@crosshands/runtime 0.1.2

package/src/ipc/windows.ts

@@ -0,0 +1,26 @@
+export type WindowsPipePeer = {
+  pid: number
+  sid: string
+  logonSessionId: string
+  integrityLevel: string
+  remote: boolean
+}
+
+export interface WindowsPipeSecurityBackend {
+  createCurrentLogonOnlyDacl(): unknown
+  verifyPeer(): WindowsPipePeer
+}
+
+export function windowsPipeSecurity(
+  backend?: WindowsPipeSecurityBackend
+): WindowsPipeSecurityBackend {
+  if (process.platform !== 'win32') {
+    throw new Error('Windows named-pipe security is only available on Windows')
+  }
+  if (backend === undefined) {
+    throw new Error(
+      'Windows named-pipe security requires a native DACL and peer-verification backend'
+    )
+  }
+  return backend
+}

package/src/policy/policy.ts

@@ -0,0 +1,73 @@
+import type { ComputerOperationName } from '@crosshands/contract'
+
+export type StableAppIdentity = {
+  appId: string
+  executableId: string
+  publisher?: string
+}
+
+export type AppClassification = 'allowed' | 'sensitive'
+
+const SENSITIVE_IDENTIFIERS = [
+  '1password',
+  'bitwarden',
+  'keychainaccess',
+  'keepass',
+  'lastpass',
+  'proton.pass',
+  'secrets'
+] as const
+
+export function classifyApp(identity: StableAppIdentity): AppClassification {
+  const stableIdentity =
+    `${identity.appId}\n${identity.executableId}\n${identity.publisher ?? ''}`.toLowerCase()
+  return SENSITIVE_IDENTIFIERS.some((identifier) => stableIdentity.includes(identifier))
+    ? 'sensitive'
+    : 'allowed'
+}
+
+export function assertAppAllowed(identity: StableAppIdentity): void {
+  if (classifyApp(identity) === 'sensitive') {
+    const error = new Error('Sensitive applications are blocked by default')
+    Object.assign(error, {
+      code: 'app_blocked',
+      retry: false,
+      remediation: 'choose_non_sensitive_target'
+    })
+    throw error
+  }
+}
+
+const PROTECTED_ROLES = new Set(['password', 'securetext', 'secret', 'credential'])
+
+export function redactProtectedContent(value: unknown): unknown {
+  if (Array.isArray(value)) return value.map(redactProtectedContent)
+  if (value === null || typeof value !== 'object') return value
+
+  const record = value as Record<string, unknown>
+  if (record.protected === true) return '[REDACTED]'
+  const protectedRole =
+    typeof record.role === 'string' && PROTECTED_ROLES.has(record.role.toLowerCase())
+  const result: Record<string, unknown> = {}
+  for (const [key, entry] of Object.entries(record)) {
+    const sensitiveKey = /^(value|text|password|secret|token|clipboard|data)$/i.test(key)
+    result[key] = protectedRole && sensitiveKey ? '[REDACTED]' : redactProtectedContent(entry)
+  }
+  return result
+}
+
+export type DiagnosticEntry =
+  | { event: 'operation'; operation: ComputerOperationName }
+  | { event: 'error'; message: string }
+
+export class SecretSafeDiagnostics {
+  readonly entries: DiagnosticEntry[] = []
+
+  operation(operation: ComputerOperationName, _input: unknown): void {
+    this.entries.push({ event: 'operation', operation })
+  }
+
+  error(message: string, _cause?: unknown): void {
+    this.entries.push({ event: 'error', message })
+  }
+}

