@elizaos/agent 2.0.0-alpha.173 → 2.0.0-alpha.192

package/apps/app-lifeops/src/lifeops/password-manager-bridge.js

@@ -0,0 +1,374 @@
+/**
+ * Password manager bridge — dual-backend (1Password CLI `op` or ProtonPass CLI).
+ *
+ * Security posture:
+ *   - Plaintext credentials NEVER enter return values.
+ *   - `injectCredentialToClipboard` pipes the secret from the backend CLI
+ *     directly into the OS clipboard via `execFile` without ever surfacing
+ *     the value to the Node process beyond a narrow buffer that is
+ *     discarded immediately.
+ *   - Nothing is logged that could contain secret material.
+ *   - All subprocess invocations use `execFile` with an args array.
+ */
+import { execFile, spawn } from "node:child_process";
+import { promisify } from "node:util";
+const execFileAsync = promisify(execFile);
+export class PasswordManagerError extends Error {
+    backend;
+    cause;
+    constructor(message, backend, cause) {
+        super(message);
+        this.name = "PasswordManagerError";
+        this.backend = backend;
+        this.cause = cause;
+    }
+}
+const CLIPBOARD_TTL_SECONDS = 30;
+// ---------------------------------------------------------------------------
+// Detection
+// ---------------------------------------------------------------------------
+const detectionCache = new Map();
+function cacheKey(config) {
+    const c = config ?? {};
+    return [
+        c.preferredBackend ?? "",
+        c.onePasswordAccount ?? "",
+        c.opPath ?? "",
+        c.protonPassPath ?? "",
+    ].join("|");
+}
+function resolveOpBinary(config) {
+    return config?.opPath?.trim() || "op";
+}
+function resolveProtonPassBinary(config) {
+    return config?.protonPassPath?.trim() || "protonpass";
+}
+async function probeBinary(binary, args) {
+    try {
+        await execFileAsync(binary, args, { timeout: 3_000 });
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function probeOp(config) {
+    return probeBinary(resolveOpBinary(config), ["--version"]);
+}
+async function probeProtonPass(config) {
+    if (await probeBinary(resolveProtonPassBinary(config), ["--version"])) {
+        return true;
+    }
+    // `pass` — classic Unix password-store — also supported as a fallback.
+    if (!config?.protonPassPath) {
+        return probeBinary("pass", ["--version"]);
+    }
+    return false;
+}
+export async function detectPasswordManagerBackend(config) {
+    const key = cacheKey(config);
+    const cached = detectionCache.get(key);
+    if (cached !== undefined)
+        return cached;
+    const preferred = config?.preferredBackend;
+    if (preferred === "none") {
+        detectionCache.set(key, "none");
+        return "none";
+    }
+    if (preferred === "1password") {
+        const ok = await probeOp(config);
+        const result = ok ? "1password" : "none";
+        detectionCache.set(key, result);
+        return result;
+    }
+    if (preferred === "protonpass") {
+        const ok = await probeProtonPass(config);
+        const result = ok ? "protonpass" : "none";
+        detectionCache.set(key, result);
+        return result;
+    }
+    if (await probeOp(config)) {
+        detectionCache.set(key, "1password");
+        return "1password";
+    }
+    if (await probeProtonPass(config)) {
+        detectionCache.set(key, "protonpass");
+        return "protonpass";
+    }
+    detectionCache.set(key, "none");
+    return "none";
+}
+/** Clear the backend detection cache. Exposed for tests. */
+export function clearPasswordManagerBackendCache() {
+    detectionCache.clear();
+}
+function opBaseArgs(config) {
+    const args = [];
+    const account = config?.onePasswordAccount?.trim();
+    if (account)
+        args.push("--account", account);
+    return args;
+}
+async function runOp(args, config) {
+    const binary = resolveOpBinary(config);
+    const fullArgs = [...opBaseArgs(config), ...args];
+    try {
+        const { stdout } = await execFileAsync(binary, fullArgs, {
+            timeout: 15_000,
+            maxBuffer: 16 * 1024 * 1024,
+        });
+        return stdout;
+    }
+    catch (error) {
+        throw new PasswordManagerError(`1Password CLI failed for "${args[0] ?? ""}": ${error instanceof Error ? error.message : String(error)}`, "1password", error);
+    }
+}
+function normalizeOpListEntry(raw) {
+    const id = raw.id ?? "";
+    if (!id) {
+        throw new PasswordManagerError("1Password item missing id", "1password");
+    }
+    const primaryUrl = raw.urls?.find((u) => u.primary)?.href ?? raw.urls?.[0]?.href;
+    return {
+        id,
+        title: raw.title ?? id,
+        url: primaryUrl,
+        username: raw.additional_information,
+        hasPassword: (raw.category ?? "").toUpperCase() === "LOGIN",
+        tags: raw.tags,
+        metadata: {
+            category: raw.category,
+            vault: raw.vault?.name,
+        },
+    };
+}
+async function listItemsVia1Password(config) {
+    const stdout = await runOp(["item", "list", "--format", "json"], config);
+    const trimmed = stdout.trim();
+    if (!trimmed)
+        return [];
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch (error) {
+        throw new PasswordManagerError("1Password returned invalid JSON from item list", "1password", error);
+    }
+    if (!Array.isArray(parsed)) {
+        throw new PasswordManagerError("1Password item list was not an array", "1password");
+    }
+    return parsed.map(normalizeOpListEntry);
+}
+function matchesQuery(item, q) {
+    if (!q)
+        return true;
+    const needle = q.toLowerCase();
+    if (item.title.toLowerCase().includes(needle))
+        return true;
+    if (item.url?.toLowerCase().includes(needle))
+        return true;
+    if (item.username?.toLowerCase().includes(needle))
+        return true;
+    if (item.tags?.some((t) => t.toLowerCase().includes(needle)))
+        return true;
+    return false;
+}
+// ---------------------------------------------------------------------------
+// ProtonPass / pass backend
+// ---------------------------------------------------------------------------
+//
+// Both `protonpass` and classic `pass` support listing entries by name.
+// Neither exposes rich metadata; we emit title-only items with the entry
+// path used as the id. Per the contract, we never include plaintext
+// secrets in returned objects.
+async function listItemsViaProtonPass(config) {
+    const binary = resolveProtonPassBinary(config);
+    let stdout;
+    try {
+        const result = await execFileAsync(binary, ["list"], {
+            timeout: 10_000,
+            maxBuffer: 8 * 1024 * 1024,
+        });
+        stdout = result.stdout;
+    }
+    catch (error) {
+        // Try classic `pass` if protonpass failed and user didn't pin a binary.
+        if (!config?.protonPassPath) {
+            try {
+                const result = await execFileAsync("pass", ["ls"], {
+                    timeout: 10_000,
+                    maxBuffer: 8 * 1024 * 1024,
+                });
+                stdout = result.stdout;
+            }
+            catch (inner) {
+                throw new PasswordManagerError(`ProtonPass/pass list failed: ${inner instanceof Error ? inner.message : String(inner)}`, "protonpass", inner);
+            }
+        }
+        else {
+            throw new PasswordManagerError(`ProtonPass list failed: ${error instanceof Error ? error.message : String(error)}`, "protonpass", error);
+        }
+    }
+    const items = [];
+    for (const rawLine of stdout.split("\n")) {
+        // Strip tree characters from `pass ls` output (├── └── │ etc.).
+        const line = rawLine
+            .replace(/[│├└─]+/g, "")
+            .replace(/\u00a0/g, " ")
+            .trim();
+        if (!line)
+            continue;
+        if (line.toLowerCase().startsWith("password store"))
+            continue;
+        items.push({
+            id: line,
+            title: line,
+            hasPassword: true,
+        });
+    }
+    return items;
+}
+// ---------------------------------------------------------------------------
+// Clipboard injection
+// ---------------------------------------------------------------------------
+function clipboardCommand() {
+    switch (process.platform) {
+        case "darwin":
+            return { cmd: "pbcopy", args: [] };
+        case "win32":
+            return { cmd: "clip", args: [] };
+        default:
+            // Linux/BSD — prefer xclip, but the command must be present on PATH.
+            return { cmd: "xclip", args: ["-selection", "clipboard"] };
+    }
+}
+/**
+ * Pipe stdout of a producer subprocess directly into the clipboard command.
+ *
+ * The plaintext secret passes through this process's memory only as kernel
+ * pipe buffers between the two children — it is never buffered as a JS
+ * string, never logged, and never returned.
+ */
+async function pipeToClipboard(producer, backend) {
+    const clip = clipboardCommand();
+    await new Promise((resolve, reject) => {
+        const source = spawn(producer.cmd, producer.args, {
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        const sink = spawn(clip.cmd, clip.args, {
+            stdio: ["pipe", "ignore", "pipe"],
+        });
+        let settled = false;
+        const settle = (err) => {
+            if (settled)
+                return;
+            settled = true;
+            if (err) {
+                try {
+                    source.kill();
+                }
+                catch { }
+                try {
+                    sink.kill();
+                }
+                catch { }
+                reject(err);
+            }
+            else {
+                resolve();
+            }
+        };
+        source.on("error", (err) => settle(new PasswordManagerError(`Failed to run ${producer.cmd}: ${err.message}`, backend, err)));
+        sink.on("error", (err) => settle(new PasswordManagerError(`Failed to run clipboard command ${clip.cmd}: ${err.message}`, backend, err)));
+        source.stdout.pipe(sink.stdin);
+        let sourceExit = null;
+        let sinkExit = null;
+        const maybeDone = () => {
+            if (sourceExit === null || sinkExit === null)
+                return;
+            if (sourceExit !== 0) {
+                settle(new PasswordManagerError(`${producer.cmd} exited with code ${sourceExit}`, backend));
+                return;
+            }
+            if (sinkExit !== 0) {
+                settle(new PasswordManagerError(`${clip.cmd} exited with code ${sinkExit}`, backend));
+                return;
+            }
+            settle();
+        };
+        source.on("close", (code) => {
+            sourceExit = code ?? 0;
+            maybeDone();
+        });
+        sink.on("close", (code) => {
+            sinkExit = code ?? 0;
+            maybeDone();
+        });
+    });
+}
+// ---------------------------------------------------------------------------
+// Public dispatch
+// ---------------------------------------------------------------------------
+async function resolveActiveBackend(config) {
+    const backend = await detectPasswordManagerBackend(config);
+    if (backend === "none") {
+        throw new PasswordManagerError("No password manager backend available (install 1Password CLI `op` or ProtonPass/`pass`)", "none");
+    }
+    return backend;
+}
+export async function searchPasswordItems(query, config) {
+    const backend = await resolveActiveBackend(config);
+    const items = backend === "1password"
+        ? await listItemsVia1Password(config)
+        : await listItemsViaProtonPass(config);
+    return items.filter((item) => matchesQuery(item, query));
+}
+export async function listPasswordItems(opts, config) {
+    const backend = await resolveActiveBackend(config);
+    const items = backend === "1password"
+        ? await listItemsVia1Password(config)
+        : await listItemsViaProtonPass(config);
+    const limit = opts.limit;
+    if (typeof limit === "number" && limit >= 0) {
+        return items.slice(0, limit);
+    }
+    return items;
+}
+export async function injectCredentialToClipboard(itemId, field, config) {
+    if (!itemId || typeof itemId !== "string") {
+        throw new PasswordManagerError("itemId is required", config?.preferredBackend ?? "none");
+    }
+    const backend = await resolveActiveBackend(config);
+    if (backend === "1password") {
+        const binary = resolveOpBinary(config);
+        const args = [
+            ...opBaseArgs(config),
+            "item",
+            "get",
+            itemId,
+            "--fields",
+            field === "password" ? "password" : "username",
+            "--reveal",
+        ];
+        await pipeToClipboard({ cmd: binary, args }, "1password");
+        return { ok: true, expiresInSeconds: CLIPBOARD_TTL_SECONDS };
+    }
+    // protonpass / pass
+    const binary = resolveProtonPassBinary(config);
+    // Both `protonpass show <id>` and `pass show <id>` print the secret on the
+    // first line. Username retrieval is not uniformly supported in classic
+    // pass; callers must store username in the entry body to retrieve it.
+    if (field === "username") {
+        throw new PasswordManagerError("Username injection is not supported by the ProtonPass/pass backend", "protonpass");
+    }
+    let producerCmd = binary;
+    const producerArgs = ["show", itemId];
+    // Fallback to classic `pass` when protonpass isn't pinned and missing.
+    if (!config?.protonPassPath) {
+        const hasProton = await probeBinary(binary, ["--version"]);
+        if (!hasProton)
+            producerCmd = "pass";
+    }
+    await pipeToClipboard({ cmd: producerCmd, args: producerArgs }, "protonpass");
+    return { ok: true, expiresInSeconds: CLIPBOARD_TTL_SECONDS };
+}

package/apps/app-lifeops/src/lifeops/remote-desktop.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Remote desktop session framework.
+ *
+ * Provides a narrow façade over Tailscale / ngrok so the owner can view or
+ * control their computer from a phone while the agent is working. Sessions are
+ * ephemeral, in-memory, and auto-expire. No secrets are persisted to disk and
+ * no passwords are passed on the command line.
+ */
+export type RemoteDesktopBackend = "tailscale-vnc" | "tailscale-ssh" | "ngrok-vnc" | "none";
+export interface RemoteDesktopSession {
+    id: string;
+    backend: RemoteDesktopBackend;
+    status: "starting" | "active" | "ended" | "failed";
+    accessUrl?: string;
+    accessCode?: string;
+    startedAt: string;
+    endedAt?: string;
+    expiresAt?: string;
+    error?: string;
+}
+export interface RemoteDesktopConfig {
+    preferredBackend?: RemoteDesktopBackend;
+    tailscaleNodeName?: string;
+    ngrokAuthToken?: string;
+    vncPort?: number;
+    sessionDurationMinutes?: number;
+}
+export declare class RemoteDesktopError extends Error {
+    readonly backend: RemoteDesktopBackend;
+    constructor(message: string, backend: RemoteDesktopBackend);
+}
+export declare function detectRemoteDesktopBackend(config?: RemoteDesktopConfig): Promise<RemoteDesktopBackend>;
+export declare function startRemoteSession(config?: RemoteDesktopConfig): Promise<RemoteDesktopSession>;
+export declare function getSessionStatus(id: string): Promise<RemoteDesktopSession | null>;
+export declare function endRemoteSession(id: string): Promise<void>;
+export declare function listActiveSessions(): Promise<RemoteDesktopSession[]>;
+//# sourceMappingURL=remote-desktop.d.ts.map

package/apps/app-lifeops/src/lifeops/remote-desktop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-desktop.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-lifeops/src/lifeops/remote-desktop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,MAAM,MAAM,oBAAoB,GAC5B,eAAe,GACf,eAAe,GACf,WAAW,GACX,MAAM,CAAC;AAEX,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;CAK3D;AA2GD,wBAAsB,0BAA0B,CAC9C,MAAM,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAsB/B;AAwLD,wBAAsB,kBAAkB,CACtC,MAAM,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CA2G/B;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAGtC;AAED,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhE;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAM1E"}