@mnemom/mnemom 0.17.23 → 0.17.25

package/dist/commands/agent-slack.d.ts

@@ -6,7 +6,8 @@
  *   mnemom agent slack login                 # store the bot + app-level tokens (0600)
  *   mnemom agent slack logout                # remove them
  *   mnemom agent slack status                # tokens, bot identity, router, live sessions
- *   mnemom agent slack post [--channel C] [--thread TS] [--icon-emoji E] <text…|->
+ *   mnemom agent slack post [--channel C] [--thread TS] [--icon-emoji E] [--] <text…|->
+ *                                            # --help prints usage; unknown flags are refused
  *   mnemom agent slack delete [--channel C] <ts>   # delete a message THIS session posted
  *   mnemom agent slack inbox [--peek]        # unread messages addressed to THIS session
  *   mnemom agent slack listen                # this session's channel server (spawned by --slack)
@@ -21,7 +22,15 @@ interface PostArgs {
     channel?: string;
     thread?: string;
     iconEmoji?: string;
+    /** `--help` / `-h` was given: print POST_USAGE and post nothing. */
+    help?: true;
     text: string;
 }
+export declare const POST_USAGE = "Usage: mnemom agent slack post [options] [--] <text\u2026|->\n\nPost a message to Slack as this session.\n\nOptions:\n  -c, --channel <C>     channel name or id (default: slack_channel from `mnemom agent config`)\n  -t, --thread <TS>     reply in the thread whose parent message has this ts\n      --icon-emoji <E>  emoji to show as the poster's icon\n  -h, --help            show this help and exit; nothing is posted\n\nText:\n  The remaining words, joined by spaces. `-` (or no words with a piped stdin) reads stdin.\n  Any other word starting with \"-\" before `--` is refused as an unknown flag. A message\n  that starts with \"-\" must come after `--`, e.g.  mnemom agent slack post -c C1 -- \"-1 on this\"";
+/**
+ * Parse `post` arguments. Before a `--` separator, `--help`/`-h` asks for usage and any
+ * other dash-word that is not a known flag is refused, so a typo or a guessed flag can
+ * never be posted as message text. Everything after `--` is text, verbatim.
+ */
 export declare function parsePostArgs(argv: string[]): PostArgs;
 export {};

package/dist/commands/agent-slack.js

@@ -6,7 +6,8 @@
  *   mnemom agent slack login                 # store the bot + app-level tokens (0600)
  *   mnemom agent slack logout                # remove them
  *   mnemom agent slack status                # tokens, bot identity, router, live sessions
- *   mnemom agent slack post [--channel C] [--thread TS] [--icon-emoji E] <text…|->
+ *   mnemom agent slack post [--channel C] [--thread TS] [--icon-emoji E] [--] <text…|->
+ *                                            # --help prints usage; unknown flags are refused
  *   mnemom agent slack delete [--channel C] <ts>   # delete a message THIS session posted
  *   mnemom agent slack inbox [--peek]        # unread messages addressed to THIS session
  *   mnemom agent slack listen                # this session's channel server (spawned by --slack)
@@ -121,15 +122,39 @@ async function status() {
     const allow = loadLauncherConfig().slackAllow ?? [];
     out(`allowed senders: ${allow.length ? allow.join(", ") : "none — no message will reach a session"}`);
 }
+export const POST_USAGE = `Usage: mnemom agent slack post [options] [--] <text…|->
+
+Post a message to Slack as this session.
+
+Options:
+  -c, --channel <C>     channel name or id (default: slack_channel from \`mnemom agent config\`)
+  -t, --thread <TS>     reply in the thread whose parent message has this ts
+      --icon-emoji <E>  emoji to show as the poster's icon
+  -h, --help            show this help and exit; nothing is posted
+
+Text:
+  The remaining words, joined by spaces. \`-\` (or no words with a piped stdin) reads stdin.
+  Any other word starting with "-" before \`--\` is refused as an unknown flag. A message
+  that starts with "-" must come after \`--\`, e.g.  mnemom agent slack post -c C1 -- "-1 on this"`;
+const POST_SHORT_FLAGS = new Set(["-c", "-t", "-h"]);
+/**
+ * Parse `post` arguments. Before a `--` separator, `--help`/`-h` asks for usage and any
+ * other dash-word that is not a known flag is refused, so a typo or a guessed flag can
+ * never be posted as message text. Everything after `--` is text, verbatim.
+ */
 export function parsePostArgs(argv) {
     const res = { text: "" };
     const words = [];
+    let unknown;
     for (let i = 0; i < argv.length; i++) {
         const a = argv[i];
         const val = () => {
             const v = argv[++i];
-            if (v === undefined)
+            // A flag is never a value: `--channel --help` must not eat the --help. (A short
+            // dash-word that is not a flag stays a value: `--icon-emoji -1` is Slack's thumbsdown.)
+            if (v === undefined || v.startsWith("--") || POST_SHORT_FLAGS.has(v)) {
                 throw new Error(`mnemom agent slack post: ${a} needs a value.`);
+            }
             return v;
         };
         if (a === "--channel" || a === "-c")
@@ -138,18 +163,32 @@ export function parsePostArgs(argv) {
             res.thread = val();
         else if (a === "--icon-emoji")
             res.iconEmoji = val();
+        else if (a === "--help" || a === "-h")
+            res.help = true;
         else if (a === "--") {
             words.push(...argv.slice(i + 1));
             break;
         }
+        else if (a.startsWith("-") && a !== "-")
+            unknown ??= a;
         else
             words.push(a);
     }
+    // Help wins over an unknown flag: someone asking for usage should get it.
+    if (res.help)
+        return { help: true, text: "" };
+    if (unknown !== undefined) {
+        throw new Error(`mnemom agent slack post: unknown flag ${unknown}; put message text after --. See \`mnemom agent slack post --help\`.`);
+    }
     res.text = words.join(" ");
     return res;
 }
 async function post(argv) {
     const args = parsePostArgs(argv);
+    if (args.help) {
+        process.stdout.write(POST_USAGE + "\n");
+        return;
+    }
     let text = args.text;
     if (text === "-" || (!text && !process.stdin.isTTY))
         text = readFileSync(0, "utf8");

