@ozyman42/ozy-cli 0.4.8 → 0.4.9-darwin-arm64.0

package/src/modules/common/index.ts

@@ -1,19 +0,0 @@
-import { interfaces } from "effective-modules";
-import type { IOSPlatform } from "./os-platform/interface";
-import type { IKeyMapStore } from "./kep-map-store/interface";
-import type { ICrypto } from "./crypto/interface";
-import type { ISSHConfig } from "./ssh-config/interface";
-
-export enum CommonModules {
-  OSPlatform = "OSPlatform",
-  KeyMapStore = "KeyMapStore",
-  Crypto = "Crypto",
-  SSHConfig = "SSHConfig",
-}
-
-export const commonModules = interfaces<CommonModules, {
-  OSPlatform: IOSPlatform;
-  KeyMapStore: IKeyMapStore;
-  Crypto: ICrypto;
-  SSHConfig: ISSHConfig;
-}>(CommonModules);

package/src/modules/common/kep-map-store/impl.ts

@@ -1,47 +0,0 @@
-import { Effect, Option, pipe } from "effect";
-import { effunct, implementing, type EffectGen } from "effective-modules";
-import { commonModules } from "..";
-import { type IKeyMapStore } from "./interface";
-import { SSHPubkey, CredentialId } from "@/modules/common/crypto/impl";
-import { CRED_ID_COMMENT_PREFIX, FUTURE_TOOL_NAME } from "@/common/constants";
-
-export class KeyMapStoreImpl extends implementing(commonModules.KeyMapStore).uses(commonModules.SSHConfig) implements IKeyMapStore {
-  private *listToolPubkeyFiles(): EffectGen<{name: string, content: string}[], string> {
-    const files = yield* effunct(this.dependencies.SSHConfig.listPubkeyFiles)();
-    return files.filter(f => f.name.startsWith(`${FUTURE_TOOL_NAME}-`));
-  }
-
-  *listPubkeys(): EffectGen<SSHPubkey[], string> {
-    const files = yield* effunct(this.listToolPubkeyFiles)();
-    return files.map(({ content }) => {
-      const pubkeyAuth = content.split(' ').slice(0, 2).join(' ');
-      return SSHPubkey.fromAuthorizedKey(pubkeyAuth);
-    });
-  }
-
-  *getCredentialByPubkey(pubkey: SSHPubkey): EffectGen<Option.Option<string>, string> {
-    const files = yield* effunct(this.listToolPubkeyFiles)();
-    const match = files.find(({ content }) => {
-      const pubkeyAuth = content.split(' ').slice(0, 2).join(' ');
-      return pubkeyAuth === pubkey.authorizedKey;
-    });
-    if (!match) return Option.none();
-    const parts = match.content.split(' ');
-    const comment = parts[2];
-    if (!comment || !comment.startsWith(CRED_ID_COMMENT_PREFIX))
-      return yield* Effect.fail(`InvalidPubkeyFileError: file for pubkey ${pubkey.authorizedKey} has no valid credentialId comment`);
-    return Option.some(comment.slice(CRED_ID_COMMENT_PREFIX.length));
-  }
-
-  *addKey(pubkey: SSHPubkey, credentialId: string): EffectGen<void, string> {
-    const name = new CredentialId(credentialId).humanReadableName;
-    yield* pipe(
-      effunct(this.dependencies.SSHConfig.writePubkey)({
-        name,
-        comment: Option.some(`${CRED_ID_COMMENT_PREFIX}${credentialId}`),
-        pubkey,
-      }),
-      Effect.asVoid
-    );
-  }
-}

package/src/modules/common/kep-map-store/interface.ts

@@ -1,9 +0,0 @@
-import { Option } from "effect";
-import type { EffectGen } from "effective-modules";
-import type { SSHPubkey } from "@/modules/common/crypto/impl";
-
-export interface IKeyMapStore {
-  listPubkeys(): EffectGen<SSHPubkey[], string>;
-  getCredentialByPubkey(pubkey: SSHPubkey): EffectGen<Option.Option<string>, string>;
-  addKey(pubkey: SSHPubkey, credentialId: string): EffectGen<void, string>;
-}

package/src/modules/common/os-platform/caller-info.ts

@@ -1,152 +0,0 @@
-import { dlopen, FFIType } from "bun:ffi";
-import { execSync } from "node:child_process";
-import { readFileSync, readlinkSync } from "node:fs";
-import { Option } from "effect";
-import type { CallerProcess } from "./interface";
-
-const isMacOS = process.platform === 'darwin';
-
-// ---- FFI: getsockopt ----
-
-const SOL_LOCAL = 0;           // macOS: SOL_LOCAL (sys/un.h)
-const LOCAL_PEERPID = 2;       // macOS: LOCAL_PEERPID (sys/un.h)
-const SOL_SOCKET_LINUX = 1;    // Linux: SOL_SOCKET
-const SO_PEERCRED_LINUX = 17;  // Linux: SO_PEERCRED
-
-type GetsockoptFn = (fd: number, level: number, optname: number, optval: Uint8Array, optlen: Uint32Array) => number;
-let _getsockopt: GetsockoptFn | undefined;
-
-function getsockoptSymbol(): GetsockoptFn {
-  if (!_getsockopt) {
-    const libName = isMacOS ? 'libSystem.B.dylib' : 'libc.so.6';
-    const lib = dlopen(libName, {
-      getsockopt: {
-        args: [FFIType.int, FFIType.int, FFIType.int, FFIType.ptr, FFIType.ptr],
-        returns: FFIType.int,
-      },
-    });
-    _getsockopt = lib.symbols['getsockopt'] as unknown as GetsockoptFn;
-  }
-  return _getsockopt;
-}
-
-function getPeerPidFromFd(fd: number): number {
-  const getsockopt = getsockoptSymbol();
-  if (isMacOS) {
-    const pidBuf = new Uint8Array(4);
-    const lenBuf = new Uint32Array([4]);
-    const ret = getsockopt(fd, SOL_LOCAL, LOCAL_PEERPID, pidBuf, lenBuf);
-    if (ret !== 0) throw new Error(`getsockopt(LOCAL_PEERPID) failed with ret=${ret}`);
-    return new DataView(pidBuf.buffer).getInt32(0, true);
-  } else {
-    // Linux: struct ucred { pid_t pid; uid_t uid; gid_t gid; } = 12 bytes
-    const credBuf = new Uint8Array(12);
-    const lenBuf = new Uint32Array([12]);
-    const ret = getsockopt(fd, SOL_SOCKET_LINUX, SO_PEERCRED_LINUX, credBuf, lenBuf);
-    if (ret !== 0) throw new Error(`getsockopt(SO_PEERCRED) failed with ret=${ret}`);
-    return new DataView(credBuf.buffer).getInt32(0, true);
-  }
-}
-
-// ---- Per-PID info resolution ----
-
-interface ProcessInfo {
-  ppid: number;
-  command: string;
-  cwd: Option.Option<string>;
-}
-
-function getProcessInfoMacOS(pid: number): ProcessInfo {
-  let psOut: string;
-  try {
-    psOut = execSync(`ps -p ${pid} -o ppid= -o args=`, { encoding: 'utf-8' }).trim();
-  } catch {
-    throw new Error(`PID ${pid} exited before caller info could be read`);
-  }
-  const firstSpace = psOut.indexOf(' ');
-  if (firstSpace < 0) throw new Error(`Unexpected ps output for PID ${pid}: "${psOut}"`);
-  const ppid = parseInt(psOut.slice(0, firstSpace).trim(), 10);
-  const command = psOut.slice(firstSpace + 1).trim();
-
-  // lsof exits non-zero on macOS when it hits permission errors on other fds even if it
-  // successfully located the cwd entry, so we check output regardless of exit code.
-  const lsofResult = Bun.spawnSync(['lsof', '-a', '-p', String(pid), '-d', 'cwd', '-Fn']);
-  const lsofOut = lsofResult.stdout.toString().trim();
-  const cwdLine = lsofOut.split('\n').find(l => l.startsWith('n'));
-  const cwd = cwdLine ? Option.some(cwdLine.slice(1)) : Option.none();
-
-  return { ppid, command, cwd };
-}
-
-function getProcessInfoLinux(pid: number): ProcessInfo {
-  const rawCmdline = readFileSync(`/proc/${pid}/cmdline`);
-  const command = rawCmdline.toString().replace(/\0+$/, '').split('\0').join(' ');
-  if (!command) throw new Error(`Empty cmdline for PID ${pid}`);
-
-  let cwd: Option.Option<string>;
-  try {
-    cwd = Option.some(readlinkSync(`/proc/${pid}/cwd`));
-  } catch {
-    cwd = Option.none();
-  }
-
-  const status = readFileSync(`/proc/${pid}/status`, 'utf-8');
-  const ppidMatch = status.match(/^PPid:\s+(\d+)/m);
-  if (!ppidMatch) throw new Error(`No PPid in /proc/${pid}/status`);
-  const ppid = parseInt(ppidMatch[1], 10);
-
-  return { ppid, command, cwd };
-}
-
-function getProcessInfoWindows(pid: number): ProcessInfo {
-  const infoOut = execSync(
-    `powershell -NoProfile -Command "` +
-    `$p = Get-WmiObject Win32_Process -Filter 'ProcessId=${pid}'; ` +
-    `if ($p) { Write-Output \\\"$($p.ParentProcessId)|$($p.CommandLine)\\\" }"`,
-    { encoding: 'utf-8' }
-  ).trim();
-  if (!infoOut) throw new Error(`WMI returned no result for PID ${pid}`);
-  const pipeIdx = infoOut.indexOf('|');
-  if (pipeIdx < 0) throw new Error(`Unexpected WMI output for PID ${pid}: "${infoOut}"`);
-  const ppid = parseInt(infoOut.slice(0, pipeIdx), 10);
-  const command = infoOut.slice(pipeIdx + 1);
-
-  return { ppid, command, cwd: Option.none() };
-}
-
-// ---- Chain walking ----
-
-function walkChain(initialPid: number, getInfo: (pid: number) => ProcessInfo): CallerProcess[] {
-  const chain: CallerProcess[] = [];
-  let pid = initialPid;
-  const visited = new Set<number>();
-  let isFirst = true;
-  while (pid > 0 && !visited.has(pid)) {
-    visited.add(pid);
-    let info: ProcessInfo;
-    try {
-      info = getInfo(pid);
-    } catch (e) {
-      if (isFirst) throw e;
-      break;
-    }
-    chain.push({ pid, command: info.command, directory: info.cwd });
-    pid = info.ppid;
-    isFirst = false;
-  }
-  // Reverse so chain[0] = oldest ancestor, chain[N-1] = direct caller.
-  // This matches the display logic in passkey-prf-page.ts which skips the common
-  // ancestor prefix to show the relevant tail (git, ssh, etc.).
-  return chain.reverse();
-}
-
-// ---- Public API ----
-
-export function resolveCallerChainUnix(fd: number): CallerProcess[] {
-  const pid = getPeerPidFromFd(fd);
-  return walkChain(pid, isMacOS ? getProcessInfoMacOS : getProcessInfoLinux);
-}
-
-export function resolveCallerChainWindows(remotePid: number): CallerProcess[] {
-  return walkChain(remotePid, getProcessInfoWindows);
-}

package/src/modules/common/os-platform/impl.ts

@@ -1,91 +0,0 @@
-import { Effect } from "effect";
-import { writeFileSync, existsSync, unlinkSync } from "node:fs";
-import * as net from "node:net";
-import { effunct, implementing, type EffectGen } from "effective-modules";
-import type { IOSPlatform, CallerProcess } from "./interface";
-import { resolveCallerChainUnix, resolveCallerChainWindows } from "./caller-info";
-import { commonModules } from "@/modules/common";
-import { registerVirtualHID } from "./virtual-hid";
-import { log } from "@/common/log";
-
-const isWindows = process.platform === 'win32';
-
-function openBrowserCommand(url: string): string[] {
-  if (process.platform === 'darwin') return ['open', url];
-  if (process.platform === 'linux') return ['xdg-open', url];
-  // `start` is a cmd.exe builtin. The empty string is the window title slot.
-  if (isWindows) ['cmd.exe', '/c', 'start', '', url];
-  // TODO: use exhaustive matching
-  throw new Error("Unknown platform");
-}
-
-function openBrowserWindow(url: string): Effect.Effect<void, never> {
-  return Effect.sync(() => { Bun.spawnSync(openBrowserCommand(url)); });
-}
-
-function writeRestrictedFile(path: string, content: string): Effect.Effect<void, string> {
-  return Effect.try({
-    try: () => {
-      if (isWindows) {
-        writeFileSync(path, content);
-        const result = Bun.spawnSync(['icacls', path, '/inheritance:r', '/grant:r', `${process.env['USERNAME']}:(R,W)`]);
-        if (result.exitCode !== 0)
-          throw new Error(`icacls failed with exit code ${result.exitCode}`);
-      } else {
-        writeFileSync(path, content, { mode: 0o600 });
-      }
-    },
-    catch: (e) => `Failed to write restricted file ${path}: ${e instanceof Error ? e.message : String(e)}`,
-  });
-}
-
-function makeConnectionHandler(onData: (data: Buffer, callerChain: CallerProcess[]) => EffectGen<Buffer>, resolveChain: (socket: net.Socket) => CallerProcess[]) {
-  return (socket: net.Socket) => {
-    let callerChain: CallerProcess[];
-    try {
-      callerChain = resolveChain(socket);
-    } catch (e) {
-      log(`[socket-server] ERROR: Failed to get caller info — closing connection. Reason: ${e instanceof Error ? e.message : String(e)}`);
-      socket.destroy();
-      return;
-    }
-    socket.on('data', async (data) => {
-      try {
-        socket.write(await Effect.runPromise(effunct(onData)(data, callerChain)));
-      } catch (e) {
-        log(`[socket-server] ERROR in onData: ${e instanceof Error ? e.message : String(e)}`);
-        socket.destroy();
-      }
-    });
-  };
-}
-
-export class OSPlatformImpl extends implementing(commonModules.OSPlatform) implements IOSPlatform {
-  openBrowserWindow(url: string) { return openBrowserWindow(url); }
-  writeRestrictedFile(path: string, content: string) { return writeRestrictedFile(path, content); }
-  *startSocketServer(socketPath: string, onData: (data: Buffer, callerChain: CallerProcess[]) => EffectGen<Buffer>): EffectGen<void, string> {
-    return yield* Effect.try({
-      try: () => {
-        if (existsSync(socketPath)) unlinkSync(socketPath);
-        if (isWindows) {
-          const pipePath = `\\\\.\\pipe\\${socketPath.replace(/[/\\:]/g, '-')}`;
-          const server = net.createServer(makeConnectionHandler(onData, (socket) => {
-            const remotePid = (socket as any)._handle?.remotePid as number | undefined;
-            if (remotePid == null) throw new Error('socket._handle.remotePid unavailable on this Windows/Bun version');
-            return resolveCallerChainWindows(remotePid);
-          }));
-          server.listen(pipePath);
-        } else {
-          const server = net.createServer(makeConnectionHandler(onData, (socket) => {
-            const fd = (socket as any)._handle?.fd as number | undefined;
-            if (fd == null) throw new Error('socket._handle.fd unavailable — cannot resolve peer PID');
-            return resolveCallerChainUnix(fd);
-          }));
-          server.listen(socketPath);
-        }
-      },
-      catch: (e) => `Failed to start socket server at ${socketPath}: ${e instanceof Error ? e.message : String(e)}`,
-    });
-  }
-  registerVirtualHID(onMessage: (data: Buffer) => Effect.Effect<Buffer>) { return registerVirtualHID(onMessage); }
-}

package/src/modules/common/os-platform/interface.ts

@@ -1,16 +0,0 @@
-import { Effect } from "effect";
-import type { Option } from "effect";
-import type { EffectGen } from "effective-modules";
-
-export interface CallerProcess {
-  pid: number;
-  command: string;
-  directory: Option.Option<string>;
-}
-
-export interface IOSPlatform {
-  openBrowserWindow(url: string): Effect.Effect<void, never>;
-  writeRestrictedFile(path: string, content: string): Effect.Effect<void, string>;
-  startSocketServer(socketPath: string, onData: (data: Buffer, callerChain: CallerProcess[]) => EffectGen<Buffer>): EffectGen<void, string>;
-  registerVirtualHID(onMessage: (data: Buffer) => Effect.Effect<Buffer>): Effect.Effect<void, string>;
-}

package/src/modules/common/os-platform/virtual-hid/index.ts

@@ -1,12 +0,0 @@
-import { Effect } from "effect";
-import { registerVirtualHIDMac } from "./mac";
-import { registerVirtualHIDLinux } from "./linux";
-import { registerVirtualHIDWindows } from "./windows";
-
-export function registerVirtualHID(
-  onMessage: (data: Buffer) => Effect.Effect<Buffer>
-): Effect.Effect<void, string> {
-  if (process.platform === 'darwin') return registerVirtualHIDMac(onMessage);
-  if (process.platform === 'win32') return registerVirtualHIDWindows(onMessage);
-  return registerVirtualHIDLinux(onMessage);
-}

package/src/modules/common/os-platform/virtual-hid/linux.ts

@@ -1,7 +0,0 @@
-import { Effect } from "effect";
-
-export function registerVirtualHIDLinux(
-  _onMessage: (data: Buffer) => Effect.Effect<Buffer>
-): Effect.Effect<void, string> {
-  return Effect.fail('registerVirtualHID is not yet supported on Linux');
-}

package/src/modules/common/os-platform/virtual-hid/mac.ts

@@ -1,150 +0,0 @@
-import { Effect, Option, pipe } from "effect";
-import { JSCallback, dlopen, FFIType, ptr, toArrayBuffer } from "bun:ffi";
-import type { Pointer } from "bun:ffi";
-
-// FIDO Alliance usage page (0xF1D0), 64-byte in/out reports, no report IDs
-const FIDO2_HID_DESCRIPTOR = new Uint8Array([
-  0x06, 0xD0, 0xF1, // Usage Page (FIDO Alliance 0xF1D0, little-endian)
-  0x09, 0x01,       // Usage (U2F HID Authenticator Device)
-  0xA1, 0x01,       // Collection (Application)
-  0x09, 0x20,       //   Usage (Input report data)
-  0x15, 0x00,       //   Logical Minimum (0)
-  0x26, 0xFF, 0x00, //   Logical Maximum (255)
-  0x75, 0x08,       //   Report Size (8 bits)
-  0x95, 0x40,       //   Report Count (64)
-  0x81, 0x02,       //   Input (Data, Variable, Absolute)
-  0x09, 0x21,       //   Usage (Output report data)
-  0x15, 0x00,       //   Logical Minimum (0)
-  0x26, 0xFF, 0x00, //   Logical Maximum (255)
-  0x75, 0x08,       //   Report Size (8 bits)
-  0x95, 0x40,       //   Report Count (64)
-  0x91, 0x02,       //   Output (Data, Variable, Absolute)
-  0xC0,             // End Collection
-]);
-
-const kIOHIDReportTypeOutput = 1;
-const kIOReturnSuccess = 0;
-const kCFStringEncodingUTF8 = 0x08000100;
-const kCFPropertyListImmutable = 0;
-
-// Kept at module scope to prevent GC while the virtual device is running
-let _vhidCallback: JSCallback | null = null;
-_vhidCallback;
-
-const fromPtr = (label: string, p: Pointer | null): Effect.Effect<Pointer, string> =>
-  pipe(
-    Option.fromNullishOr(p),
-    Effect.fromOption,
-    Effect.mapError(() => `${label} returned NULL`),
-  );
-
-// Build the device properties as an XML plist. CFPropertyListCreateWithData parses this
-// into a fully-initialized CFDictionary (with correct hash/equal callbacks), avoiding
-// the need to pass raw CFDictionaryKeyCallBacks structs via FFI.
-function buildDevicePropertiesPlist(): Uint8Array {
-  const descriptorB64 = Buffer.from(FIDO2_HID_DESCRIPTOR).toString('base64');
-  const xml = [
-    '<?xml version="1.0" encoding="UTF-8"?>',
-    '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
-    '<plist version="1.0">',
-    '<dict>',
-    '  <key>ReportDescriptor</key>',
-    `  <data>${descriptorB64}</data>`,
-    '  <key>VendorID</key>',
-    '  <integer>4617</integer>',   // 0x1209 - pid.codes open-source VID
-    '  <key>ProductID</key>',
-    '  <integer>1</integer>',
-    '  <key>VersionNumber</key>',
-    '  <integer>256</integer>',    // 0x0100
-    '  <key>Product</key>',
-    '  <string>Ozy Virtual FIDO2 Key</string>',
-    '</dict>',
-    '</plist>',
-  ].join('\n');
-  return new TextEncoder().encode(xml);
-}
-
-export function registerVirtualHIDMac(
-  onMessage: (data: Buffer) => Effect.Effect<Buffer>
-): Effect.Effect<void, string> {
-  return Effect.gen(function* () {
-    console.log('[vhid] loading frameworks');
-
-    const IOKit = yield* Effect.try({
-      try: () => dlopen('/System/Library/Frameworks/IOKit.framework/IOKit', {
-        IOHIDUserDeviceCreate: { args: [FFIType.ptr, FFIType.ptr], returns: FFIType.ptr },
-        IOHIDUserDeviceRegisterSetReportCallback: { args: [FFIType.ptr, FFIType.ptr, FFIType.ptr], returns: FFIType.void },
-        IOHIDUserDeviceScheduleWithRunLoop: { args: [FFIType.ptr, FFIType.ptr, FFIType.ptr], returns: FFIType.void },
-        IOHIDUserDeviceHandleReport: { args: [FFIType.ptr, FFIType.ptr, FFIType.i64], returns: FFIType.i32 },
-      }),
-      catch: (e) => `Failed to load IOKit: ${e}`,
-    });
-
-    const CF = yield* Effect.try({
-      try: () => dlopen('/System/Library/Frameworks/CoreFoundation.framework/CoreFoundation', {
-        CFRunLoopGetCurrent: { args: [], returns: FFIType.ptr },
-        CFRunLoopRunInMode: { args: [FFIType.ptr, FFIType.f64, FFIType.bool], returns: FFIType.i32 },
-        CFStringCreateWithCString: { args: [FFIType.ptr, FFIType.ptr, FFIType.u32], returns: FFIType.ptr },
-        CFDataCreate: { args: [FFIType.ptr, FFIType.ptr, FFIType.i64], returns: FFIType.ptr },
-        CFPropertyListCreateWithData: { args: [FFIType.ptr, FFIType.ptr, FFIType.u64, FFIType.ptr, FFIType.ptr], returns: FFIType.ptr },
-        CFRelease: { args: [FFIType.ptr], returns: FFIType.void },
-      }),
-      catch: (e) => `Failed to load CoreFoundation: ${e}`,
-    });
-
-    console.log('[vhid] frameworks loaded');
-
-    const encoder = new TextEncoder();
-
-    const makeCFString = (s: string): Effect.Effect<Pointer, string> =>
-      // TextEncoder gives a Uint8Array with its own ArrayBuffer (byteOffset=0, pool-safe)
-      fromPtr(`CFStringCreateWithCString("${s}")`,
-        CF.symbols.CFStringCreateWithCString(null, ptr(encoder.encode(s + '\0')), kCFStringEncodingUTF8));
-
-    const makeCFData = (data: Uint8Array): Effect.Effect<Pointer, string> =>
-      fromPtr('CFDataCreate', CF.symbols.CFDataCreate(null, ptr(data), BigInt(data.length)));
-
-    console.log('[vhid] building device properties plist');
-    const plistBytes = buildDevicePropertiesPlist();
-    const plistData = yield* makeCFData(plistBytes);
-
-    const dict = yield* fromPtr('CFPropertyListCreateWithData',
-      CF.symbols.CFPropertyListCreateWithData(null, plistData, BigInt(kCFPropertyListImmutable), null, null));
-    CF.symbols.CFRelease(plistData);
-    console.log('[vhid] device properties dict =', dict);
-
-    console.log('[vhid] creating IOHIDUserDevice');
-    const device = yield* fromPtr('IOHIDUserDeviceCreate', IOKit.symbols.IOHIDUserDeviceCreate(null, dict));
-    CF.symbols.CFRelease(dict);
-    console.log('[vhid] IOHIDUserDeviceCreate =', device);
-
-    const callback = yield* Effect.try({
-      try: () => new JSCallback(
-        (_refcon: number, _result: number, _sender: number, type: number, _reportID: number, report: number, reportLength: number) => {
-          if (type !== kIOHIDReportTypeOutput) return kIOReturnSuccess;
-          const incoming = Buffer.from(toArrayBuffer(report as unknown as Pointer, 0, reportLength));
-          console.log(`[vhid] received ${incoming.length} bytes: ${incoming.toString('hex')}`);
-          Effect.runPromise(onMessage(incoming)).then(response => {
-            const responseBuf = new Uint8Array(64);
-            response.copy(Buffer.from(responseBuf.buffer), 0, 0, Math.min(response.length, 64));
-            IOKit.symbols.IOHIDUserDeviceHandleReport(device, ptr(responseBuf), BigInt(responseBuf.length));
-          }).catch(() => {});
-          return kIOReturnSuccess;
-        },
-        { returns: 'i32', args: ['ptr', 'i32', 'ptr', 'i32', 'u32', 'ptr', 'i64'] },
-      ),
-      catch: (e) => `Failed to create JSCallback: ${e}`,
-    });
-    _vhidCallback = callback;
-
-    IOKit.symbols.IOHIDUserDeviceRegisterSetReportCallback(device, callback.ptr, null);
-
-    const runLoop = CF.symbols.CFRunLoopGetCurrent();
-    const runLoopMode = yield* makeCFString('kCFRunLoopDefaultMode');
-    IOKit.symbols.IOHIDUserDeviceScheduleWithRunLoop(device, runLoop, runLoopMode);
-
-    console.log('[vhid] virtual FIDO2 device active, pumping run loop');
-    // Pump CFRunLoop from Bun's libuv event loop without blocking
-    setInterval(() => CF.symbols.CFRunLoopRunInMode(runLoopMode, 0.0, false), 10);
-  });
-}

package/src/modules/common/os-platform/virtual-hid/windows.ts

@@ -1,7 +0,0 @@
-import { Effect } from "effect";
-
-export function registerVirtualHIDWindows(
-  _onMessage: (data: Buffer) => Effect.Effect<Buffer>
-): Effect.Effect<void, string> {
-  return Effect.fail('registerVirtualHID is not yet supported on Windows');
-}

package/src/modules/common/ssh-config/impl.ts

@@ -1,130 +0,0 @@
-import * as fs from "node:fs/promises";
-import { join } from "node:path";
-import { writeFileSync } from "node:fs";
-import { Effect, Option, Schema } from "effect";
-import SSHConfig, { LineType } from "ssh-config";
-import expandTilde from "expand-tilde";
-import { implementing, type EffectGen } from "effective-modules";
-import { commonModules } from "@/modules/common";
-
-import { SSHConfigSection, type ISSHConfig, type SSHConfigHosts, type WriteHostInput, type WritePubkeyInput } from "./interface";
-
-const SSH_CONFIG_PATH = "~/.ssh/config";
-const SSH_DIR = "~/.ssh";
-
-export class SSHConfigImpl extends implementing(commonModules.SSHConfig) implements ISSHConfig {
-  private *loadSSHConfigRaw(): EffectGen<SSHConfig, string> {
-    const configPath = expandTilde(SSH_CONFIG_PATH);
-    const exists = yield* Effect.promise(() => fs.exists(configPath));
-    const text = exists
-      ? yield* Effect.tryPromise({
-          try: () => fs.readFile(configPath, "utf8"),
-          catch: (e) => `Failed to read ssh config at ${configPath}: ${e instanceof Error ? e.message : String(e)}`,
-        })
-      : "";
-    return yield* Effect.try({
-      try: () => SSHConfig.parse(text),
-      catch: (e) => `ParseError: unable to parse ssh config at ${configPath}\n${e instanceof Error ? e.message : String(e)}`,
-    });
-  }
-
-  *getSSHConfig(): EffectGen<SSHConfigHosts, string> {
-    const configPath = expandTilde(SSH_CONFIG_PATH);
-    const exists = yield* Effect.promise(() => fs.exists(configPath));
-    if (!exists)
-      return yield* Effect.fail(`SSHConfigFileMissingError: No file found at ${configPath}`);
-
-    const parsed = yield* this.loadSSHConfigRaw();
-
-    const hosts: SSHConfigHosts = {};
-    for (const line of parsed) {
-      if (line.type === LineType.COMMENT) continue;
-      const { param, value: host } = line;
-      if (param !== "Host")
-        return yield* Effect.fail(`EntryNotAHostKeyValuePairError: unexpected top-level entry '${param}=${JSON.stringify(host)}'`);
-      if (typeof host !== "string")
-        return yield* Effect.fail(`EntryNotAHostKeyValuePairError: Host value is not a string: ${JSON.stringify(host)}`);
-      if (!("config" in line))
-        return yield* Effect.fail(`EntryNotAHostKeyValuePairError: non-section Host entry '${host}'`);
-      if (host in hosts)
-        return yield* Effect.fail(`DuplicateHostError: duplicate Host '${host}' in ${configPath}`);
-
-      const kv: Record<string, string> = {};
-      for (const inner of line.config) {
-        if (inner.type === LineType.COMMENT) continue;
-        if (typeof inner.value !== "string")
-          return yield* Effect.fail(`MalformedError: Host '${host}' key '${inner.param}' has non-string value`);
-        kv[inner.param] = inner.value;
-      }
-
-      const section = yield* Schema.decodeUnknownEffect(SSHConfigSection)(kv).pipe(
-        Effect.mapError(e => `MalformedError: malformed section at Host '${host}': ${String(e)}`)
-      );
-      hosts[host] = section;
-    }
-
-    return hosts;
-  }
-
-  *writeHost({ section }: WriteHostInput): EffectGen<void, string> {
-    const configPath = expandTilde(SSH_CONFIG_PATH);
-    const cfg = yield* this.loadSSHConfigRaw();
-    const newEntries = Object.entries(section)
-      .filter(([, v]) => v !== undefined)
-      .map(([k, v]) => ({ type: LineType.DIRECTIVE, before: '  ', param: k, separator: ' ', value: v as string, after: '\n' }));
-
-    const existingIdx = cfg.findIndex((e: any) => e.param === "Host" && e.value === section.HostName);
-    if (existingIdx >= 0) {
-      (cfg[existingIdx] as any).config = newEntries;
-    } else {
-      const record: Record<string, string> = { Host: section.HostName };
-      for (const [k, v] of Object.entries(section)) {
-        if (v !== undefined) record[k] = v;
-      }
-      cfg.append(record);
-    }
-
-    yield* Effect.try({
-      try: () => writeFileSync(configPath, SSHConfig.stringify(cfg), { mode: 0o600 }),
-      catch: (e) => `Failed to write ssh config: ${e instanceof Error ? e.message : String(e)}`,
-    });
-  }
-
-  *listPubkeyFiles(): EffectGen<{name: string, content: string}[], string> {
-    const sshDir = expandTilde(SSH_DIR);
-    const entries = yield* Effect.tryPromise({
-      try: () => fs.readdir(sshDir),
-      catch: (e) => `Failed to read ${sshDir}: ${e instanceof Error ? e.message : String(e)}`,
-    });
-    const pubkeyFiles = entries.filter(f => f.endsWith('.pub'));
-    const results: {name: string, content: string}[] = [];
-    for (const file of pubkeyFiles) {
-      const content = yield* Effect.tryPromise({
-        try: () => fs.readFile(join(sshDir, file), 'utf8'),
-        catch: (e) => `Failed to read ${file}: ${e instanceof Error ? e.message : String(e)}`,
-      });
-      results.push({ name: file.slice(0, -'.pub'.length), content: content.trim() });
-    }
-    return results;
-  }
-
-  getPubkeyPath(name: string): string {
-    return `${expandTilde(SSH_DIR)}/${name}.pub`;
-  }
-
-  *writePubkey({ name, comment, pubkey }: WritePubkeyInput): EffectGen<{pubkeyPath: string}, string> {
-    const sshDir = expandTilde(SSH_DIR);
-    const pubkeyPath = `${sshDir}/${name}.pub`;
-    const content = Option.match(comment, {
-      onNone: () => pubkey.authorizedKey,
-      onSome: (c) => `${pubkey.authorizedKey} ${c}`,
-    });
-
-    yield* Effect.try({
-      try: () => writeFileSync(pubkeyPath, content + "\n", { mode: 0o600 }),
-      catch: (e) => `Failed to write pubkey to ${pubkeyPath}: ${e instanceof Error ? e.message : String(e)}`,
-    });
-
-    return {pubkeyPath};
-  }
-}