@elizaos/ui 2.0.0-alpha.382 → 2.0.0-alpha.385

package/apps/app-lifeops/src/lifeops/password-manager-bridge.js

@@ -1,448 +0,0 @@
-/**
- * Password manager bridge — dual-backend (1Password CLI `op` or ProtonPass CLI).
- *
- * Security posture:
- *   - Plaintext credentials NEVER enter return values.
- *   - `injectCredentialToClipboard` pipes the secret from the backend CLI
- *     directly into the OS clipboard via `execFile` without ever surfacing
- *     the value to the Node process beyond a narrow buffer that is
- *     discarded immediately.
- *   - Nothing is logged that could contain secret material.
- *   - All subprocess invocations use `execFile` with an args array.
- */
-import { execFile, spawn } from "node:child_process";
-import { promisify } from "node:util";
-import { logger } from "@elizaos/core";
-const execFileAsync = promisify(execFile);
-export class PasswordManagerError extends Error {
-    backend;
-    cause;
-    constructor(message, backend, cause) {
-        super(message);
-        this.name = "PasswordManagerError";
-        this.backend = backend;
-        this.cause = cause;
-    }
-}
-const CLIPBOARD_TTL_SECONDS = 30;
-const PASSWORD_MANAGER_FIXTURE_ITEMS = [
-    {
-        id: "pm-github",
-        title: "GitHub",
-        url: "https://github.com/login",
-        username: "benchmark-user",
-        hasPassword: true,
-        tags: ["dev", "github", "code"],
-        metadata: { vault: "Mocked Benchmark" },
-    },
-    {
-        id: "pm-google-workspace",
-        title: "Google Workspace",
-        url: "https://mail.google.com",
-        username: "owner@example.com",
-        hasPassword: true,
-        tags: ["google", "email"],
-        metadata: { vault: "Mocked Benchmark" },
-    },
-    {
-        id: "pm-aws-prod",
-        title: "AWS Console",
-        url: "https://signin.aws.amazon.com",
-        username: "infra@example.com",
-        hasPassword: true,
-        tags: ["aws", "cloud"],
-        metadata: { vault: "Mocked Benchmark" },
-    },
-];
-function isTruthyEnv(value) {
-    if (!value)
-        return false;
-    const normalized = value.trim().toLowerCase();
-    return (normalized === "1" ||
-        normalized === "true" ||
-        normalized === "yes" ||
-        normalized === "on" ||
-        normalized === "fixture");
-}
-function isFalsyEnv(value) {
-    if (!value)
-        return false;
-    const normalized = value.trim().toLowerCase();
-    return (normalized === "0" ||
-        normalized === "false" ||
-        normalized === "no" ||
-        normalized === "off");
-}
-function isFixturePasswordManagerEnabled() {
-    const explicit = process.env.MILADY_TEST_PASSWORD_MANAGER_BACKEND;
-    if (isFalsyEnv(explicit))
-        return false;
-    if (isTruthyEnv(explicit))
-        return true;
-    return false;
-}
-function listItemsViaFixture() {
-    return PASSWORD_MANAGER_FIXTURE_ITEMS.map((item) => ({
-        ...item,
-        tags: item.tags ? [...item.tags] : undefined,
-        metadata: item.metadata ? { ...item.metadata } : undefined,
-    }));
-}
-// ---------------------------------------------------------------------------
-// Detection
-// ---------------------------------------------------------------------------
-const detectionCache = new Map();
-function cacheKey(config) {
-    const c = config ?? {};
-    return [
-        c.preferredBackend ?? "",
-        c.onePasswordAccount ?? "",
-        c.opPath ?? "",
-        c.protonPassPath ?? "",
-    ].join("|");
-}
-function resolveOpBinary(config) {
-    return config?.opPath?.trim() || "op";
-}
-function resolveProtonPassBinary(config) {
-    return config?.protonPassPath?.trim() || "protonpass";
-}
-async function probeBinary(binary, args) {
-    try {
-        await execFileAsync(binary, args, { timeout: 3_000 });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
-async function probeOp(config) {
-    return probeBinary(resolveOpBinary(config), ["--version"]);
-}
-async function probeProtonPass(config) {
-    if (await probeBinary(resolveProtonPassBinary(config), ["--version"])) {
-        return true;
-    }
-    // `pass` — classic Unix password-store — also supported as a fallback.
-    if (!config?.protonPassPath) {
-        return probeBinary("pass", ["--version"]);
-    }
-    return false;
-}
-export async function detectPasswordManagerBackend(config) {
-    const key = cacheKey(config);
-    const cached = detectionCache.get(key);
-    if (cached !== undefined)
-        return cached;
-    const preferred = config?.preferredBackend;
-    if (preferred === "none") {
-        detectionCache.set(key, "none");
-        return "none";
-    }
-    if (preferred === "fixture") {
-        detectionCache.set(key, "fixture");
-        return "fixture";
-    }
-    if (isFixturePasswordManagerEnabled()) {
-        detectionCache.set(key, "fixture");
-        return "fixture";
-    }
-    if (preferred === "1password") {
-        const ok = await probeOp(config);
-        const result = ok ? "1password" : "none";
-        detectionCache.set(key, result);
-        return result;
-    }
-    if (preferred === "protonpass") {
-        const ok = await probeProtonPass(config);
-        const result = ok ? "protonpass" : "none";
-        detectionCache.set(key, result);
-        return result;
-    }
-    if (await probeOp(config)) {
-        detectionCache.set(key, "1password");
-        return "1password";
-    }
-    if (await probeProtonPass(config)) {
-        detectionCache.set(key, "protonpass");
-        return "protonpass";
-    }
-    detectionCache.set(key, "none");
-    return "none";
-}
-/** Clear the backend detection cache. Exposed for tests. */
-export function clearPasswordManagerBackendCache() {
-    detectionCache.clear();
-}
-function opBaseArgs(config) {
-    const args = [];
-    const account = config?.onePasswordAccount?.trim();
-    if (account)
-        args.push("--account", account);
-    return args;
-}
-async function runOp(args, config) {
-    const binary = resolveOpBinary(config);
-    const fullArgs = [...opBaseArgs(config), ...args];
-    try {
-        const { stdout } = await execFileAsync(binary, fullArgs, {
-            timeout: 15_000,
-            maxBuffer: 16 * 1024 * 1024,
-        });
-        return stdout;
-    }
-    catch (error) {
-        throw new PasswordManagerError(`1Password CLI failed for "${args[0] ?? ""}": ${error instanceof Error ? error.message : String(error)}`, "1password", error);
-    }
-}
-function normalizeOpListEntry(raw) {
-    const id = raw.id ?? "";
-    if (!id) {
-        throw new PasswordManagerError("1Password item missing id", "1password");
-    }
-    const primaryUrl = raw.urls?.find((u) => u.primary)?.href ?? raw.urls?.[0]?.href;
-    return {
-        id,
-        title: raw.title ?? id,
-        url: primaryUrl,
-        username: raw.additional_information,
-        hasPassword: (raw.category ?? "").toUpperCase() === "LOGIN",
-        tags: raw.tags,
-        metadata: {
-            category: raw.category,
-            vault: raw.vault?.name,
-        },
-    };
-}
-async function listItemsVia1Password(config) {
-    const stdout = await runOp(["item", "list", "--format", "json"], config);
-    const trimmed = stdout.trim();
-    if (!trimmed)
-        return [];
-    let parsed;
-    try {
-        parsed = JSON.parse(trimmed);
-    }
-    catch (error) {
-        throw new PasswordManagerError("1Password returned invalid JSON from item list", "1password", error);
-    }
-    if (!Array.isArray(parsed)) {
-        throw new PasswordManagerError("1Password item list was not an array", "1password");
-    }
-    return parsed.map(normalizeOpListEntry);
-}
-function matchesQuery(item, q) {
-    if (!q)
-        return true;
-    const needle = q.toLowerCase();
-    if (item.title.toLowerCase().includes(needle))
-        return true;
-    if (item.url?.toLowerCase().includes(needle))
-        return true;
-    if (item.username?.toLowerCase().includes(needle))
-        return true;
-    if (item.tags?.some((t) => t.toLowerCase().includes(needle)))
-        return true;
-    return false;
-}
-// ---------------------------------------------------------------------------
-// ProtonPass / pass backend
-// ---------------------------------------------------------------------------
-//
-// Both `protonpass` and classic `pass` support listing entries by name.
-// Neither exposes rich metadata; we emit title-only items with the entry
-// path used as the id. Per the contract, we never include plaintext
-// secrets in returned objects.
-async function listItemsViaProtonPass(config) {
-    const binary = resolveProtonPassBinary(config);
-    let stdout;
-    try {
-        const result = await execFileAsync(binary, ["list"], {
-            timeout: 10_000,
-            maxBuffer: 8 * 1024 * 1024,
-        });
-        stdout = result.stdout;
-    }
-    catch (error) {
-        // Try classic `pass` if protonpass failed and user didn't pin a binary.
-        if (!config?.protonPassPath) {
-            try {
-                const result = await execFileAsync("pass", ["ls"], {
-                    timeout: 10_000,
-                    maxBuffer: 8 * 1024 * 1024,
-                });
-                stdout = result.stdout;
-            }
-            catch (inner) {
-                throw new PasswordManagerError(`ProtonPass/pass list failed: ${inner instanceof Error ? inner.message : String(inner)}`, "protonpass", inner);
-            }
-        }
-        else {
-            throw new PasswordManagerError(`ProtonPass list failed: ${error instanceof Error ? error.message : String(error)}`, "protonpass", error);
-        }
-    }
-    const items = [];
-    for (const rawLine of stdout.split("\n")) {
-        // Strip tree characters from `pass ls` output (├── └── │ etc.).
-        const line = rawLine
-            .replace(/[│├└─]+/g, "")
-            .replace(/\u00a0/g, " ")
-            .trim();
-        if (!line)
-            continue;
-        if (line.toLowerCase().startsWith("password store"))
-            continue;
-        items.push({
-            id: line,
-            title: line,
-            hasPassword: true,
-        });
-    }
-    return items;
-}
-// ---------------------------------------------------------------------------
-// Clipboard injection
-// ---------------------------------------------------------------------------
-function clipboardCommand() {
-    switch (process.platform) {
-        case "darwin":
-            return { cmd: "pbcopy", args: [] };
-        case "win32":
-            return { cmd: "clip", args: [] };
-        default:
-            // Linux/BSD — prefer xclip, but the command must be present on PATH.
-            return { cmd: "xclip", args: ["-selection", "clipboard"] };
-    }
-}
-/**
- * Pipe stdout of a producer subprocess directly into the clipboard command.
- *
- * The plaintext secret passes through this process's memory only as kernel
- * pipe buffers between the two children — it is never buffered as a JS
- * string, never logged, and never returned.
- */
-async function pipeToClipboard(producer, backend) {
-    const clip = clipboardCommand();
-    await new Promise((resolve, reject) => {
-        const source = spawn(producer.cmd, producer.args, {
-            stdio: ["ignore", "pipe", "pipe"],
-        });
-        const sink = spawn(clip.cmd, clip.args, {
-            stdio: ["pipe", "ignore", "pipe"],
-        });
-        let settled = false;
-        const settle = (err) => {
-            if (settled)
-                return;
-            settled = true;
-            if (err) {
-                source.kill();
-                sink.kill();
-                reject(err);
-            }
-            else {
-                resolve();
-            }
-        };
-        source.on("error", (err) => settle(new PasswordManagerError(`Failed to run ${producer.cmd}: ${err.message}`, backend, err)));
-        sink.on("error", (err) => settle(new PasswordManagerError(`Failed to run clipboard command ${clip.cmd}: ${err.message}`, backend, err)));
-        source.stdout.pipe(sink.stdin);
-        let sourceExit = null;
-        let sinkExit = null;
-        const maybeDone = () => {
-            if (sourceExit === null || sinkExit === null)
-                return;
-            if (sourceExit !== 0) {
-                settle(new PasswordManagerError(`${producer.cmd} exited with code ${sourceExit}`, backend));
-                return;
-            }
-            if (sinkExit !== 0) {
-                settle(new PasswordManagerError(`${clip.cmd} exited with code ${sinkExit}`, backend));
-                return;
-            }
-            settle();
-        };
-        source.on("close", (code) => {
-            sourceExit = code ?? 0;
-            maybeDone();
-        });
-        sink.on("close", (code) => {
-            sinkExit = code ?? 0;
-            maybeDone();
-        });
-    });
-}
-// ---------------------------------------------------------------------------
-// Public dispatch
-// ---------------------------------------------------------------------------
-async function resolveActiveBackend(config) {
-    const backend = await detectPasswordManagerBackend(config);
-    if (backend === "none") {
-        throw new PasswordManagerError("No password manager backend available (install 1Password CLI `op` or ProtonPass/`pass`)", "none");
-    }
-    return backend;
-}
-export async function searchPasswordItems(query, config) {
-    const backend = await resolveActiveBackend(config);
-    const items = backend === "fixture"
-        ? listItemsViaFixture()
-        : backend === "1password"
-            ? await listItemsVia1Password(config)
-            : await listItemsViaProtonPass(config);
-    return items.filter((item) => matchesQuery(item, query));
-}
-export async function listPasswordItems(opts, config) {
-    const backend = await resolveActiveBackend(config);
-    const items = backend === "fixture"
-        ? listItemsViaFixture()
-        : backend === "1password"
-            ? await listItemsVia1Password(config)
-            : await listItemsViaProtonPass(config);
-    const limit = opts.limit;
-    if (typeof limit === "number" && limit >= 0) {
-        return items.slice(0, limit);
-    }
-    return items;
-}
-export async function injectCredentialToClipboard(itemId, field, config) {
-    if (!itemId || typeof itemId !== "string") {
-        throw new PasswordManagerError("itemId is required", config?.preferredBackend ?? "none");
-    }
-    const backend = await resolveActiveBackend(config);
-    if (backend === "fixture") {
-        logger.warn({ itemId, field, boundary: "lifeops", component: "password-manager-bridge" }, "[password-manager-bridge] fixture backend active: NO actual clipboard write performed. Set MILADY_TEST_PASSWORD_MANAGER_BACKEND=0 for real injection.");
-        return { ok: true, expiresInSeconds: CLIPBOARD_TTL_SECONDS, fixtureMode: true };
-    }
-    if (backend === "1password") {
-        const binary = resolveOpBinary(config);
-        const args = [
-            ...opBaseArgs(config),
-            "item",
-            "get",
-            itemId,
-            "--fields",
-            field === "password" ? "password" : "username",
-            "--reveal",
-        ];
-        await pipeToClipboard({ cmd: binary, args }, "1password");
-        return { ok: true, expiresInSeconds: CLIPBOARD_TTL_SECONDS };
-    }
-    // protonpass / pass
-    const binary = resolveProtonPassBinary(config);
-    // Both `protonpass show <id>` and `pass show <id>` print the secret on the
-    // first line. Username retrieval is not uniformly supported in classic
-    // pass; callers must store username in the entry body to retrieve it.
