@clearlysh/beehaven 0.8.16

package/dist/keychain.js

@@ -0,0 +1,224 @@
+/**
+ * Keychain — OS-native credential storage for beehaven daemon.
+ *
+ * macOS: Uses `security` CLI (Keychain Access)
+ * Linux: Uses `secret-tool` CLI (libsecret / GNOME Keyring)
+ * Fallback: null — caller must handle (we never silently fall back to plaintext)
+ *
+ * Security model:
+ *   - All secrets are passed to child processes via stdin or argv arrays,
+ *     never via shell-interpolated strings. This prevents command injection
+ *     when a secret contains shell metacharacters ($, `, ", etc.).
+ *   - Each secret is stored under a distinct `account` within the `beehaven`
+ *     service, so one keychain can hold multiple independent credentials
+ *     (ipc-auth token, Firebase idToken/refreshToken, BYOK keys, etc.).
+ *   - Reads return null on not-found — callers must handle missing secrets.
+ */
+import { execFileSync, spawnSync } from 'child_process';
+import { platform } from 'os';
+const SERVICE = 'beehaven';
+/** The keychain service every account below is stored under. Exported so a caller clearing
+ *  credentials cannot type it out a second time and drift. */
+export const KEYCHAIN_SERVICE = SERVICE;
+/**
+ * The accounts that belong to a SESSION, and must therefore be deleted on logout.
+ *
+ * ⚠⚠ THIS EXISTS BECAUSE THE LIST WAS A LITERAL IN ONE CALLER AND WAS ALREADY WRONG.
+ * `setup-relay.ts` cleared `daemon-token`, `firebase-refresh` and `ipc-auth` — and
+ * `agent-identity-secret`, written by `agent-identity-daemon.ts`, was added later and never made
+ * it into that list. Logging out left it in the keychain indefinitely, and nothing said so.
+ *
+ * ⚠ SESSION CREDENTIALS ONLY. `byok-*` and `vertex-service-account` are the USER'S OWN keys —
+ * they survive a logout deliberately, because signing out of an account is not the same as
+ * handing back the API keys you pay for. Removing those belongs to uninstall, a different verb.
+ */
+export const SESSION_KEYCHAIN_ACCOUNTS = [
+    'daemon-token',
+    'firebase-refresh',
+    'ipc-auth',
+    'agent-identity-secret',
+];
+/** Default account name for the legacy daemon token (Firebase ID token). */
+const LEGACY_DAEMON_ACCOUNT = 'daemon-token';
+/**
+ * ⚠⚠ EVERY KEYCHAIN CALL IS TIME-BOUNDED, BECAUSE ONE CAN OPEN A MODAL SYSTEM WINDOW.
+ *
+ * `security` in a process with no Aqua security session — which a DETACHED daemon is — cannot
+ * resolve a default keychain and macOS answers with a blocking dialog ("A keychain cannot be found
+ * to store …"). `spawnSync` then waits on a window the daemon cannot see or dismiss. Measured at
+ * 153 SECONDS on one call before it returned.
+ *
+ * A timeout cannot stop the dialog appearing, but it stops it holding the process: the call gives
+ * up, the caller treats it as unavailable, and the file store — which is primary everywhere this
+ * module is used for ephemeral secrets — carries on.
+ */
+const KEYCHAIN_TIMEOUT_MS = 5_000;
+export class Keychain {
+    _available = null;
+    /** Check if OS keychain is available */
+    get available() {
+        if (this._available !== null)
+            return this._available;
+        /**
+         * ⚠ AN EXPLICIT OFF SWITCH, because the keychain is the one dependency a sandboxed HOME cannot
+         * redirect: `security` always talks to the REAL login keychain. A test that mints tokens under
+         * a temp HOME still reaches it, and on this machine that blocked for 153 SECONDS on first use.
+         * The file store is primary; the mirror is best-effort, so skipping it changes no behaviour.
