botbuddy-agent.json` `staging_session_pool` binding
+// (binding.mjs): no flag, environment variable or pool-home file can add a mint
+// host or persona. The staging target must be https, not loopback, and not a
+// production origin; loopback ("local") targets exist for local proofs/tests.
+
+import { execFileSync } from "node:child_process";
+
+export class MintRefusedError extends Error {
+  constructor(code, message) {
+    super(message);
+    this.name = "MintRefusedError";
+    this.code = code;
+  }
+}
+
+// Production origins refused for every repo, whatever its binding says. A binding
+// adds its own product's production origins on top (production_origins).
+export const BUILTIN_PRODUCTION_ORIGINS = Object.freeze([
+  "https://app.bot-buddy.ai",
+  "https://api.bot-buddy.ai",
+  "https://bot-buddy.ai",
+  "https://xymjddoobrfnsmawmtbc.supabase.co",
+  "https://app.supply-guard.io",
+  "https://supply-guard.io",
+  "https://enterprise.vercel.app",
+  "https://hhukfannuankqtswiqdq.supabase.co",
+]);
+
+const LOOPBACK_HOSTNAMES = new Set(["127.0.0.1", "localhost", "[::1]", "::1"]);
+
+export function isLoopbackHostname(hostname) {
+  return LOOPBACK_HOSTNAMES.has(String(hostname ?? "").toLowerCase());
+}
+
+function parseOrigin(value, label) {
+  let parsed;
+  try {
+    parsed = new URL(String(value));
+  } catch {
+    throw new MintRefusedError("origin_not_allowed", `${label} is not a valid URL.`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new MintRefusedError("origin_not_allowed", `${label} must be http(s).`);
+  }
+  return parsed;
+}
+
+// The staging target, frozen from the binding. Every field is checked here, not
+// only when the binding is parsed, so a tampered pool-home copy is refused too.
+export function stagingTargetFromBinding(binding) {
+  if (!binding || typeof binding !== "object") throw new MintRefusedError("config_missing", "No staging_session_pool binding.");
+  const production = new Set([...BUILTIN_PRODUCTION_ORIGINS, ...(binding.productionOrigins ?? [])]);
+  const app = parseOrigin(binding.appOrigin, "App origin");
+  const supabase = parseOrigin(binding.supabaseUrl, "Supabase URL");
+  for (const [parsed, label] of [[app, "App origin"], [supabase, "Supabase URL"]]) {
+    if (parsed.protocol !== "https:") throw new MintRefusedError("origin_not_allowed", `${label} ${parsed.origin} must be https for the staging target.`);
+    if (isLoopbackHostname(parsed.hostname)) throw new MintRefusedError("origin_not_allowed", `${label} ${parsed.origin} is loopback; use the local target.`);
+    if (production.has(parsed.origin)) throw new MintRefusedError("origin_not_allowed", `${label} ${parsed.origin} is a production origin and never a mint target.`);
+    if (parsed.origin !== String(label === "App origin" ? binding.appOrigin : binding.supabaseUrl).replace(/\/$/, "")) {
+      throw new MintRefusedError("origin_not_allowed", `${label} must be a bare origin.`);
+    }
+  }
+  return Object.freeze({
+    name: "staging",
+    appOrigin: app.origin,
+    supabaseUrl: supabase.origin,
+    publishableKey: binding.publishableKey,
+    storageKey: binding.storageKey,
+    totpEnvironment: binding.environment,
+    appSlug: binding.appSlug,
+    tenant: binding.tenant,
+    personaEmails: Object.freeze(Object.values(binding.personas).map((persona) => persona.email)),
+    loopback: false,
+  });
+}
+
+// Mirrors supabase-js's default storage key for a loopback Supabase URL.