-    if (field === "username") {
-        throw new PasswordManagerError("Username injection is not supported by the ProtonPass/pass backend", "protonpass");
-    }
-    let producerCmd = binary;
-    const producerArgs = ["show", itemId];
-    // Fallback to classic `pass` when protonpass isn't pinned and missing.
-    if (!config?.protonPassPath) {
-        const hasProton = await probeBinary(binary, ["--version"]);
-        if (!hasProton)
-            producerCmd = "pass";
-    }
-    await pipeToClipboard({ cmd: producerCmd, args: producerArgs }, "protonpass");
-    return { ok: true, expiresInSeconds: CLIPBOARD_TTL_SECONDS };
-}

package/apps/app-lifeops/src/lifeops/remote-desktop.d.ts

@@ -1,38 +0,0 @@
-/**
- * Remote desktop session framework.
- *
- * Provides a narrow façade over Tailscale / ngrok so the owner can view or
- * control their computer from a phone while the agent is working. Sessions are
- * ephemeral, in-memory, and auto-expire. No secrets are persisted to disk and
- * no passwords are passed on the command line.
- */
-export type RemoteDesktopBackend = "tailscale-vnc" | "tailscale-ssh" | "ngrok-vnc" | "none";
-export interface RemoteDesktopSession {
-    id: string;
-    backend: RemoteDesktopBackend;
-    status: "starting" | "active" | "ended" | "failed";
-    accessUrl?: string;
-    accessCode?: string;
-    startedAt: string;
-    endedAt?: string;
-    expiresAt?: string;
-    error?: string;
-    mockMode?: boolean;
-}
-export interface RemoteDesktopConfig {
-    preferredBackend?: RemoteDesktopBackend;
-    tailscaleNodeName?: string;
-    ngrokAuthToken?: string;
-    vncPort?: number;
-    sessionDurationMinutes?: number;
-}
-export declare class RemoteDesktopError extends Error {
-    readonly backend: RemoteDesktopBackend;
-    constructor(message: string, backend: RemoteDesktopBackend);
-}
-export declare function detectRemoteDesktopBackend(config?: RemoteDesktopConfig): Promise<RemoteDesktopBackend>;
-export declare function startRemoteSession(config?: RemoteDesktopConfig): Promise<RemoteDesktopSession>;
-export declare function getSessionStatus(id: string): Promise<RemoteDesktopSession | null>;
-export declare function endRemoteSession(id: string): Promise<void>;
-export declare function listActiveSessions(): Promise<RemoteDesktopSession[]>;
-//# sourceMappingURL=remote-desktop.d.ts.map

package/apps/app-lifeops/src/lifeops/remote-desktop.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"remote-desktop.d.ts","sourceRoot":"","sources":["../../../../../../../apps/app-lifeops/src/lifeops/remote-desktop.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,MAAM,MAAM,oBAAoB,GAC5B,eAAe,GACf,eAAe,GACf,WAAW,GACX,MAAM,CAAC;AAEX,MAAM,WAAW,oBAAoB;IACnC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,oBAAoB,CAAC;IAC9B,MAAM,EAAE,UAAU,GAAG,QAAQ,GAAG,OAAO,GAAG,QAAQ,CAAC;IACnD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,QAAQ,CAAC,OAAO,EAAE,oBAAoB,CAAC;gBAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB;CAK3D;AA0HD,wBAAsB,0BAA0B,CAC9C,MAAM,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CAyB/B;AAwLD,wBAAsB,kBAAkB,CACtC,MAAM,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,oBAAoB,CAAC,CA4H/B;AAED,wBAAsB,gBAAgB,CACpC,EAAE,EAAE,MAAM,GACT,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAGtC;AAED,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BhE;AAED,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAM1E"}