@mnemom/mnemom 0.17.23 → 0.17.24

package/dist/rc-certs.mjs

@@ -0,0 +1,186 @@
+// Certificate checks and leaf rotation for the Remote Control MITM proxy (rc-proxy.mjs).
+//
+// The proxy mints its CA and leaf by shelling out to whatever `openssl` is first on PATH. On macOS
+// that is often /usr/bin/openssl (LibreSSL), whose defaults differ from OpenSSL 3's: `x509 -req`
+// signs with SHA-1, and EC keys come out with explicit curve parameters. Node (OpenSSL 3) refuses
+// both — a SHA-1 leaf at https.createServer (ERR_SSL_CA_MD_TOO_WEAK), an explicit-parameter key at
+// the client's chain verification. rc-proxy.mjs pins `-sha256` and `ec_param_enc:named_curve`;
+// this module is the fail-closed check behind that pin, so an openssl that still mints something
+// Node cannot use stops the proxy with a message naming the binary, not a raw Node stack trace.
+//
+// Node 22's X509Certificate has no signatureAlgorithm getter, and it reports `namedCurve` even for
+// an explicit-parameter key, so the two properties are read from the certificate's DER directly.
+
+import fs from "node:fs";
+import path from "node:path";
+import tls from "node:tls";
+import crypto from "node:crypto";
+import { execFileSync } from "node:child_process";
+
+const SIG_ALGS = {
+  "2a8648ce3d0401": "ecdsa-with-SHA1",
+  "2a8648ce3d040301": "ecdsa-with-SHA224",
+  "2a8648ce3d040302": "ecdsa-with-SHA256",
+  "2a8648ce3d040303": "ecdsa-with-SHA384",
+  "2a8648ce3d040304": "ecdsa-with-SHA512",
+  "2a864886f70d010104": "md5WithRSAEncryption",
+  "2a864886f70d010105": "sha1WithRSAEncryption",
+  "2a864886f70d01010b": "sha256WithRSAEncryption",
+  "2a864886f70d01010c": "sha384WithRSAEncryption",
+  "2a864886f70d01010d": "sha512WithRSAEncryption",
+};
+const STRONG_SIG_ALGS = new Set([
+  "ecdsa-with-SHA256",
+  "ecdsa-with-SHA384",
+  "ecdsa-with-SHA512",
+  "sha256WithRSAEncryption",
+  "sha384WithRSAEncryption",
+  "sha512WithRSAEncryption",
+]);
+const OID_EC_PUBLIC_KEY = "2a8648ce3d0201";
+
+// One DER TLV at `off`: { tag, start (of the value), end }.
+function tlv(buf, off) {
+  if (off + 2 > buf.length) throw new Error("truncated DER");
+  const tag = buf[off];
+  let len = buf[off + 1];
+  let start = off + 2;
+  if (len & 0x80) {
+    const n = len & 0x7f;
+    if (n < 1 || n > 4 || start + n > buf.length) throw new Error("bad DER length");
+    len = 0;
+    for (let i = 0; i < n; i++) len = len * 256 + buf[start + i];
+    start += n;
+  }
+  const end = start + len;
+  if (end > buf.length) throw new Error("truncated DER");
+  return { tag, start, end };
+}
+
+function children(buf, node) {
+  const out = [];
+  for (let o = node.start; o < node.end; ) {
+    const c = tlv(buf, o);
+    out.push(c);
+    o = c.end;
+  }
+  return out;
+}
+
+const hex = (buf, node) => buf.subarray(node.start, node.end).toString("hex");
+
+/**
+ * The signature algorithm and EC parameter encoding of a certificate, read from its DER:
+ * { signatureAlgorithm: "ecdsa-with-SHA256" | … | "oid:<hex>", ecParams: "named" | "explicit" | null }
+ * (ecParams is null for a non-EC key).
+ */
+export function describeCert(pemOrDer) {
+  const der =
+    Buffer.isBuffer(pemOrDer) && pemOrDer[0] === 0x30
+      ? pemOrDer
+      : new crypto.X509Certificate(pemOrDer).raw;
+  const [tbs, sigAlg] = children(der, tlv(der, 0)); // Certificate ::= SEQ { tbs, sigAlg, sig }
+  const sigOid = hex(der, children(der, sigAlg)[0]);
+  const t = children(der, tbs);
+  const spki = t[t[0].tag === 0xa0 ? 6 : 5]; // [0] version?, serial, sigAlg, issuer, validity, subject, spki
+  const [algId] = children(der, spki);
