@ozyman42/ozy-cli 0.4.6-linux-x64.0 → 0.4.6

package/src/modules/common/os-platform/impl.ts

@@ -0,0 +1,86 @@
+import { Effect } from "effect";
+import { writeFileSync, existsSync, unlinkSync } from "node:fs";
+import * as net from "node:net";
+import { effunct, implementing, type EffectGen } from "effective-modules";
+import type { IOSPlatform, CallerProcess } from "./interface";
+import { resolveCallerChainUnix, resolveCallerChainWindows } from "./caller-info";
+import { commonModules } from "@/modules/common";
+import { registerVirtualHID } from "./virtual-hid";
+import { log } from "@/common/log";
+
+const openCmd = process.platform === 'darwin' ? 'open'
+  : process.platform === 'linux' ? 'xdg-open'
+  : 'start';
+
+const isWindows = process.platform === 'win32';
+
+function openBrowserWindow(url: string): Effect.Effect<void, never> {
+  return Effect.sync(() => { Bun.spawnSync([openCmd, url]); });
+}
+
+function writeRestrictedFile(path: string, content: string): Effect.Effect<void, string> {
+  return Effect.try({
+    try: () => {
+      if (isWindows) {
+        writeFileSync(path, content);
+        const result = Bun.spawnSync(['icacls', path, '/inheritance:r', '/grant:r', `${process.env['USERNAME']}:(R,W)`]);
+        if (result.exitCode !== 0)
+          throw new Error(`icacls failed with exit code ${result.exitCode}`);
+      } else {
+        writeFileSync(path, content, { mode: 0o600 });
+      }
+    },
+    catch: (e) => `Failed to write restricted file ${path}: ${e instanceof Error ? e.message : String(e)}`,
+  });
+}
+
+function makeConnectionHandler(onData: (data: Buffer, callerChain: CallerProcess[]) => EffectGen<Buffer>, resolveChain: (socket: net.Socket) => CallerProcess[]) {
+  return (socket: net.Socket) => {
+    let callerChain: CallerProcess[];
+    try {
+      callerChain = resolveChain(socket);
+    } catch (e) {
+      log(`[socket-server] ERROR: Failed to get caller info — closing connection. Reason: ${e instanceof Error ? e.message : String(e)}`);
+      socket.destroy();
+      return;
+    }
+    socket.on('data', async (data) => {
+      try {
+        socket.write(await Effect.runPromise(effunct(onData)(data, callerChain)));
+      } catch (e) {
+        log(`[socket-server] ERROR in onData: ${e instanceof Error ? e.message : String(e)}`);
+        socket.destroy();
+      }
+    });
+  };
+}
+
+export class OSPlatformImpl extends implementing(commonModules.OSPlatform) implements IOSPlatform {
+  openBrowserWindow(url: string) { return openBrowserWindow(url); }
+  writeRestrictedFile(path: string, content: string) { return writeRestrictedFile(path, content); }
+  *startSocketServer(socketPath: string, onData: (data: Buffer, callerChain: CallerProcess[]) => EffectGen<Buffer>): EffectGen<void, string> {
+    return yield* Effect.try({
+      try: () => {
+        if (existsSync(socketPath)) unlinkSync(socketPath);
+        if (isWindows) {
+          const pipePath = `\\\\.\\pipe\\${socketPath.replace(/[/\\:]/g, '-')}`;
+          const server = net.createServer(makeConnectionHandler(onData, (socket) => {
+            const remotePid = (socket as any)._handle?.remotePid as number | undefined;
+            if (remotePid == null) throw new Error('socket._handle.remotePid unavailable on this Windows/Bun version');
+            return resolveCallerChainWindows(remotePid);
+          }));
+          server.listen(pipePath);
+        } else {
+          const server = net.createServer(makeConnectionHandler(onData, (socket) => {
+            const fd = (socket as any)._handle?.fd as number | undefined;
+            if (fd == null) throw new Error('socket._handle.fd unavailable — cannot resolve peer PID');
+            return resolveCallerChainUnix(fd);
+          }));
+          server.listen(socketPath);
+        }
+      },
+      catch: (e) => `Failed to start socket server at ${socketPath}: ${e instanceof Error ? e.message : String(e)}`,
+    });
+  }
+  registerVirtualHID(onMessage: (data: Buffer) => Effect.Effect<Buffer>) { return registerVirtualHID(onMessage); }
+}

package/src/modules/common/os-platform/interface.ts

@@ -0,0 +1,16 @@
+import { Effect } from "effect";
+import type { Option } from "effect";
+import type { EffectGen } from "effective-modules";
+
+export interface CallerProcess {
+  pid: number;
+  command: string;
+  directory: Option.Option<string>;
+}
+
+export interface IOSPlatform {
+  openBrowserWindow(url: string): Effect.Effect<void, never>;
+  writeRestrictedFile(path: string, content: string): Effect.Effect<void, string>;
+  startSocketServer(socketPath: string, onData: (data: Buffer, callerChain: CallerProcess[]) => EffectGen<Buffer>): EffectGen<void, string>;
+  registerVirtualHID(onMessage: (data: Buffer) => Effect.Effect<Buffer>): Effect.Effect<void, string>;
+}

package/src/modules/common/os-platform/virtual-hid/index.ts

@@ -0,0 +1,12 @@
+import { Effect } from "effect";
+import { registerVirtualHIDMac } from "./mac";
+import { registerVirtualHIDLinux } from "./linux";
+import { registerVirtualHIDWindows } from "./windows";
+
+export function registerVirtualHID(
+  onMessage: (data: Buffer) => Effect.Effect<Buffer>
+): Effect.Effect<void, string> {
+  if (process.platform === 'darwin') return registerVirtualHIDMac(onMessage);
+  if (process.platform === 'win32') return registerVirtualHIDWindows(onMessage);
+  return registerVirtualHIDLinux(onMessage);
+}

package/src/modules/common/os-platform/virtual-hid/linux.ts

@@ -0,0 +1,7 @@
+import { Effect } from "effect";
+
+export function registerVirtualHIDLinux(
+  _onMessage: (data: Buffer) => Effect.Effect<Buffer>
+): Effect.Effect<void, string> {
+  return Effect.fail('registerVirtualHID is not yet supported on Linux');
+}

