@fugood/buttress-server 2.26.0-beta.12 → 2.26.0-beta.13

package/README.md

@@ -69,14 +69,14 @@ The `bricks` CLI is the tool that performs the binding and writes the local stat
 ### Bind a server to a workspace
 
 ```bash
-# Pair the local machine's buttress-server with the workspace of the current bricks-cli profile
+# Pair the local server and provision a workspace DevTools token using the current CLI profile
 bricks buttress bind
 
 # Override the auto-detected server id, give it a friendly name, or write to a custom state dir
 bricks buttress bind --server-id buttress-mac-studio --name "Studio LLM" --state-dir /etc/buttress
 
 # For headless/remote setups: emit state.json to stdout instead of writing to disk
-bricks buttress bind --print > /etc/buttress/state.json
+(umask 077; bricks buttress bind --print > /etc/buttress/state.json)
 ```
 
 The state file (`~/.bricks-cli/buttress/state.json` by default, or `$BRICKS_BUTTRESS_STATE_DIR`) stores:
@@ -84,6 +84,15 @@ The state file (`~/.bricks-cli/buttress/state.json` by default, or `$BRICKS_BUTT
 - `workspace.id` / `workspace.name` — which workspace this server belongs to
 - `workspace.serverId` — the server's stable id (defaults to `buttress-<machineId>`)
 - `workspace.issuerPublicKey` + `workspace.kid` — Ed25519 SPKI used to verify access tokens
+- `devtools` — workspace-scoped DevTools JWT (`k: "da"`), workspace id and expiry,
+  provisioned automatically by `bind` for agent device tools
+
+Normal bind/status output reports only token expiry, never the token. The CLI writes
+state with mode `0600`; `--print` includes credentials and must be treated as a secret.
+Rebinding provisions a fresh token (default lifetime: 30 days) and rotates the announce
+key. Issuance failure stops binding before changing the remote announce key. Rebinding
+or unbinding does not revoke previously issued DevTools JWTs; they remain valid until
+expiry or issuer-key rotation.
 
 **Restart `bricks-buttress` after binding** for the change to take effect — the state file is read once at startup.
 
@@ -914,16 +923,23 @@ fail closed unless marked `optional = true`.
 
 For example, scan with `{}` then call `devtools` with
 `{ "action": "tree", "address": "192.168.1.42", "port": 19851 }`.
-Supply `passcode` or a workspace DevTools `accessToken` if required; otherwise the
-transport uses the device's advertised Chrome Inspect credential. Buttress does **not**
-read the host's CLI login or mint tokens. Calls open/close their own connection;
+After `bricks buttress bind` and a restart, the workspace credential is injected
+server-side automatically when the device advertises the same workspace and issuer.
+The token is validated for signature, kind and expiry before use; inbound Buttress
+JWTs (`k: "ba"`) are never forwarded. Older bindings without the credential, or expired
+credentials, require rebinding and a restart. The server does not read the CLI login
+or renew tokens itself. Local previews can still use advertised inspect credentials;
+explicit `passcode` / `accessToken` arguments remain optional overrides. Calls open/close their own connection;
 avoid parallel calls or other inspectors on the same device (one CDP client at a time).
 
 **Security:** enabling this option grants network discovery and device control,
 including arbitrary JavaScript evaluation on reachable authenticated devices. It is
-not read-only or a network sandbox. Tool arguments/results (including credentials,
-console output and device data) enter model context and persisted session transcripts;
-only grant this to trusted agents/callers. Disable with `local_devices = false` and
+not read-only or a network sandbox. Automatic authentication requires a **trusted LAN**:
+workspace/issuer hints from device info are not cryptographic peer authentication.
+The stored token is never inserted into model arguments and is redacted from text
+results/errors before truncation. Explicit credentials supplied in arguments still
+enter session transcripts, as do console output and device data; prefer automatic
+authentication and only grant this to trusted agents/callers. Disable with `local_devices = false` and
 restart Buttress. Aborting closes active CDP connections; discovery completes its
 bounded scan before returning the abort result.
 

package/lib/agent/device-auth.d.ts

@@ -0,0 +1,3 @@
+import type { WorkspaceState } from '../utils/workspaceState';
+/** Select only the bound workspace's credential; never reuse an inbound Buttress (k=ba) JWT. */
+export declare const resolveDeviceAccessToken: (address: string, port: number, state?: WorkspaceState, signal?: AbortSignal) => Promise<string | undefined>;

package/lib/agent/device-tools.d.ts

@@ -1,4 +1,5 @@
 import type { AgentFunctionTool } from './tools';
 import type { AgentDefinition } from './types';
+import type { WorkspaceState } from '../utils/workspaceState';
 /** Two tools regardless of device count; no remote tool-list expansion or persistent sockets. */
-export declare const buildLocalDeviceTools: (agent: Pick<AgentDefinition, 'localDevices'>, configDir: string) => AgentFunctionTool[];
+export declare const buildLocalDeviceTools: (agent: Pick<AgentDefinition, 'localDevices'>, configDir: string, workspaceState?: WorkspaceState) => AgentFunctionTool[];