@ozyman42/ozy-cli 0.4.8-linux-x64.0 → 0.4.8

package/src/modules/ssh-agent/session/interface.ts

@@ -0,0 +1,62 @@
+import type { CallerProcess } from "@/modules/common/os-platform/interface";
+import { Schema } from "effect";
+import type { EffectGen } from "effective-modules";
+import type { SSHPubkey } from "@/modules/common/crypto/impl";
+
+export const SessionError = Schema.TaggedUnion({
+  SessionTimedOut: {seconds: Schema.Number},
+  WebAuthnCancelled: {},
+  InternalError: {reason: Schema.String },
+  PubkeyMismatch: {expected: Schema.String, derived: Schema.String },
+  PubkeyNotRegistered: {pubkey: Schema.String},
+  InterruptingSession: {id: Schema.String},
+  UnexpectedSignRequest: {},
+});
+export type SessionError = Schema.Schema.Type<typeof SessionError>
+
+export const SetupInput = Schema.Struct({
+  pubkey: Schema.OptionFromNullOr(Schema.String),
+  credentialId: Schema.OptionFromNullOr(Schema.String),
+  username: Schema.String,
+});
+export type SetupInput = Schema.Schema.Type<typeof SetupInput>;
+
+export const SetupOutput = Schema.Struct({
+  pubkey: Schema.String,
+  credentialId: Schema.String
+});
+export type SetupOutput = Schema.Schema.Type<typeof SetupOutput>;
+
+export interface SignInput {
+  data: Buffer;
+  pubkey: SSHPubkey;
+  callerTree: CallerProcess[];
+}
+
+export const ExpectedSignRequest = Schema.Struct({
+  expectedCallerChain: Schema.Array(Schema.Struct({
+    command: Schema.String,
+    directory: Schema.OptionFromNullOr(Schema.String)
+  }))
+});
+export type ExpectedSignRequest = Schema.Schema.Type<typeof ExpectedSignRequest>;
+
+export const StartSessionInput = Schema.Struct({
+  expectedSignRequests: Schema.Array(ExpectedSignRequest),
+  expectedCommonAncestorPID: Schema.Number,
+  timeoutSeconds: Schema.Number,
+  pubkey: Schema.String
+});
+export type StartSessionInput = Schema.Schema.Type<typeof StartSessionInput>;
+
+export interface ISession {
+  startSession(input: StartSessionInput): EffectGen<void, SessionError>;
+  sign(input: SignInput): EffectGen<Buffer, SessionError>;
+  /*
+    Runs PRF directly. Create key from existing credential or create new credential,
+    verify against existing pubkey (if pubkey sent).
+    Register it in map.
+  */
+  setup(input: SetupInput): EffectGen<SetupOutput, SessionError>;
+}
+

package/src/modules/ssh-agent/session/passkey-prf-page.ts

@@ -0,0 +1,224 @@
+import { Option } from "effect";
+import { FUTURE_TOOL_NAME } from "@/common/constants";
+import type { ECDHKeyPair } from "@/modules/common/crypto/interface";
+import { CredentialId } from "@/modules/common/crypto/impl";
+import { PrfInput } from "./prf-flow";
+
+export interface UseOrCreatePasskeyPageInput {
+  agentKeyPair: ECDHKeyPair;
+  challenge: string;
+  context: PrfInput;
+  transportKeyContext: string;
+  username: string;
+}
+
+type Mode = 'credential' | 'selectExisting' | 'create' | 'createOrSelect';
+type ChainNode = { command: string; directory: Option.Option<string> };
+type TreeNode = { label: string; children: TreeNode[] };
+
+function escHtml(s: string): string {
+  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;');
+}
+
+function nodeLabel(node: ChainNode): string {
+  const dir = Option.getOrElse(() => '(cannot load dir)')(node.directory);
+  return `${node.command}  ${dir}`;
+}
+
+function findCommonPrefixLen(chains: ReadonlyArray<ReadonlyArray<ChainNode>>): number {
+  if (chains.length <= 1) return chains[0]?.length ?? 0;
+  let len = 0;
+  for (let i = 0; ; i++) {
+    if (chains.some(c => i >= c.length)) break;
+    const first = chains[0]![i]!;
+    if (chains.some(c => c[i]!.command !== first.command)) break;
+    len = i + 1;
+  }
+  return len;
+}
+
+function buildTreeNodes(chains: ReadonlyArray<ReadonlyArray<ChainNode>>, from: number): TreeNode[] {
+  const groups = new Map<string, { chains: ReadonlyArray<ChainNode>[]; node: ChainNode }>();