+         */
+        if (process.env.BEEHAVEN_NO_KEYCHAIN === '1') {
+            this._available = false;
+            return false;
+        }
+        try {
+            if (platform() === 'darwin') {
+                // macOS: probe `security` without a shell
+                execFileSync('/usr/bin/security', ['help'], { stdio: 'ignore', timeout: KEYCHAIN_TIMEOUT_MS });
+                this._available = true;
+            }
+            else if (platform() === 'linux') {
+                // Linux: probe `secret-tool` without a shell
+                const r = spawnSync('secret-tool', ['--version'], { stdio: 'ignore', timeout: KEYCHAIN_TIMEOUT_MS });
+                this._available = r.status === 0;
+            }
+            else {
+                this._available = false;
+            }
+        }
+        catch {
+            this._available = false;
+        }
+        return this._available;
+    }
+    /**
+     * Store a secret under the given account.
+     *
+     * Account is a free-form identifier for the secret's namespace. Callers
+     * should use stable, descriptive names like:
+     *   - 'daemon-token'           — Firebase ID token (legacy)
+     *   - 'firebase-refresh'       — Firebase refresh token
+     *   - 'ipc-auth'               — per-launch IPC auth secret
+     *   - 'byok-anthropic'         — user-supplied Anthropic API key
+     *   - 'byok-openrouter'        — user-supplied OpenRouter API key
+     *   - 'vertex-service-account' — Vertex service account JSON
+     *
+     * The secret is never interpolated into a shell string — it goes in via
+     * stdin (macOS `security -w -` and Linux `secret-tool store`).
+     */
+    set(account, secret) {
+        if (!this.available)
+            return false;
+        if (!isSafeAccount(account))
+            return false;
+        try {
+            if (platform() === 'darwin') {
+                // Delete existing entry first so we don't accumulate duplicates.
+                // spawnSync with argv does NOT invoke a shell, so there's no
+                // metacharacter injection risk even if account contained bad
+                // chars (which isSafeAccount rules out anyway).
+                spawnSync('/usr/bin/security', ['delete-generic-password', '-s', SERVICE, '-a', account], { stdio: 'ignore', timeout: KEYCHAIN_TIMEOUT_MS });
+                // Pass the secret as an argv element. This is the standard way to
+                // script `security add-generic-password` — the `-w` flag expects
+                // the password as its argument, not from stdin. Because spawnSync
+                // forks `security` directly (no /bin/sh between us), the secret
+                // never hits a shell and can't be split on whitespace or metachars.
+                //
+                // Trade-off: the secret is briefly visible to `ps auxww` for the
+                // same user during the sub-second lifetime of the subprocess.
+                // Since the same user already has filesystem access to read tokens
+                // from `~/.beehaven/`, this doesn't expand the threat surface in
+                // practice — and Security.framework is the only serious
+                // alternative, which would require a native helper binary.
+                const r = spawnSync('/usr/bin/security', ['add-generic-password', '-s', SERVICE, '-a', account, '-w', secret, '-U'], { stdio: 'ignore', timeout: KEYCHAIN_TIMEOUT_MS });
+                return r.status === 0;
+            }
+            if (platform() === 'linux') {
+                // secret-tool reads the password from stdin by design — this is the
+                // recommended scripting pattern, and it keeps the secret off argv
+                // (so `ps` never sees it even briefly).
