@ozyman42/ozy-cli 0.4.8-windows-x64.0 → 0.4.8

package/src/modules/common/index.ts

@@ -0,0 +1,19 @@
+import { interfaces } from "effective-modules";
+import type { IOSPlatform } from "./os-platform/interface";
+import type { IKeyMapStore } from "./kep-map-store/interface";
+import type { ICrypto } from "./crypto/interface";
+import type { ISSHConfig } from "./ssh-config/interface";
+
+export enum CommonModules {
+  OSPlatform = "OSPlatform",
+  KeyMapStore = "KeyMapStore",
+  Crypto = "Crypto",
+  SSHConfig = "SSHConfig",
+}
+
+export const commonModules = interfaces<CommonModules, {
+  OSPlatform: IOSPlatform;
+  KeyMapStore: IKeyMapStore;
+  Crypto: ICrypto;
+  SSHConfig: ISSHConfig;
+}>(CommonModules);

package/src/modules/common/kep-map-store/impl.ts

@@ -0,0 +1,47 @@
+import { Effect, Option, pipe } from "effect";
+import { effunct, implementing, type EffectGen } from "effective-modules";
+import { commonModules } from "..";
+import { type IKeyMapStore } from "./interface";
+import { SSHPubkey, CredentialId } from "@/modules/common/crypto/impl";
+import { CRED_ID_COMMENT_PREFIX, FUTURE_TOOL_NAME } from "@/common/constants";
+
+export class KeyMapStoreImpl extends implementing(commonModules.KeyMapStore).uses(commonModules.SSHConfig) implements IKeyMapStore {
+  private *listToolPubkeyFiles(): EffectGen<{name: string, content: string}[], string> {
+    const files = yield* effunct(this.dependencies.SSHConfig.listPubkeyFiles)();
+    return files.filter(f => f.name.startsWith(`${FUTURE_TOOL_NAME}-`));
+  }
+
+  *listPubkeys(): EffectGen<SSHPubkey[], string> {
+    const files = yield* effunct(this.listToolPubkeyFiles)();
+    return files.map(({ content }) => {
+      const pubkeyAuth = content.split(' ').slice(0, 2).join(' ');
+      return SSHPubkey.fromAuthorizedKey(pubkeyAuth);
+    });
+  }
+
+  *getCredentialByPubkey(pubkey: SSHPubkey): EffectGen<Option.Option<string>, string> {
+    const files = yield* effunct(this.listToolPubkeyFiles)();
+    const match = files.find(({ content }) => {
+      const pubkeyAuth = content.split(' ').slice(0, 2).join(' ');
+      return pubkeyAuth === pubkey.authorizedKey;
+    });
+    if (!match) return Option.none();
+    const parts = match.content.split(' ');
+    const comment = parts[2];
+    if (!comment || !comment.startsWith(CRED_ID_COMMENT_PREFIX))
+      return yield* Effect.fail(`InvalidPubkeyFileError: file for pubkey ${pubkey.authorizedKey} has no valid credentialId comment`);
+    return Option.some(comment.slice(CRED_ID_COMMENT_PREFIX.length));
+  }
+
+  *addKey(pubkey: SSHPubkey, credentialId: string): EffectGen<void, string> {
+    const name = new CredentialId(credentialId).humanReadableName;
+    yield* pipe(
+      effunct(this.dependencies.SSHConfig.writePubkey)({
+        name,
+        comment: Option.some(`${CRED_ID_COMMENT_PREFIX}${credentialId}`),
+        pubkey,
+      }),
+      Effect.asVoid
+    );
+  }
+}

package/src/modules/common/kep-map-store/interface.ts

@@ -0,0 +1,9 @@
+import { Option } from "effect";
+import type { EffectGen } from "effective-modules";
+import type { SSHPubkey } from "@/modules/common/crypto/impl";
+
+export interface IKeyMapStore {
+  listPubkeys(): EffectGen<SSHPubkey[], string>;
+  getCredentialByPubkey(pubkey: SSHPubkey): EffectGen<Option.Option<string>, string>;
+  addKey(pubkey: SSHPubkey, credentialId: string): EffectGen<void, string>;
+}