package/dist/rc-certs.mjs

@@ -0,0 +1,186 @@
+// Certificate checks and leaf rotation for the Remote Control MITM proxy (rc-proxy.mjs).
+//
+// The proxy mints its CA and leaf by shelling out to whatever `openssl` is first on PATH. On macOS
+// that is often /usr/bin/openssl (LibreSSL), whose defaults differ from OpenSSL 3's: `x509 -req`
+// signs with SHA-1, and EC keys come out with explicit curve parameters. Node (OpenSSL 3) refuses
+// both — a SHA-1 leaf at https.createServer (ERR_SSL_CA_MD_TOO_WEAK), an explicit-parameter key at
+// the client's chain verification. rc-proxy.mjs pins `-sha256` and `ec_param_enc:named_curve`;
+// this module is the fail-closed check behind that pin, so an openssl that still mints something
+// Node cannot use stops the proxy with a message naming the binary, not a raw Node stack trace.
+//
+// Node 22's X509Certificate has no signatureAlgorithm getter, and it reports `namedCurve` even for
+// an explicit-parameter key, so the two properties are read from the certificate's DER directly.
+
+import fs from "node:fs";
+import path from "node:path";
+import tls from "node:tls";
+import crypto from "node:crypto";
+import { execFileSync } from "node:child_process";
+
+const SIG_ALGS = {
+  "2a8648ce3d0401": "ecdsa-with-SHA1",
+  "2a8648ce3d040301": "ecdsa-with-SHA224",
+  "2a8648ce3d040302": "ecdsa-with-SHA256",
+  "2a8648ce3d040303": "ecdsa-with-SHA384",
+  "2a8648ce3d040304": "ecdsa-with-SHA512",
+  "2a864886f70d010104": "md5WithRSAEncryption",
+  "2a864886f70d010105": "sha1WithRSAEncryption",
+  "2a864886f70d01010b": "sha256WithRSAEncryption",
+  "2a864886f70d01010c": "sha384WithRSAEncryption",
+  "2a864886f70d01010d": "sha512WithRSAEncryption",
+};
+const STRONG_SIG_ALGS = new Set([
+  "ecdsa-with-SHA256",
+  "ecdsa-with-SHA384",
+  "ecdsa-with-SHA512",
+  "sha256WithRSAEncryption",
+  "sha384WithRSAEncryption",
+  "sha512WithRSAEncryption",
+]);
+const OID_EC_PUBLIC_KEY = "2a8648ce3d0201";
+
+// One DER TLV at `off`: { tag, start (of the value), end }.
+function tlv(buf, off) {
+  if (off + 2 > buf.length) throw new Error("truncated DER");
+  const tag = buf[off];
+  let len = buf[off + 1];
+  let start = off + 2;
+  if (len & 0x80) {
+    const n = len & 0x7f;
+    if (n < 1 || n > 4 || start + n > buf.length) throw new Error("bad DER length");
+    len = 0;
+    for (let i = 0; i < n; i++) len = len * 256 + buf[start + i];
+    start += n;
+  }
+  const end = start + len;
+  if (end > buf.length) throw new Error("truncated DER");
+  return { tag, start, end };
+}
+
+function children(buf, node) {
+  const out = [];
+  for (let o = node.start; o < node.end; ) {
+    const c = tlv(buf, o);
+    out.push(c);
+    o = c.end;
+  }
+  return out;
+}
+
+const hex = (buf, node) => buf.subarray(node.start, node.end).toString("hex");
+
+/**
+ * The signature algorithm and EC parameter encoding of a certificate, read from its DER:
+ * { signatureAlgorithm: "ecdsa-with-SHA256" | … | "oid:<hex>", ecParams: "named" | "explicit" | null }
+ * (ecParams is null for a non-EC key).
+ */
+export function describeCert(pemOrDer) {
+  const der =
+    Buffer.isBuffer(pemOrDer) && pemOrDer[0] === 0x30
+      ? pemOrDer
+      : new crypto.X509Certificate(pemOrDer).raw;
+  const [tbs, sigAlg] = children(der, tlv(der, 0)); // Certificate ::= SEQ { tbs, sigAlg, sig }
+  const sigOid = hex(der, children(der, sigAlg)[0]);
+  const t = children(der, tbs);
+  const spki = t[t[0].tag === 0xa0 ? 6 : 5]; // [0] version?, serial, sigAlg, issuer, validity, subject, spki
+  const [algId] = children(der, spki);