+                const r = spawnSync('secret-tool', ['store', '--label=Beehaven', 'service', SERVICE, 'account', account], { input: secret, stdio: ['pipe', 'ignore', 'ignore'], timeout: KEYCHAIN_TIMEOUT_MS });
+                return r.status === 0;
+            }
+        }
+        catch (err) {
+            console.warn(`[Keychain] Failed to store ${account}:`, err.message);
+        }
+        return false;
+    }
+    /** Retrieve a secret. Returns null if not found or keychain unavailable. */
+    get(account) {
+        if (!this.available)
+            return null;
+        if (!isSafeAccount(account))
+            return null;
+        try {
+            if (platform() === 'darwin') {
+                const r = spawnSync('/usr/bin/security', ['find-generic-password', '-s', SERVICE, '-a', account, '-w'], { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'], timeout: KEYCHAIN_TIMEOUT_MS });
+                if (r.status !== 0)
+                    return null;
+                return r.stdout.trim() || null;
+            }
+            if (platform() === 'linux') {
+                const r = spawnSync('secret-tool', ['lookup', 'service', SERVICE, 'account', account], {
+                    encoding: 'utf-8',
+                    stdio: ['ignore', 'pipe', 'ignore'], timeout: KEYCHAIN_TIMEOUT_MS,
+                });
+                if (r.status !== 0)
+                    return null;
+                return r.stdout.trim() || null;
+            }
+        }
+        catch {
+            // Not found
+        }
+        return null;
+    }
+    /** Remove a secret. Returns true if removed (or nothing to remove). */
+    delete(account) {
+        if (!this.available)
+            return false;
+        if (!isSafeAccount(account))
+            return false;
+        try {
+            if (platform() === 'darwin') {
+                spawnSync('/usr/bin/security', ['delete-generic-password', '-s', SERVICE, '-a', account], { stdio: 'ignore', timeout: KEYCHAIN_TIMEOUT_MS });
+                return true;
+            }
+            if (platform() === 'linux') {
+                spawnSync('secret-tool', ['clear', 'service', SERVICE, 'account', account], { stdio: 'ignore', timeout: KEYCHAIN_TIMEOUT_MS });
+                return true;
+            }
+        }
+        catch {
+            /* not found — fine */
+        }
+        return false;
+    }
+    // ── Legacy compat (single daemon token) ───────────────────────────────
+    //
+    // The existing daemon.ts calls `keychain.setToken()/getToken()/deleteToken()`
+    // for the Firebase ID token. Keep those working by delegating to the named
+    // API, but new code should use set()/get()/delete() with an explicit account.
+    /** @deprecated Use set('daemon-token', …) */
+    setToken(token) {
+        return this.set(LEGACY_DAEMON_ACCOUNT, token);
+    }
+    /** @deprecated Use get('daemon-token') */
+    getToken() {
+        return this.get(LEGACY_DAEMON_ACCOUNT);
+    }
+    /** @deprecated Use delete('daemon-token') */
+    deleteToken() {
+        return this.delete(LEGACY_DAEMON_ACCOUNT);
+    }
+}
+/**
+ * Account names are passed to `security` and `secret-tool` as argv, so shell
+ * injection isn't possible — but we still constrain them to alphanumerics +
+ * a small set of separators to prevent callers from accidentally stepping on
+ * reserved keychain attribute names or writing un-auditable account keys.
+ */
+function isSafeAccount(account) {
+    return /^[a-zA-Z0-9._-]{1,64}$/.test(account);
+}
+/** Singleton for the daemon process */
+export const keychain = new Keychain();

package/dist/lib/admin-client.js

@@ -0,0 +1,73 @@
+/**
+ * Lightweight admin HTTP client — direct bearer auth, daemon-optional.
+ *
+ * Resolves the worker URL + admin secret from (in order): explicit opts,
+ * env vars (BEEHAVEN_WORKER_URL / BEEHAVEN_ADMIN_SECRET), then
+ * ~/.beehaven/credentials.json if present. No daemon dependency, no relay —
+ * third-party SDK adopters can use this against their own worker.
+ *
+ * Different layer from cli.ts's inline `adminCall` which prefers the
+ * daemon-fetch path. This is the unauthenticated-by-default sibling for
+ * commands that don't need Clearly's auth integration.
