@ixo/asks-mcp 1.6.0-dev.3 → 1.6.0-dev.4

package/README.md

@@ -87,6 +87,8 @@ naming what is missing; nothing is posted and nothing is spent. `my_status` and
 
 On first run the server makes a key in `$OPENHANDS_HOME/<network>/key.json` (by default `~/.openhands/testnet/key.json`), readable only by you. The server refuses to use it if anyone else can read the file, anyone else can write to its directory, or either is a symlink. The mnemonic never leaves the server: no tool returns it and nothing logs it. The spend ledger (`spend.json`), the account it acts for (`principal.json`) and open-call drafts (`calls/`) sit beside it.
 
+On Windows the server verifies the actual ACL using Windows PowerShell, because Node's POSIX mode bits cannot express Windows permissions. The current Windows user must have Full control; only that user, SYSTEM and the built-in Administrators group may have access. Inherited private permissions are accepted. The server does not rewrite Windows ACLs, and refuses to read a key when it cannot verify them. For a refusal, check the directory and file under **Properties > Security**, or choose an `OPENHANDS_HOME` that already has private permissions. No permission-check bypass is available.
+
 Spending tools preview first and need the exact total confirmed; daily caps are counted on disk, so restarting the client does not reset them. Earnings go only to `OPENHANDS_HOME_ADDRESS`.
 
 ## The hosted server instead

package/dist/asks-mcp.mjs

@@ -8058,7 +8058,14 @@ function reportProblems(raw, requirement, fileIds = []) {
 }
 function readReport(envelope) {
   const doc = obj(envelope);
-  const report = obj(doc?.report) ?? (doc?.kind === REPORT_KIND ? doc : null);
+  let report = obj(doc?.report) ?? (doc?.kind === REPORT_KIND ? doc : null);
+  if (!report && typeof doc?.deliverable === "string" && doc.deliverable.length <= REPORT_LIMITS.bytes) {
+    try {
+      const pasted = obj(JSON.parse(doc.deliverable));
+      if (pasted?.kind === REPORT_KIND && obj(pasted.summary)) report = pasted;
+    } catch {
+    }
+  }
   if (!report) return null;
   const summary = obj(report.summary) ?? {};
   const read9 = {
@@ -8090,6 +8097,16 @@ function readReport(envelope) {
     sections: Object.entries(obj(report.sections) ?? {}).map(([title, value]) => ({ title, text: String(value) }))
   };
   const files = (Array.isArray(doc?.files) ? doc.files : []).map(obj).filter((one) => one !== null && typeof one.id === "string" && typeof one.url === "string" && STORED.test(one.url)).slice(0, 24).map((one) => ({ id: String(one.id), url: String(one.url), sha256: String(one.sha256 ?? ""), mediaType: String(one.mediaType ?? "application/octet-stream"), name: String(one.name ?? one.id) }));
+  for (const field2 of Object.values(doc ?? {})) {
+    if (!Array.isArray(field2)) continue;
+    for (const value of field2) {
+      const file3 = obj(value);
+      if (!file3 || !isStoredFile(file3.content) || files.some((one) => one.url === file3.content) || files.length >= 24) continue;
+      let id = `attachment-${files.length + 1}`;
+      while (files.some((one) => one.id === id)) id += "-file";
+      files.push({ id, url: file3.content, sha256: "", mediaType: str(file3.type) ?? "application/octet-stream", name: str(file3.name) ?? "Attachment" });
+    }
+  }
   return { doc: read9, files };
 }
 function formAnswersOf(envelope) {
@@ -30395,6 +30412,73 @@ var init_site = __esm({
   }
 });
 
+// src/keyPermissions.ts
+import { spawnSync } from "node:child_process";
+import { lstatSync } from "node:fs";
+import { win32 } from "node:path";
+function assertWindowsPrivatePath(path, run2 = spawnSync) {
+  const root = process.env.SystemRoot;
+  if (!root || !win32.isAbsolute(root)) throw new Error(`Cannot verify Windows permissions for ${path}: SystemRoot is unavailable. No key was read.`);
+  const powershellHome = win32.join(root, "System32", "WindowsPowerShell", "v1.0");
+  const env = { ...process.env };
+  for (const name8 of Object.keys(env)) if (/^(psmodulepath|openhands_acl_path)$/i.test(name8)) delete env[name8];
+  const result = run2(win32.join(powershellHome, "powershell.exe"), [
+    "-NoLogo",
+    "-NoProfile",
+    "-NonInteractive",
+    "-EncodedCommand",
+    Buffer.from(CHECK_ACL, "utf16le").toString("base64")
+  ], {
+    env: { ...env, PSModulePath: win32.join(powershellHome, "Modules"), OPENHANDS_ACL_PATH: path },
+    timeout: 3e4,
+    windowsHide: true,
+    stdio: "ignore"
+  });
+  if (result.error || result.signal || result.status !== 0) {
+    const why = result.error?.code === "ETIMEDOUT" ? "inspection timed out" : `inspection exit ${result.status ?? "unavailable"}`;
+    throw new Error(`Cannot verify private Windows permissions for ${path} (${why}). Only your Windows account, SYSTEM and Administrators may have access, and your account must have Full control. Check Properties > Security, or choose a private OPENHANDS_HOME. No key was read.`);
+  }
+}
+function assertSafe(path, what, platform = process.platform, run2) {
+  const stat = lstatSync(path);
+  if (stat.isSymbolicLink()) throw new Error(`${path} is a symlink. A key that lives where another program decides is not a key we will use.`);
+  if (what === "file" ? !stat.isFile() : !stat.isDirectory()) throw new Error(`${path} is not a ${what}.`);
+  if (platform === "win32") {
+    assertWindowsPrivatePath(path, run2);
+    return;
+  }
+  const mode = stat.mode & 511;
+  const tooOpen = what === "file" ? mode & 63 : mode & 18;
+  if (tooOpen) throw new Error(`${path} is readable or writable by others (mode ${mode.toString(8)}). Run: chmod ${what === "file" ? "600" : "700"} ${path}`);
+}
+var CHECK_ACL;
+var init_keyPermissions = __esm({
+  "src/keyPermissions.ts"() {
+    "use strict";
+    CHECK_ACL = String.raw`
+$ErrorActionPreference = 'Stop'
+try {
+  $item = Get-Item -LiteralPath $env:OPENHANDS_ACL_PATH -Force
+  if (($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -ne 0) { exit 2 }
+  $acl = Get-Acl -LiteralPath $env:OPENHANDS_ACL_PATH
+  $me = [Security.Principal.WindowsIdentity]::GetCurrent().User.Value
+  $trusted = @($me, 'S-1-5-18', 'S-1-5-32-544')
+  if ($trusted -notcontains $acl.GetOwner([Security.Principal.SecurityIdentifier]).Value) { exit 3 }
+  $mine = $false
+  foreach ($rule in $acl.GetAccessRules($true, $true, [Security.Principal.SecurityIdentifier])) {
+    if (($rule.PropagationFlags -band [Security.AccessControl.PropagationFlags]::InheritOnly) -ne 0) { continue }
+    if ($rule.AccessControlType -ne [Security.AccessControl.AccessControlType]::Allow) { continue }
+    if ($trusted -notcontains $rule.IdentityReference.Value) { exit 3 }
+    if ($rule.IdentityReference.Value -eq $me -and
+        ($rule.FileSystemRights -band [Security.AccessControl.FileSystemRights]::FullControl) -eq [Security.AccessControl.FileSystemRights]::FullControl) { $mine = $true }
+  }
+  if (-not $mine) { exit 3 }
+  exit 0
+} catch { exit 4 }
+`;
+  }
+});
+
 // ../../node_modules/.pnpm/cosmjs-types@0.11.0/node_modules/cosmjs-types/utf8.js
 var require_utf82 = __commonJS({
   "../../node_modules/.pnpm/cosmjs-types@0.11.0/node_modules/cosmjs-types/utf8.js"(exports) {
@@ -49621,26 +49705,14 @@ __export(keys_exports, {
   signer: () => signer,
   writePin: () => writePin
 });
-import { chmodSync, existsSync, lstatSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { chmodSync, existsSync, lstatSync as lstatSync2, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join as join3 } from "node:path";
-function assertSafe(path, what) {
-  const stat = lstatSync(path);
-  if (stat.isSymbolicLink()) {
-    throw new Error(`${path} is a symlink. A key that lives where another program decides is not a key we will use.`);
-  }
-  const mode = stat.mode & 511;
-  const tooOpen = what === "file" ? mode & 63 : mode & 18;
-  if (tooOpen) {
-    throw new Error(
-      `${path} is readable or writable by others (mode ${mode.toString(8)}). Run: chmod ${what === "file" ? "600" : "700"} ${path}`
-    );
-  }
-}
 function ensureDir() {
   const dir = DIR();
   if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
-  chmodSync(dir, 448);
+  if (lstatSync2(dir).isSymbolicLink()) throw new Error(`${dir} is a symlink.`);
+  if (process.platform !== "win32") chmodSync(dir, 448);
   assertSafe(dir, "dir");
 }
 async function loadKey() {
@@ -49667,7 +49739,7 @@ async function loadKey() {
   const [account] = await wallet.getAccounts();
   const made = { mnemonic: wallet.mnemonic, address: account.address };
   writeFileSync(KEY_FILE2, JSON.stringify(made, null, 2), { mode: 384 });
-  chmodSync(KEY_FILE2, 384);
+  if (process.platform !== "win32") chmodSync(KEY_FILE2, 384);
   assertSafe(KEY_FILE2, "file");
   cached2.set(KEY_FILE2, made);
   return made;
@@ -49691,6 +49763,10 @@ async function signer() {
 function readPin() {
   const PIN_FILE = pinFile();
   if (!existsSync(PIN_FILE)) return null;
+  const { ino, mtimeMs, ctimeMs } = lstatSync2(PIN_FILE);
+  const stamp = `${ino}:${mtimeMs}:${ctimeMs}`;
+  const seen2 = pins.get(PIN_FILE);
+  if (seen2?.stamp === stamp) return seen2.pin;
   assertSafe(PIN_FILE, "file");
   let parsed;
   try {
@@ -49701,7 +49777,9 @@ function readPin() {
   if (typeof parsed.principal !== "string" || !PRINCIPAL.test(parsed.principal) || typeof parsed.agent !== "string") {
     throw new Error(`${PIN_FILE} does not name an account. Remove it and call connect_account again.`);
   }
-  return { principal: parsed.principal, agent: parsed.agent, pinnedAt: typeof parsed.pinnedAt === "string" ? parsed.pinnedAt : "", ...parsed.signed === true ? { signed: true } : {} };
+  const pin = { principal: parsed.principal, agent: parsed.agent, pinnedAt: typeof parsed.pinnedAt === "string" ? parsed.pinnedAt : "", ...parsed.signed === true ? { signed: true } : {} };
+  pins.set(PIN_FILE, { stamp, pin });
+  return pin;
 }
 function writePin(pin) {
   if (!PRINCIPAL.test(pin.principal)) throw new Error("that is not an ixo account address");
@@ -49709,17 +49787,18 @@ function writePin(pin) {
   const PIN_FILE = pinFile();
   const temporary = `${PIN_FILE}.tmp`;
   writeFileSync(temporary, JSON.stringify(pin, null, 2), { mode: 384 });
-  chmodSync(temporary, 384);
+  if (process.platform !== "win32") chmodSync(temporary, 384);
   renameSync(temporary, PIN_FILE);
   assertSafe(PIN_FILE, "file");
 }
 function clearPin() {
   rmSync(pinFile(), { force: true });
 }
-var DIR, KEY_FILE, cached2, keyLocation, pinFile, PRINCIPAL, pinLocation;
+var DIR, KEY_FILE, cached2, keyLocation, pinFile, PRINCIPAL, pins, pinLocation;
 var init_keys = __esm({
   "src/keys.ts"() {
     "use strict";
+    init_keyPermissions();
     init_net();
     DIR = () => join3(process.env.OPENHANDS_HOME || join3(homedir(), ".openhands"), currentNetwork2());
     KEY_FILE = () => join3(DIR(), "key.json");
@@ -49727,6 +49806,7 @@ var init_keys = __esm({
     keyLocation = () => KEY_FILE();
     pinFile = () => join3(DIR(), "principal.json");
     PRINCIPAL = /^(ixo1[a-z0-9]{38,58}|self)$/;
+    pins = /* @__PURE__ */ new Map();
     pinLocation = () => pinFile();
   }
 });
@@ -259464,8 +259544,8 @@ function noteIgnored(agent, pinned, others, log) {
   for (const one of fresh2) told.add(`${agent}:${pinned}:${one}`);
   log(`asks-mcp: ignoring ${fresh2.length === 1 ? "a connection" : "connections"} to this key from ${fresh2.join(", ")}: it is pinned to ${pinned === SELF ? "itself" : pinned}, and only connect_account changes that.`);
 }
-async function actingFor(agent, reads2 = chainReads, pins = keyPins) {
-  const pinned = pinOf(agent, pins);
+async function actingFor(agent, reads2 = chainReads, pins2 = keyPins) {
+  const pinned = pinOf(agent, pins2);
   if (!pinned || pinned === SELF) return null;
   let found;
   try {
@@ -259475,14 +259555,14 @@ async function actingFor(agent, reads2 = chainReads, pins = keyPins) {
   }
   return found ? actingOf(found) : null;
 }
-async function actingOrWhy(agent, reads2 = chainReads, pins = keyPins, log = stderr) {
+async function actingOrWhy(agent, reads2 = chainReads, pins2 = keyPins, log = stderr) {
   let acting = null;
   try {
-    acting = await actingFor(agent, reads2, pins);
+    acting = await actingFor(agent, reads2, pins2);
   } catch (error54) {
     return { acting: null, problem: error54 instanceof Error ? error54.message : String(error54), candidates: [] };
   }
-  const pinned = pinOf(agent, pins);
+  const pinned = pinOf(agent, pins2);
   let standing;
   try {
     standing = (await reads2.connectionsTo(agent)).map((one) => one.principal);
@@ -259499,16 +259579,16 @@ function candidateWords(candidates) {
   if (!candidates.length) return null;
   return `Not acting for anyone: ${candidates.length === 1 ? "an account has" : `${candidates.length} accounts have`} connected this key (${list5(candidates)}), and none has been chosen. Anybody can grant to a public address, so ask the person which is theirs and call connect_account with principal set to it (or principal: "self" to stay as this key and stop being asked).`;
 }
-async function connectAs(agent, choice, reads2 = chainReads, pins = keyPins, now3 = /* @__PURE__ */ new Date(), log = stderr) {
-  const pinned = pinOf(agent, pins);
+async function connectAs(agent, choice, reads2 = chainReads, pins2 = keyPins, now3 = /* @__PURE__ */ new Date(), log = stderr) {
+  const pinned = pinOf(agent, pins2);
   if (choice === SELF) {
-    if (pinned !== SELF) pins.write({ principal: SELF, agent, pinnedAt: now3.toISOString() });
+    if (pinned !== SELF) pins2.write({ principal: SELF, agent, pinnedAt: now3.toISOString() });
     return { kind: "self", pinnedNow: pinned !== SELF };
   }
   if (choice) {
     const found = await reads2.connectionFor(agent, choice);
     if (!found) return { kind: "not-granted", principal: choice };
-    if (pinned !== choice) pins.write({ principal: choice, agent, pinnedAt: now3.toISOString() });
+    if (pinned !== choice) pins2.write({ principal: choice, agent, pinnedAt: now3.toISOString() });
     const others = (await reads2.connectionsTo(agent)).map((one) => one.principal).filter((one) => one !== choice);
     return { kind: "connected", acting: actingOf(found), pinnedNow: pinned !== choice, others };
   }
@@ -259522,13 +259602,13 @@ async function connectAs(agent, choice, reads2 = chainReads, pins = keyPins, now
   const standing = (await reads2.connectionsTo(agent)).map((one) => one.principal);
   return standing.length ? { kind: "choose", principals: standing } : { kind: "none" };
 }
-function markSigned(agent, principal2, pins = keyPins) {
-  const pin = pins.read();
-  if (pin && pin.agent === agent && pin.principal === principal2 && !pin.signed) pins.write({ ...pin, signed: true });
+function markSigned(agent, principal2, pins2 = keyPins) {
+  const pin = pins2.read();
+  if (pin && pin.agent === agent && pin.principal === principal2 && !pin.signed) pins2.write({ ...pin, signed: true });
 }
-function disconnect(pins = keyPins) {
-  const pin = pins.read();
-  pins.clear();
+function disconnect(pins2 = keyPins) {
+  const pin = pins2.read();
+  pins2.clear();
   return pin;
 }
 function actingWords(acting, face) {
@@ -259604,8 +259684,8 @@ var init_connect = __esm({
     SELF = "self";
     told = /* @__PURE__ */ new Set();
     stderr = (line2) => console.error(line2);
-    pinOf = (agent, pins) => {
-      const pin = pins.read();
+    pinOf = (agent, pins2) => {
+      const pin = pins2.read();
       return pin && pin.agent === agent ? pin.principal : null;
     };
     feeAllowanceSpent = (error54) => /codespace:?\s*feegrant|fee limit exceeded|fee allowance/i.test(error54 instanceof Error ? error54.message : String(error54));
@@ -291941,7 +292021,7 @@ import { randomBytes as randomBytes7 } from "node:crypto";
 // package.json
 var package_default = {
   name: "@ixo/asks-mcp",
-  version: "1.6.0-dev.3",
+  version: "1.6.0-dev.4",
   description: "The Openhands Network MCP server: read the board, answer asks, post work and get paid on the ixo chain, with a key of its own on your machine.",
   license: "Apache-2.0",
   repository: {
@@ -296091,7 +296171,7 @@ ${settings}`
         confirm: external_exports.string().optional().describe("The exact total from the preview. Omit to preview.")
       }
     },
-    async ({ name: name8, pins, pin_pay, currency, days, metres, confirm }) => {
+    async ({ name: name8, pins: pins2, pin_pay, currency, days, metres, confirm }) => {
       const acting = await principal2();
       const coin = await coinFor(currency, acting);
       if (typeof coin !== "string") return text4(`Refused: ${coin.refused}. Nothing was opened and nothing was spent.`);
@@ -296112,8 +296192,8 @@ ${settings}`
       terms.via = "mcp";
       const unread = await unreadable(terms);
       if (unread) return text4(unread);
-      const { total } = escrowTotal(pin_pay, pins, legBase, coinSymbol, coin === FEE_DENOM);
-      const preview = `${face(total, coinSymbol)} to open "${name8}". ${pins} ${pins === 1 ? "report" : "reports"} at ${face(pin_pay, coinSymbol)} each, plus ${feeWords(legBase)} to whoever checks each one. Mapping stays open ${open} days, and two pins closer than ${apart} m are the same mess`;
+      const { total } = escrowTotal(pin_pay, pins2, legBase, coinSymbol, coin === FEE_DENOM);
+      const preview = `${face(total, coinSymbol)} to open "${name8}". ${pins2} ${pins2 === 1 ? "report" : "reports"} at ${face(pin_pay, coinSymbol)} each, plus ${feeWords(legBase)} to whoever checks each one. Mapping stays open ${open} days, and two pins closer than ${apart} m are the same mess`;
       const guard = spendGuard({ bucket: "organise", task: `campaign ${tag}`, total, ...confirm ? { confirm } : {}, what: preview, symbol: coinSymbol });
       if (guard) {
         return text4(
@@ -296138,7 +296218,7 @@ Mapping pays for the report. What happens to a mapped pin afterwards is a separa
         ...await postedAs(acting),
         title: terms.task,
         amountUixo: baseFromPay2(pin_pay),
-        quota: pins,
+        quota: pins2,
         days: open,
         denom: coin,
         terms,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ixo/asks-mcp",
-  "version": "1.6.0-dev.3",
+  "version": "1.6.0-dev.4",
   "description": "The Openhands Network MCP server: read the board, answer asks, post work and get paid on the ixo chain, with a key of its own on your machine.",
   "license": "Apache-2.0",
   "repository": {