+  const [keyOid, params] = children(der, algId);
+  let ecParams = null;
+  if (hex(der, keyOid) === OID_EC_PUBLIC_KEY) {
+    ecParams = params && params.tag === 0x06 ? "named" : "explicit";
+  }
+  return { signatureAlgorithm: SIG_ALGS[sigOid] || `oid:${sigOid}`, ecParams };
+}
+
+/** What makes this certificate unusable by Node's TLS stack, as phrases; empty when none. */
+export function certProblems(pem) {
+  const { signatureAlgorithm, ecParams } = describeCert(pem);
+  const problems = [];
+  if (!STRONG_SIG_ALGS.has(signatureAlgorithm)) {
+    problems.push(`signed with ${signatureAlgorithm} (Node needs SHA-256 or stronger)`);
+  }
+  if (ecParams === "explicit") {
+    problems.push("EC key with explicit curve parameters (Node needs a named curve)");
+  }
+  return problems;
+}
+
+/**
+ * "/usr/bin/openssl (LibreSSL 3.3.6)" — the `openssl` the proxy runs (the first on env.PATH, as
+ * execFileSync resolves it), for error messages. The version comes from running THAT binary.
+ */
+export function opensslIdentity(env = process.env) {
+  let found = null;
+  for (const dir of (env.PATH || "").split(path.delimiter)) {
+    if (!dir) continue; // an empty PATH segment ("a::b") is not the cwd here
+    const f = path.join(dir, "openssl");
+    try {
+      fs.accessSync(f, fs.constants.X_OK);
+      found = f;
+      break;
+    } catch {
+      /* next */
+    }
+  }
+  if (!found) return "openssl (not found on PATH)";
+  let version = "version unknown";
+  try {
+    version = execFileSync(found, ["version"], {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "ignore"],
+      env,
+    }).trim();
+  } catch {
+    /* keep "version unknown" */
+  }
+  return `${found} (${version})`;
+}
+
+/**
+ * Throws if `cert` (the CA, when `role` is "CA") cannot be used by Node. For a leaf, also builds
+ * the exact secure context https.createServer / setSecureContext will, so anything else Node
+ * refuses (a key/cert mismatch, a digest under the security level) fails here, with a message.
+ */
+export function assertUsableCert({ role, cert, key }, env = process.env) {
+  const problems = certProblems(cert);
+  if (!problems.length && key) {
+    try {
+      tls.createSecureContext({ key, cert });
+    } catch (e) {
+      problems.push(`Node refuses it: ${e.code || e.message}`);
+    }
+  }
+  if (problems.length) {
+    throw new Error(
+      `${opensslIdentity(env)} minted a ${role} certificate Node cannot use: ${problems.join("; ")}. ` +
+        "Put OpenSSL 3 first on PATH (macOS: `brew install openssl@3`) and relaunch.",
+    );
+  }
+}
+
+/**
+ * The leaf in force, and how to replace it. rotate() mints a new leaf and installs it; only when
+ * BOTH succeed does the new leaf become current. Before this, `leaf = mint()` ran ahead of the
+ * install, so an install that threw left the server serving the old leaf while `notAfter` already
+ * held the new leaf's expiry — the CONNECT handler's "expiring" check then never retried, and the
+ * session broke with an expired certificate once the original leaf ran out.
+ */
+export function makeLeafRotator({ initial, mint, install, log, errText = (e) => e.message }) {
+  let leaf = initial;
+  return {
+    current: () => leaf,
+    rotate(why) {
+      let next;
+      try {
+        next = mint();
+        install(next);
+      } catch (e) {
+        log(`leaf rotation FAILED (${why}), keeping the current leaf: ${errText(e)}`);
+        return false;
+      }
+      leaf = next;
+      log(`leaf rotated (${why}) notAfter=${new Date(leaf.notAfter).toISOString()}`);
+      return true;
+    },
+  };
+}