+  for (const chain of chains) {
+    if (from >= chain.length) continue;
+    const node = chain[from]!;
+    const key = `${node.command}|${Option.getOrElse(() => '')(node.directory)}`;
+    const existing = groups.get(key);
+    if (existing) {
+      existing.chains.push(chain);
+    } else {
+      groups.set(key, { chains: [chain], node });
+    }
+  }
+  return Array.from(groups.values()).map(({ chains: groupChains, node }) => ({
+    label: nodeLabel(node),
+    children: buildTreeNodes(groupChains, from + 1),
+  }));
+}
+
+function renderTreeLines(nodes: TreeNode[], prefix: string): string[] {
+  const lines: string[] = [];
+  for (let i = 0; i < nodes.length; i++) {
+    const node = nodes[i]!;
+    const isLast = i === nodes.length - 1;
+    const connector = isLast ? '└── ' : '├── ';
+    const childPrefix = prefix + (isLast ? '    ' : '│   ');
+    lines.push(escHtml(prefix + connector + node.label));
+    lines.push(...renderTreeLines(node.children, childPrefix));
+  }
+  return lines;
+}
+
+function buildSignRequestTreeHtml(chains: ReadonlyArray<ReadonlyArray<ChainNode>>): string {
+  if (chains.length === 0) return '';
+  const commonPrefixLen = findCommonPrefixLen(chains);
+  const minLen = Math.min(...chains.map(c => c.length));
+  // Show at least 3 levels per branch; always include divergence point
+  const displayStart = Math.max(0, Math.min(commonPrefixLen, minLen - 3));
+
+  const rootNodes = buildTreeNodes(chains, displayStart);
+  const lines: string[] = [];
+
+  if (rootNodes.length === 1) {
+    lines.push(escHtml(rootNodes[0]!.label));
+    lines.push(...renderTreeLines(rootNodes[0]!.children, ''));
+  } else {
+    lines.push(...renderTreeLines(rootNodes, ''));
+  }
+
+  return `<pre class="tree">${lines.join('\n')}</pre>`;
+}
+
+function getContextInfo(context: PrfInput): { contextHtml: string; credentialId: string | null; mode: Mode; friendlyName: string | null } {
+  return PrfInput.$match(context, {
+    DerivePubkeyOnly: ({ credentialId: credOpt, pubkey }) => {
+      const credIdBase58 = Option.getOrNull(credOpt);
+      const credIdBase64 = credIdBase58 ? new CredentialId(credIdBase58).base64 : null;
+      const mode: Mode = credIdBase64 !== null ? 'credential'
+        : Option.isSome(pubkey) ? 'selectExisting'
+        : 'createOrSelect';
+      const friendlyName = credIdBase58 ? new CredentialId(credIdBase58).humanReadableName : null;
+      const contextHtml = friendlyName && credIdBase58
+        ? `<p style="color:#666;font-size:.95rem">Setup — confirming ownership of <strong>${escHtml(friendlyName)}</strong> (${escHtml(credIdBase58)})</p>`
+        : '<p style="color:#666;font-size:.95rem">Setup — create or select a passkey for SSH signing</p>';
+      return { contextHtml, credentialId: credIdBase64, mode, friendlyName };
+    },
+    DerivePubkeyForRequests: ({ session }) => {
+      const chains = session.definition.expectedSignRequests.map(r => r.expectedCallerChain);
+      const friendlyName = new CredentialId(session.credentialId).humanReadableName;
+      const contextHtml = `<p style="color:#666;font-size:.95rem">Signing with <strong>${escHtml(friendlyName)}</strong> (${escHtml(session.credentialId)})</p>${buildSignRequestTreeHtml(chains)}`;
+      return {
+        contextHtml,
+        credentialId: new CredentialId(session.credentialId).base64,
+        mode: 'credential' as Mode,
+        friendlyName,
+      };
+    },
+  });
+}
+
+function buttonsHtml(mode: Mode, friendlyName: string | null): string {
+  if (mode === 'createOrSelect') {
+    return `<button class="btn" onclick="btnClick('create')">Create new passkey</button>` +
+           `<button class="btn" onclick="btnClick('selectExisting')">Sign with existing passkey</button>`;
+  }
+  const label = mode === 'credential' && friendlyName ? `Sign with ${friendlyName}`
+    : mode === 'selectExisting' ? 'Sign with existing passkey'
+    : 'Create new passkey';
+  return `<button class="btn" onclick="btnClick()">Authorize — ${label}</button>`;
+}
+
+export function useOrCreatePasskeyPage(input: UseOrCreatePasskeyPageInput): string {
+  const { agentKeyPair, challenge, context, transportKeyContext, username } = input;
+  const capitalizedName = FUTURE_TOOL_NAME.slice(0, 1).toLocaleUpperCase() + FUTURE_TOOL_NAME.slice(1);
+  const title = `${capitalizedName} SSH Auth`;
+
+  const { contextHtml, credentialId, mode, friendlyName } = getContextInfo(context);
+
+  const cfg = JSON.stringify({
+    agentPublicKey: agentKeyPair.base64Pubkey,
+    challenge,
+    credentialId,
+    mode,
+    username,
+  }).replace(/</g, "\\u003c");
+
+  return `<!DOCTYPE html>
+<html>
+<head><title>${title}</title><meta charset="utf-8">
+<style>
+body{font-family:system-ui,sans-serif;max-width:560px;margin:80px auto;padding:0 20px;text-align:center}
+h1{font-size:1.5rem}#st{font-size:1.1rem;margin-top:20px}.ok{color:#060}.err{color:#d00}
+.btn{margin:8px 4px;padding:10px 28px;font-size:1rem;cursor:pointer}.btn:disabled{cursor:default;opacity:.5}
+.tree{font-family:monospace;text-align:left;font-size:.85rem;background:#f5f5f5;padding:12px;border-radius:6px;overflow-x:auto;margin:16px 0}
+</style>
+</head>
+<body>
+<h1>${title}</h1>
+${contextHtml}
+<div id="trust-row" style="margin-bottom:16px;color:#aaa;font-size:.9rem"><label><input type="checkbox" id="trust" onchange="trustChanged()"> trust this device (cache SSH private key) for <input type="number" id="mins" value="15" min="1" disabled style="width:4rem;color:#aaa"> minutes</label></div>
+${buttonsHtml(mode, friendlyName)}
+<p id="st"></p>
+<script>
+const C=${cfg};
+function bu(b){return btoa(String.fromCharCode(...new Uint8Array(b))).replace(/\\+/g,'-').replace(/\\//g,'_').replace(/=+$/,'')}
+function fu(s){const b=atob(s.replace(/-/g,'+').replace(/_/g,'/'));const u=new Uint8Array(b.length);for(let i=0;i<b.length;i++)u[i]=b.charCodeAt(i);return u}
+function btnClick(m){document.querySelectorAll('.btn').forEach(b=>b.disabled=true);main(m);}
+function trustChanged(){const c=document.getElementById('trust').checked;const m=document.getElementById('mins');document.getElementById('trust-row').style.color=c?'':'#aaa';m.disabled=!c;m.style.color=c?'':'#aaa';}
+async function main(modeOverride){
+  const mode=modeOverride??C.mode;
+  const st=document.getElementById('st');
+  const fid=new URLSearchParams(location.search).get('id');
+  try{
+    const ch=fu(C.challenge);
+    const salt=new Uint8Array(32);new TextEncoder().encodeInto('${FUTURE_TOOL_NAME}-prf-v1',salt);
+    let cred;
+    if(mode==='credential'){
+      cred=await navigator.credentials.get({publicKey:{
+        challenge:ch,userVerification:'required',
+        allowCredentials:[{type:'public-key',id:fu(C.credentialId)}],
+        extensions:{prf:{eval:{first:salt}}}
+      }});
+    }else if(mode==='selectExisting'){
+      cred=await navigator.credentials.get({publicKey:{
+        challenge:ch,userVerification:'required',
+        extensions:{prf:{eval:{first:salt}}}
+      }});
+    }else{
+      cred=await navigator.credentials.create({publicKey:{
+        challenge:ch,rp:{name:'${FUTURE_TOOL_NAME} challenge'},
+        user:{id:crypto.getRandomValues(new Uint8Array(16)),name:C.username,displayName:C.username+' — ${capitalizedName} SSH Key'},
+        pubKeyCredParams:[{alg:-7,type:'public-key'}],
+        authenticatorSelection:{authenticatorAttachment:'platform',userVerification:'required',residentKey:'required'},
+        extensions:{prf:{eval:{first:salt}}}
+      }});
+    }
+    const prf=cred.getClientExtensionResults().prf?.results?.first;
+    if(!prf)throw Object.assign(new Error('PRF extension not returned — authenticator may not support PRF'),{noRetry:true});
+    const ap=await crypto.subtle.importKey('raw',fu(C.agentPublicKey),{name:'ECDH',namedCurve:'P-256'},false,[]);
+    const bkp=await crypto.subtle.generateKey({name:'ECDH',namedCurve:'P-256'},true,['deriveBits']);
+    const sh=await crypto.subtle.deriveBits({name:'ECDH',public:ap},bkp.privateKey,256);
+    const hk=await crypto.subtle.importKey('raw',sh,'HKDF',false,['deriveKey']);
+    const ak=await crypto.subtle.deriveKey(
+      {name:'HKDF',hash:'SHA-256',salt:new Uint8Array(32),info:new TextEncoder().encode('${transportKeyContext}')},
+      hk,{name:'AES-GCM',length:256},false,['encrypt']
+    );
+    const iv=crypto.getRandomValues(new Uint8Array(12));
+    const enc=await crypto.subtle.encrypt({name:'AES-GCM',iv},ak,prf);
+    const bp=await crypto.subtle.exportKey('raw',bkp.publicKey);
+    const cm=document.getElementById('trust').checked?Math.max(1,parseInt(document.getElementById('mins').value,10)||15):undefined;
+    const r=await fetch('/seed?id='+fid,{method:'POST',headers:{'Content-Type':'application/json'},
+      body:JSON.stringify({encryptedSeed:bu(enc),iv:bu(iv),browserPublicKey:bu(bp),credentialId:bu(cred.rawId),cacheMinutes:cm})});
+    if(!r.ok)throw new Error('Agent returned '+r.status);
+    const d=await r.json();
+    st.className='ok';st.textContent='Authorized as '+d.friendlyName+'. You can close this tab.';
+  }catch(e){
+    const cancelled=e&&(e.name==='NotAllowedError'||e.name==='AbortError');
+    await fetch('/error?id='+fid,{method:'POST',headers:{'Content-Type':'application/json'},
+      body:JSON.stringify({cancelled,message:e?.message??String(e)})}).catch(()=>{});
+    st.className='err';st.textContent=(cancelled?'Cancelled or passkey not found.':'Error: '+(e?.message??e))+' You can close this tab.';
+  }
+}
+</script>
+</body></html>`;
+}

package/src/modules/ssh-agent/session/prf-flow.ts

@@ -0,0 +1,152 @@
+import { Effect, Option, pipe, Deferred, Scope, Data, Result } from "effect";
+import { effunct, type EffectGen } from "effective-modules";
+import { SessionError } from "./interface";
+import { FUTURE_TOOL_NAME } from "@/common/constants";
+import { randomUUID } from "node:crypto";
+import { CredentialId } from "@/modules/common/crypto/impl";
+import { useOrCreatePasskeyPage } from "./passkey-prf-page";
+import { CommonModules, commonModules } from "@/modules/common";
+import { log } from "@/common/log";
+import { SSHKeyPair } from "@/modules/common/crypto/impl";
+import type { ActiveSession } from "./impl";
+
+type BrowserResult = {
+  seed: Uint8Array;
+  credentialId: CredentialId;
+  cacheMinutes?: number;
+};
+
+export type PrfResult = {
+  keyPair: SSHKeyPair;
+  credentialId: CredentialId;
+  cacheMinutes?: number;
+};
+
+export type PrfInput = Data.TaggedEnum<{
+  DerivePubkeyOnly: {
+    pubkey: Option.Option<string>;
+    credentialId: Option.Option<string>;
+    username: string;
+  },
+  DerivePubkeyForRequests: {
+    session: ActiveSession
+  }
+}>
+export const PrfInput = Data.taggedEnum<PrfInput>();
+
+const TRANSPORT_KEY_CONTEXT = `${FUTURE_TOOL_NAME}-transport-v1`;
+
+export function* prfFlow(input: PrfInput): EffectGen<PrfResult, SessionError, CommonModules.Crypto | CommonModules.OSPlatform | Scope.Scope> {
+  const crypto = yield* commonModules.Crypto;
+  const osPlatform = yield* commonModules.OSPlatform;
+
+  const flowId = PrfInput.$match(input, {
+    DerivePubkeyOnly: () => randomUUID(),
+    DerivePubkeyForRequests: ({ session }) => session.id,
+  });
+
+  const agentKeyPair = yield* pipe(
+    effunct(crypto.createECDHKey)(),
+    Effect.catch(err => Effect.fail(SessionError.cases.InternalError.make({ reason: err })))
+  );
+
+  const challenge = yield* crypto.getRandomChallenge();
+  const deferred = yield* Deferred.make<BrowserResult, SessionError>();
+
+  const server = yield* Effect.acquireRelease(
+    Effect.sync(() =>
+      Bun.serve({
+        port: 0,
+        async fetch(req) {
+          const url = new URL(req.url);
+          if (url.searchParams.get("id") !== flowId) {
+            return new Response("Forbidden", { status: 403 });
+          }
+          if (url.pathname === "/" && req.method === "GET") {
+            return new Response(
+              useOrCreatePasskeyPage({
+                agentKeyPair, challenge, context: input,
+                transportKeyContext: TRANSPORT_KEY_CONTEXT,
+                username: PrfInput.$match(input, {
+                  DerivePubkeyOnly: ({ username }) => username,
+                  DerivePubkeyForRequests: () => '',
+                }),
+              }),
+              { headers: { "Content-Type": "text/html; charset=utf-8" } }
+            );
+          }
+          if (url.pathname === "/seed" && req.method === "POST") {
+            try {
+              const body = await req.json() as {
+                encryptedSeed: string; iv: string;
+                browserPublicKey: string; credentialId: string;
+                cacheMinutes?: number;
+              };
+              Effect.runFork(Effect.gen(function* () {
+                const innerResult = yield* Effect.result(Effect.gen(function* () {
+                  const decrypted = yield* crypto.decrypt({
+                    senderPubkey: body.browserPublicKey,
+                    receiverKey: agentKeyPair.keyPair,
+                    cipherText: body.encryptedSeed,
+                    iv: body.iv,
+                    hkdfInfo: TRANSPORT_KEY_CONTEXT
+                  });
+                  const completed = yield* Deferred.succeed(deferred, {
+                    seed: decrypted,
+                    credentialId: CredentialId.fromBase64(body.credentialId),
+                    cacheMinutes: body.cacheMinutes,
+                  });
+                  if (!completed) {
+                    yield* Effect.fail(SessionError.cases.InternalError.make({
+                      reason: 'Detected multiple POSTs to seed endpoint'
+                    }));
+                  }
+                }));
+                if (Result.isFailure(innerResult)) {
+                  console.error('[/seed fork error]', innerResult.failure);
+                  yield* Deferred.fail(deferred, SessionError.cases.InternalError.make({
+                    reason: `Seed decryption failed: ${String(innerResult.failure)}`
+                  }));
+                }
+              }));
+              return new Response(JSON.stringify({ ok: true, friendlyName: CredentialId.fromBase64(body.credentialId).humanReadableName }), {
+                headers: { "Content-Type": "application/json" },
+              });
+            } catch (e) {
+              console.error("[/seed handler error]", e);
+              Effect.runFork(Deferred.fail(deferred, SessionError.cases.InternalError.make({
+                reason: (e as Error).toString()
+              })));
+              return new Response(JSON.stringify({ error: String(e) }), {
+                status: 500, headers: { "Content-Type": "application/json" },
+              });
+            }
+          }
+          if (url.pathname === "/error" && req.method === "POST") {
+            const body = await req.json() as { cancelled: boolean; message: string };
+            const error = body.cancelled
+              ? SessionError.cases.WebAuthnCancelled.make({})
+              : SessionError.cases.InternalError.make({ reason: body.message });
+            Effect.runFork(Deferred.fail(deferred, error));
+            return new Response(JSON.stringify({ ok: true }), {
+              headers: { "Content-Type": "application/json" },
+            });
+          }
+          return new Response("Not found", { status: 404 });
+        },
+      })
+    ),
+    (server) => Effect.sync(() => server.stop())
+  );
+
+  log(`Opening browser for WebAuthn PRF on port ${server.port}`);
+  yield* osPlatform.openBrowserWindow(`http://localhost:${server.port}/?id=${flowId}`);
+
+  const { seed, credentialId, cacheMinutes } = yield* Deferred.await(deferred);
+
+  const keyPair = yield* pipe(
+    SSHKeyPair.fromSeed(seed, `${FUTURE_TOOL_NAME}-key-v1`),
+    Effect.mapError(reason => SessionError.cases.InternalError.make({ reason }))
+  );
+  return { keyPair, credentialId, cacheMinutes };
+}

package/src/modules/ssh-agent/ssh-agent/impl.ts

@@ -0,0 +1,136 @@
+import { Effect, pipe, Result, Layer } from "effect";
+import { effunct, implementing, type EffectGen } from "effective-modules";
+import type { ISSHAgent } from "./interface";
+import type { CallerProcess } from "@/modules/common/os-platform/interface";
+import { agentModules } from "@/modules/ssh-agent";
+import { commonModules } from "@/modules/common";
+import { SSHPubkey } from "@/modules/common/crypto/impl";
+import { log } from "@/common/log";
+import { renderCallerTree } from "@/common/render-caller-tree";
+import { AGENT_PID_FILE_PATH, AGENT_SOCK_FILE_PATH } from "@/common/constants";
+import { writeFileSync } from "node:fs";
+
+const SSH2_AGENT_FAILURE = 5;
+const SSH2_AGENT_REQUEST_IDENTITIES = 11;
+const SSH2_AGENT_IDENTITIES_ANSWER = 12;
+const SSH2_AGENT_SIGN_REQUEST = 13;
+const SSH2_AGENT_SIGN_RESPONSE = 14;
+const SSH2_AGENT_EXTENSION = 27;
+
+function u32(n: number): Buffer {
+  const b = Buffer.allocUnsafe(4);
+  b.writeUInt32BE(n, 0);
+  return b;
+}
+
+function sshString(s: Buffer): Buffer {
+  return Buffer.concat([u32(s.length), s]);
+}
+
+function buildSignResponse(keyType: string, signature: Buffer): Buffer {
+  const sigBlob = Buffer.concat([sshString(Buffer.from(keyType)), sshString(signature)]);
+  const body = Buffer.concat([Buffer.from([SSH2_AGENT_SIGN_RESPONSE]), sshString(sigBlob)]);
+  return Buffer.concat([u32(body.length), body]);
+}
+
+function failureResponse(): Buffer {
+  const r = Buffer.alloc(5);
+  r.writeUInt32BE(1, 0);
+  r[4] = SSH2_AGENT_FAILURE;
+  return r;
+}
+
+const { KeyMapStore, OSPlatform } = commonModules;
+const { SSHAgent, Session } = agentModules;
+
+export class SSHAgentImpl extends implementing(SSHAgent).uses(Session, KeyMapStore, OSPlatform) implements ISSHAgent {
+
+  private log(...items: any[]) {
+    log(`[ssh-agent]`, ...items);
+  }
+
+  *start(): EffectGen<void, string> {
+    const { OSPlatform: { startSocketServer } } = this.dependencies;
+    const { handleExtension, handleRequestIdentities, handleSignRequest, log } = this;
+    yield* startSocketServer(AGENT_SOCK_FILE_PATH, function*(data, callerChain): EffectGen<Buffer> {
+      const msgType = data[4];
+      switch (msgType) {
+        case SSH2_AGENT_EXTENSION:
+          log(`received extensions request`);
+          return yield* handleExtension(data);
+        case SSH2_AGENT_REQUEST_IDENTITIES:
+          log(`received request identities request`);
+          return yield* handleRequestIdentities();
+        case SSH2_AGENT_SIGN_REQUEST:
+          log(`received signature request`);
+          return yield* handleSignRequest(data, callerChain);
+        default:
+          log(`received unknown message type ${msgType}`);
+          return failureResponse();
+      }
+    });
+    writeFileSync(AGENT_PID_FILE_PATH, process.pid.toString());
+    log(`listening on ${AGENT_SOCK_FILE_PATH}`);
+  }
+
+  *handleExtension(data: Buffer): EffectGen<Buffer, never> {
+    const nameLen = data.readUInt32BE(5);
+    const name = data.subarray(9, 9 + nameLen).toString("utf8");
+    this.log(`extension request for ${name}`);
+    // We don't support any extensions, so we fail this outright.
+    return yield* Effect.sync(() => failureResponse());
+  }
+
+  *handleRequestIdentities(): EffectGen<Buffer, never> {
+    const keyMapStore = this.dependencies.KeyMapStore;
+    const listResult = yield* pipe(
+      effunct(keyMapStore.listPubkeys)(),
+      Effect.result
+    );
+    const pubkeys = Result.isSuccess(listResult) ? listResult.success : [];
+    if (Result.isFailure(listResult)) {
+      this.log(`Failure to retrieve keys ${listResult.failure}`);
+    }
+    this.log(`Total keys ${pubkeys.length}`);
+    if (pubkeys.length === 0) {
+      const body = Buffer.concat([Buffer.from([SSH2_AGENT_IDENTITIES_ANSWER]), u32(0)]);
+      return Buffer.concat([u32(body.length), body]);
+    }
+    const keyEntries = pubkeys.map(pubkey => {
+      return Buffer.concat([sshString(pubkey.wire), sshString(Buffer.alloc(0))]);
+    });
+    const body = Buffer.concat([
+      Buffer.from([SSH2_AGENT_IDENTITIES_ANSWER]),
+      u32(pubkeys.length),
+      ...keyEntries,
+    ]);
+    return Buffer.concat([u32(body.length), body]);
+  }
+
+  *handleSignRequest(data: Buffer, callerChain: CallerProcess[]): EffectGen<Buffer, never> {
+    const session = this.dependencies.Session;
+    let offset = 5; // skip length(4) + type(1)
+    const keyBlobLen = data.readUInt32BE(offset); offset += 4;
+    const pubkeyWire = Buffer.from(data.subarray(offset, offset + keyBlobLen)); offset += keyBlobLen;
+    const dataToSignLen = data.readUInt32BE(offset); offset += 4;
+    const dataToSign = Buffer.from(data.subarray(offset, offset + dataToSignLen));
+
+    const pubkey = SSHPubkey.fromWire(pubkeyWire);
+
+    this.log(`Sign request for pubkey ${pubkey.authorizedKey}\n${renderCallerTree(callerChain.slice(-3))}`);
+    const signResult = yield* pipe(
+      effunct(session.sign)({
+        data: dataToSign,
+        pubkey,
+        callerTree: callerChain
+      }),
+      Effect.result
+    );
+    return Result.isSuccess(signResult) ? buildSignResponse(pubkey.keyType, signResult.success) : failureResponse();
+  }
+
+  public static ServiceLayer = Layer.effectDiscard(Effect.gen(function*() {
+    const sshAgent = yield* agentModules.SSHAgent;
+    yield* sshAgent.start();
+  })).pipe(Layer.provideMerge(this.Layer))
+}

package/src/modules/ssh-agent/ssh-agent/interface.ts

@@ -0,0 +1,9 @@
+import type { EffectGen } from "effective-modules";
+import type { CallerProcess } from "@/modules/common/os-platform/interface";
+
+export interface ISSHAgent {
+  start(): EffectGen<void, string>;
+  handleExtension(data: Buffer): EffectGen<Buffer, never>;
+  handleRequestIdentities(): EffectGen<Buffer, never>;
+  handleSignRequest(data: Buffer, callerChain: CallerProcess[]): EffectGen<Buffer, never>;
+}