package/src/providers/supervisor.ts

@@ -0,0 +1,140 @@
+import {
+  CONTRACT_VERSIONS,
+  ProviderHandshakeSchema,
+  createComputerError,
+  type ComputerProvider,
+  type ProviderHandshake,
+  type ProviderRequest,
+  type ProviderResponse
+} from '@crosshands/contract'
+
+export type ProviderSupervisorOptions = {
+  providerFactory: () => ComputerProvider
+  graphicalSessionId: string
+  maxInFlight?: number
+}
+
+export class ProviderSupervisor {
+  readonly #providerFactory: () => ComputerProvider
+  readonly #graphicalSessionId: string
+  readonly #maxInFlight: number
+  readonly #inFlight = new Set<string>()
+  #provider: ComputerProvider | undefined
+  #handshake: ProviderHandshake | undefined
+  #retirement: Promise<void> = Promise.resolve()
+
+  constructor(options: ProviderSupervisorOptions) {
+    this.#providerFactory = options.providerFactory
+    this.#graphicalSessionId = options.graphicalSessionId
+    this.#maxInFlight = options.maxInFlight ?? 16
+    if (this.#maxInFlight <= 0) throw new RangeError('maxInFlight must be positive')
+  }
+
+  get generation(): string | undefined {
+    return this.#handshake?.generation
+  }
+
+  async start(): Promise<ProviderHandshake> {
+    await this.#retirement
+    if (this.#handshake !== undefined) return this.#handshake
+    const provider = this.#providerFactory()
+    let handshake: ProviderHandshake
+    try {
+      handshake = ProviderHandshakeSchema.parse(await provider.start())
+    } catch (cause) {
+      await provider.close().catch(() => undefined)
+      throw createComputerError('provider_unavailable', 'Provider handshake was malformed', {
+        cause: cause instanceof Error ? cause.name : 'unknown'
+      })
+    }
+    if (
+      handshake.providerProtocol !== CONTRACT_VERSIONS.providerProtocol ||
+      handshake.publicContract !== CONTRACT_VERSIONS.publicContract
+    ) {
+      await provider.close().catch(() => undefined)
+      throw createComputerError('version_incompatible', 'Provider protocol is incompatible', {
+        expectedProviderProtocol: CONTRACT_VERSIONS.providerProtocol,
+        receivedProviderProtocol: handshake.providerProtocol,
+        expectedPublicContract: CONTRACT_VERSIONS.publicContract,
+        receivedPublicContract: handshake.publicContract
+      })
+    }
+    if (handshake.graphicalSessionId !== this.#graphicalSessionId) {
+      await provider.close().catch(() => undefined)
+      throw createComputerError(
+        'session_unavailable',
+        'Provider is attached to a different graphical session'
+      )
+    }
+    if (handshake.generation !== provider.generation) {
+      await provider.close().catch(() => undefined)
+      throw createComputerError('provider_unavailable', 'Provider generation handshake mismatch')
+    }
+    this.#provider = provider
+    this.#handshake = handshake
+    return handshake
+  }
+
+  async dispatch(request: ProviderRequest): Promise<ProviderResponse> {
+    const provider = this.#provider ?? (await this.start(), this.#provider)
+    if (provider === undefined)
+      throw createComputerError('provider_unavailable', 'Provider failed to start')
+    if (this.#inFlight.size >= this.#maxInFlight) {
+      throw createComputerError('provider_unavailable', 'Provider backpressure limit reached')
+    }
+    if (request.deadlineAt <= Date.now()) {
+      throw createComputerError('timeout', 'Provider request deadline elapsed before dispatch')
+    }
+    this.#inFlight.add(request.requestId)
+    let timer: NodeJS.Timeout | undefined
+    let timedOut = false
+    try {
+      const timeout = new Promise<never>((_, reject) => {
+        timer = setTimeout(() => {
+          timedOut = true
+          this.#retirement = this.#retire(provider, request.requestId)
+          reject(createComputerError('timeout', 'Provider request deadline elapsed'))
+        }, request.deadlineAt - Date.now())
+        timer.unref()
+      })
+      return await Promise.race([provider.dispatch(request), timeout])
+    } catch (cause) {
+      if (timedOut) await this.#retirement
+      if (typeof cause === 'object' && cause !== null && 'code' in cause) throw cause
+      throw createComputerError('provider_crashed', 'Provider crashed or disconnected', {
+        cause: cause instanceof Error ? cause.message : 'unknown'
+      })
+    } finally {
+      if (timer !== undefined) clearTimeout(timer)
+      this.#inFlight.delete(request.requestId)
+    }
+  }
+
+  async cancel(requestId: string): Promise<void> {
+    if (!this.#inFlight.has(requestId)) return
+    await this.#provider?.cancel(requestId)
+  }
+
+  async restart(): Promise<ProviderHandshake> {
+    await this.close()
+    return this.start()
+  }
+
+  async close(): Promise<void> {
+    await this.#retirement
+    const provider = this.#provider
+    this.#provider = undefined
+    this.#handshake = undefined
+    this.#inFlight.clear()
+    await provider?.close()
+  }
+
+  async #retire(provider: ComputerProvider, requestId: string): Promise<void> {
+    if (this.#provider === provider) {
+      this.#provider = undefined
+      this.#handshake = undefined
+    }
+    await provider.cancel(requestId).catch(() => undefined)
+    await provider.close().catch(() => undefined)
+  }
+}