@modelprofile.com/authswitch 8.2.0 → 9.1.0

package/ts/classes.authorityimport.ts

@@ -76,9 +76,15 @@ export interface IAuthSwitchImportClaudeTokens {
 }
 
 export interface IAuthSwitchAuthorityImportOptions {
-  /** Locates the legacy stores, exactly as each owning class locates its own. */
-  env?: NodeJS.ProcessEnv;
-  homeDirectory?: string;
+  /**
+   * Locates the legacy stores, exactly as each owning class locates its own -- and always stated.
+   *
+   * These are the two inputs that decide whose real credentials an import reads, so the importer never
+   * reaches for the host's own environment: a caller that could not name them has no business importing.
+   * `AuthSwitchAuthorityService`'s entry point is the one place that takes them from this host.
+   */
+  env: NodeJS.ProcessEnv;
+  homeDirectory: string;
   now?: () => number;
   /** The one rotating refresh of an imported ChatGPT login, and the non-rotating read that proves one. */
   openAi?: IAuthSwitchImportOpenAiOperations;
@@ -189,6 +195,58 @@ const RUN_ORDER_REFUSAL = 'Importing needs the run-order acknowledgement: an imp
   + 'exercise exactly that copy. Import only once those commands run on the authority and the native '
   + 'projections exist.';
 
+/**
+ * A row keeps the login it named, permanently: no route forgets a row or re-points it at another account,
+ * and one would be a way to import a login the owner never approved under an approval given for a different
+ * one. The same is true of a settled row, which answers that it is already imported.
+ */
+const FOREIGN_SOURCE_REFUSAL = 'This source now holds a different account\'s login than the one this import '
+  + 'registered for it. Restore the login this source was registered with, then import it again.';
+const CHANGED_SOURCE_REFUSAL =
+  'The source changed after its migration ledger row was written; it is a different source now.';
+
+/**
+ * Whether a row may take the bytes its source holds now.
+ *
+ * A projection that could not be proven waits for its own tool, and that tool proves itself by refreshing
+ * its store -- which rewrites the file. The row has to be able to follow those bytes, or the retry its own
+ * refusal asks for could never be made at all. It follows them only this far: the row is unsettled, nothing
+ * rotating was ever sent for it, and the authority holds no copy of its credential. That the bytes are still
+ * the same login is a separate question, and `ledgerObjection` answers it first.
+ */
+const followsRefreshedSource = (ledger: IStoredAuthorityMigrationLedger,
+  record: Pick<ILegacySourceRecord, 'treatment'>): boolean =>
+  ledger.status === 'pending_native_owner' && record.treatment === 'project' && ledger.grantId !== null;
+
+/**
+ * What this source's own row objects to, asked once and answered for both the report and the submit.
+ *
+ * The runbook tells the owner not to submit a source the inventory lists a problem for, which is only true
+ * while the two agree, so they are the same four questions in one place. The identity question is the one
+ * the provider cannot answer: a row is found by the hash of its location, so the same row answers for
+ * whatever login that location holds later -- `codex login` under the same path, a replaced saved record --
+ * and the non-rotating proof asks the provider about the identity the newly read bytes themselves claim. It
+ * therefore proves those bytes are self-consistent and live, never that they are the login this row was
+ * approved for. A source with no derivable identity is left to its reader's own problem.
+ */
+type TLedgerObjection = 'imported' | 'quarantined' | 'foreign' | 'changed';
+
+const ledgerObjection = (ledger: IStoredAuthorityMigrationLedger,
+  record: Pick<ILegacySourceRecord, 'treatment' | 'accountId' | 'sourceDigest'>,
+  grantId: string | null): TLedgerObjection | null => {
+  // A quarantined row is terminal whatever its location holds now, and its answer -- sign in to that
+  // account again -- is the next step either way. Everything after it is about the login that is there.
+  if (ledger.status === 'quarantined') return 'quarantined';
+  // Before "already imported": a settled row whose location now holds another account would otherwise
+  // answer that a login it never touched is imported.
+  if (record.accountId !== null && grantId !== null
+    && ((ledger.accountId !== null && ledger.accountId !== record.accountId)
+      || (ledger.grantId !== null && ledger.grantId !== grantId))) return 'foreign';
+  if (ledger.status === 'complete') return 'imported';
+  if (ledger.sourceDigest !== record.sourceDigest && !followsRefreshedSource(ledger, record)) return 'changed';
+  return null;
+};
+
 /** Strips the source location: a ledger row stores its hash, and no response may carry the path. */
 const publicSource = (record: ILegacySourceRecord,
   ledgerStatus: IAuthSwitchImportSource['ledgerStatus']): IAuthSwitchImportSource => ({
@@ -227,9 +285,9 @@ export class AuthSwitchAuthorityImport {
   private readonly quiescence: IAuthSwitchImportQuiescence;
 
   constructor(private readonly database: AuthSwitchAuthorityDatabase,
-    options: IAuthSwitchAuthorityImportOptions = {}) {
-    this.env = options.env ?? process.env;
-    this.homeDirectory = options.homeDirectory ?? plugins.os.homedir();
+    options: IAuthSwitchAuthorityImportOptions) {
+    this.env = options.env;
+    this.homeDirectory = options.homeDirectory;
     this.now = options.now ?? Date.now;
     this.openAi = options.openAi ?? new plugins.flexAccounts.OpenAiProviderAdapter();
     this.claudeStatus = options.claudeStatus ?? new ClaudeAccountStatus();
@@ -248,12 +306,20 @@ export class AuthSwitchAuthorityImport {
     for (const record of report.sources) {
       const ledger = await this.database.readMigrationLedger(record.id);
       const source = publicSource(record, ledger?.status ?? null);
-      if (ledger !== null && ledger.sourceDigest !== record.sourceDigest) {
-        // The source changed after its row was written. A later import must not treat the approved bytes and
-        // the current bytes as the same source; the ledger deliberately refuses to move that row.
+      // The same four questions the submit decides on, so a source the report invites is one the submit
+      // takes. New bytes of the same login under a row that is still waiting for them are not an objection:
+      // they are the retry that row asks for, and no problem line tells the owner to stop.
+      const objection = ledger === null ? null : ledgerObjection(ledger, record,
+        record.accountId === null ? null : importGrantId(record.accountId, grantPlan(record)));
+      if (objection === 'foreign') {
+        source.problems.push('this source now holds a different account\'s login than the one it was registered with');
+      }
+      if (objection === 'changed') {
+        // A later import must not treat the approved bytes and the current bytes as the same source; the
+        // ledger deliberately refuses to move that row.
         source.problems.push('the source changed after its migration ledger row was written');
       }
-      if (ledger?.status === 'complete') {
+      if (objection === 'imported') {
         source.problems.push('this source is already imported; its legacy copy is retired');
       }
       sources.push(source);
@@ -281,7 +347,7 @@ export class AuthSwitchAuthorityImport {
       const grant = row.grantId === null ? null : await this.database.readGrant(row.grantId);
       const handoff = await this.database.readHandoff(importHandoffId(row.id));
       entries.push({
-        sourceId: row.id, sourceKind: row.sourceKind, status: row.status,
+        sourceId: row.id, sourceKind: row.sourceKind, sourcePathHash: row.sourcePathHash, status: row.status,
         accountId: row.accountId, loginId: row.grantId, owner: grant?.owner ?? null,
         action: importAction(row.status, handoff), statusObservedAt: row.statusObservedAt,
       });
@@ -308,17 +374,6 @@ export class AuthSwitchAuthorityImport {
     const record = this.resolveSource(request.submission);
     const plan = grantPlan(record);
     this.assertQuiescent(record);
-    const ledger = await this.database.readMigrationLedger(record.id);
-    if (ledger !== null) {
-      if (ledger.sourceDigest !== record.sourceDigest) {
-        refuse('The source changed after its migration ledger row was written; it is a different source now.');
-      }
-      if (ledger.status === 'complete') refuse('This source is already imported.');
-      if (ledger.status === 'quarantined') {
-        refuse('This source is quarantined: its outcome could not be established, so it needs a device '
-          + 'sign-in for that account rather than another import.');
-      }
-    }
     const accountId = record.accountId;
     const subject = record.subject;
     const workspaceId = record.workspaceId;
@@ -326,6 +381,18 @@ export class AuthSwitchAuthorityImport {
       refuse('The source carries no provider identity the authority can bind an account to.');
     }
     const grantId = importGrantId(accountId, plan);
+    const ledger = await this.database.readMigrationLedger(record.id);
+    // Every one of these is decided from the durable row alone, before a single write: a projection
+    // registers its account and grant before the provider is asked anything, so an objection that arrived
+    // later would arrive after the record it objects to had been written.
+    switch (ledger === null ? null : ledgerObjection(ledger, record, grantId)) {
+      case 'imported': refuse('This source is already imported.');
+      case 'quarantined':
+        refuse('This source is quarantined: its outcome could not be established, so it needs a device '
+          + 'sign-in for that account rather than another import.');
+      case 'foreign': refuse(FOREIGN_SOURCE_REFUSAL);
+      case 'changed': refuse(CHANGED_SOURCE_REFUSAL);
+    }
     if (ledger === null) await this.beginLedger(record);
     const material = this.material(record, request.submission);
     return record.treatment === 'project'
@@ -428,12 +495,20 @@ export class AuthSwitchAuthorityImport {
     }));
   }
 
+  /**
+   * Moves the row, and -- only where a caller states it -- the bytes that move with the status.
+   *
+   * The digest is part of the same write as the status it was proven under, so no row can record a proof of
+   * bytes it does not name. The database holds the rule about which row may carry a new digest at all.
+   */
   private async moveLedger(ledgerId: string, status: IStoredAuthorityMigrationLedger['status'],
-    accountId: string | null, grantId: string | null): Promise<IStoredAuthorityMigrationLedger> {
+    accountId: string | null, grantId: string | null,
+    sourceDigest?: string): Promise<IStoredAuthorityMigrationLedger> {
     const updateId = plugins.crypto.randomUUID();
     return this.database.changeMigrationLedger(updateId, ledgerId, current => {
       if (!current) throw new Error('The migration ledger row disappeared during the import.');
-      return { ...current, status, accountId, grantId, revision: current.revision + 1,
+      return { ...current, status, accountId, grantId,
+        sourceDigest: sourceDigest ?? current.sourceDigest, revision: current.revision + 1,
         statusObservedAt: this.stamp(), updateId };
     });
   }
@@ -513,7 +588,9 @@ export class AuthSwitchAuthorityImport {
       await this.moveLedger(record.id, 'pending_native_owner', identity.accountId, identity.grantId);
       throw error;
     }
-    await this.moveLedger(record.id, 'verified', identity.accountId, identity.grantId);
+    // The bytes that were just proven are the bytes this row records, written with the proof itself: a row
+    // that followed its tool's refresh names the store the provider answered for, never the one before it.
+    await this.moveLedger(record.id, 'verified', identity.accountId, identity.grantId, record.sourceDigest);
     if (record.sourceKind === 'claude_native') await this.adoptClaudeHome(record, identity);
     await this.moveLedger(record.id, 'complete', identity.accountId, identity.grantId);
     return this.result(record, 'complete', identity, []);

package/ts/classes.authoritymodels.ts

@@ -444,7 +444,10 @@ export const assertStoredAuthorityGrant: (value: unknown) => asserts value is IS
     throw new Error('Claude handoff grant has incompatible custody.');
   }
   if (value.purpose === 'openai_managed' && value.providerId !== 'openai') throw new Error('OpenAI grant provider mismatch.');
-  if (value.purpose === 'claude_container_setup' && value.owner === 'claude_native') throw new Error('Container setup grant has a native host owner.');
+  // No native tool refreshes a container setup token: the authority holds it, or nobody does.
+  if (value.purpose === 'claude_container_setup' && value.owner !== 'daemon' && value.owner !== 'none') {
+    throw new Error('Container setup grant has a native owner.');
+  }
 };
 
 export const assertStoredAuthorityBinding: (value: unknown) => asserts value is IStoredAuthorityBinding = value => {

package/ts/classes.authoritypreuse.ts

@@ -1,5 +1,6 @@
 import * as plugins from './plugins.js';
 import type { IAuthSwitchPreuseOperation } from './authority-contract.js';
+import { AuthSwitchRefusal } from './authority-contract.js';
 import { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
 import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
 import type { IStoredAuthorityPreuseOperation, TStoredAuthorityPreuseProblem } from './classes.authoritymodels.js';
@@ -250,7 +251,12 @@ export class AuthSwitchAuthorityPreuse {
   private async readStored(operationId: string): Promise<IStoredAuthorityPreuseOperation> {
     if (!uuid(operationId)) throw new Error('Invalid preuse operation ID.');
     const operation = await this.database.readOperation(operationId);
-    if (!operation || operation.kind !== 'preuse_openai') throw new Error('Preuse operation was not found.');
+    // One site answers both routes that take a preuse operation id, so a read and a cancel of something
+    // this authority does not hold say the same thing in the same code.
+    if (!operation || operation.kind !== 'preuse_openai') {
+      throw new AuthSwitchRefusal('not_found', 'This authority knows no preuse by that operation ID. '
+        + 'Start a new preuse and follow that one.');
+    }
     return operation;
   }
 

package/ts/classes.authorityservice.ts

@@ -1,37 +1,12 @@
 import * as plugins from './plugins.js';
+import { authSwitchAuthorityUnitDirectory, authSwitchAuthorityUnitName,
+  resolveAuthSwitchAuthorityPaths } from './authority-paths.js';
 import { AuthSwitchAuthorityDaemon } from './classes.authoritydaemon.js';
 import type { IClaudeNativeAuthorityOptions } from './classes.claudeauthority.js';
 import { ClaudeNativeAdapter, claudeNativeUserSettingsFiles,
   resolveClaudeNativeHome } from './classes.claudenative.js';
 
-export interface IAuthSwitchAuthorityPaths {
-  runtimeDirectory: string;
-  dataDirectory: string;
-  databaseSocketPath: string;
-  authoritySocketPath: string;
-  runtimeSocketPath: string;
-  runtimeSocketDirectory: string;
-}
-
-/** Canonical per-user paths. An explicit runtime directory is also usable by a trusted container host. */
-export const resolveAuthSwitchAuthorityPaths = (runtimeDirectory = process.env.XDG_RUNTIME_DIR): IAuthSwitchAuthorityPaths => {
-  if (!runtimeDirectory || !plugins.path.isAbsolute(runtimeDirectory)) {
-    throw new Error('A private XDG_RUNTIME_DIR is required for authswitch authority.');
-  }
-  const home = plugins.os.userInfo().homedir;
-  const dataHome = process.env.XDG_DATA_HOME || plugins.path.join(home, '.local/share');
-  if (!plugins.path.isAbsolute(dataHome)) throw new Error('XDG_DATA_HOME must be an absolute path.');
-  const socketDirectory = plugins.path.join(runtimeDirectory, 'authswitch');
-  const runtimeSocketDirectory = plugins.path.join(socketDirectory, 'runtime');
-  return {
-    runtimeDirectory,
-    dataDirectory: plugins.path.join(dataHome, 'authswitch', 'authority'),
-    databaseSocketPath: plugins.path.join(socketDirectory, 'internal', 'db.sock'),
-    authoritySocketPath: plugins.path.join(socketDirectory, 'management', 'authority.sock'),
-    runtimeSocketPath: plugins.path.join(runtimeSocketDirectory, 'runtime.sock'),
-    runtimeSocketDirectory,
-  };
-};
+export { resolveAuthSwitchAuthorityPaths, type IAuthSwitchAuthorityPaths } from './authority-paths.js';
 
 /** Explicit installer and lifecycle operations for a user-scoped systemd service. */
 export class AuthSwitchAuthorityService {
@@ -39,9 +14,11 @@ export class AuthSwitchAuthorityService {
   public readonly unitFile: plugins.smartdaemon.SystemdUnitFile;
   public readonly definition: plugins.smartdaemon.SystemdServiceDefinition;
 
-  constructor(runtimeDirectory: string, unitDirectory?: string) {
+  /** The unit directory defaults to the one the legacy fence looks in for this user (`./authority-paths`). */
+  constructor(runtimeDirectory: string,
+    unitDirectory = authSwitchAuthorityUnitDirectory(process.env, plugins.os.userInfo().homedir)) {
     const packageRoot = plugins.path.dirname(plugins.path.dirname(plugins.fileURLToPath(import.meta.url)));
-    const options = { unitName: 'authswitch-authority.service', scope: 'user' as const, runtimeDirectory };
+    const options = { unitName: authSwitchAuthorityUnitName, scope: 'user' as const, runtimeDirectory };
     this.unit = new plugins.smartdaemon.SystemdUnit(options);
     this.unitFile = new plugins.smartdaemon.SystemdUnitFile({ ...options, unitDirectory });
     this.definition = new plugins.smartdaemon.SystemdServiceDefinition({
@@ -86,6 +63,13 @@ export const resolveAuthSwitchClaudeNativeAuthority = (env: NodeJS.ProcessEnv =
     settingsFiles: claudeNativeUserSettingsFiles(configDir) }) };
 };
 
+/**
+ * The per-user daemon this package installs, and the one place that names this host's own legacy stores.
+ *
+ * Every other construction of `AuthSwitchAuthorityDaemon` -- a test, a consumer's harness, an embedding
+ * backend -- states its own locations or asks for no import surface, because a daemon that defaulted here
+ * would read the credentials of whichever user happened to start it.
+ */
 export const runAuthSwitchAuthorityDaemon = async (paths = resolveAuthSwitchAuthorityPaths()): Promise<void> => {
   const daemon = new AuthSwitchAuthorityDaemon({
     dataDirectory: paths.dataDirectory,
@@ -93,6 +77,7 @@ export const runAuthSwitchAuthorityDaemon = async (paths = resolveAuthSwitchAuth
     authoritySocketPath: paths.authoritySocketPath,
     runtimeSocketPath: paths.runtimeSocketPath,
     claudeNative: resolveAuthSwitchClaudeNativeAuthority(),
+    legacyImport: { env: process.env, homeDirectory: plugins.os.homedir() },
   });
   await daemon.start();
   await new Promise<void>((resolve, reject) => {

package/ts/classes.cli.ts

@@ -4,7 +4,7 @@ import { CodexHarness } from './classes.codexharness.js';
 import { OpenCodeHarness } from './classes.opencodeharness.js';
 import { ClaudeCodeHarness } from './classes.claudecodeharness.js';
 import { AuthSwitchTui } from './classes.tui.js';
-import { AglAuthSwitchCoordinator, AuthSwitchOperations, authSwitchMutationReplacesLogin, type TAuthSwitchCoordinator, type TAuthSwitchMutation } from './classes.operations.js';
+import { AglAuthSwitchCoordinator, AuthSwitchOperations, authSwitchHostLegacyFence, authSwitchMutationReplacesLogin, type TAuthSwitchCoordinator, type TAuthSwitchLegacyFence, type TAuthSwitchMutation } from './classes.operations.js';
 import { readAccountList } from './classes.accountlist.js';
 import { AccountListRenderer } from './classes.listrenderer.js';
 import { accountLimits, activeAccounts, CondensedRenderer } from './classes.limits.js';
@@ -98,9 +98,20 @@ export class AuthSwitchCli {
   private readonly operations: AuthSwitchOperations;
   private get out(): plugins.smartconsole.SmartConsole { return this.console ??= new plugins.smartconsole.SmartConsole(); }
 
-  constructor(harnessesArg?: IAuthHarness[] | CodexSwitcher, coordinatorArg?: TAuthSwitchCoordinator) {
+  /**
+   * `legacyFenceArg` states which authority fences the mutations of injected harnesses.
+   *
+   * With no harnesses this command line is this host's, exactly as its default harnesses and its AGL
+   * coordinator are, and it is fenced by this host's authority. Injected harnesses write whatever stores
+   * their caller chose, so -- like the coordinator -- nothing of this host is assumed for them: they are
+   * fenced only by what the caller states, and by nothing when it states nothing.
+   */
+  constructor(harnessesArg?: IAuthHarness[] | CodexSwitcher, coordinatorArg?: TAuthSwitchCoordinator,
+    legacyFenceArg?: TAuthSwitchLegacyFence) {
     const coordinator = new AglAuthSwitchCoordinator();
-    this.operations = new AuthSwitchOperations(coordinatorArg ?? (harnessesArg === undefined ? request => coordinator.coordinate(request) : undefined));
+    this.operations = new AuthSwitchOperations(
+      coordinatorArg ?? (harnessesArg === undefined ? request => coordinator.coordinate(request) : undefined),
+      legacyFenceArg ?? (harnessesArg === undefined ? authSwitchHostLegacyFence() : 'none'));
     harnessesArg ??= [new CodexHarness(), new OpenCodeHarness(), new ClaudeCodeHarness()];
     // Preserve the published single-Codex constructor at the composition boundary.
     const harnesses = Array.isArray(harnessesArg) ? harnessesArg : [new CodexHarness(harnessesArg)];

package/ts/classes.codexmanaged.ts

@@ -1,6 +1,7 @@
 import * as plugins from './plugins.js';
 import { commitinfo } from './00_commitinfo_data.js';
 import type { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
+import { requireVerifiedCodexServer, verifyManagedCodexContract, type IManagedCodexContract } from './codexcontract.js';
 
 export interface IAuthSwitchManagedCodexOptions {
   /** Private runtime root; only the disposable control socket lives here. */
@@ -153,18 +154,6 @@ export class AuthSwitchManagedCodex {
     return picked;
   }
 
-  private async requireVersion(): Promise<void> {
-    const executable = this.options.executable ?? 'codex';
-    const output = await new Promise<string>((resolve, reject) => {
-      plugins.childProcess.execFile(executable, ['--version'], { timeout: 5_000, maxBuffer: 4096,
-        windowsHide: true, env: this.environment() }, (error, stdout) => {
-        if (error) reject(new Error('Managed Codex version probe failed.'));
-        else resolve(stdout.trim());
-      });
-    });
-    if (output !== 'codex-cli 0.155.1') throw new Error('Managed Codex requires verified codex-cli 0.155.1.');
-  }
-
   public start(): Promise<void> {
     if (this.closed || this.startPromise) throw new Error('Managed Codex can start only once.');
     this.startPromise = this.performStart();
@@ -195,13 +184,18 @@ export class AuthSwitchManagedCodex {
       } catch (error) {
         if (!isRecord(error) || error.code !== 'ENOENT') throw error;
       }
-      await this.requireVersion();
+      // Nothing is recorded or started for a Codex that is too old or no longer offers what this uses.
+      const contract: IManagedCodexContract = await verifyManagedCodexContract({
+        executable: this.options.executable ?? 'codex', env: this.environment(), scratchDirectory: this.runDirectory });
       if (this.closed) throw new Error('Managed Codex startup was cancelled.');
       const initial = await this.options.broker.resolveAccess(this.options.bindingId,
         this.options.capability, 60_000);
       if (this.closed) throw new Error('Managed Codex startup was cancelled.');
       this.workspaceId = initial.accountId;
       this.grantedGeneration = initial.grantGeneration;
+      // Codex binds the socket elsewhere and publishes this path as an alias; deriving where
+      // proves the host can verify that alias before any run is recorded or process started.
+      await plugins.crossharness.codexUnixSocketTarget(this.socketPath);
       await this.options.onPreparedRun(this.socketPath);
       if (this.closed) throw new Error('Managed Codex startup was cancelled.');
       const child = plugins.childProcess.spawn(this.options.executable ?? 'codex', [
@@ -226,11 +220,7 @@ export class AuthSwitchManagedCodex {
       while (true) {
         if (this.closed) throw new Error('Managed Codex startup was cancelled.');
         if (!isAlive(child)) throw new Error('Managed Codex app-server exited before accepting connections.');
-        try {
-          if ((await plugins.fs.promises.lstat(this.socketPath)).isSocket()) break;
-        } catch (error) {
-          if (!isRecord(error) || error.code !== 'ENOENT') throw error;
-        }
+        if (await plugins.crossharness.observeCodexUnixSocket(this.socketPath) === 'published') break;
         if (Date.now() >= deadline) throw new Error('Managed Codex app-server socket startup timed out.');
         await wait(25);
       }
@@ -248,7 +238,8 @@ export class AuthSwitchManagedCodex {
       });
       this.client = client;
       await client.connect();
-      if (client.serverVersion !== '0.155.1') throw new Error('Managed Codex app-server version changed.');
+      // The executable can be replaced between the check and the spawn (Codex updates itself).
+      requireVerifiedCodexServer(contract, client.serverVersion);
       const login: unknown = await client.request('account/login/start', {
         type: 'chatgptAuthTokens', accessToken: initial.accessToken, chatgptAccountId: initial.accountId,
       }, 5_000);

package/ts/classes.legacyfence.ts

@@ -0,0 +1,219 @@
+import * as plugins from './plugins.js';
+import { AuthSwitchRefusal } from './authority-contract.js';
+import { authSwitchAuthoritySocketPaths, authSwitchAuthorityUnitDirectory,
+  authSwitchAuthorityUnitName } from './authority-paths.js';
+import { AuthSwitchClient } from './classes.authorityclient.js';
+import { StashStore } from './classes.stashstore.js';
+import { legacyHash, legacySourceId,
+  resolveLegacySourceLocations } from './ts_migration/legacysources/shared.js';
+import type { TAuthSwitchMutation } from './mutation.js';
+import type { IAuthHarness } from './interfaces.harness.js';
+
+/**
+ * The gate between the legacy credential commands and an account the authority has taken over.
+ *
+ * An import is a transfer of ownership, not a copy: the moment the authority refreshes an adopted login,
+ * the legacy saved copy holds a refresh token the provider has already rotated away. Writing that copy back
+ * into a native store -- which is what the legacy `save` and `switch` do -- would hand a tool a credential
+ * that is dead, and the owner would learn it from the tool rather than from here. This is the one place
+ * that stops it, and it stops it for the hosted service too, because `runAuthSwitchMutation` is the
+ * chokepoint both the command line and `AuthSwitchService` pass through.
+ *
+ * An authority that answers decides from its migration ledger alone. The ledger names a source by the hash
+ * of its own path, which is exactly what the legacy side can compute for the record it is about to touch, so
+ * no account identity has to be mapped between the two worlds: the legacy account id names a file, the file
+ * names a row, and the row says whether the authority took it. One that does not answer is decided by
+ * whether its service unit is installed (`authorityUnitInstalled`).
+ */
+
+/** Where a fence looks: this host's legacy stores and this host's authority, both stated by the caller. */
+export interface IAuthSwitchLegacyFenceLocations {
+  env: NodeJS.ProcessEnv;
+  homeDirectory: string;
+}
+
+/**
+ * What a caller states, exactly as a daemon states where it reads the legacy stores.
+ *
+ * `'none'` is for a caller that is not this host's own credential tooling -- a fixture, or a harness test
+ * that owns no authority -- and it is stated rather than defaulted, because a fence that silently pointed
+ * at `process.env` from inside a test would read whichever host ran it.
+ */
+export type TAuthSwitchLegacyFence = IAuthSwitchLegacyFenceLocations | 'none';
+
+/**
+ * This host's own locations, for a caller whose harnesses are this host's own.
+ *
+ * `AuthSwitchCli` and `AuthSwitchService` use it when they compose their harnesses from this process's
+ * environment, and a host that composes them the same way -- AGL -- states it explicitly. A fence that named
+ * anything else would be fencing other stores than the ones those harnesses write. Everything below them --
+ * `AuthSwitchOperations`, `runAuthSwitchMutation` -- takes it as an argument, so no library path can pick
+ * up a host it was never given.
+ */
+export const authSwitchHostLegacyFence = (): IAuthSwitchLegacyFenceLocations =>
+  ({ env: process.env, homeDirectory: plugins.os.homedir() });
+
+const fenceRequired = 'An authswitch account mutation requires stated legacy fence locations: pass an env '
+  + 'and an absolute homeDirectory, or "none" for a caller that owns no authority.';
+
+/** The same check for a caller with types and one without. */
+export function assertStatedLegacyFence(value: unknown): asserts value is TAuthSwitchLegacyFence {
+  if (value === 'none') return;
+  if (value === null || typeof value !== 'object'
+    || typeof (value as { env?: unknown }).env !== 'object' || (value as { env?: unknown }).env === null
+    || typeof (value as { homeDirectory?: unknown }).homeDirectory !== 'string'
+    || !plugins.path.isAbsolute((value as { homeDirectory: string }).homeDirectory)) {
+    throw new Error(fenceRequired);
+  }
+}
+
+/**
+ * What the owner is told. Neither names a path, an id or a host; each names the command that helps.
+ *
+ * There is no authority command that activates a login in a native store, and that is the point: a login
+ * the authority holds is used by binding a runtime to it, which is what AGL does, so the instruction names
+ * the read that shows it rather than inventing a replacement for `switch`.
+ */
+const authorityHoldsLogin = 'The account authority holds this login now: its legacy saved copy is stale, '
+  + 'so the legacy save and switch no longer apply to it. "authswitch account list" shows the account; a '
+  + 'runtime uses it by binding to it through the authority.';
+const authorityUnavailable = 'This host has an account authority and it is not answering, so whether it '
+  + 'holds this login cannot be known. Start it with "authswitch authority service start" and run this '
+  + 'again.';
+
+/** A settled row is one whose source was taken over. Both statuses mean the legacy copy is finished. */
+const settled = new Set(['verified', 'complete']);
+
+/** How long the gate may wait on the authority before a mutation is refused rather than delayed. */
+const ASK_TIMEOUT_MS = 4_000;
+
+/**
+ * The legacy store paths one mutation would read or write, as the migration readers name them.
+ *
+ * Codex keeps a stash directory per account, Claude and OpenCode a record file per account, and the reader
+ * of each derives its ledger row from that exact path (`ts_migration/legacysources/authswitchstores.ts`).
+ * Only the account the mutation names is looked up: a switch also re-saves the outgoing login, but writing
+ * a record rotates nothing, while activating one is the write this fence exists for.
+ */
+const mutationSourcePaths = (root: string, harnessId: string, accountId: string): string[] => {
+  if (harnessId === 'codex') {
+    try { return [new StashStore('codex', root).entryDir(accountId)]; }
+    // An account id no stash name can be derived from names no stash, and therefore no ledger row.
+    catch { return []; }
+  }
+  if (harnessId === 'claude' || harnessId === 'opencode') {
+    return /^[a-f0-9]{64}$/.test(accountId)
+      ? [plugins.path.join(root, harnessId, `${accountId}.json`)] : [];
+  }
+  // A harness this package never wrote a legacy store for has no legacy copy to strand.
+  return [];
+};
+
+/** Which account a mutation touches. A save without one saves whatever login is active right now. */
+const mutationAccountId = async (harness: IAuthHarness,
+  mutation: TAuthSwitchMutation): Promise<string | null> => {
+  if (mutation.accountId !== undefined) return mutation.accountId;
+  if (mutation.action !== 'save') return null;
+  const state = await harness.readState();
+  return state.accounts.find(account => account.isActive)?.id ?? null;
+};
+
+/** What the legacy source a mutation names looks like to an authority that answers. */
+type TLedgerAnswer = 'settled' | 'not_settled' | 'no_answer';
+
+/**
+ * One bounded, paged read of the ledger over the management socket: credential-free, and it reaches no
+ * legacy store. Anything but a complete answer -- no runtime directory, no socket, a socket that never
+ * answers within the bound, a daemon that serves no import status -- is `no_answer`, never "nothing held".
+ */
+const askLedger = async (env: NodeJS.ProcessEnv, sourceIds: ReadonlySet<string>): Promise<TLedgerAnswer> => {
+  // Only the stated environment names a socket, and nothing else decides which one: the full path resolver
+  // defaults an absent directory to this process's own and reads this process's home and XDG_DATA_HOME for
+  // the store, so a value there would silence an authority that answers.
+  if (!env.XDG_RUNTIME_DIR) return 'no_answer';
+  let client: AuthSwitchClient;
+  try {
+    const paths = authSwitchAuthoritySocketPaths(env.XDG_RUNTIME_DIR);
+    client = new AuthSwitchClient(paths.authoritySocketPath, paths.runtimeSocketPath);
+  } catch { return 'no_answer'; }
+  const deadline = AbortSignal.timeout(ASK_TIMEOUT_MS);
+  let after: string | undefined;
+  try {
+    while (true) {
+      const page = await client.importStatus({ after, limit: 128 }, deadline);
+      if (page.entries.some(entry => sourceIds.has(entry.sourceId) && settled.has(entry.status))) return 'settled';
+      if (!page.nextCursor) return 'not_settled';
+      after = page.nextCursor;
+    }
+  } catch { return 'no_answer'; }
+};
+
+const unitUnreadable = 'The authswitch authority service unit could not be inspected, so whether an account '
+  + 'authority is installed here cannot be known; the legacy save and switch refuse until it can.';
+
+/**
+ * Whether this user has the authority's service unit installed: the durable evidence that an authority
+ * exists here even while it is not running.
+ *
+ * The unit is what `authswitch authority service install` writes, in the directory
+ * `authSwitchAuthorityUnitDirectory` derives from the caller's stated locations, and it survives a reboot --
+ * the management socket does not: it lives on tmpfs and is absent after every boot until the service
+ * starts. It is read through smartdaemon's own `SystemdUnitFile.inspect()`, which checks the exact file the
+ * installer writes and reads nothing else; its content is a service definition, never a credential.
+ *
+ * The read needs no login session. `inspect()` reads only the unit directory, so the fence hands smartdaemon
+ * no runtime directory: the stated one belongs to the ledger ask above, and passing it here would let a value
+ * this read never uses refuse the command. The answer therefore depends on the stated unit directory alone,
+ * and a cron job or a plain ssh command -- no `XDG_RUNTIME_DIR` at all -- is decided exactly like a session.
+ *
+ * smartdaemon agrees: with an explicit unit directory it validates only that directory at construction, and
+ * `inspect()` never reads this process's `XDG_RUNTIME_DIR`, `XDG_CONFIG_HOME`, `XDG_DATA_HOME` or home, so
+ * none of them can change the answer.
+ *
+ * systemd is the only installer this package has, so on another platform no unit can be installed. Any
+ * failure to inspect it -- an unsafe or changed file, a directory another user can write -- is not an answer,
+ * and refuses. So does a stated unit directory that cannot be derived or that smartdaemon refuses to
+ * construct the read from (a relative or malformed stated `XDG_DATA_HOME`): the stated locations then name no
+ * directory to look in, an installer running with well-formed locations may have written the unit elsewhere,
+ * and reading that as "no authority here" would be a guess.
+ */
+const authorityUnitInstalled = async (fence: IAuthSwitchLegacyFenceLocations): Promise<boolean> => {
+  if (process.platform !== 'linux') return false;
+  // One catch covers derivation, construction and inspection: each failure leaves the same question open.
+  try {
+    const unitFile = new plugins.smartdaemon.SystemdUnitFile({ unitName: authSwitchAuthorityUnitName,
+      scope: 'user', unitDirectory: authSwitchAuthorityUnitDirectory(fence.env, fence.homeDirectory) });
+    return await unitFile.inspect() !== null;
+  } catch { throw new Error(unitUnreadable); }
+};
+
+/**
+ * The gate itself: allow, or refuse with the reason.
+ *
+ * An authority that answers decides, whether or not its unit is installed: its ledger is the only record
+ * of what it took over. One that does not answer is unknown -- and unknown is never idle -- but only where
+ * an authority is installed at all; a host without the unit is known to hold nothing, and it is every host
+ * before the cutover. The evidence cannot tell which stores an installed authority imports from, so while it
+ * is stopped it refuses the legacy save and switch of every store, until it runs again.
+ */
+export const assertAuthSwitchMutationAllowed = async (fence: TAuthSwitchLegacyFence,
+  harness: IAuthHarness, mutation: TAuthSwitchMutation): Promise<void> => {
+  assertStatedLegacyFence(fence);
+  if (fence === 'none') return;
+  // A remove deletes a saved copy and writes no credential, which is why the legacy `drop` command is
+  // deliberately unfenced as well: for an adopted account that copy already holds a rotated-away token.
+  if (mutation.action !== 'save' && mutation.action !== 'switch') return;
+
+  const root = resolveLegacySourceLocations(fence.env, fence.homeDirectory).authSwitchHome;
+  const accountId = await mutationAccountId(harness, mutation);
+  const paths = accountId === null ? [] : mutationSourcePaths(root, harness.id, accountId);
+  // A mutation that names no legacy record the importer reads can never have been imported, so there is
+  // nothing to ask about, and the answer must not depend on whether an authority is up.
+  if (paths.length === 0) return;
+
+  const answer = await askLedger(fence.env,
+    new Set(paths.map(path => legacySourceId('authswitch_stash', legacyHash(path)))));
+  if (answer === 'settled') throw new AuthSwitchRefusal('authority_holds_login', authorityHoldsLogin);
+  if (answer === 'not_settled') return;
+  if (await authorityUnitInstalled(fence)) throw new AuthSwitchRefusal('authority_unavailable', authorityUnavailable);
+};