@jabezpauls/agentbox 0.1.12 → 0.1.14

package/dist/agentbox.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// agentbox-cli v0.1.12
+// agentbox-cli v0.1.14
 import { createRequire as __agentboxCreateRequire } from "node:module";
 const require = __agentboxCreateRequire(import.meta.url);
 var __create = Object.create;
@@ -3868,7 +3868,7 @@ function parseSize(raw2) {
 }
 
 // src/version.ts
-var VERSION = true ? "v0.1.12" : "0.0.0-dev";
+var VERSION = true ? "v0.1.14" : "0.0.0-dev";
 var STANDALONE = typeof __AGENTBOX_STANDALONE__ === "boolean" && __AGENTBOX_STANDALONE__;
 var MIN_NODE_MAJOR = 20;
 function nodeMajor(version = process.versions.node) {
@@ -6871,7 +6871,7 @@ function writePrivate2(file, contents, mode = 384) {
 }
 
 // src/node/control.ts
-var COMMANDS = /* @__PURE__ */ new Set(["status", "pause", "resume", "leave", "preview", "preview-list", "preview-stop"]);
+var COMMANDS = /* @__PURE__ */ new Set(["status", "pause", "resume", "leave", "preview", "preview-list", "preview-stop", "passphrase"]);
 var PIPE_NAME = /^\\\\\.\\pipe\\agentbox-node-[0-9a-f]{32}$/;
 function address(socketPath, platform) {
   if (platform !== "win32") return socketPath;
@@ -7033,6 +7033,7 @@ function decodeControl(payload) {
 import { createHash as createHash3, createHmac, timingSafeEqual as timingSafeEqual2 } from "node:crypto";
 var PROTOCOL_VERSION = 1;
 var LINK_PATH = "/_gate/node";
+var MAX_STREAMS_PER_LINK = 256;
 var DUPLICATE_BACKOFF_MS = 5 * 6e4;
 var NODE_TOKEN_SHAPE = /^abn_[A-Za-z0-9_-]{43}$/;
 function tokenDigest(token) {
@@ -7997,6 +7998,7 @@ var Roots = class {
   isHidden;
   isWriteDenied;
   refusePath;
+  holdsHidden;
   constructor(opts) {
     this.roots = opts.roots.map((r) => ({ id: r.id, path: path13.resolve(r.path), mode: r.mode, stateDir: path13.resolve(r.stateDir) }));
     const first = this.roots[0];
@@ -8008,6 +8010,7 @@ var Roots = class {
     this.isHidden = opts.isHidden;
     this.isWriteDenied = opts.isWriteDenied;
     this.refusePath = opts.refusePath;
+    this.holdsHidden = opts.holdsHidden;
   }
   byId(id) {
     const root = this.roots.find((r) => r.id === id);
@@ -8133,6 +8136,10 @@ var Roots = class {
       }
     }
   }
+  /** Refuse to copy an entry that holds a hidden path: the copy would show it. */
+  assertCopyable(ref) {
+    if (this.holdsHidden?.(ref.fs)) throw new FilesError(403, `permission denied: ${ref.abs}`, "denied");
+  }
   /** Resolve through every symlink; the destination must stay in the root. */
   async target(input) {
     const loc = this.locate(input);
@@ -8808,6 +8815,7 @@ var FileOps = class {
   async copy(body) {
     const src = await this.roots.entry(body.from);
     await this.roots.assertMovable(src);
+    this.roots.assertCopyable(src);
     const dest = await this.roots.creatable(body.to);
     this.roots.assertMutable(dest);
     if (dest.abs === src.abs) throw new FilesError(409, "a copy needs a different name", "exists");
@@ -8872,6 +8880,7 @@ var Trash = class {
         }
         throw err;
       }
+      this.roots.assertMutable(ref);
       result.trashed.push(await this.put(ref.root, ref.abs, ref.fs));
     }
     return result;
@@ -9293,6 +9302,7 @@ var FilesService = class {
       ...opts.caseInsensitive === void 0 ? {} : { caseInsensitive: opts.caseInsensitive },
       ...opts.isHidden === void 0 ? {} : { isHidden: opts.isHidden },
       ...opts.isWriteDenied === void 0 ? {} : { isWriteDenied: opts.isWriteDenied },
+      ...opts.holdsHidden === void 0 ? {} : { holdsHidden: opts.holdsHidden },
       ...opts.refusePath === void 0 ? {} : { refusePath: opts.refusePath }
     });
     this.git = new GitStatusCache(opts.gitTtlMs === void 0 ? {} : { ttlMs: opts.gitTtlMs });
@@ -9887,6 +9897,7 @@ function refuseWindowsPath(input) {
   for (const part of rest.split("\\")) {
     if (part === "" || part === "." || part === "..") continue;
     if (/[. ]$/.test(part)) return "a name ending in a dot or a space is refused";
+    if (/~\d/.test(part)) return "short (8.3) names, with a ~ and a digit, are refused";
     if (/^(con|prn|aux|nul|com[0-9¹²³]|lpt[0-9¹²³]|conin\$|conout\$)(\..*)?$/i.test(part)) return "DOS device names are refused";
   }
   return null;
@@ -9922,11 +9933,25 @@ function pathRules(o) {
   };
   const gitRuns = (p) => {
     const parts = fold(p).split(P.sep);
-    for (let i = 0; i + 1 < parts.length; i++) {
-      if (parts[i] === ".git" && (parts[i + 1] === "hooks" || parts[i + 1] === "config")) return true;
+    for (let i = 0; i < parts.length; i++) {
+      if (parts[i] === ".git") return true;
+      if (parts[i]?.endsWith(".git") && (parts[i + 1] === "hooks" || parts[i + 1] === "config")) return true;
     }
     return false;
   };
+  const homeF = fold(o.home);
+  const homeBase = homeF.endsWith(P.sep) ? homeF : homeF + P.sep;
+  const inHomeDot = (p) => {
+    const f = fold(p);
+    if (!f.startsWith(homeBase)) return false;
+    const first = f.slice(homeBase.length).split(P.sep)[0] ?? "";
+    return first.startsWith(".") || platform === "win32" && first === "appdata";
+  };
+  const holds = (p, list) => {
+    const f = fold(p);
+    const base = f.endsWith(P.sep) ? f : f + P.sep;
+    return list.some((e) => e.startsWith(base));
+  };
   const remote = (p) => platform === "win32" && (p.startsWith("\\\\") || p.startsWith("//"));
   return {
     platform,
@@ -9934,7 +9959,8 @@ function pathRules(o) {
     hidden,
     writeDenied,
     isHidden: (p) => remote(p) || under(p, hiddenF),
-    isWriteDenied: (p) => remote(p) || under(p, deniedF) || gitRuns(p),
+    isWriteDenied: (p) => remote(p) || under(p, deniedF) || gitRuns(p) || inHomeDot(p) || holds(p, deniedF) || holds(p, hiddenF),
+    holdsHidden: (p) => holds(p, hiddenF),
     refusePath: (input) => platform === "win32" ? refuseWindowsPath(input) : null
   };
 }
@@ -9956,7 +9982,7 @@ function windowsDocuments(env = process.env) {
   const out = [];
   for (const key of ["User Shell Folders", "Shell Folders"]) {
     try {
-      const text = execFileSync("reg.exe", ["query", `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\${key}`, "/v", "Personal"], {
+      const text = execFileSync(path22.win32.join(env.SystemRoot && path22.win32.isAbsolute(env.SystemRoot) ? env.SystemRoot : "C:\\Windows", "System32", "reg.exe"), ["query", `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\${key}`, "/v", "Personal"], {
         encoding: "utf8",
         timeout: 1e4,
         windowsHide: true,
@@ -9988,6 +10014,7 @@ function filesFor(policy, paths2, rules) {
     caseInsensitive: rules.caseInsensitive,
     isHidden: rules.isHidden,
     isWriteDenied: rules.isWriteDenied,
+    holdsHidden: rules.holdsHidden,
     refusePath: rules.refusePath,
     ...rules.platform === "win32" ? { apiPaths: { toHost: (p) => toHostPath(p, "win32"), toApi: (p) => toApiPath(p, "win32") } } : {}
   });
@@ -10218,6 +10245,8 @@ var NodeLink = class extends EventEmitter {
   stateNow = "stopped";
   running = false;
   paused = false;
+  /** It said `leave`: only then is a close saying "left" taken for one (a gate saying so unasked is a dropped link). */
+  leaving = false;
   failures = 0;
   failingSince = null;
   retryTimer = null;
@@ -10315,6 +10344,7 @@ var NodeLink = class extends EventEmitter {
         clearTimeout(timer);
         resolve(code2 === 4005);
       });
+      this.leaving = true;
       ws.send(encodeControl({ type: "leave" }));
     });
   }
@@ -10362,7 +10392,7 @@ var NodeLink = class extends EventEmitter {
     if (!this.running || this.paused || this.ws) return;
     this.set("connecting");
     const url = `${this.o.box.replace(/^http/, "ws")}${LINK_PATH}`;
-    const ws = new import_websocket.default(url, { headers: { authorization: `Bearer ${this.o.token}` }, perMessageDeflate: false, handshakeTimeout: 2e4, followRedirects: false });
+    const ws = new import_websocket.default(url, { headers: { authorization: `Bearer ${this.o.token}` }, perMessageDeflate: false, handshakeTimeout: 2e4, followRedirects: false, maxPayload: STREAM_WINDOW + 16 });
     this.ws = ws;
     let welcomed = false;
     let stopKeepAlive = () => {
@@ -10445,7 +10475,7 @@ var NodeLink = class extends EventEmitter {
         return;
       }
       if (frame.type === FrameType.open) {
-        if (!welcomed || this.listenerCount("stream") === 0 || streams.has(frame.stream)) {
+        if (!welcomed || this.listenerCount("stream") === 0 || streams.has(frame.stream) || streams.size >= MAX_STREAMS_PER_LINK) {
           ws.send(encodeFrame(FrameType.close, frame.stream));
           return;
         }
@@ -10460,7 +10490,7 @@ var NodeLink = class extends EventEmitter {
       if (this.ws !== ws) return;
       this.ws = null;
       if (!this.running || this.stateNow === "revoked") return;
-      if (code2 === 4005) {
+      if (code2 === 4005 && this.leaving) {
         this.stop("left");
         return;
       }
@@ -10511,16 +10541,29 @@ function presenceAnswer(key, challenge, sessionId, machineId) {
 var PresenceGate = class {
   constructor(o) {
     this.o = o;
+    this.presence = o.presence;
     this.key = Buffer.from(o.presence.key, "base64url");
     this.now = o.now ?? Date.now;
   }
   o;
   key;
+  presence;
   challenges = /* @__PURE__ */ new Map();
   grants = /* @__PURE__ */ new Map();
   failures = [];
   lockedUntil = 0;
   now;
+  /**
+   * A new passphrase (`agentbox node passphrase`), taken at once: every
+   * challenge and every grant the old one earned ends, so channels opened on
+   * them close at the next check.
+   */
+  rekey(presence) {
+    this.presence = presence;
+    this.key = Buffer.from(presence.key, "base64url");
+    this.challenges.clear();
+    this.grants.clear();
+  }
   /** Locked until this time, or `null`. */
   locked() {
     return this.lockedUntil > this.now() ? this.lockedUntil : null;
@@ -10535,7 +10578,7 @@ var PresenceGate = class {
     const challenge = randomBytes10(32).toString("base64url");
     const expiresAt = t2 + CHALLENGE_MS;
     this.challenges.set(challenge, { session, expiresAt });
-    return { challenge, salt: this.o.presence.salt, iterations: this.o.presence.iterations, expiresAt };
+    return { challenge, salt: this.presence.salt, iterations: this.presence.iterations, expiresAt };
   }
   answer(session, challenge, answer) {
     if (session === null) return { ok: false, error: "no_session" };
@@ -11703,9 +11746,19 @@ function unitDir(env = process.env, home2 = os9.homedir()) {
   const xdg = env.XDG_CONFIG_HOME;
   return path26.join(xdg && path26.isAbsolute(xdg) ? xdg : path26.join(home2, ".config"), "systemd", "user");
 }
-function execStart(execPath = process.execPath, script = process.argv[1]) {
-  const isSea = script === void 0 || path26.resolve(script) === path26.resolve(execPath);
-  return isSea ? [execPath, "node", "run"] : [execPath, path26.resolve(script), "node", "run"];
+function runningAsSea() {
+  try {
+    const sea = process.getBuiltinModule?.("node:sea");
+    return typeof sea?.isSea === "function" && sea.isSea();
+  } catch {
+    return false;
+  }
+}
+function isStandalone(execPath, script, sea = runningAsSea()) {
+  return sea || script === void 0 || path26.resolve(script) === path26.resolve(execPath);
+}
+function execStart(execPath = process.execPath, script = process.argv[1], sea = runningAsSea()) {
+  return isStandalone(execPath, script, sea) ? [execPath, "node", "run"] : [execPath, path26.resolve(script), "node", "run"];
 }
 function quote(arg) {
   return `"${arg.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/%/g, "%%")}"`;
@@ -11775,11 +11828,12 @@ var CONSOLE_EXE = "agentbox.exe";
 var LOG_MAX_BYTES = 10 * 1024 * 1024;
 var LOG_FILES = 3;
 var RESTART_EXIT = 75;
-function standalone(execPath, script) {
-  return script === void 0 || path27.resolve(script) === path27.resolve(execPath);
+function regExe(env = process.env) {
+  const root = env.SystemRoot && path27.win32.isAbsolute(env.SystemRoot) ? env.SystemRoot : "C:\\Windows";
+  return path27.win32.join(root, "System32", "reg.exe");
 }
-function guiExecutable(execPath = process.execPath, script = process.argv[1]) {
-  if (!standalone(execPath, script)) {
+function guiExecutable(execPath = process.execPath, script = process.argv[1], sea = runningAsSea()) {
+  if (!isStandalone(execPath, script, sea)) {
     return {
       problem: "the Windows sign-in entry needs the standalone agentbox.exe and agentbox-node.exe (this is agentbox.mjs under Node, which would open a console window at every sign-in); run `agentbox node run` yourself, or install the standalone executables"
     };
@@ -11791,8 +11845,8 @@ function guiExecutable(execPath = process.execPath, script = process.argv[1]) {
 function runEntry(gui) {
   return `"${gui}" node supervise`;
 }
-function runCommandLine(execPath = process.execPath, script = process.argv[1]) {
-  if (!standalone(execPath, script)) return [execPath, path27.resolve(script), "node", "run"];
+function runCommandLine(execPath = process.execPath, script = process.argv[1], sea = runningAsSea()) {
+  if (!isStandalone(execPath, script, sea)) return [execPath, path27.resolve(script), "node", "run"];
   const dir = path27.dirname(execPath);
   const exe = path27.basename(execPath).toLowerCase() === GUI_EXE ? path27.join(dir, CONSOLE_EXE) : execPath;
   return [exe, "node", "run"];
@@ -11800,7 +11854,7 @@ function runCommandLine(execPath = process.execPath, script = process.argv[1]) {
 async function installService2(opts) {
   const run4 = opts.run ?? runCommand;
   const entry = runEntry(opts.gui);
-  const r = await run4("reg.exe", ["add", RUN_KEY, "/v", RUN_VALUE, "/t", "REG_SZ", "/d", entry, "/f"]);
+  const r = await run4(regExe(), ["add", RUN_KEY, "/v", RUN_VALUE, "/t", "REG_SZ", "/d", entry, "/f"]);
   if (r.code !== 0) throw new Error(`reg add ${RUN_KEY} failed: ${(r.stderr || r.stdout).trim() || `exit ${r.code}`}`);
   if (opts.start !== false) {
     const child = spawn9(opts.gui, ["node", "supervise"], { detached: true, stdio: "ignore", windowsHide: true });
@@ -11811,14 +11865,14 @@ async function installService2(opts) {
   return { entry };
 }
 async function readRunEntry(run4 = runCommand) {
-  const r = await run4("reg.exe", ["query", RUN_KEY, "/v", RUN_VALUE]);
+  const r = await run4(regExe(), ["query", RUN_KEY, "/v", RUN_VALUE]);
   if (r.code !== 0) return null;
   return new RegExp(`${RUN_VALUE}\\s+REG_SZ\\s+(.*)`).exec(r.stdout)?.[1]?.trim() ?? null;
 }
 async function removeService2(opts) {
   const run4 = opts.run ?? runCommand;
   const had = await readRunEntry(run4) !== null;
-  if (had) await run4("reg.exe", ["delete", RUN_KEY, "/v", RUN_VALUE, "/f"]);
+  if (had) await run4(regExe(), ["delete", RUN_KEY, "/v", RUN_VALUE, "/f"]);
   const pid = supervisorPid(opts.paths);
   if (pid !== null && pid !== process.pid) {
     try {
@@ -12509,6 +12563,7 @@ async function runNode(o) {
   if (await callControl(o.paths.control, o.paths.controlSecret, "status", 2e3) !== null) {
     throw new CliError("a node is already running on this machine (see `agentbox node status`)");
   }
+  process.chdir(o.paths.dir);
   let policy = loadPolicy(o.paths.policy, o.home);
   const claude = claudePaths(o.paths);
   prepareClaude(claude, { home: o.home, machine: creds.name });
@@ -12682,6 +12737,14 @@ async function runNode(o) {
         setPaused(o.paths.policy, false);
         link.resume();
         return { state: link.state };
+      case "passphrase": {
+        const fresh = readCredentials(o.paths.credentials);
+        if (!fresh) throw new Error("credentials.json cannot be read");
+        presence.rekey(fresh.presence);
+        const closed = server.enforce();
+        o.log(`presence: the machines passphrase changed on this machine; every grant ended${closed ? ` (${closed} channel(s) closed)` : ""}`);
+        return {};
+      }
       case "leave": {
         const told = await link.leave();
         setImmediate(() => finish(EXIT.OK));
@@ -12691,7 +12754,7 @@ async function runNode(o) {
   });
   link.on("revoked", () => {
     fs22.rmSync(o.paths.secrets, { recursive: true, force: true });
-    writeCredentials(o.paths.credentials, { ...creds, revokedAt: now() });
+    writeCredentials(o.paths.credentials, { ...readCredentials(o.paths.credentials) ?? creds, revokedAt: now() });
     o.log(`${creds.box} revoked this machine. Its shared secrets are wiped; everything else is kept. Re-join it to use it again.`);
     finish(EXIT.OK);
   });
@@ -12704,15 +12767,15 @@ async function runNode(o) {
     if (checking || o.checkUpdates === false) return;
     checking = true;
     try {
-      const standalone2 = execStart().length === 3;
+      const standalone = execStart().length === 3;
       const gui = path30.join(path30.dirname(process.execPath), GUI_EXE);
       const report = await checkForUpdate({
         policy: policy.policy.updates,
         running: o.version,
         // Only the standalone executable replaces itself; agentbox.mjs under Node does not.
-        nodePath: standalone2 ? process.execPath : null,
+        nodePath: standalone ? process.execPath : null,
         // Windows: the windowless copy beside it, which the sign-in entry starts.
-        ...win && standalone2 && fs22.existsSync(gui) ? { nodeGuiPath: gui } : {},
+        ...win && standalone && fs22.existsSync(gui) ? { nodeGuiPath: gui } : {},
         ...fs22.existsSync(herdrBin) ? { herdr: { path: herdrBin, version: HERDR_VERSION } } : {},
         ...installedClaude(claude) ? { claude: { path: claude.bin, version: installedClaude(claude), versionFile: claude.versionFile } } : {},
         // Agents live in herdr: herdr and Claude Code are replaced only while none runs.
@@ -13059,6 +13122,8 @@ var passphrase = command({
     } finally {
       prompt.close();
     }
+    const live = await callControl(np.control, np.controlSecret, "passphrase", 5e3);
+    if (live !== null && live.ok !== true) throw new CliError(`the running node did not take it (${String(live.error ?? "refused")}); restart it`);
     ctx.err("This machine now proves presence with the new passphrase.\n");
   }
 });
@@ -14334,12 +14399,12 @@ function nodeCredentials(env, platform = process.platform) {
   }
   return candidates.find((f) => fs26.existsSync(f)) ?? null;
 }
-function signedUpdatesOnly(env, platform = process.platform, standalone2 = STANDALONE) {
+function signedUpdatesOnly(env, platform = process.platform, standalone = STANDALONE) {
   const creds = nodeCredentials(env, platform);
   if (creds) {
     return `this machine is joined to a box as a node (${creds}), so agentbox here updates only from signed releases, never from a box: the node checks for them itself (\`updates\` in its policy.json), or see https://github.com/jabezpauls/agentbox/releases`;
   }
-  if (standalone2) {
+  if (standalone) {
     return "this is the standalone agentbox, which updates only from signed releases, never from a box; download the latest from https://github.com/jabezpauls/agentbox/releases";
   }
   return null;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@jabezpauls/agentbox",
   "type": "module",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "description": "agentbox from your own machine: sign in, attach, move files, mount the workspace.",
   "license": "MIT",
   "homepage": "https://github.com/jabezpauls/agentbox/blob/main/docs/cli.md",