package/src/modules/common/os-platform/virtual-hid/mac.ts

@@ -0,0 +1,150 @@
+import { Effect, Option, pipe } from "effect";
+import { JSCallback, dlopen, FFIType, ptr, toArrayBuffer } from "bun:ffi";
+import type { Pointer } from "bun:ffi";
+
+// FIDO Alliance usage page (0xF1D0), 64-byte in/out reports, no report IDs
+const FIDO2_HID_DESCRIPTOR = new Uint8Array([
+  0x06, 0xD0, 0xF1, // Usage Page (FIDO Alliance 0xF1D0, little-endian)
+  0x09, 0x01,       // Usage (U2F HID Authenticator Device)
+  0xA1, 0x01,       // Collection (Application)
+  0x09, 0x20,       //   Usage (Input report data)
+  0x15, 0x00,       //   Logical Minimum (0)
+  0x26, 0xFF, 0x00, //   Logical Maximum (255)
+  0x75, 0x08,       //   Report Size (8 bits)
+  0x95, 0x40,       //   Report Count (64)
+  0x81, 0x02,       //   Input (Data, Variable, Absolute)
+  0x09, 0x21,       //   Usage (Output report data)
+  0x15, 0x00,       //   Logical Minimum (0)
+  0x26, 0xFF, 0x00, //   Logical Maximum (255)
+  0x75, 0x08,       //   Report Size (8 bits)
+  0x95, 0x40,       //   Report Count (64)
+  0x91, 0x02,       //   Output (Data, Variable, Absolute)
+  0xC0,             // End Collection
+]);
+
+const kIOHIDReportTypeOutput = 1;
+const kIOReturnSuccess = 0;
+const kCFStringEncodingUTF8 = 0x08000100;
+const kCFPropertyListImmutable = 0;
+
+// Kept at module scope to prevent GC while the virtual device is running
+let _vhidCallback: JSCallback | null = null;
+_vhidCallback;
+
+const fromPtr = (label: string, p: Pointer | null): Effect.Effect<Pointer, string> =>
+  pipe(
+    Option.fromNullishOr(p),
+    Effect.fromOption,
+    Effect.mapError(() => `${label} returned NULL`),
+  );
+
+// Build the device properties as an XML plist. CFPropertyListCreateWithData parses this
+// into a fully-initialized CFDictionary (with correct hash/equal callbacks), avoiding
+// the need to pass raw CFDictionaryKeyCallBacks structs via FFI.
+function buildDevicePropertiesPlist(): Uint8Array {
+  const descriptorB64 = Buffer.from(FIDO2_HID_DESCRIPTOR).toString('base64');
+  const xml = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    '<dict>',
+    '  <key>ReportDescriptor</key>',
+    `  <data>${descriptorB64}</data>`,
+    '  <key>VendorID</key>',
+    '  <integer>4617</integer>',   // 0x1209 - pid.codes open-source VID
+    '  <key>ProductID</key>',
+    '  <integer>1</integer>',
+    '  <key>VersionNumber</key>',
+    '  <integer>256</integer>',    // 0x0100
+    '  <key>Product</key>',
+    '  <string>Ozy Virtual FIDO2 Key</string>',
+    '</dict>',
+    '</plist>',
+  ].join('\n');
+  return new TextEncoder().encode(xml);
+}
+
+export function registerVirtualHIDMac(
+  onMessage: (data: Buffer) => Effect.Effect<Buffer>
+): Effect.Effect<void, string> {
+  return Effect.gen(function* () {
+    console.log('[vhid] loading frameworks');
+
+    const IOKit = yield* Effect.try({
+      try: () => dlopen('/System/Library/Frameworks/IOKit.framework/IOKit', {
+        IOHIDUserDeviceCreate: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.ptr },
+        IOHIDUserDeviceRegisterSetReportCallback: { args: [FFIType.ptr, FFIType.ptr, FFIType.ptr], returns: FFIType.void },
+        IOHIDUserDeviceScheduleWithRunLoop: { args: [FFIType.ptr, FFIType.ptr, FFIType.ptr], returns: FFIType.void },
+        IOHIDUserDeviceHandleReport: { args: [FFIType.ptr, FFIType.ptr, FFIType.i64], returns: FFIType.i32 },
+      }),
+      catch: (e) => `Failed to load IOKit: ${e}`,
+    });
+
+    const CF = yield* Effect.try({
+      try: () => dlopen('/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation', {