package/dist/rc-proxy.mjs

@@ -92,6 +92,7 @@ import crypto from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { TURN_HEADER, TurnOrigins, turnHeaderEnabled, turnHeaderFor } from "./turn-origin.mjs";
 import { OWNER_FILE, ensureRcStateRoot, keepPrivateDir, sweepRcDirs } from "./rc-state.mjs";
+import { assertUsableCert, makeLeafRotator } from "./rc-certs.mjs";
 
 const MITM_HOST = "api.anthropic.com";
 const env = process.env;
@@ -180,7 +181,19 @@ if (SUBSCRIPTION) {
 // session picks it up on its next TLS handshake. (A 2-day CA + leaf with the CA key deleted at
 // startup broke every session older than 48 h with "SSL certificate has expired".) openssl only
 // takes the CA key from a file, so each signing writes it 0600 into caDir and deletes it right
-// after. Works with macOS's system LibreSSL (3.3+) and OpenSSL 1.1.1+ (`-addext`).
+// after. The openssl flags used (`-addext`, `-pkeyopt`, `-sha256`) exist in OpenSSL 1.1.1+ and 3
+// and in LibreSSL 3.3+ (macOS's /usr/bin/openssl).
+//
+// Until the digest and curve encoding were pinned, this only ever worked with OpenSSL 3 first on
+// PATH: no call passed a digest, and LibreSSL's defaults differ from OpenSSL 3's in two ways that
+// each break Node (OpenSSL 3), whatever the Node version. (1) `x509 -req` signs with
+// ecdsa-with-SHA1, and https.createServer refuses that leaf with ERR_SSL_CA_MD_TOO_WEAK — the proxy
+// died before READY and --remote-control refused to launch. (2) EC keys are written with explicit
+// curve parameters, and a client verifying the chain rejects them ("Certificate public key has
+// explicit ECC parameters"). So every call passes `-sha256` and `ec_param_enc:named_curve`, and
+// every minted CA and leaf is checked before use (assertUsableCert, rc-certs.mjs): an openssl that
+// still produces something Node cannot use stops the proxy with a message naming the binary and
+// its version — or, for a rotation, fails that rotation and keeps the current leaf.
 //
 // Nothing may take the CA files mid-session. In the OS temp dir, macOS's dirhelper deleted
 // ca.pem / leaf.ext from sessions older than ~3-4 days (files not accessed for 3 days; openssl
@@ -240,6 +253,8 @@ try {
     "ec",
     "-pkeyopt",
     "ec_paramgen_curve:prime256v1",
+    "-pkeyopt",
+    "ec_param_enc:named_curve",
     "-nodes",
     "-keyout",
     p("ca.key"),
@@ -253,6 +268,7 @@ try {
     "basicConstraints=critical,CA:TRUE",
     "-addext",
     "keyUsage=critical,keyCertSign,cRLSign",
+    "-sha256",
   );
   caKey = fs.readFileSync(p("ca.key"));
   fs.rmSync(p("ca.key"));
@@ -262,6 +278,11 @@ try {
   fs.rmSync(p("ca.key"), { force: true });
   die(`could not mint the ephemeral CA with openssl: ${osslErr(e)}`);
 }
+try {
+  assertUsableCert({ role: "CA", cert: caPem });
+} catch (e) {
+  die(`${e.message} Refusing to start.`);
+}
 
