@dharma-ai-labs/agent-fabric-secure-store 0.1.0 → 0.1.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +11 -0
- package/dist/index.d.ts +15 -0
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +55 -5
- package/dist/index.js.map +1 -1
- package/dist/index.test.js +26 -0
- package/dist/index.test.js.map +1 -1
- package/package.json +6 -2
package/README.md
ADDED
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
# `@dharma-ai-labs/agent-fabric-secure-store`
|
|
2
|
+
|
|
3
|
+
Fail-closed operating-system credential storage for Agent Fabric device and
|
|
4
|
+
vault secrets. It targets Windows Credential Manager, macOS Keychain, and Linux
|
|
5
|
+
Secret Service rather than plaintext repository or dotfile credentials.
|
|
6
|
+
|
|
7
|
+
- [Security boundary](https://github.com/dharma-ai-labs/dharma-agent-fabric/blob/main/docs/10-security-privacy-and-threat-model.md)
|
|
8
|
+
- [Source](https://github.com/dharma-ai-labs/dharma-agent-fabric/tree/main/packages/secure-store)
|
|
9
|
+
- [Dharma AI](https://www.dharma-ai.io)
|
|
10
|
+
|
|
11
|
+
Licensed under MIT.
|
package/dist/index.d.ts
CHANGED
|
@@ -4,11 +4,26 @@ export interface SecureSecretStore {
|
|
|
4
4
|
put(account: string, secret: string): Promise<void>;
|
|
5
5
|
delete(account: string): Promise<void>;
|
|
6
6
|
}
|
|
7
|
+
interface ProcessResult {
|
|
8
|
+
code: number | null;
|
|
9
|
+
stdout: string;
|
|
10
|
+
stderr: string;
|
|
11
|
+
timedOut?: boolean;
|
|
12
|
+
}
|
|
13
|
+
declare function run(command: string, argv: string[], input?: string, timeoutMs?: number): Promise<ProcessResult>;
|
|
14
|
+
declare function isTransientWindowsInteropFailure(result: ProcessResult): boolean;
|
|
15
|
+
declare function withTransientWindowsRetry(operation: () => Promise<ProcessResult>, options?: {
|
|
16
|
+
attempts?: number;
|
|
17
|
+
delayMs?: number;
|
|
18
|
+
}): Promise<ProcessResult>;
|
|
7
19
|
declare function windowsStore(command?: string): SecureSecretStore;
|
|
8
20
|
declare function linuxStore(): SecureSecretStore;
|
|
9
21
|
declare function macosStore(): SecureSecretStore;
|
|
10
22
|
export declare function createSystemSecureStore(): Promise<SecureSecretStore>;
|
|
11
23
|
export declare const secureStoreInternals: {
|
|
24
|
+
run: typeof run;
|
|
25
|
+
isTransientWindowsInteropFailure: typeof isTransientWindowsInteropFailure;
|
|
26
|
+
withTransientWindowsRetry: typeof withTransientWindowsRetry;
|
|
12
27
|
windowsStore: typeof windowsStore;
|
|
13
28
|
linuxStore: typeof linuxStore;
|
|
14
29
|
macosStore: typeof macosStore;
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,4BAA4B,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;IAClF,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,4BAA4B,GAAG,gBAAgB,GAAG,sBAAsB,CAAC;IAClF,GAAG,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC7C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED,UAAU,aAAa;IAAG,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE;AAEnG,iBAAS,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,CAqCxG;AAED,iBAAS,gCAAgC,CAAC,MAAM,EAAE,aAAa,WAG9D;AAED,iBAAe,yBAAyB,CACtC,SAAS,EAAE,MAAM,OAAO,CAAC,aAAa,CAAC,EACvC,OAAO,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAO,0BAWtD;AAWD,iBAAS,YAAY,CAAC,OAAO,SAAoH,GAAG,iBAAiB,CAwBpK;AAED,iBAAS,UAAU,IAAI,iBAAiB,CAqBvC;AAED,iBAAS,UAAU,IAAI,iBAAiB,CAqBvC;AAOD,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAM1E;AAED,eAAO,MAAM,oBAAoB;;;;;;;CAOhC,CAAC"}
|
package/dist/index.js
CHANGED
|
@@ -1,20 +1,63 @@
|
|
|
1
1
|
import { spawn } from 'node:child_process';
|
|
2
2
|
import { readFile } from 'node:fs/promises';
|
|
3
|
-
function run(command, argv, input) {
|
|
3
|
+
function run(command, argv, input, timeoutMs = 10_000) {
|
|
4
4
|
return new Promise((accept, reject) => {
|
|
5
5
|
const child = spawn(command, argv, { shell: false, windowsHide: true, stdio: ['pipe', 'pipe', 'pipe'] });
|
|
6
6
|
const stdout = [];
|
|
7
7
|
const stderr = [];
|
|
8
|
+
let settled = false;
|
|
9
|
+
const finish = (result) => {
|
|
10
|
+
if (settled)
|
|
11
|
+
return;
|
|
12
|
+
settled = true;
|
|
13
|
+
clearTimeout(timer);
|
|
14
|
+
accept(result);
|
|
15
|
+
};
|
|
16
|
+
const timer = setTimeout(() => {
|
|
17
|
+
child.kill('SIGKILL');
|
|
18
|
+
finish({
|
|
19
|
+
code: null,
|
|
20
|
+
stdout: Buffer.concat(stdout).toString('utf8'),
|
|
21
|
+
stderr: `Secure-store command timed out after ${timeoutMs} ms.`,
|
|
22
|
+
timedOut: true,
|
|
23
|
+
});
|
|
24
|
+
}, timeoutMs);
|
|
8
25
|
child.stdout.on('data', (chunk) => stdout.push(chunk));
|
|
9
26
|
child.stderr.on('data', (chunk) => stderr.push(chunk));
|
|
10
|
-
child.once('error',
|
|
11
|
-
|
|
27
|
+
child.once('error', (error) => {
|
|
28
|
+
if (settled)
|
|
29
|
+
return;
|
|
30
|
+
settled = true;
|
|
31
|
+
clearTimeout(timer);
|
|
32
|
+
reject(error);
|
|
33
|
+
});
|
|
34
|
+
child.once('close', (code) => finish({
|
|
35
|
+
code,
|
|
36
|
+
stdout: Buffer.concat(stdout).toString('utf8'),
|
|
37
|
+
stderr: Buffer.concat(stderr).toString('utf8'),
|
|
38
|
+
}));
|
|
12
39
|
if (input !== undefined)
|
|
13
40
|
child.stdin.end(input);
|
|
14
41
|
else
|
|
15
42
|
child.stdin.end();
|
|
16
43
|
});
|
|
17
44
|
}
|
|
45
|
+
function isTransientWindowsInteropFailure(result) {
|
|
46
|
+
return result.timedOut === true
|
|
47
|
+
|| /UtilAcceptVsock|accept4 failed 110|ECONNRESET|resource temporarily unavailable/i.test(result.stderr);
|
|
48
|
+
}
|
|
49
|
+
async function withTransientWindowsRetry(operation, options = {}) {
|
|
50
|
+
const attempts = Math.max(1, options.attempts ?? 3);
|
|
51
|
+
const delayMs = Math.max(0, options.delayMs ?? 200);
|
|
52
|
+
let result = null;
|
|
53
|
+
for (let attempt = 1; attempt <= attempts; attempt += 1) {
|
|
54
|
+
result = await operation();
|
|
55
|
+
if (!isTransientWindowsInteropFailure(result) || attempt === attempts)
|
|
56
|
+
return result;
|
|
57
|
+
await new Promise((accept) => setTimeout(accept, delayMs * attempt));
|
|
58
|
+
}
|
|
59
|
+
return result;
|
|
60
|
+
}
|
|
18
61
|
function assertAccount(account) {
|
|
19
62
|
if (!/^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/.test(account))
|
|
20
63
|
throw new Error('Invalid secure-store account.');
|
|
@@ -24,7 +67,7 @@ const windowsRead = `${windowsPreamble}try {$credential=$vault.Retrieve("Dharma
|
|
|
24
67
|
const windowsWrite = `${windowsPreamble}$value=[Console]::In.ReadToEnd(); try {$old=$vault.Retrieve("Dharma Agent Fabric",$args[0]); $vault.Remove($old)} catch {}; $credential=[Windows.Security.Credentials.PasswordCredential,Windows.Security.Credentials,ContentType=WindowsRuntime]::new("Dharma Agent Fabric",$args[0],$value); $vault.Add($credential)`;
|
|
25
68
|
const windowsDelete = `${windowsPreamble}try {$credential=$vault.Retrieve("Dharma Agent Fabric",$args[0]); $vault.Remove($credential)} catch {exit 3}`;
|
|
26
69
|
function windowsStore(command = process.platform === 'win32' ? 'powershell.exe' : '/mnt/c/Windows/System32/WindowsPowerShell/v1.0/powershell.exe') {
|
|
27
|
-
const invoke = (script, account, secret) => run(command, ['-NoProfile', '-NonInteractive', '-Command', `& { ${script} }`, account], secret);
|
|
70
|
+
const invoke = (script, account, secret) => withTransientWindowsRetry(() => run(command, ['-NoProfile', '-NonInteractive', '-Command', `& { ${script} }`, account], secret, 5_000));
|
|
28
71
|
return {
|
|
29
72
|
backend: 'windows-credential-manager',
|
|
30
73
|
async get(account) {
|
|
@@ -123,5 +166,12 @@ export async function createSystemSecureStore() {
|
|
|
123
166
|
return linuxStore();
|
|
124
167
|
throw new Error(`No supported secure secret store for ${process.platform}.`);
|
|
125
168
|
}
|
|
126
|
-
export const secureStoreInternals = {
|
|
169
|
+
export const secureStoreInternals = {
|
|
170
|
+
run,
|
|
171
|
+
isTransientWindowsInteropFailure,
|
|
172
|
+
withTransientWindowsRetry,
|
|
173
|
+
windowsStore,
|
|
174
|
+
linuxStore,
|
|
175
|
+
macosStore,
|
|
176
|
+
};
|
|
127
177
|
//# sourceMappingURL=index.js.map
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAW5C,SAAS,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,KAAc;
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAW5C,SAAS,GAAG,CAAC,OAAe,EAAE,IAAc,EAAE,KAAc,EAAE,SAAS,GAAG,MAAM;IAC9E,OAAO,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;QACpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACzG,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,MAAqB,EAAE,EAAE;YACvC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,MAAM,CAAC,CAAC;QACjB,CAAC,CAAC;QACF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,MAAM,CAAC;gBACL,IAAI,EAAE,IAAI;gBACV,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC9C,MAAM,EAAE,wCAAwC,SAAS,MAAM;gBAC/D,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;QACL,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC;YACnC,IAAI;YACJ,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YAC9C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;SAC/C,CAAC,CAAC,CAAC;QACJ,IAAI,KAAK,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;;YAC3C,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,gCAAgC,CAAC,MAAqB;IAC7D,OAAO,MAAM,CAAC,QAAQ,KAAK,IAAI;WAC1B,iFAAiF,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,SAAuC,EACvC,UAAmD,EAAE;IAErD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,OAAO,IAAI,GAAG,CAAC,CAAC;IACpD,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,gCAAgC,CAAC,MAAM,CAAC,IAAI,OAAO,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QACrF,MAAM,IAAI,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,MAAO,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,eAAe,GAAG,2MAA2M,CAAC;AACpO,MAAM,WAAW,GAAG,GAAG,eAAe,8JAA8J,CAAC;AACrM,MAAM,YAAY,GAAG,GAAG,eAAe,wTAAwT,CAAC;AAChW,MAAM,aAAa,GAAG,GAAG,eAAe,8GAA8G,CAAC;AAEvJ,SAAS,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,+DAA+D;IAC/I,MAAM,MAAM,GAAG,CAAC,MAAc,EAAE,OAAe,EAAE,MAAe,EAAE,EAAE,CAAC,yBAAyB,CAC5F,GAAG,EAAE,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,MAAM,IAAI,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAC7G,CAAC;IACF,OAAO;QACL,OAAO,EAAE,4BAA4B;QACrC,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YAClD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,OAAO,MAAM,CAAC,MAAM,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM;YACvB,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;YACpD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC5H,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,OAAO,EAAE,sBAAsB;QAC/B,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YAC1G,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACnC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/F,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM;YACvB,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,6BAA6B,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;YAChJ,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjG,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,qBAAqB,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YACzG,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACtH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU;IACjB,OAAO;QACL,OAAO,EAAE,gBAAgB;QACzB,KAAK,CAAC,GAAG,CAAC,OAAO;YACf,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;YAClH,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;gBAAE,OAAO,IAAI,CAAC;YACpC,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;YACzF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACjC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM;YACvB,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC/H,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,aAAa,CAAC,OAAO,CAAC,CAAC;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAC9G,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACjH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,KAAK;IAClB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/C,IAAI,CAAC;QAAC,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,KAAK,CAAC;IAAC,CAAC;AACxG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,YAAY,EAAE,CAAC;IACxD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAAE,OAAO,UAAU,EAAE,CAAC;IACvD,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,YAAY,EAAE,CAAC;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,UAAU,EAAE,CAAC;IACtD,MAAM,IAAI,KAAK,CAAC,wCAAwC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,GAAG;IACH,gCAAgC;IAChC,yBAAyB;IACzB,YAAY;IACZ,UAAU;IACV,UAAU;CACX,CAAC"}
|
package/dist/index.test.js
CHANGED
|
@@ -10,4 +10,30 @@ test('platform backends identify their security boundary', () => {
|
|
|
10
10
|
assert.equal(secureStoreInternals.linuxStore().backend, 'linux-secret-service');
|
|
11
11
|
assert.equal(secureStoreInternals.macosStore().backend, 'macos-keychain');
|
|
12
12
|
});
|
|
13
|
+
test('secure-store bounds a stalled subprocess', async () => {
|
|
14
|
+
const result = await secureStoreInternals.run(process.execPath, ['-e', 'setTimeout(() => {}, 2_000)'], undefined, 25);
|
|
15
|
+
assert.equal(result.code, null);
|
|
16
|
+
assert.equal(result.timedOut, true);
|
|
17
|
+
assert.match(result.stderr, /timed out after 25 ms/);
|
|
18
|
+
});
|
|
19
|
+
test('secure-store retries transient WSL interop failures', async () => {
|
|
20
|
+
let calls = 0;
|
|
21
|
+
const result = await secureStoreInternals.withTransientWindowsRetry(async () => {
|
|
22
|
+
calls += 1;
|
|
23
|
+
if (calls < 3)
|
|
24
|
+
return { code: 1, stdout: '', stderr: 'UtilAcceptVsock: accept4 failed 110' };
|
|
25
|
+
return { code: 0, stdout: 'ok', stderr: '' };
|
|
26
|
+
}, { attempts: 3, delayMs: 0 });
|
|
27
|
+
assert.equal(calls, 3);
|
|
28
|
+
assert.deepEqual(result, { code: 0, stdout: 'ok', stderr: '' });
|
|
29
|
+
});
|
|
30
|
+
test('secure-store does not retry permanent failures', async () => {
|
|
31
|
+
let calls = 0;
|
|
32
|
+
const result = await secureStoreInternals.withTransientWindowsRetry(async () => {
|
|
33
|
+
calls += 1;
|
|
34
|
+
return { code: 1, stdout: '', stderr: 'Access denied' };
|
|
35
|
+
}, { attempts: 3, delayMs: 0 });
|
|
36
|
+
assert.equal(calls, 1);
|
|
37
|
+
assert.equal(result.code, 1);
|
|
38
|
+
});
|
|
13
39
|
//# sourceMappingURL=index.test.js.map
|
package/dist/index.test.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,KAAK,GAAG,oBAAoB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"index.test.js","sourceRoot":"","sources":["../src/index.test.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,KAAK,GAAG,oBAAoB,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;IAChE,MAAM,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,8BAA8B,CAAC,CAAC;AACxF,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;IAC9D,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;IACxF,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAChF,MAAM,CAAC,KAAK,CAAC,oBAAoB,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;AAC5E,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;IAC1D,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAC3C,OAAO,CAAC,QAAQ,EAChB,CAAC,IAAI,EAAE,6BAA6B,CAAC,EACrC,SAAS,EACT,EAAE,CACH,CAAC;IACF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACpC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,qDAAqD,EAAE,KAAK,IAAI,EAAE;IACrE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,KAAK,IAAI,EAAE;QAC7E,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QAC7F,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC/C,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,gDAAgD,EAAE,KAAK,IAAI,EAAE;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,yBAAyB,CAAC,KAAK,IAAI,EAAE;QAC7E,KAAK,IAAI,CAAC,CAAC;QACX,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1D,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACvB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,12 +1,16 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@dharma-ai-labs/agent-fabric-secure-store",
|
|
3
|
-
"version": "0.1.
|
|
3
|
+
"version": "0.1.2",
|
|
4
|
+
"description": "Fail-closed OS credential storage abstraction for Dharma Agent Fabric",
|
|
5
|
+
"license": "MIT",
|
|
6
|
+
"homepage": "https://github.com/dharma-ai-labs/dharma-agent-fabric/tree/main/packages/secure-store#readme",
|
|
7
|
+
"bugs": { "url": "https://github.com/dharma-ai-labs/dharma-agent-fabric/issues" },
|
|
4
8
|
"type": "module",
|
|
5
9
|
"main": "dist/index.js",
|
|
6
10
|
"types": "dist/index.d.ts",
|
|
7
11
|
"repository": { "type": "git", "url": "git+https://github.com/dharma-ai-labs/dharma-agent-fabric.git", "directory": "packages/secure-store" },
|
|
8
12
|
"exports": { ".": "./dist/index.js" },
|
|
9
|
-
"files": ["dist"],
|
|
13
|
+
"files": ["dist", "README.md"],
|
|
10
14
|
"publishConfig": { "access": "public", "provenance": true },
|
|
11
15
|
"scripts": { "test": "node --test dist/*.test.js" }
|
|
12
16
|
}
|