+ */
+import { existsSync, readFileSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+export function resolveAdminConfig(opts = {}) {
+    let url = opts.url ?? process.env.BEEHAVEN_WORKER_URL;
+    let secret = opts.secret ?? process.env.BEEHAVEN_ADMIN_SECRET;
+    if (!url || !secret) {
+        const credsPath = join(homedir(), '.beehaven', 'credentials.json');
+        if (existsSync(credsPath)) {
+            try {
+                const creds = JSON.parse(readFileSync(credsPath, 'utf-8'));
+                url = url ?? creds.workerUrl;
+                secret = secret ?? creds.adminSecret;
+            }
+            catch {
+                /* ignore */
+            }
+        }
+    }
+    if (!url)
+        return {
+            error: 'No worker URL. Pass --url, set BEEHAVEN_WORKER_URL, or save to ~/.beehaven/credentials.json.',
+        };
+    if (!secret)
+        return {
+            error: 'No admin secret. Pass --secret, set BEEHAVEN_ADMIN_SECRET, or save to ~/.beehaven/credentials.json.',
+        };
+    return { url: url.replace(/\/$/, ''), secret };
+}
+export function getAdminClient(opts = {}) {
+    const cfg = resolveAdminConfig(opts);
+    if ('error' in cfg)
+        return { error: cfg.error };
+    const call = async (path, init = {}) => {
+        const res = await fetch(`${cfg.url}${path}`, {
+            method: init.method ?? 'GET',
+            headers: {
+                Authorization: `Bearer ${cfg.secret}`,
+                'Content-Type': 'application/json',
+                'X-Beehaven-Source': 'cli',
+            },
+            body: init.body !== undefined
+                ? typeof init.body === 'string'
+                    ? init.body
+                    : JSON.stringify(init.body)
+                : undefined,
+        });
+        let body = null;
+        try {
+            body = await res.json();
+        }
+        catch {
+            /* ignore */
+        }
+        return { status: res.status, ok: res.ok, body };
+    };
+    return { workerUrl: cfg.url, call };
+}
+export function doActionPath(type, id, action) {
+    return `/admin/do/${encodeURIComponent(type)}/${encodeURIComponent(id)}/${encodeURIComponent(action)}`;
+}

package/dist/lib/mobile-build-parser.js

@@ -0,0 +1,156 @@
+/**
+ * mobile-build-parser — CLI-side metadata extraction from .ipa / .apk.
+ *
+ * Called by `beehaven teleport build.ipa --composition <id>` to
+ * auto-populate bundle id / version / display name without forcing
+ * the developer to type them as CLI flags. Any failure falls back
+ * to defaults; the developer can still override via --bundle-id etc.
+ *
+ * Coverage today:
+ *   - .ipa  → Info.plist (both binary plist and XML plist). bplist-parser
+ *             handles binary; XML uses a regex extractor (good enough
+ *             for the keys we need; a full plist parser is overkill).
+ *   - .ipa  → embedded.mobileprovision UDID extraction (CMS-wrapped plist)
+ *             is NOT implemented here. Use --udids manually until task
+ *             #17 ships (UDID auto-collection via mobileconfig).
+ *   - .apk  → AndroidManifest.xml uses the binary AXML format which
+ *             needs a dedicated parser. Not implemented in this iter.
+ *             Use --bundle-id / --app-version manually.
+ *
+ * All parse failures resolve to `{ ok: false, ... }` so the caller
+ * decides whether to fall back to filename-based defaults.
+ */
+import { readFileSync } from 'node:fs';
+import { unzipSync, strFromU8 } from 'fflate';
+import bplist from 'bplist-parser';
+/**
+ * Top-level entry: dispatch on filename extension.
+ */
+export function parseMobileBinary(filePath) {
+    const lower = filePath.toLowerCase();
+    if (lower.endsWith('.ipa'))
+        return parseIPA(filePath);
+    if (lower.endsWith('.apk'))
+        return parseAPK(filePath);
+    return {
+        ok: false,
+        reason: 'unsupported-extension',
+        detail: `Expected .ipa or .apk, got ${filePath}`,
+    };
+}
+/**
+ * Parse an iOS .ipa (ZIP) → Payload/<App>.app/Info.plist.
+ * Reads the whole file into memory (typically <200MB; fflate is
+ * synchronous and the CLI doesn't need streaming).
+ */
+function parseIPA(filePath) {
+    let buf;
+    try {
+        buf = readFileSync(filePath);
+    }
+    catch (e) {
+        return { ok: false, reason: 'read-failed', detail: e?.message };
+    }
+    let entries;
+    try {
+        entries = unzipSync(new Uint8Array(buf));
+    }
+    catch (e) {
+        return { ok: false, reason: 'unzip-failed', detail: e?.message };
+    }
+    // Locate Info.plist. IPAs always have exactly one `Payload/<X>.app/Info.plist`
+    // (multiple .app entries would be an enterprise wrapper, which we don't
+    // support — fall back to the first match).
+    const infoPlistKey = Object.keys(entries).find((k) => /^Payload\/[^/]+\.app\/Info\.plist$/i.test(k));
+    if (!infoPlistKey) {
+        return {
+            ok: false,
+            reason: 'no-info-plist',
+            detail: 'IPA does not contain Payload/<App>.app/Info.plist',
+        };
+    }
+    const plistBytes = entries[infoPlistKey];
+    let plist;
+    try {
+        plist = decodePlist(plistBytes);
+    }
+    catch (e) {
+        return { ok: false, reason: 'plist-decode-failed', detail: e?.message?.slice(0, 240) };
+    }
+    return {
+        ok: true,
+        platform: 'ios',
+        bundleId: stringOrUndefined(plist?.CFBundleIdentifier),
+        version: stringOrUndefined(plist?.CFBundleShortVersionString),
+        buildNumber: stringOrUndefined(plist?.CFBundleVersion),
+        displayName: stringOrUndefined(plist?.CFBundleDisplayName ?? plist?.CFBundleName ?? plist?.CFBundleExecutable),
+        minOsVersion: stringOrUndefined(plist?.MinimumOSVersion),
+    };
+}
+/**
+ * Parse an .apk. AndroidManifest.xml is binary AXML — not parseable
+ * without a dedicated decoder. Stubbed for now.
+ */
+function parseAPK(_filePath) {
+    return {
+        ok: false,
+        reason: 'apk-parser-not-implemented',
+        detail: 'AndroidManifest.xml binary AXML parsing is a future iteration. Use --bundle-id / --app-version / --display-name / --build flags manually for now.',
+    };
+}
+/**
+ * Decode an Info.plist that may be either binary plist (bplist00...)
+ * or XML plist (<?xml ...>). bplist-parser is synchronous despite the
+ * Promise API; we just resolve immediately.
+ */
+function decodePlist(bytes) {
+    // Binary plists start with the magic "bplist" header.
+    if (bytes.length >= 6 &&
+        bytes[0] === 0x62 && // 'b'
+        bytes[1] === 0x70 && // 'p'
+        bytes[2] === 0x6c && // 'l'
+        bytes[3] === 0x69 && // 'i'
+        bytes[4] === 0x73 && // 's'
+        bytes[5] === 0x74 // 't'
+    ) {
+        const parsed = bplist.parseBuffer(Buffer.from(bytes));
+        return parsed?.[0] ?? {};
+    }
+    // XML plist — regex-extract the keys we care about. Not a real
+    // parser, but Info.plist XML is a flat <dict> of <key>NAME</key>
+    // <string>VALUE</string> pairs and the regex catches every case
+    // I've seen in the wild.
+    const xml = strFromU8(bytes);
+    return parseXmlPlistShallow(xml);
+}
+/**
+ * Shallow regex extractor for XML plists. Pulls every top-level
+ * <key>X</key><string|integer>Y</string|integer> pair. Sufficient
+ * for Info.plist (no nested dicts that we care about).
+ */
+function parseXmlPlistShallow(xml) {
+    const out = {};
+    // Match <key>NAME</key> followed by <string>VALUE</string> OR <integer>123</integer>.
+    // Whitespace tolerant. Doesn't handle CDATA — Info.plist doesn't use it.
+    const re = /<key>([^<]+)<\/key>\s*<(string|integer)>([^<]*)<\/(?:string|integer)>/g;
+    let m;
+    while ((m = re.exec(xml)) !== null) {
+        const [, key, , value] = m;
+        out[decodeXmlEntities(key)] = decodeXmlEntities(value);
+    }
+    return out;
+}
+function decodeXmlEntities(s) {
+    return s
+        .replace(/&amp;/g, '&')
+        .replace(/&lt;/g, '<')
+        .replace(/&gt;/g, '>')
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'");
+}
+function stringOrUndefined(v) {
+    if (v == null)
+        return undefined;
+    const s = String(v).trim();
+    return s.length ? s : undefined;
+}