 // Recreate caDir and its long-lived files from memory if something deleted them, and refresh
 // every atime/mtime so the cleaner does not try again (see the block comment above).
@@ -299,6 +320,8 @@ function mintLeaf() {
     "ec",
     "-pkeyopt",
     "ec_paramgen_curve:prime256v1",
+    "-pkeyopt",
+    "ec_param_enc:named_curve",
     "-nodes",
     "-keyout",
     p("leaf.key"),
@@ -306,6 +329,7 @@ function mintLeaf() {
     p("leaf.csr"),
     "-subj",
     `/CN=${MITM_HOST}`,
+    "-sha256",
   );
   try {
     fs.writeFileSync(p("ca.key"), caKey, { mode: 0o600, flag: "wx" });
@@ -325,23 +349,27 @@ function mintLeaf() {
       String(LEAF_DAYS),
       "-extfile",
       p("leaf.ext"),
+      "-sha256",
     );
   } finally {
     fs.rmSync(p("ca.key"), { force: true });
   }
   const cert = fs.readFileSync(p("leaf.pem"));
-  return {
-    key: fs.readFileSync(p("leaf.key")),
-    cert,
-    notAfter: Date.parse(new crypto.X509Certificate(cert).validTo),
-  };
+  const key = fs.readFileSync(p("leaf.key"));
+  assertUsableCert({ role: "leaf", cert, key }); // fail closed: never serve a leaf Node refuses
+  return { key, cert, notAfter: Date.parse(new crypto.X509Certificate(cert).validTo) };
 }
 
-let leaf;
+let firstLeaf;
 try {
-  leaf = mintLeaf();
+  firstLeaf = mintLeaf();
 } catch (e) {
-  die(`could not mint the ephemeral CA with openssl: ${osslErr(e)}`);
+  // An openssl failure carries its stderr; an unusable certificate carries assertUsableCert's message.
+  const why =
+    e.stderr && e.stderr.length
+      ? `could not mint the ephemeral CA with openssl: ${osslErr(e)}`
+      : null;
+  die(why || `${e.message} Refusing to start.`);
 }
 
 // --- request handling ---------------------------------------------------------------------
@@ -613,22 +641,22 @@ function handle(req, res, viaPlain) {
   }
 }
 
-const tlsServer = https.createServer({ key: leaf.key, cert: leaf.cert }, (req, res) =>
+const tlsServer = https.createServer({ key: firstLeaf.key, cert: firstLeaf.cert }, (req, res) =>
   handle(req, res, false),
 );
 tlsServer.on("tlsClientError", (e) => log(`tls client error: ${e.code || e.message}`));
 
 // Re-mint the leaf and hot-swap it; established TLS connections keep the old one, every new
-// handshake gets the new one. A failed re-mint keeps serving the current leaf.
-function rotateLeaf(why) {
-  try {
-    leaf = mintLeaf();
-    tlsServer.setSecureContext({ key: leaf.key, cert: leaf.cert });
-    log(`leaf rotated (${why}) notAfter=${new Date(leaf.notAfter).toISOString()}`);
-  } catch (e) {
-    log(`leaf rotation FAILED (${why}), keeping the current leaf: ${osslErr(e)}`);
-  }
-}
+// handshake gets the new one. A failed re-mint OR a failed swap keeps serving the current leaf —
+// and keeps its notAfter, so the CONNECT handler's "expiring" check retries (rc-certs.mjs).
+const leaves = makeLeafRotator({
+  initial: firstLeaf,
+  mint: mintLeaf,
+  install: (next) => tlsServer.setSecureContext({ key: next.key, cert: next.cert }),
+  log,
+  errText: osslErr,
+});
+const rotateLeaf = (why) => leaves.rotate(why);
 rotateTimer = setInterval(() => rotateLeaf("interval"), LEAF_ROTATE_MS);
 rotateTimer.unref();
 keepAliveTimer = setInterval(() => keepAlive("interval"), CA_KEEPALIVE_MS);
@@ -641,7 +669,7 @@ proxy.on("connect", (req, sock, head) => {
   sock.on("error", () => {});
   if (host === MITM_HOST && port === 443) {
     // A timer can run late (laptop sleep): never hand out a leaf that is about to expire.
-    if (leaf.notAfter - Date.now() < LEAF_MIN_LEFT_MS) rotateLeaf("expiring");
+    if (leaves.current().notAfter - Date.now() < LEAF_MIN_LEFT_MS) rotateLeaf("expiring");
     sock.write("HTTP/1.1 200 Connection Established\r\n\r\n");
     if (head && head.length) sock.unshift(head);
     tlsServer.emit("connection", sock);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.17.23",
+  "version": "0.17.25",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {