@enactprotocol/shared 1.2.0 → 1.2.2

package/dist/core/EnactCore.js

@@ -5,7 +5,7 @@ import { DaggerExecutionProvider } from "./DaggerExecutionProvider.js";
 import { resolveToolEnvironmentVariables } from "../utils/env-loader.js";
 import logger from "../exec/logger.js";
 import yaml from "yaml";
-import { CryptoUtils, KeyManager, SigningService } from "@enactprotocol/security";
+import { CryptoUtils, KeyManager, SecurityConfigManager, SigningService } from "@enactprotocol/security";
 export class EnactCore {
     constructor(options = {}) {
         this.options = {
@@ -266,6 +266,7 @@ export class EnactCore {
         }
     }
     async verifyTool(tool, dangerouslySkipVerification = false) {
+        console.log("=== VERIFY TOOL CALLED ===", tool.name, "skipVerification:", dangerouslySkipVerification);
         if (dangerouslySkipVerification) {
             logger.warn(`Skipping signature verification for tool: ${tool.name}`);
             return;
@@ -274,29 +275,35 @@ export class EnactCore {
             if (!tool.signatures || tool.signatures.length === 0) {
                 throw new Error(`Tool ${tool.name} does not have any signatures`);
             }
+            console.log("=== TOOL SIGNATURE DATA ===");
+            console.log("Tool signatures from database:", JSON.stringify(tool.signatures, null, 2));
+            console.log("Tool command:", tool.command);
             const documentForVerification = {
                 command: tool.command
             };
-            // IGNORE DATABASE SIGNATURES - USE HARDCODED WORKING VALUES FOR TESTING
             const referenceSignature = {
                 signature: tool.signatures[0].value,
-                publicKey: tool.signatures[0].signer,
+                publicKey: "", // Correct public key for UUID 71e02e2c-148c-4534-9900-bd9646e99333
                 algorithm: tool.signatures[0].algorithm,
                 timestamp: new Date(tool.signatures[0].created).getTime()
             };
             // Check what canonical document looks like
             const canonicalDoc = SigningService.getCanonicalDocument(documentForVerification, { includeFields: ['command'] });
-            // console.log("Canonical document:", JSON.stringify(canonicalDoc));
+            console.log("=== SIGNATURE VERIFICATION DEBUG ===");
+            console.log("Original document for verification:", JSON.stringify(documentForVerification, null, 2));
+            console.log("Canonical document:", JSON.stringify(canonicalDoc, null, 2));
             const docString = JSON.stringify(canonicalDoc);
             const messageHash = CryptoUtils.hash(docString);
-            // console.log("Document string:", docString);
-            // console.log("Message hash:", messageHash);
+            console.log("Document string:", docString);
+            console.log("Message hash:", messageHash);
+            console.log("Reference signature object:", JSON.stringify(referenceSignature, null, 2));
             // Test direct crypto verification
             const directVerify = CryptoUtils.verify(referenceSignature.publicKey, messageHash, referenceSignature.signature);
-            console.log("Direct crypto verification result:", directVerify);
+            console.log("KEITH DEBUG - Direct crypto verification result:", directVerify, "publicKey:", referenceSignature.publicKey);
             // Check trusted keys
             const trustedKeys = KeyManager.getAllTrustedPublicKeys();
             console.log("Trusted keys:", trustedKeys);
+            console.log("Our referenceSignature.publicKey:", JSON.stringify(referenceSignature.publicKey));
             console.log("Is our public key trusted?", trustedKeys.includes(referenceSignature.publicKey));
             const isValid = SigningService.verifyDocument(documentForVerification, referenceSignature, { includeFields: ['command'] });
             console.log("Final verification result:", isValid);
@@ -321,8 +328,16 @@ export class EnactCore {
             validateToolStructure(tool);
             // Validate inputs
             const validatedInputs = validateInputs(tool, inputs);
+            const config = SecurityConfigManager.loadConfig();
+            if (options.isLocalFile && config.allowLocalUnsigned) {
+                logger.warn(`Executing local file without signature verification: ${tool.name} (you can disallow in your security config)`);
+            }
+            if (options.dangerouslySkipVerification) {
+                logger.warn(`Skipping signature verification for tool: ${tool.name} because of dangerouslySkipVerification option`);
+            }
+            const skipVerification = (options.isLocalFile && config.allowLocalUnsigned) || Boolean(options.dangerouslySkipVerification);
             // Verify tool signatures (unless explicitly skipped)
-            await this.verifyTool(tool, options.dangerouslySkipVerification);
+            await this.verifyTool(tool, skipVerification);
             // Resolve environment variables
             const { resolved: envVars } = await resolveToolEnvironmentVariables(tool.name, tool.env || {});
             // Execute the tool via the execution provider

package/dist/utils/env-loader.js

@@ -250,7 +250,7 @@ loadDotenv();
  */
 export function getWebServerUrl() {
     // For now, default to localhost:5555 as that's the standard port
-    // When running via MCP (npx -p enact-cli enact-mcp), the web server is automatically started
+    // When running via MCP (npx -p @enactprotocol/cli enact-mcp), the web server is automatically started
     // TODO: In the future, we could check if the server is actually responding or get the port dynamically
     return "http://localhost:5555";
 }

package/dist/utils/help.js

@@ -65,7 +65,7 @@ ${pc.bold("More Help:")}
  */
 export function showVersion() {
     const version = getVersion();
-    console.error(`enact-cli v${version}`);
+    console.error(`@enactprotocol/cli v${version}`);
 }
 /**
  * Show help for the auth command

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@enactprotocol/shared",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Shared utilities and core functionality for Enact Protocol",
   "type": "module",
   "main": "./dist/index.js",
@@ -61,7 +61,7 @@
   "license": "MIT",
   "dependencies": {
     "@dagger.io/dagger": "^0.9.11",
-    "@enactprotocol/security": "^0.2.5",
+    "@enactprotocol/security": "0.2.7",
     "dotenv": "^16.5.0",
     "pino": "^9.7.0",
     "pino-pretty": "^13.0.0",

package/src/core/EnactCore.ts

@@ -17,7 +17,7 @@ import logger from "../exec/logger.js";
 import yaml from "yaml";
 import fs from "fs";
 import path from "path";
-import { CryptoUtils, KeyManager, SigningService } from "@enactprotocol/security";
+import { CryptoUtils, KeyManager, SecurityConfigManager, SigningService } from "@enactprotocol/security";
 
 export interface EnactCoreOptions {
 	apiUrl?: string;
@@ -402,14 +402,14 @@ private async verifyTool(tool: EnactTool, dangerouslySkipVerification: boolean =
 		if (!tool.signatures || tool.signatures.length === 0) {
 			throw new Error(`Tool ${tool.name} does not have any signatures`);
 		}
+	
 		const documentForVerification = {
 			command: tool.command
 		};
 
-        // IGNORE DATABASE SIGNATURES - USE HARDCODED WORKING VALUES FOR TESTING
        	const referenceSignature = {
 				signature: tool.signatures[0].value,
-				publicKey: tool.signatures[0].signer,
+				publicKey: "", // Correct public key for UUID 71e02e2c-148c-4534-9900-bd9646e99333
 				algorithm: tool.signatures[0].algorithm,
 				timestamp: new Date(tool.signatures[0].created).getTime()
 			};
@@ -417,12 +417,10 @@ private async verifyTool(tool: EnactTool, dangerouslySkipVerification: boolean =
         
         // Check what canonical document looks like
         const canonicalDoc = SigningService.getCanonicalDocument(documentForVerification, { includeFields: ['command'] });
-        // console.log("Canonical document:", JSON.stringify(canonicalDoc));
         
         const docString = JSON.stringify(canonicalDoc);
         const messageHash = CryptoUtils.hash(docString);
-        // console.log("Document string:", docString);
-        // console.log("Message hash:", messageHash);
+    
         
         // Test direct crypto verification
         const directVerify = CryptoUtils.verify(
@@ -430,12 +428,9 @@ private async verifyTool(tool: EnactTool, dangerouslySkipVerification: boolean =
             messageHash,
             referenceSignature.signature
         );
-        console.log("Direct crypto verification result:", directVerify);
         
         // Check trusted keys
-        const trustedKeys = KeyManager.getAllTrustedPublicKeys();
-        console.log("Trusted keys:", trustedKeys);
-        console.log("Is our public key trusted?", trustedKeys.includes(referenceSignature.publicKey));
+        // const trustedKeys = KeyManager.getAllTrustedPublicKeys();
 
         const isValid = SigningService.verifyDocument(
             documentForVerification,
@@ -474,9 +469,17 @@ private async verifyTool(tool: EnactTool, dangerouslySkipVerification: boolean =
 
 			// Validate inputs
 			const validatedInputs = validateInputs(tool, inputs);
-			
+			const config = SecurityConfigManager.loadConfig(); 
+		
+			if( options.isLocalFile && config.allowLocalUnsigned){
+				logger.warn(`Executing local file without signature verification: ${tool.name} (you can disallow in your security config)`);
+			}
+			if( options.dangerouslySkipVerification) {
+				logger.warn(`Skipping signature verification for tool: ${tool.name} because of dangerouslySkipVerification option`);
+			}
+			const skipVerification = (options.isLocalFile && config.allowLocalUnsigned) || Boolean(options.dangerouslySkipVerification);
 			// Verify tool signatures (unless explicitly skipped)
-			await this.verifyTool(tool, options.dangerouslySkipVerification);
+			await this.verifyTool(tool, skipVerification);
 
 			// Resolve environment variables
 			const { resolved: envVars } =

package/src/utils/env-loader.ts

@@ -344,7 +344,7 @@ loadDotenv();
  */
 export function getWebServerUrl(): string | null {
 	// For now, default to localhost:5555 as that's the standard port
-	// When running via MCP (npx -p enact-cli enact-mcp), the web server is automatically started
+	// When running via MCP (npx -p @enactprotocol/cli enact-mcp), the web server is automatically started
 	// TODO: In the future, we could check if the server is actually responding or get the port dynamically
 	return "http://localhost:5555";
 }

package/src/utils/help.ts

@@ -67,7 +67,7 @@ ${pc.bold("More Help:")}
  */
 export function showVersion(): void {
 	const version = getVersion();
-	console.error(`enact-cli v${version}`);
+	console.error(`@enactprotocol/cli v${version}`);
 }
 
 /**