package/src/modules/common/os-platform/caller-info.ts

@@ -0,0 +1,152 @@
+import { dlopen, FFIType } from "bun:ffi";
+import { execSync } from "node:child_process";
+import { readFileSync, readlinkSync } from "node:fs";
+import { Option } from "effect";
+import type { CallerProcess } from "./interface";
+
+const isMacOS = process.platform === 'darwin';
+
+// ---- FFI: getsockopt ----
+
+const SOL_LOCAL = 0;           // macOS: SOL_LOCAL (sys/un.h)
+const LOCAL_PEERPID = 2;       // macOS: LOCAL_PEERPID (sys/un.h)
+const SOL_SOCKET_LINUX = 1;    // Linux: SOL_SOCKET
+const SO_PEERCRED_LINUX = 17;  // Linux: SO_PEERCRED
+
+type GetsockoptFn = (fd: number, level: number, optname: number, optval: Uint8Array, optlen: Uint32Array) => number;
+let _getsockopt: GetsockoptFn | undefined;
+
+function getsockoptSymbol(): GetsockoptFn {
+  if (!_getsockopt) {
+    const libName = isMacOS ? 'libSystem.B.dylib' : 'libc.so.6';
+    const lib = dlopen(libName, {
+      getsockopt: {
+        args: [FFIType.int, FFIType.int, FFIType.int, FFIType.ptr, FFIType.ptr],
+        returns: FFIType.int,
+      },
+    });
+    _getsockopt = lib.symbols['getsockopt'] as unknown as GetsockoptFn;
+  }
+  return _getsockopt;
+}
+
+function getPeerPidFromFd(fd: number): number {
+  const getsockopt = getsockoptSymbol();
+  if (isMacOS) {
+    const pidBuf = new Uint8Array(4);
+    const lenBuf = new Uint32Array([4]);
+    const ret = getsockopt(fd, SOL_LOCAL, LOCAL_PEERPID, pidBuf, lenBuf);
+    if (ret !== 0) throw new Error(`getsockopt(LOCAL_PEERPID) failed with ret=${ret}`);
+    return new DataView(pidBuf.buffer).getInt32(0, true);
+  } else {
+    // Linux: struct ucred { pid_t pid; uid_t uid; gid_t gid; } = 12 bytes
+    const credBuf = new Uint8Array(12);
+    const lenBuf = new Uint32Array([12]);
+    const ret = getsockopt(fd, SOL_SOCKET_LINUX, SO_PEERCRED_LINUX, credBuf, lenBuf);
+    if (ret !== 0) throw new Error(`getsockopt(SO_PEERCRED) failed with ret=${ret}`);
+    return new DataView(credBuf.buffer).getInt32(0, true);
+  }
+}
+
+// ---- Per-PID info resolution ----
+
+interface ProcessInfo {
+  ppid: number;
+  command: string;
+  cwd: Option.Option<string>;
+}
+
+function getProcessInfoMacOS(pid: number): ProcessInfo {
+  let psOut: string;
+  try {
+    psOut = execSync(`ps -p ${pid} -o ppid= -o args=`, { encoding: 'utf-8' }).trim();
+  } catch {
+    throw new Error(`PID ${pid} exited before caller info could be read`);
+  }
+  const firstSpace = psOut.indexOf(' ');
+  if (firstSpace < 0) throw new Error(`Unexpected ps output for PID ${pid}: "${psOut}"`);
+  const ppid = parseInt(psOut.slice(0, firstSpace).trim(), 10);
+  const command = psOut.slice(firstSpace + 1).trim();
+
+  // lsof exits non-zero on macOS when it hits permission errors on other fds even if it
+  // successfully located the cwd entry, so we check output regardless of exit code.
+  const lsofResult = Bun.spawnSync(['lsof', '-a', '-p', String(pid), '-d', 'cwd', '-Fn']);
+  const lsofOut = lsofResult.stdout.toString().trim();
+  const cwdLine = lsofOut.split('\n').find(l => l.startsWith('n'));
+  const cwd = cwdLine ? Option.some(cwdLine.slice(1)) : Option.none();
+
+  return { ppid, command, cwd };
+}
+
+function getProcessInfoLinux(pid: number): ProcessInfo {
+  const rawCmdline = readFileSync(`/proc/${pid}/cmdline`);
+  const command = rawCmdline.toString().replace(/\0+$/, '').split('\0').join(' ');
+  if (!command) throw new Error(`Empty cmdline for PID ${pid}`);
+
+  let cwd: Option.Option<string>;
+  try {
+    cwd = Option.some(readlinkSync(`/proc/${pid}/cwd`));
+  } catch {
+    cwd = Option.none();
+  }
+
+  const status = readFileSync(`/proc/${pid}/status`, 'utf-8');
+  const ppidMatch = status.match(/^PPid:\s+(\d+)/m);
+  if (!ppidMatch) throw new Error(`No PPid in /proc/${pid}/status`);
+  const ppid = parseInt(ppidMatch[1], 10);
+
+  return { ppid, command, cwd };
+}
+
+function getProcessInfoWindows(pid: number): ProcessInfo {
+  const infoOut = execSync(
+    `powershell -NoProfile -Command "` +
+    `$p = Get-WmiObject Win32_Process -Filter 'ProcessId=${pid}'; ` +
+    `if ($p) { Write-Output \\\"$($p.ParentProcessId)|$($p.CommandLine)\\\" }"`,
+    { encoding: 'utf-8' }
+  ).trim();
+  if (!infoOut) throw new Error(`WMI returned no result for PID ${pid}`);
+  const pipeIdx = infoOut.indexOf('|');
+  if (pipeIdx < 0) throw new Error(`Unexpected WMI output for PID ${pid}: "${infoOut}"`);
+  const ppid = parseInt(infoOut.slice(0, pipeIdx), 10);
+  const command = infoOut.slice(pipeIdx + 1);
+
+  return { ppid, command, cwd: Option.none() };
+}
+
+// ---- Chain walking ----
+
+function walkChain(initialPid: number, getInfo: (pid: number) => ProcessInfo): CallerProcess[] {
+  const chain: CallerProcess[] = [];
+  let pid = initialPid;
+  const visited = new Set<number>();
+  let isFirst = true;
+  while (pid > 0 && !visited.has(pid)) {
+    visited.add(pid);
+    let info: ProcessInfo;
+    try {
+      info = getInfo(pid);
+    } catch (e) {
+      if (isFirst) throw e;
+      break;
+    }
+    chain.push({ pid, command: info.command, directory: info.cwd });
+    pid = info.ppid;
+    isFirst = false;
+  }
+  // Reverse so chain[0] = oldest ancestor, chain[N-1] = direct caller.
+  // This matches the display logic in passkey-prf-page.ts which skips the common
+  // ancestor prefix to show the relevant tail (git, ssh, etc.).
+  return chain.reverse();
+}
+
+// ---- Public API ----
+
+export function resolveCallerChainUnix(fd: number): CallerProcess[] {
+  const pid = getPeerPidFromFd(fd);
+  return walkChain(pid, isMacOS ? getProcessInfoMacOS : getProcessInfoLinux);
+}
+
+export function resolveCallerChainWindows(remotePid: number): CallerProcess[] {
+  return walkChain(remotePid, getProcessInfoWindows);
+}

package/src/modules/common/os-platform/impl.ts

@@ -0,0 +1,91 @@
+import { Effect } from "effect";
+import { writeFileSync, existsSync, unlinkSync } from "node:fs";
+import * as net from "node:net";
+import { effunct, implementing, type EffectGen } from "effective-modules";
+import type { IOSPlatform, CallerProcess } from "./interface";
+import { resolveCallerChainUnix, resolveCallerChainWindows } from "./caller-info";
+import { commonModules } from "@/modules/common";
+import { registerVirtualHID } from "./virtual-hid";
+import { log } from "@/common/log";
+
+const isWindows = process.platform === 'win32';
+
+function openBrowserCommand(url: string): string[] {
+  if (process.platform === 'darwin') return ['open', url];
+  if (process.platform === 'linux') return ['xdg-open', url];
+  // `start` is a cmd.exe builtin. The empty string is the window title slot.
+  if (isWindows) ['cmd.exe', '/c', 'start', '', url];
+  // TODO: use exhaustive matching
+  throw new Error("Unknown platform");
+}
+
+function openBrowserWindow(url: string): Effect.Effect<void, never> {
+  return Effect.sync(() => { Bun.spawnSync(openBrowserCommand(url)); });
+}
+
+function writeRestrictedFile(path: string, content: string): Effect.Effect<void, string> {
+  return Effect.try({
+    try: () => {
+      if (isWindows) {
+        writeFileSync(path, content);
+        const result = Bun.spawnSync(['icacls', path, '/inheritance:r', '/grant:r', `${process.env['USERNAME']}:(R,W)`]);
+        if (result.exitCode !== 0)
+          throw new Error(`icacls failed with exit code ${result.exitCode}`);
+      } else {
+        writeFileSync(path, content, { mode: 0o600 });
+      }
+    },
+    catch: (e) => `Failed to write restricted file ${path}: ${e instanceof Error ? e.message : String(e)}`,
+  });
+}
+
+function makeConnectionHandler(onData: (data: Buffer, callerChain: CallerProcess[]) => EffectGen<Buffer>, resolveChain: (socket: net.Socket) => CallerProcess[]) {
+  return (socket: net.Socket) => {
+    let callerChain: CallerProcess[];
+    try {
+      callerChain = resolveChain(socket);
+    } catch (e) {
+      log(`[socket-server] ERROR: Failed to get caller info — closing connection. Reason: ${e instanceof Error ? e.message : String(e)}`);
+      socket.destroy();
+      return;
+    }
+    socket.on('data', async (data) => {
+      try {
+        socket.write(await Effect.runPromise(effunct(onData)(data, callerChain)));
+      } catch (e) {
+        log(`[socket-server] ERROR in onData: ${e instanceof Error ? e.message : String(e)}`);
+        socket.destroy();
+      }
+    });
+  };
+}
+
+export class OSPlatformImpl extends implementing(commonModules.OSPlatform) implements IOSPlatform {
+  openBrowserWindow(url: string) { return openBrowserWindow(url); }
+  writeRestrictedFile(path: string, content: string) { return writeRestrictedFile(path, content); }
+  *startSocketServer(socketPath: string, onData: (data: Buffer, callerChain: CallerProcess[]) => EffectGen<Buffer>): EffectGen<void, string> {
+    return yield* Effect.try({
+      try: () => {
+        if (existsSync(socketPath)) unlinkSync(socketPath);
+        if (isWindows) {
+          const pipePath = `\\\\.\\pipe\\${socketPath.replace(/[/\\:]/g, '-')}`;
+          const server = net.createServer(makeConnectionHandler(onData, (socket) => {
+            const remotePid = (socket as any)._handle?.remotePid as number | undefined;
+            if (remotePid == null) throw new Error('socket._handle.remotePid unavailable on this Windows/Bun version');
+            return resolveCallerChainWindows(remotePid);
+          }));
+          server.listen(pipePath);
+        } else {
+          const server = net.createServer(makeConnectionHandler(onData, (socket) => {
+            const fd = (socket as any)._handle?.fd as number | undefined;
+            if (fd == null) throw new Error('socket._handle.fd unavailable — cannot resolve peer PID');
+            return resolveCallerChainUnix(fd);
+          }));
+          server.listen(socketPath);
+        }
+      },
+      catch: (e) => `Failed to start socket server at ${socketPath}: ${e instanceof Error ? e.message : String(e)}`,
+    });
+  }
+  registerVirtualHID(onMessage: (data: Buffer) => Effect.Effect<Buffer>) { return registerVirtualHID(onMessage); }
+}

package/src/modules/common/os-platform/interface.ts

@@ -0,0 +1,16 @@
+import { Effect } from "effect";
+import type { Option } from "effect";
+import type { EffectGen } from "effective-modules";
+
+export interface CallerProcess {
+  pid: number;
+  command: string;
+  directory: Option.Option<string>;
+}
+
+export interface IOSPlatform {
+  openBrowserWindow(url: string): Effect.Effect<void, never>;
+  writeRestrictedFile(path: string, content: string): Effect.Effect<void, string>;
+  startSocketServer(socketPath: string, onData: (data: Buffer, callerChain: CallerProcess[]) => EffectGen<Buffer>): EffectGen<void, string>;
+  registerVirtualHID(onMessage: (data: Buffer) => Effect.Effect<Buffer>): Effect.Effect<void, string>;
+}

package/src/modules/common/os-platform/virtual-hid/index.ts

@@ -0,0 +1,12 @@
+import { Effect } from "effect";
+import { registerVirtualHIDMac } from "./mac";
+import { registerVirtualHIDLinux } from "./linux";
+import { registerVirtualHIDWindows } from "./windows";
+
+export function registerVirtualHID(
+  onMessage: (data: Buffer) => Effect.Effect<Buffer>
+): Effect.Effect<void, string> {
+  if (process.platform === 'darwin') return registerVirtualHIDMac(onMessage);
+  if (process.platform === 'win32') return registerVirtualHIDWindows(onMessage);
+  return registerVirtualHIDLinux(onMessage);
+}

package/src/modules/common/os-platform/virtual-hid/linux.ts

@@ -0,0 +1,7 @@
+import { Effect } from "effect";
+
+export function registerVirtualHIDLinux(
+  _onMessage: (data: Buffer) => Effect.Effect<Buffer>
+): Effect.Effect<void, string> {
+  return Effect.fail('registerVirtualHID is not yet supported on Linux');
+}

package/src/modules/common/os-platform/virtual-hid/mac.ts

@@ -0,0 +1,150 @@
+import { Effect, Option, pipe } from "effect";
+import { JSCallback, dlopen, FFIType, ptr, toArrayBuffer } from "bun:ffi";
+import type { Pointer } from "bun:ffi";
+
+// FIDO Alliance usage page (0xF1D0), 64-byte in/out reports, no report IDs
+const FIDO2_HID_DESCRIPTOR = new Uint8Array([
+  0x06, 0xD0, 0xF1, // Usage Page (FIDO Alliance 0xF1D0, little-endian)
+  0x09, 0x01,       // Usage (U2F HID Authenticator Device)
+  0xA1, 0x01,       // Collection (Application)
+  0x09, 0x20,       //   Usage (Input report data)
+  0x15, 0x00,       //   Logical Minimum (0)
+  0x26, 0xFF, 0x00, //   Logical Maximum (255)
+  0x75, 0x08,       //   Report Size (8 bits)
+  0x95, 0x40,       //   Report Count (64)
+  0x81, 0x02,       //   Input (Data, Variable, Absolute)
+  0x09, 0x21,       //   Usage (Output report data)
+  0x15, 0x00,       //   Logical Minimum (0)
+  0x26, 0xFF, 0x00, //   Logical Maximum (255)
+  0x75, 0x08,       //   Report Size (8 bits)
+  0x95, 0x40,       //   Report Count (64)
+  0x91, 0x02,       //   Output (Data, Variable, Absolute)
+  0xC0,             // End Collection
+]);
+
+const kIOHIDReportTypeOutput = 1;
+const kIOReturnSuccess = 0;
+const kCFStringEncodingUTF8 = 0x08000100;
+const kCFPropertyListImmutable = 0;
+
+// Kept at module scope to prevent GC while the virtual device is running
+let _vhidCallback: JSCallback | null = null;
+_vhidCallback;
+
+const fromPtr = (label: string, p: Pointer | null): Effect.Effect<Pointer, string> =>
+  pipe(
+    Option.fromNullishOr(p),
+    Effect.fromOption,
+    Effect.mapError(() => `${label} returned NULL`),
+  );
+
+// Build the device properties as an XML plist. CFPropertyListCreateWithData parses this
+// into a fully-initialized CFDictionary (with correct hash/equal callbacks), avoiding
+// the need to pass raw CFDictionaryKeyCallBacks structs via FFI.
+function buildDevicePropertiesPlist(): Uint8Array {
+  const descriptorB64 = Buffer.from(FIDO2_HID_DESCRIPTOR).toString('base64');
+  const xml = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
+    '<plist version="1.0">',
+    '<dict>',
+    '  <key>ReportDescriptor</key>',
+    `  <data>${descriptorB64}</data>`,
+    '  <key>VendorID</key>',
+    '  <integer>4617</integer>',   // 0x1209 - pid.codes open-source VID
+    '  <key>ProductID</key>',
+    '  <integer>1</integer>',
+    '  <key>VersionNumber</key>',
+    '  <integer>256</integer>',    // 0x0100
+    '  <key>Product</key>',
+    '  <string>Ozy Virtual FIDO2 Key</string>',
+    '</dict>',
+    '</plist>',
+  ].join('\n');
+  return new TextEncoder().encode(xml);
+}
+
+export function registerVirtualHIDMac(
+  onMessage: (data: Buffer) => Effect.Effect<Buffer>
+): Effect.Effect<void, string> {
+  return Effect.gen(function* () {
+    console.log('[vhid] loading frameworks');
+
+    const IOKit = yield* Effect.try({
+      try: () => dlopen('/System/Library/Frameworks/IOKit.framework/IOKit', {
+        IOHIDUserDeviceCreate: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.ptr },
+        IOHIDUserDeviceRegisterSetReportCallback: { args: [FFIType.ptr, FFIType.ptr, FFIType.ptr], returns: FFIType.void },
+        IOHIDUserDeviceScheduleWithRunLoop: { args: [FFIType.ptr, FFIType.ptr, FFIType.ptr], returns: FFIType.void },
+        IOHIDUserDeviceHandleReport: { args: [FFIType.ptr, FFIType.ptr, FFIType.i64], returns: FFIType.i32 },
+      }),
+      catch: (e) => `Failed to load IOKit: ${e}`,
+    });
+
+    const CF = yield* Effect.try({
+      try: () => dlopen('/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation', {
+        CFRunLoopGetCurrent: { args: [], returns: FFIType.ptr },
+        CFRunLoopRunInMode: { args: [FFIType.ptr, FFIType.f64, FFIType.bool], returns: FFIType.i32 },
+        CFStringCreateWithCString: { args: [FFIType.ptr, FFIType.ptr, FFIType.u32], returns: FFIType.ptr },
+        CFDataCreate: { args: [FFIType.ptr, FFIType.ptr, FFIType.i64], returns: FFIType.ptr },
+        CFPropertyListCreateWithData: { args: [FFIType.ptr, FFIType.ptr, FFIType.u64, FFIType.ptr, FFIType.ptr], returns: FFIType.ptr },
+        CFRelease: { args: [FFIType.ptr], returns: FFIType.void },
+      }),
+      catch: (e) => `Failed to load CoreFoundation: ${e}`,
+    });
+
+    console.log('[vhid] frameworks loaded');
+
+    const encoder = new TextEncoder();
+
+    const makeCFString = (s: string): Effect.Effect<Pointer, string> =>
+      // TextEncoder gives a Uint8Array with its own ArrayBuffer (byteOffset=0, pool-safe)
+      fromPtr(`CFStringCreateWithCString("${s}")`,
+        CF.symbols.CFStringCreateWithCString(null, ptr(encoder.encode(s + '\0')), kCFStringEncodingUTF8));
+
+    const makeCFData = (data: Uint8Array): Effect.Effect<Pointer, string> =>
+      fromPtr('CFDataCreate', CF.symbols.CFDataCreate(null, ptr(data), BigInt(data.length)));
+
+    console.log('[vhid] building device properties plist');
+    const plistBytes = buildDevicePropertiesPlist();
+    const plistData = yield* makeCFData(plistBytes);
+
+    const dict = yield* fromPtr('CFPropertyListCreateWithData',
+      CF.symbols.CFPropertyListCreateWithData(null, plistData, BigInt(kCFPropertyListImmutable), null, null));
+    CF.symbols.CFRelease(plistData);
+    console.log('[vhid] device properties dict =', dict);
+
+    console.log('[vhid] creating IOHIDUserDevice');
+    const device = yield* fromPtr('IOHIDUserDeviceCreate', IOKit.symbols.IOHIDUserDeviceCreate(null, dict));
+    CF.symbols.CFRelease(dict);
+    console.log('[vhid] IOHIDUserDeviceCreate =', device);
+
+    const callback = yield* Effect.try({
+      try: () => new JSCallback(
+        (_refcon: number, _result: number, _sender: number, type: number, _reportID: number, report: number, reportLength: number) => {
+          if (type !== kIOHIDReportTypeOutput) return kIOReturnSuccess;
+          const incoming = Buffer.from(toArrayBuffer(report as unknown as Pointer, 0, reportLength));
+          console.log(`[vhid] received ${incoming.length} bytes: ${incoming.toString('hex')}`);
+          Effect.runPromise(onMessage(incoming)).then(response => {
+            const responseBuf = new Uint8Array(64);
+            response.copy(Buffer.from(responseBuf.buffer), 0, 0, Math.min(response.length, 64));
+            IOKit.symbols.IOHIDUserDeviceHandleReport(device, ptr(responseBuf), BigInt(responseBuf.length));
+          }).catch(() => {});
+          return kIOReturnSuccess;
+        },
+        { returns: 'i32', args: ['ptr', 'i32', 'ptr', 'i32', 'u32', 'ptr', 'i64'] },
+      ),
+      catch: (e) => `Failed to create JSCallback: ${e}`,
+    });
+    _vhidCallback = callback;
+
+    IOKit.symbols.IOHIDUserDeviceRegisterSetReportCallback(device, callback.ptr, null);
+
+    const runLoop = CF.symbols.CFRunLoopGetCurrent();
+    const runLoopMode = yield* makeCFString('kCFRunLoopDefaultMode');
+    IOKit.symbols.IOHIDUserDeviceScheduleWithRunLoop(device, runLoop, runLoopMode);
+
+    console.log('[vhid] virtual FIDO2 device active, pumping run loop');
+    // Pump CFRunLoop from Bun's libuv event loop without blocking
+    setInterval(() => CF.symbols.CFRunLoopRunInMode(runLoopMode, 0.0, false), 10);
+  });
+}

package/src/modules/common/os-platform/virtual-hid/windows.ts

@@ -0,0 +1,7 @@
+import { Effect } from "effect";
+
+export function registerVirtualHIDWindows(
+  _onMessage: (data: Buffer) => Effect.Effect<Buffer>
+): Effect.Effect<void, string> {
+  return Effect.fail('registerVirtualHID is not yet supported on Windows');
+}

package/src/modules/common/ssh-config/impl.ts

@@ -0,0 +1,130 @@
+import * as fs from "node:fs/promises";
+import { join } from "node:path";
+import { writeFileSync } from "node:fs";
+import { Effect, Option, Schema } from "effect";
+import SSHConfig, { LineType } from "ssh-config";
+import expandTilde from "expand-tilde";
+import { implementing, type EffectGen } from "effective-modules";
+import { commonModules } from "@/modules/common";
+
+import { SSHConfigSection, type ISSHConfig, type SSHConfigHosts, type WriteHostInput, type WritePubkeyInput } from "./interface";
+
+const SSH_CONFIG_PATH = "~/.ssh/config";
+const SSH_DIR = "~/.ssh";
+
+export class SSHConfigImpl extends implementing(commonModules.SSHConfig) implements ISSHConfig {
+  private *loadSSHConfigRaw(): EffectGen<SSHConfig, string> {
+    const configPath = expandTilde(SSH_CONFIG_PATH);
+    const exists = yield* Effect.promise(() => fs.exists(configPath));
+    const text = exists
+      ? yield* Effect.tryPromise({
+          try: () => fs.readFile(configPath, "utf8"),
+          catch: (e) => `Failed to read ssh config at ${configPath}: ${e instanceof Error ? e.message : String(e)}`,
+        })
+      : "";
+    return yield* Effect.try({
+      try: () => SSHConfig.parse(text),
+      catch: (e) => `ParseError: unable to parse ssh config at ${configPath}\n${e instanceof Error ? e.message : String(e)}`,
+    });
+  }
+
+  *getSSHConfig(): EffectGen<SSHConfigHosts, string> {
+    const configPath = expandTilde(SSH_CONFIG_PATH);
+    const exists = yield* Effect.promise(() => fs.exists(configPath));
+    if (!exists)
+      return yield* Effect.fail(`SSHConfigFileMissingError: No file found at ${configPath}`);
+
+    const parsed = yield* this.loadSSHConfigRaw();
+
+    const hosts: SSHConfigHosts = {};
+    for (const line of parsed) {
+      if (line.type === LineType.COMMENT) continue;
+      const { param, value: host } = line;
+      if (param !== "Host")
+        return yield* Effect.fail(`EntryNotAHostKeyValuePairError: unexpected top-level entry '${param}=${JSON.stringify(host)}'`);
+      if (typeof host !== "string")
+        return yield* Effect.fail(`EntryNotAHostKeyValuePairError: Host value is not a string: ${JSON.stringify(host)}`);
+      if (!("config" in line))
+        return yield* Effect.fail(`EntryNotAHostKeyValuePairError: non-section Host entry '${host}'`);
+      if (host in hosts)
+        return yield* Effect.fail(`DuplicateHostError: duplicate Host '${host}' in ${configPath}`);
+
+      const kv: Record<string, string> = {};
+      for (const inner of line.config) {
+        if (inner.type === LineType.COMMENT) continue;
+        if (typeof inner.value !== "string")
+          return yield* Effect.fail(`MalformedError: Host '${host}' key '${inner.param}' has non-string value`);
+        kv[inner.param] = inner.value;
+      }
+
+      const section = yield* Schema.decodeUnknownEffect(SSHConfigSection)(kv).pipe(
+        Effect.mapError(e => `MalformedError: malformed section at Host '${host}': ${String(e)}`)
+      );
+      hosts[host] = section;
+    }
+
+    return hosts;
+  }
+
+  *writeHost({ section }: WriteHostInput): EffectGen<void, string> {
+    const configPath = expandTilde(SSH_CONFIG_PATH);
+    const cfg = yield* this.loadSSHConfigRaw();
+    const newEntries = Object.entries(section)
+      .filter(([, v]) => v !== undefined)
+      .map(([k, v]) => ({ type: LineType.DIRECTIVE, before: '  ', param: k, separator: ' ', value: v as string, after: '\n' }));
+
+    const existingIdx = cfg.findIndex((e: any) => e.param === "Host" && e.value === section.HostName);
+    if (existingIdx >= 0) {
+      (cfg[existingIdx] as any).config = newEntries;
+    } else {
+      const record: Record<string, string> = { Host: section.HostName };
+      for (const [k, v] of Object.entries(section)) {
+        if (v !== undefined) record[k] = v;
+      }
+      cfg.append(record);
+    }
+
+    yield* Effect.try({
+      try: () => writeFileSync(configPath, SSHConfig.stringify(cfg), { mode: 0o600 }),
+      catch: (e) => `Failed to write ssh config: ${e instanceof Error ? e.message : String(e)}`,
+    });
+  }
+
+  *listPubkeyFiles(): EffectGen<{name: string, content: string}[], string> {
+    const sshDir = expandTilde(SSH_DIR);
+    const entries = yield* Effect.tryPromise({
+      try: () => fs.readdir(sshDir),
+      catch: (e) => `Failed to read ${sshDir}: ${e instanceof Error ? e.message : String(e)}`,
+    });
+    const pubkeyFiles = entries.filter(f => f.endsWith('.pub'));
+    const results: {name: string, content: string}[] = [];
+    for (const file of pubkeyFiles) {
+      const content = yield* Effect.tryPromise({
+        try: () => fs.readFile(join(sshDir, file), 'utf8'),
+        catch: (e) => `Failed to read ${file}: ${e instanceof Error ? e.message : String(e)}`,
+      });
+      results.push({ name: file.slice(0, -'.pub'.length), content: content.trim() });
+    }
+    return results;
+  }
+
+  getPubkeyPath(name: string): string {
+    return `${expandTilde(SSH_DIR)}/${name}.pub`;
+  }
+
+  *writePubkey({ name, comment, pubkey }: WritePubkeyInput): EffectGen<{pubkeyPath: string}, string> {
+    const sshDir = expandTilde(SSH_DIR);
+    const pubkeyPath = `${sshDir}/${name}.pub`;
+    const content = Option.match(comment, {
+      onNone: () => pubkey.authorizedKey,
+      onSome: (c) => `${pubkey.authorizedKey} ${c}`,
+    });
+
+    yield* Effect.try({
+      try: () => writeFileSync(pubkeyPath, content + "\n", { mode: 0o600 }),
+      catch: (e) => `Failed to write pubkey to ${pubkeyPath}: ${e instanceof Error ? e.message : String(e)}`,
+    });
+
+    return {pubkeyPath};
+  }
+}