+function loopbackStorageKey(parsed) {
+  const host = parsed.hostname.replace(/[^a-zA-Z0-9]+/g, "-").replace(/^-|-$/g, "");
+  const port = parsed.port || (parsed.protocol === "https:" ? "443" : "80");
+  return `sb-${host}-${port}-auth-token`;
+}
+
+export function localTarget({ appOrigin, supabaseUrl, publishableKey, personaEmails, storageKey } = {}) {
+  if (!appOrigin || !supabaseUrl || !publishableKey) {
+    throw new MintRefusedError("config_missing", "A local target needs --app-origin, --supabase-url and --publishable-key (all loopback).");
+  }
+  const app = parseOrigin(appOrigin, "App origin");
+  const supabase = parseOrigin(supabaseUrl, "Supabase URL");
+  for (const [parsed, label] of [[app, "App origin"], [supabase, "Supabase URL"]]) {
+    if (!isLoopbackHostname(parsed.hostname)) throw new MintRefusedError("origin_not_allowed", `${label} ${parsed.origin} is not loopback.`);
+  }
+  return Object.freeze({
+    name: "local",
+    appOrigin: app.origin,
+    supabaseUrl: supabase.origin,
+    publishableKey: String(publishableKey),
+    storageKey: storageKey ?? loopbackStorageKey(supabase),
+    totpEnvironment: "local",
+    personaEmails: Object.freeze([...(personaEmails ?? [])]),
+    loopback: true,
+  });
+}
+
+export function assertPersonaAllowed(target, email) {
+  const value = typeof email === "string" ? email : "";
+  if (!target?.personaEmails?.includes(value)) {
+    throw new MintRefusedError(
+      "persona_not_allowed",
+      `Persona "${value}" is not an allowlisted seeded persona for ${target?.appOrigin ?? "this pool"}. Allowed: ${(target?.personaEmails ?? []).join(", ")}.`,
+    );
+  }
+  return value;
+}
+
+// Claude Code and Codex set these in every tool subprocess.
+export const AGENT_CONTEXT_ENV_MARKERS = Object.freeze([
+  "CLAUDECODE",
+  "CLAUDE_CODE_ENTRYPOINT",
+  "CLAUDE_CODE_SESSION_ID",
+  "CODEX_SANDBOX",
+  "CODEX_SANDBOX_NETWORK_DISABLED",
+  "CODEX_THREAD_ID",
+  "CODEX_CI",
+]);
+
+// An agent can scrub its env, but not its parent processes: a mint launched from
+// a Claude/Codex app or CLI has that binary in its ancestry.
+const AGENT_ANCESTOR_PATTERN = /(^|\/)(claude|codex)(\.app\/|$)|\/(claude|codex)\.app\//i;
+
+export function listProcessAncestors({ pid = process.pid, exec = execFileSync } = {}) {
+  const table = String(exec("/bin/ps", ["-A", "-o", "pid=,ppid=,comm="], { encoding: "utf8" }));
+  const byPid = new Map();
+  for (const line of table.split("\n")) {
+    const match = /^\s*(\d+)\s+(\d+)\s+(.*)$/.exec(line);
+    if (match) byPid.set(Number(match[1]), { ppid: Number(match[2]), comm: match[3].trim() });
+  }
+  const ancestors = [];
+  const seen = new Set();
+  let current = byPid.get(pid)?.ppid;
+  while (current && current > 1 && !seen.has(current)) {
+    seen.add(current);
+    const entry = byPid.get(current);
+    if (!entry) break;
+    ancestors.push(entry.comm);
+    current = entry.ppid;
+  }
+  return ancestors;
+}
+
+export function detectAgentContext({ env = process.env, listAncestors = listProcessAncestors } = {}) {
+  const markers = AGENT_CONTEXT_ENV_MARKERS.filter((name) => Object.hasOwn(env, name)).map((name) => `env:${name}`);
+  for (const comm of listAncestors()) {
+    if (AGENT_ANCESTOR_PATTERN.test(comm)) markers.push(`ancestor:${comm.split("/").pop()}`);
+  }
+  return markers;
+}
+
+// Mint, tick, install and uninstall are human/job-only for a non-loopback target.
+// A heuristic, not a security boundary: it stops accidental agent mints.
+export function assertMintAllowed({ target, env = process.env, listAncestors = listProcessAncestors }) {
+  if (target.loopback) return;
+  let markers;
+  try {
+    markers = detectAgentContext({ env, listAncestors });
+  } catch (error) {
+    throw new MintRefusedError(
+      "agent_context_unknown",
+      `Could not establish that this is not an agent session (${error?.message ?? error}); refusing a ${target.name} mint.`,
+    );
+  }
+  if (markers.length > 0) {
+    const error = new MintRefusedError(
+      "agent_context",
+      `Refusing a ${target.name} mint from an agent session (${markers.join(", ")}). Agents never sign in to ${target.appOrigin}: ` +
+        "report this blocker and its remedy once, then stop; ask the human to run the pool job.",
+    );
+    error.markers = markers;
+    throw error;
+  }
+}