+  const [keyOid, params] = children(der, algId);
+  let ecParams = null;
+  if (hex(der, keyOid) === OID_EC_PUBLIC_KEY) {
+    ecParams = params && params.tag === 0x06 ? "named" : "explicit";
+  }
+  return { signatureAlgorithm: SIG_ALGS[sigOid] || `oid:${sigOid}`, ecParams };
+}
+
+/** What makes this certificate unusable by Node's TLS stack, as phrases; empty when none. */
+export function certProblems(pem) {
+  const { signatureAlgorithm, ecParams } = describeCert(pem);
+  const problems = [];
+  if (!STRONG_SIG_ALGS.has(signatureAlgorithm)) {
+    problems.push(`signed with ${signatureAlgorithm} (Node needs SHA-256 or stronger)`);
+  }
+  if (ecParams === "explicit") {
+    problems.push("EC key with explicit curve parameters (Node needs a named curve)");
+  }
+  return problems;
+}
+
+/**
+ * "/usr/bin/openssl (LibreSSL 3.3.6)" — the `openssl` the proxy runs (the first on env.PATH, as
+ * execFileSync resolves it), for error messages. The version comes from running THAT binary.
+ */
+export function opensslIdentity(env = process.env) {
+  let found = null;
+  for (const dir of (env.PATH || "").split(path.delimiter)) {
+    if (!dir) continue; // an empty PATH segment ("a::b") is not the cwd here
+    const f = path.join(dir, "openssl");
+    try {
+      fs.accessSync(f, fs.constants.X_OK);
+      found = f;
+      break;
+    } catch {
+      /* next */
+    }
+  }
+  if (!found) return "openssl (not found on PATH)";
+  let version = "version unknown";
+  try {
+    version = execFileSync(found, ["version"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      env,
+    }).trim();
+  } catch {
+    /* keep "version unknown" */
+  }
+  return `${found} (${version})`;
+}
+
+/**
+ * Throws if `cert` (the CA, when `role` is "CA") cannot be used by Node. For a leaf, also builds
+ * the exact secure context https.createServer / setSecureContext will, so anything else Node
+ * refuses (a key/cert mismatch, a digest under the security level) fails here, with a message.
+ */
+export function assertUsableCert({ role, cert, key }, env = process.env) {
+  const problems = certProblems(cert);
+  if (!problems.length && key) {
+    try {
+      tls.createSecureContext({ key, cert });
+    } catch (e) {
+      problems.push(`Node refuses it: ${e.code || e.message}`);
+    }
+  }
+  if (problems.length) {
+    throw new Error(
+      `${opensslIdentity(env)} minted a ${role} certificate Node cannot use: ${problems.join("; ")}. ` +
+        "Put OpenSSL 3 first on PATH (macOS: `brew install openssl@3`) and relaunch.",
+    );
+  }
+}
+
+/**
+ * The leaf in force, and how to replace it. rotate() mints a new leaf and installs it; only when
+ * BOTH succeed does the new leaf become current. Before this, `leaf = mint()` ran ahead of the
+ * install, so an install that threw left the server serving the old leaf while `notAfter` already
+ * held the new leaf's expiry — the CONNECT handler's "expiring" check then never retried, and the
+ * session broke with an expired certificate once the original leaf ran out.
+ */
+export function makeLeafRotator({ initial, mint, install, log, errText = (e) => e.message }) {
+  let leaf = initial;
+  return {
+    current: () => leaf,
+    rotate(why) {
+      let next;
+      try {
+        next = mint();
+        install(next);
+      } catch (e) {
+        log(`leaf rotation FAILED (${why}), keeping the current leaf: ${errText(e)}`);
+        return false;
+      }
+      leaf = next;
+      log(`leaf rotated (${why}) notAfter=${new Date(leaf.notAfter).toISOString()}`);
+      return true;
+    },
+  };
+}