+        CFRunLoopGetCurrent: { args: [], returns: FFIType.ptr },
+        CFRunLoopRunInMode: { args: [FFIType.ptr, FFIType.f64, FFIType.bool], returns: FFIType.i32 },
+        CFStringCreateWithCString: { args: [FFIType.ptr, FFIType.ptr, FFIType.u32], returns: FFIType.ptr },
+        CFDataCreate: { args: [FFIType.ptr, FFIType.ptr, FFIType.i64], returns: FFIType.ptr },
+        CFPropertyListCreateWithData: { args: [FFIType.ptr, FFIType.ptr, FFIType.u64, FFIType.ptr, FFIType.ptr], returns: FFIType.ptr },
+        CFRelease: { args: [FFIType.ptr], returns: FFIType.void },
+      }),
+      catch: (e) => `Failed to load CoreFoundation: ${e}`,
+    });
+
+    console.log('[vhid] frameworks loaded');
+
+    const encoder = new TextEncoder();
+
+    const makeCFString = (s: string): Effect.Effect<Pointer, string> =>
+      // TextEncoder gives a Uint8Array with its own ArrayBuffer (byteOffset=0, pool-safe)
+      fromPtr(`CFStringCreateWithCString("${s}")`,
+        CF.symbols.CFStringCreateWithCString(null, ptr(encoder.encode(s + '\0')), kCFStringEncodingUTF8));
+
+    const makeCFData = (data: Uint8Array): Effect.Effect<Pointer, string> =>
+      fromPtr('CFDataCreate', CF.symbols.CFDataCreate(null, ptr(data), BigInt(data.length)));
+
+    console.log('[vhid] building device properties plist');
+    const plistBytes = buildDevicePropertiesPlist();
+    const plistData = yield* makeCFData(plistBytes);
+
+    const dict = yield* fromPtr('CFPropertyListCreateWithData',
+      CF.symbols.CFPropertyListCreateWithData(null, plistData, BigInt(kCFPropertyListImmutable), null, null));
+    CF.symbols.CFRelease(plistData);
+    console.log('[vhid] device properties dict =', dict);
+
+    console.log('[vhid] creating IOHIDUserDevice');
+    const device = yield* fromPtr('IOHIDUserDeviceCreate', IOKit.symbols.IOHIDUserDeviceCreate(null, dict));
+    CF.symbols.CFRelease(dict);
+    console.log('[vhid] IOHIDUserDeviceCreate =', device);
+
+    const callback = yield* Effect.try({
+      try: () => new JSCallback(
+        (_refcon: number, _result: number, _sender: number, type: number, _reportID: number, report: number, reportLength: number) => {
+          if (type !== kIOHIDReportTypeOutput) return kIOReturnSuccess;
+          const incoming = Buffer.from(toArrayBuffer(report as unknown as Pointer, 0, reportLength));
+          console.log(`[vhid] received ${incoming.length} bytes: ${incoming.toString('hex')}`);
+          Effect.runPromise(onMessage(incoming)).then(response => {
+            const responseBuf = new Uint8Array(64);
+            response.copy(Buffer.from(responseBuf.buffer), 0, 0, Math.min(response.length, 64));
+            IOKit.symbols.IOHIDUserDeviceHandleReport(device, ptr(responseBuf), BigInt(responseBuf.length));
+          }).catch(() => {});
+          return kIOReturnSuccess;
+        },
+        { returns: 'i32', args: ['ptr', 'i32', 'ptr', 'i32', 'u32', 'ptr', 'i64'] },
+      ),
+      catch: (e) => `Failed to create JSCallback: ${e}`,
+    });
+    _vhidCallback = callback;
+
+    IOKit.symbols.IOHIDUserDeviceRegisterSetReportCallback(device, callback.ptr, null);
+
+    const runLoop = CF.symbols.CFRunLoopGetCurrent();
+    const runLoopMode = yield* makeCFString('kCFRunLoopDefaultMode');
+    IOKit.symbols.IOHIDUserDeviceScheduleWithRunLoop(device, runLoop, runLoopMode);
+
+    console.log('[vhid] virtual FIDO2 device active, pumping run loop');
+    // Pump CFRunLoop from Bun's libuv event loop without blocking
+    setInterval(() => CF.symbols.CFRunLoopRunInMode(runLoopMode, 0.0, false), 10);
+  });
+}

package/src/modules/common/os-platform/virtual-hid/windows.ts

@@ -0,0 +1,7 @@
+import { Effect } from "effect";
+
+export function registerVirtualHIDWindows(
+  _onMessage: (data: Buffer) => Effect.Effect<Buffer>
+): Effect.Effect<void, string> {
+  return Effect.fail('registerVirtualHID is not yet supported on Windows');
+}

package/src/modules/common/ssh-config/impl.ts

@@ -0,0 +1,130 @@
+import * as fs from "node:fs/promises";
+import { join } from "node:path";
+import { writeFileSync } from "node:fs";
+import { Effect, Option, Schema } from "effect";
+import SSHConfig, { LineType } from "ssh-config";
+import expandTilde from "expand-tilde";
+import { implementing, type EffectGen } from "effective-modules";
+import { commonModules } from "@/modules/common";
+
+import { SSHConfigSection, type ISSHConfig, type SSHConfigHosts, type WriteHostInput, type WritePubkeyInput } from "./interface";
+
+const SSH_CONFIG_PATH = "~/.ssh/config";
+const SSH_DIR = "~/.ssh";
+
+export class SSHConfigImpl extends implementing(commonModules.SSHConfig) implements ISSHConfig {
+  private *loadSSHConfigRaw(): EffectGen<SSHConfig, string> {
+    const configPath = expandTilde(SSH_CONFIG_PATH);
+    const exists = yield* Effect.promise(() => fs.exists(configPath));
+    const text = exists
+      ? yield* Effect.tryPromise({
+          try: () => fs.readFile(configPath, "utf8"),
+          catch: (e) => `Failed to read ssh config at ${configPath}: ${e instanceof Error ? e.message : String(e)}`,
+        })
+      : "";
+    return yield* Effect.try({
+      try: () => SSHConfig.parse(text),
+      catch: (e) => `ParseError: unable to parse ssh config at ${configPath}\n${e instanceof Error ? e.message : String(e)}`,
+    });
+  }
+
+  *getSSHConfig(): EffectGen<SSHConfigHosts, string> {
+    const configPath = expandTilde(SSH_CONFIG_PATH);
+    const exists = yield* Effect.promise(() => fs.exists(configPath));
+    if (!exists)
+      return yield* Effect.fail(`SSHConfigFileMissingError: No file found at ${configPath}`);
+
+    const parsed = yield* this.loadSSHConfigRaw();
+
+    const hosts: SSHConfigHosts = {};
+    for (const line of parsed) {
+      if (line.type === LineType.COMMENT) continue;
+      const { param, value: host } = line;
+      if (param !== "Host")
+        return yield* Effect.fail(`EntryNotAHostKeyValuePairError: unexpected top-level entry '${param}=${JSON.stringify(host)}'`);
+      if (typeof host !== "string")
+        return yield* Effect.fail(`EntryNotAHostKeyValuePairError: Host value is not a string: ${JSON.stringify(host)}`);
+      if (!("config" in line))
+        return yield* Effect.fail(`EntryNotAHostKeyValuePairError: non-section Host entry '${host}'`);
+      if (host in hosts)
+        return yield* Effect.fail(`DuplicateHostError: duplicate Host '${host}' in ${configPath}`);
+
+      const kv: Record<string, string> = {};
+      for (const inner of line.config) {
+        if (inner.type === LineType.COMMENT) continue;
+        if (typeof inner.value !== "string")
+          return yield* Effect.fail(`MalformedError: Host '${host}' key '${inner.param}' has non-string value`);
+        kv[inner.param] = inner.value;
+      }
+
+      const section = yield* Schema.decodeUnknownEffect(SSHConfigSection)(kv).pipe(
+        Effect.mapError(e => `MalformedError: malformed section at Host '${host}': ${String(e)}`)
+      );
+      hosts[host] = section;
+    }
+
+    return hosts;
+  }
+
+  *writeHost({ section }: WriteHostInput): EffectGen<void, string> {
+    const configPath = expandTilde(SSH_CONFIG_PATH);
+    const cfg = yield* this.loadSSHConfigRaw();
+    const newEntries = Object.entries(section)
+      .filter(([, v]) => v !== undefined)
+      .map(([k, v]) => ({ type: LineType.DIRECTIVE, before: '  ', param: k, separator: ' ', value: v as string, after: '\n' }));
+
+    const existingIdx = cfg.findIndex((e: any) => e.param === "Host" && e.value === section.HostName);
+    if (existingIdx >= 0) {
+      (cfg[existingIdx] as any).config = newEntries;
+    } else {
+      const record: Record<string, string> = { Host: section.HostName };
+      for (const [k, v] of Object.entries(section)) {
+        if (v !== undefined) record[k] = v;
+      }
+      cfg.append(record);
+    }
+
+    yield* Effect.try({
+      try: () => writeFileSync(configPath, SSHConfig.stringify(cfg), { mode: 0o600 }),
+      catch: (e) => `Failed to write ssh config: ${e instanceof Error ? e.message : String(e)}`,
+    });
+  }
+
+  *listPubkeyFiles(): EffectGen<{name: string, content: string}[], string> {
+    const sshDir = expandTilde(SSH_DIR);
+    const entries = yield* Effect.tryPromise({
+      try: () => fs.readdir(sshDir),
+      catch: (e) => `Failed to read ${sshDir}: ${e instanceof Error ? e.message : String(e)}`,
+    });
+    const pubkeyFiles = entries.filter(f => f.endsWith('.pub'));
+    const results: {name: string, content: string}[] = [];
+    for (const file of pubkeyFiles) {
+      const content = yield* Effect.tryPromise({
+        try: () => fs.readFile(join(sshDir, file), 'utf8'),
+        catch: (e) => `Failed to read ${file}: ${e instanceof Error ? e.message : String(e)}`,
+      });
+      results.push({ name: file.slice(0, -'.pub'.length), content: content.trim() });
+    }
+    return results;
+  }
+
+  getPubkeyPath(name: string): string {
+    return `${expandTilde(SSH_DIR)}/${name}.pub`;
+  }
+
+  *writePubkey({ name, comment, pubkey }: WritePubkeyInput): EffectGen<{pubkeyPath: string}, string> {
+    const sshDir = expandTilde(SSH_DIR);
+    const pubkeyPath = `${sshDir}/${name}.pub`;
+    const content = Option.match(comment, {
+      onNone: () => pubkey.authorizedKey,
+      onSome: (c) => `${pubkey.authorizedKey} ${c}`,
+    });
+
+    yield* Effect.try({
+      try: () => writeFileSync(pubkeyPath, content + "\n", { mode: 0o600 }),
+      catch: (e) => `Failed to write pubkey to ${pubkeyPath}: ${e instanceof Error ? e.message : String(e)}`,
+    });
+
+    return {pubkeyPath};
+  }
+}

package/src/modules/common/ssh-config/interface.ts

@@ -0,0 +1,33 @@
+import { Schema } from "effect";
+import type { Option } from "effect";
+import type { EffectGen } from "effective-modules";
+import type { SSHPubkey } from "@/modules/common/crypto/impl";
+
+export const SSHConfigSection = Schema.Struct({
+  HostName: Schema.String,
+  User: Schema.String,
+  IdentityFile: Schema.optional(Schema.String),
+  AddKeysToAgent: Schema.optional(Schema.String),
+  IdentitiesOnly: Schema.optional(Schema.String),
+  IdentityAgent: Schema.optional(Schema.String),
+});
+export type SSHConfigSection = Schema.Schema.Type<typeof SSHConfigSection>;
+export type SSHConfigHosts = Record<string, SSHConfigSection>;
+
+export interface WriteHostInput {
+  section: SSHConfigSection;
+}
+
+export interface WritePubkeyInput {
+  name: string;
+  comment: Option.Option<string>;
+  pubkey: SSHPubkey;
+}
+
+export interface ISSHConfig {
+  getSSHConfig(): EffectGen<SSHConfigHosts, string>;
+  writeHost(input: WriteHostInput): EffectGen<void, string>;
+  writePubkey(input: WritePubkeyInput): EffectGen<{pubkeyPath: string}, string>;
+  listPubkeyFiles(): EffectGen<{name: string, content: string}[], string>;
+  getPubkeyPath(name: string): string;
+}

package/src/modules/ssh-agent/index.ts

@@ -0,0 +1,13 @@
+import { interfaces } from "effective-modules";
+import type { ISSHAgent } from "./ssh-agent/interface";
+import type { ISession } from "./session/interface";
+
+export enum AgentModules {
+  SSHAgent = "SSHAgent",
+  Session = "Session"
+}
+
+export const agentModules = interfaces<AgentModules, {
+  SSHAgent: ISSHAgent;
+  Session: ISession;
+}>(AgentModules);