package/dist/rc-proxy.mjs

@@ -92,6 +92,7 @@ import crypto from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { TURN_HEADER, TurnOrigins, turnHeaderEnabled, turnHeaderFor } from "./turn-origin.mjs";
 import { OWNER_FILE, ensureRcStateRoot, keepPrivateDir, sweepRcDirs } from "./rc-state.mjs";
+import { assertUsableCert, makeLeafRotator } from "./rc-certs.mjs";
 
 const MITM_HOST = "api.anthropic.com";
 const env = process.env;
@@ -180,7 +181,19 @@ if (SUBSCRIPTION) {
 // session picks it up on its next TLS handshake. (A 2-day CA + leaf with the CA key deleted at
 // startup broke every session older than 48 h with "SSL certificate has expired".) openssl only
 // takes the CA key from a file, so each signing writes it 0600 into caDir and deletes it right
-// after. Works with macOS's system LibreSSL (3.3+) and OpenSSL 1.1.1+ (`-addext`).
+// after. The openssl flags used (`-addext`, `-pkeyopt`, `-sha256`) exist in OpenSSL 1.1.1+ and 3
+// and in LibreSSL 3.3+ (macOS's /usr/bin/openssl).
+//
+// Until the digest and curve encoding were pinned, this only ever worked with OpenSSL 3 first on
+// PATH: no call passed a digest, and LibreSSL's defaults differ from OpenSSL 3's in two ways that
+// each break Node (OpenSSL 3), whatever the Node version. (1) `x509 -req` signs with
+// ecdsa-with-SHA1, and https.createServer refuses that leaf with ERR_SSL_CA_MD_TOO_WEAK — the proxy
+// died before READY and --remote-control refused to launch. (2) EC keys are written with explicit
+// curve parameters, and a client verifying the chain rejects them ("Certificate public key has
+// explicit ECC parameters"). So every call passes `-sha256` and `ec_param_enc:named_curve`, and
+// every minted CA and leaf is checked before use (assertUsableCert, rc-certs.mjs): an openssl that
+// still produces something Node cannot use stops the proxy with a message naming the binary and
+// its version — or, for a rotation, fails that rotation and keeps the current leaf.
 //
 // Nothing may take the CA files mid-session. In the OS temp dir, macOS's dirhelper deleted
 // ca.pem / leaf.ext from sessions older than ~3-4 days (files not accessed for 3 days; openssl
@@ -240,6 +253,8 @@ try {
     "ec",
     "-pkeyopt",
     "ec_paramgen_curve:prime256v1",
+    "-pkeyopt",
+    "ec_param_enc:named_curve",
     "-nodes",
     "-keyout",
     p("ca.key"),
@@ -253,6 +268,7 @@ try {
     "basicConstraints=critical,CA:TRUE",
     "-addext",
     "keyUsage=critical,keyCertSign,cRLSign",
+    "-sha256",
   );
   caKey = fs.readFileSync(p("ca.key"));
   fs.rmSync(p("ca.key"));
@@ -262,6 +278,11 @@ try {
   fs.rmSync(p("ca.key"), { force: true });
   die(`could not mint the ephemeral CA with openssl: ${osslErr(e)}`);
 }
+try {
+  assertUsableCert({ role: "CA", cert: caPem });
+} catch (e) {
+  die(`${e.message} Refusing to start.`);
+}
 
 // Recreate caDir and its long-lived files from memory if something deleted them, and refresh
 // every atime/mtime so the cleaner does not try again (see the block comment above).
@@ -299,6 +320,8 @@ function mintLeaf() {
     "ec",
     "-pkeyopt",
     "ec_paramgen_curve:prime256v1",
+    "-pkeyopt",
+    "ec_param_enc:named_curve",
     "-nodes",
     "-keyout",
     p("leaf.key"),
@@ -306,6 +329,7 @@ function mintLeaf() {
     p("leaf.csr"),
     "-subj",
     `/CN=${MITM_HOST}`,
+    "-sha256",
   );
   try {
     fs.writeFileSync(p("ca.key"), caKey, { mode: 0o600, flag: "wx" });
@@ -325,23 +349,27 @@ function mintLeaf() {
       String(LEAF_DAYS),
       "-extfile",
       p("leaf.ext"),
+      "-sha256",
     );
   } finally {
     fs.rmSync(p("ca.key"), { force: true });
   }
   const cert = fs.readFileSync(p("leaf.pem"));
-  return {
-    key: fs.readFileSync(p("leaf.key")),
-    cert,
-    notAfter: Date.parse(new crypto.X509Certificate(cert).validTo),
-  };
+  const key = fs.readFileSync(p("leaf.key"));
+  assertUsableCert({ role: "leaf", cert, key }); // fail closed: never serve a leaf Node refuses
+  return { key, cert, notAfter: Date.parse(new crypto.X509Certificate(cert).validTo) };
 }
 
-let leaf;
+let firstLeaf;
 try {
-  leaf = mintLeaf();
+  firstLeaf = mintLeaf();
 } catch (e) {
-  die(`could not mint the ephemeral CA with openssl: ${osslErr(e)}`);
+  // An openssl failure carries its stderr; an unusable certificate carries assertUsableCert's message.
+  const why =
+    e.stderr && e.stderr.length
+      ? `could not mint the ephemeral CA with openssl: ${osslErr(e)}`
+      : null;
+  die(why || `${e.message} Refusing to start.`);
 }
 
 // --- request handling ---------------------------------------------------------------------
@@ -613,22 +641,22 @@ function handle(req, res, viaPlain) {
   }
 }
 
-const tlsServer = https.createServer({ key: leaf.key, cert: leaf.cert }, (req, res) =>
+const tlsServer = https.createServer({ key: firstLeaf.key, cert: firstLeaf.cert }, (req, res) =>
   handle(req, res, false),
 );
 tlsServer.on("tlsClientError", (e) => log(`tls client error: ${e.code || e.message}`));
 
 // Re-mint the leaf and hot-swap it; established TLS connections keep the old one, every new
-// handshake gets the new one. A failed re-mint keeps serving the current leaf.
-function rotateLeaf(why) {
-  try {
-    leaf = mintLeaf();
-    tlsServer.setSecureContext({ key: leaf.key, cert: leaf.cert });
-    log(`leaf rotated (${why}) notAfter=${new Date(leaf.notAfter).toISOString()}`);
-  } catch (e) {
-    log(`leaf rotation FAILED (${why}), keeping the current leaf: ${osslErr(e)}`);
-  }
-}
+// handshake gets the new one. A failed re-mint OR a failed swap keeps serving the current leaf —
+// and keeps its notAfter, so the CONNECT handler's "expiring" check retries (rc-certs.mjs).
+const leaves = makeLeafRotator({
+  initial: firstLeaf,
+  mint: mintLeaf,
+  install: (next) => tlsServer.setSecureContext({ key: next.key, cert: next.cert }),
+  log,
+  errText: osslErr,
+});
+const rotateLeaf = (why) => leaves.rotate(why);
 rotateTimer = setInterval(() => rotateLeaf("interval"), LEAF_ROTATE_MS);
 rotateTimer.unref();
 keepAliveTimer = setInterval(() => keepAlive("interval"), CA_KEEPALIVE_MS);
@@ -641,7 +669,7 @@ proxy.on("connect", (req, sock, head) => {
   sock.on("error", () => {});
   if (host === MITM_HOST && port === 443) {
     // A timer can run late (laptop sleep): never hand out a leaf that is about to expire.
-    if (leaf.notAfter - Date.now() < LEAF_MIN_LEFT_MS) rotateLeaf("expiring");
+    if (leaves.current().notAfter - Date.now() < LEAF_MIN_LEFT_MS) rotateLeaf("expiring");
     sock.write("HTTP/1.1 200 Connection Established\r\n\r\n");
     if (head && head.length) sock.unshift(head);
     tlsServer.emit("connection", sock);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.23",
+  "version": "0.17.24",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {