@ozyman42/ozy-cli 0.4.8 → 0.4.9-darwin-x64.0

package/src/modules/common/ssh-config/interface.ts

@@ -1,33 +0,0 @@
-import { Schema } from "effect";
-import type { Option } from "effect";
-import type { EffectGen } from "effective-modules";
-import type { SSHPubkey } from "@/modules/common/crypto/impl";
-
-export const SSHConfigSection = Schema.Struct({
-  HostName: Schema.String,
-  User: Schema.String,
-  IdentityFile: Schema.optional(Schema.String),
-  AddKeysToAgent: Schema.optional(Schema.String),
-  IdentitiesOnly: Schema.optional(Schema.String),
-  IdentityAgent: Schema.optional(Schema.String),
-});
-export type SSHConfigSection = Schema.Schema.Type<typeof SSHConfigSection>;
-export type SSHConfigHosts = Record<string, SSHConfigSection>;
-
-export interface WriteHostInput {
-  section: SSHConfigSection;
-}
-
-export interface WritePubkeyInput {
-  name: string;
-  comment: Option.Option<string>;
-  pubkey: SSHPubkey;
-}
-
-export interface ISSHConfig {
-  getSSHConfig(): EffectGen<SSHConfigHosts, string>;
-  writeHost(input: WriteHostInput): EffectGen<void, string>;
-  writePubkey(input: WritePubkeyInput): EffectGen<{pubkeyPath: string}, string>;
-  listPubkeyFiles(): EffectGen<{name: string, content: string}[], string>;
-  getPubkeyPath(name: string): string;
-}

package/src/modules/ssh-agent/index.ts

@@ -1,13 +0,0 @@
-import { interfaces } from "effective-modules";
-import type { ISSHAgent } from "./ssh-agent/interface";
-import type { ISession } from "./session/interface";
-
-export enum AgentModules {
-  SSHAgent = "SSHAgent",
-  Session = "Session"
-}
-
-export const agentModules = interfaces<AgentModules, {
-  SSHAgent: ISSHAgent;
-  Session: ISession;
-}>(AgentModules);

package/src/modules/ssh-agent/session/agent-notes.md

@@ -1,210 +0,0 @@
-# Why This Tool Exists
-
-`webauthn-sk-ecdsa-sha2-nistp256@openssh.com` is the SSH key type that would allow platform passkeys (Face ID, Touch ID, Windows Hello) to sign SSH auth and commits directly — no PRF, no HKDF, no agent needed. If GitHub supported it, this tool would be largely unnecessary for the basic case.
-
-GitHub only supports the `sk-` prefix variants (FIDO2 hardware security keys like YubiKey), not the `webauthn-sk-` platform passkey variant. So we need the PRF → HKDF → derived key path instead.
-
-Even if GitHub added `webauthn-sk-` support, per-repo scoping would remain valuable: a standard GitHub SSH key grants access to all your repos. Deploy keys + per-repo HKDF derivation is the only way to get true repo-level auth scoping, critical for the Jive multi-repo context.
-
-## Long-Term Vision (not current scope)
-
-Jive could eventually bypass SSH entirely: accept native passkey WebAuthn signatures directly, with the challenge encoding the repo (for push/pull) or the commit SHA (for signing). Jive verifies server-side and writes to the repo via its GitHub App permissions. No SSH agent, no key derivation, no deploy keys — passkey IS the auth primitive.
-
----
-
-# Key Architecture: Per-Repo HKDF Derivation
-
-Each repo gets a distinct SSH keypair derived from the passkey PRF seed:
-- `HKDF(passkey_seed, repo_url)` → SSH private key for that repo
-- Public key is registered as a GitHub **deploy key** on that specific repo
-- Agent maintains a persistent registry: `pubkey → repo_path` (populated at setup time)
-
-**Security property:** A signature from repo X's derived key is valid ONLY for repo X's deploy key. Even a sophisticated attacker who gets the agent to sign for repo X's key cannot use that signature to access repo Y. The per-repo key derivation IS the security boundary — no binary replacement or cwd trick escapes it.
-
-**Signing request flow:**
-1. Request arrives with pubkey P + data to sign
-2. Agent looks up registry: pubkey P → repo R
-3. Agent triggers WebAuthn PRF to get seed (if not cached)
-4. HKDF(seed, R) → private key K; verify K's pubkey = P
-5. Sign and return
-
-**Session manifest:** list of `(pubkey, operation_type, count)` tuples. Incoming requests match by pubkey — unambiguous, one pubkey per repo. No cwd lookup needed.
-
-**Full security stack against a sophisticated local attacker:**
-- Push/pull auth: scoped to specific repo via deploy key — signature for repo X is cryptographically useless for repo Y
-- Commit signing: separate WebAuthn tap, browser shows exact commit content being signed — attacker can't forge a signed commit without the user seeing it
-- Verified commits enforced server-side: repo rejects unsigned/unverified commits
-
-An attacker would need to both obtain an auth signature AND trick the user into approving a commit signing request for malicious content — both visible in the browser. Very hard to pull off silently at any scale.
-
----
-
-# Setup Flow (per repo)
-
-`ozy git passkey-to-ssh setup`:
-1. If no derived pubkey registered for this repo:
-   - Trigger WebAuthn PRF to get seed (registration assertion, creates passkey if needed)
-   - HKDF(seed, repo_url) → keypair
-   - Browser OAuth flow to get short-lived GitHub token (admin:repo scope, setup only, discarded after)
-   - Register pubkey as deploy key via GitHub API (`POST /repos/{owner}/{repo}/keys`)
-   - Store pubkey → repo_path in local agent registry
-   - Write pubkey to local git config (`user.signingkey`)
-   - Write git config settings (sshCommand, gpg.format, gpg.ssh.program)
-2. If pubkey already registered → authentication flow (start agent/session)
-
----
-
-# Git Config (per-repo local)
-
-```
-# 1. Network Authn (Pushes/Pulls)
-git config local.core.sshCommand "env SSH_AUTH_SOCK='/path/to/your/custom/agent.sock' ssh"
-
-# 2. Tell Git to use SSH format for signing
-git config local.gpg.format "ssh"
-
-# 3. Provide the literal public key (Triggers agent mode automatically)
-git config local.user.signingkey "ssh-ed25519 AAAAC3Nz..."
-
-# 4. Force ssh-keygen to read your custom agent using OpenSSH options
-git config local.gpg.ssh.program "ssh-keygen -o IdentityAgent=/path/to/your/custom/agent.sock"
-```
-
-Both auth and signing flow through the same custom SSH agent socket.
-Pubkey lives in local git config (`user.signingkey`).
-
----
-
-# Browser / Agent Communication
-
-- Agent starts a localhost HTTP server on a random port
-- Agent opens browser to `http://localhost:<port>/`
-- Page performs WebAuthn PRF assertion
-- Page encrypts PRF seed with agent's ephemeral public key
-- Page `fetch()` POSTs encrypted seed to `POST /seed` on same server
-- Agent responds with success or failure JSON
-- On success, page instructs user to close the tab
-- Agent tears down HTTP server, derives SSH key via HKDF from decrypted seed
-
----
-
-# Agent Ephemeral Keypair
-
-- Generated fresh on each invocation of `getAndVerifySigningAndDeployKey` (never touches disk)
-- Used only to encrypt the PRF seed during browser→agent transfer
-- Wiped after session ends along with derived SSH key
-- ECDH P-256 + HKDF → AES-GCM (X25519 not supported in Bun compiled binaries)
-
-**Security properties of the ephemeral keypair:**
-
-- **Prevents PRF sniffing:** An attacker who intercepts the encrypted POST to `/seed` cannot recover the raw PRF seed. The ciphertext is decryptable only by the agent that generated the keypair for that session.
-- **Prevents cross-session replay:** The AES-GCM key is derived from `ECDH(agent_private, browser_ephemeral_public)`. A new invocation generates a fresh agent keypair, so the ECDH shared secret differs — replaying a captured encrypted POST to a new server produces a different AES key and decryption fails with an authentication tag mismatch. The encrypted seed is cryptographically bound to the specific agent public key that was live during that session.
-
----
-
-# Session Model
-
-Sessions are **explicitly pre-declared** by the orchestrator (e.g. jive), not accumulated dynamically.
-
-Flow:
-1. Orchestrator starts a session, declaring the full manifest of expected operations upfront
-2. Agent opens browser; browser shows exactly what will be signed
-3. User approves with a single tap
-4. Agent derives SSH key, services only the declared requests
-5. Any request outside the declared manifest is rejected outright
-6. After all declared requests are serviced (or on cancel), key is wiped and session ends
-
-**Why not timeout-based accumulation:** A malicious script with shell access could inject additional signing requests into an open session window. With pre-declaration, the agent has a fixed allowlist.
-
-**Unrecognized requests:** If a signing request arrives that doesn't match any active session's manifest, the agent treats it as a single-request session and initiates its own WebAuthn flow for just that one signature. This handles:
-- Direct git usage (no orchestrator started a session)
-- Malicious injection (user sees a single isolated request in the browser and can deny it)
-
-## What Can Be Pre-Declared?
-
-For **SSH auth (push/pull)**: the challenge bytes are random and server-generated — the exact signature input isn't known in advance. Can only pre-declare: destination host + operation type (push vs pull) + repo path. Agent enforces that only declared host/repo/operation combinations are serviced, up to declared counts.
-
-**SSH auth request identifiability:** For N repos all pointing at the same SSH host (e.g. github.com), the agent sees N signing requests that are effectively indistinguishable — each is "sign this opaque blob as user `git`". The repo path is not part of SSH auth signing data; it only appears later in the git protocol layer after authentication. The session identifier is a fresh hash per connection (different ephemeral keys), so blobs differ, but their meaning is the same from the agent's perspective.
-
-Implication: manifest matching for SSH auth is host + username + operation type + **count**. The agent allows exactly N such requests and rejects any beyond that. Individual slot-to-repo mapping is not enforceable at the agent level.
-
----
-
-# Registration vs Authentication Flow
-
-`ozy git passkey-to-ssh setup` (per repo):
-- If no pubkey in local git config → **registration flow**: create passkey, derive SSH key, store pubkey in git config, configure git settings above
-- If pubkey exists → **authentication flow**: start agent if not running, either use cached key or open browser for PRF assertion
-
----
-
-# Context Derivation at Sign Time
-
-The agent derives repo context by reading the **peer PID** of the Unix socket / named pipe connection — not from the signing data itself, and not via filesystem walk.
-
-**Why not parse the signing data:**
-- Commit signing: the SSHSIG blob contains `SHA-512(commit object)`. The commit object has tree hash, parent hashes, author, committer, message — but NOT the repo name. The final commit hash also isn't present (it depends on the signature, so it doesn't exist yet).
-- Push/pull SSH auth: the challenge bytes are random and server-generated. Repo path doesn't appear until after authentication at the git protocol layer.
-
-**Why not walk the filesystem:**
-- Slow and costly on large filesystems; hangs on network mounts.
-- Doesn't handle users moving their repo around.
-- Attacker with local filesystem access could plant a git object with the same tree hash into another repo to cause a false match.
-
-**Peer PID approach:**
-- The git process that triggered the signing request is alive on the socket. Its cwd IS the repo.
-- Get peer PID from the socket connection, read cwd, read `remote.origin.url` from that repo's git config.
-- Platform APIs: `SO_PEERCRED` (Linux), `LOCAL_PEERCRED`/`getpeereid` (macOS), `GetNamedPipeClientProcessId` (Windows).
-
-**What each signing key tells you:**
-- Deploy key used → push/pull for the repo that key was registered to (per-repo key, unambiguous)
-- Signing key used → commit signing; use peer PID to identify which repo's git process is requesting
-
-**What the tree hash means:**
-- The tree SHA in a commit is a content-addressed merkle tree over the entire working directory. Signing the commit object is effectively signing that full snapshot plus lineage (parent hashes) and authorship metadata.
-- A malicious commit requires a different tree hash (different file contents), so showing the tree hash in the browser prompt is meaningful — but not human-readable. Showing the commit message + author is more practical UX.
-
----
-
-# Credential Map
-
-The `pubkey → credentialId` map on disk is kept for two reasons:
-
-1. **Pre-selecting an existing passkey in the WebAuthn PRF flow** — avoids creating a new passkey registration on every session; the credential ID is passed to `navigator.credentials.get()` as `allowCredentials`.
-2. **Responding to `REQUEST_IDENTITIES` from the SSH client** — `listKeys()` returns all known deploy pubkeys so git knows which keys the agent holds.
----
-
-# Flows mapped out
-
-1. User clones repo (`ozy git setup <owner/repo>`)
-  1. Note that in this case, the deploy key needs to be registered before git clone can be run
-  1. client calls getOrSetupKeys(credentialId?, repoIds?[])
-    1. agent will ask for a new credential if missing. In addition it will derive X deploy keys and 1 signing key
-    1. agent will both return these keys and store them in the map from key to credential
-  1. client registers deploy keys and signing key if any didn't exist yet
-  1. client starts session([Action { user, clone, repo, pubkey }])
-    1. agent fails request if the pubkey isn't present in the map file
-  1. client calls git clone using the deploy key
-    1. ssh agent passes this action to main agent
-    1. agent will fail if pubkey mapping isn't present
-    1. if there's no matching session, agent will create single use session with just the action
-1. User sets up already cloned repo
-  1. client calls getOrSetupKeys(credentialId?, repoIds?[])
-1. User pushes/pulls
-  1. client starts session
-1. User signs commit
-
-SSH Agent lists keys by finding the PID talking to it and only returning that key
-There can only be one active session at a time. Browser will learn of sneaky attempts to bypass this
-
----
-
-# Known attack vectors
-
-We use PID hierarchy tied to a session to ensure that only git commands spawned from the trusted PID root can send actions to the active signing session. This works fine on Unix like systems since PID trees are controlled by the kernel, but on Windows someone can set the parent PID to whatever they want and also the PID is not reassigned to some global root when the parent exists.
-
----
-
-# Open Questions
-
-- For SSH auth pre-declaration: is host+repo+operation granularity sufficient?

package/src/modules/ssh-agent/session/design.md

@@ -1,2 +0,0 @@
-Passkey to SSH is a utility which will configure a repo to do git authn and commit signing
-with a passkey. The general flow is that an agent will be running which stores a standard ssh private key in memory. The key is derived from a passkey PRF extension obtained deterministic seed. When the ssh key needs to reassembled, the agent will open a browser which will perform a prf passkey request using the web's WebAuthn APIs, the seed will be encrypted with the agent's public key then sent over the wire to the agent. The agent will decrypt with its private key then with the decrypted seed use an HKDF to derive the ssh private key. Once in memory the key will be used to sign requests, when the machine restarts the ssh private key will have been lost since it only lives in memory. Also when the agent boots up it generates a new self keypair for the encryption / decryption of ssh key seeds. This keypair also only ever live in memory. There will either be utilities used to replace the commands which git calls out to for git commit signing (git config's gpg.ssh.program) and ssh authn (git config's core.sshCommand), or we'll find a way to work with existing default ssh tools.

package/src/modules/ssh-agent/session/html-refactor.md

@@ -1,23 +0,0 @@
-# HTML Refactor: passkey-prf-page
-
-## Problem
-`passkey-prf-page.ts` generates HTML+JS via string templates. The embedded browser script (escape noise, no type checking, no IDE support) makes it hard to read and maintain.
-
-## Proposed approach
-Split into three layers:
-
-```
-passkey-prf-browser.ts          ← real TypeScript; browser DOM/WebAuthn code with full IDE support
-        ↓ Bun.build (added to build.ts before main binary compile)
-passkey-prf-browser-bundle.ts   ← generated file: export const BROWSER_BUNDLE = "..."
-        ↓ imported by
-passkey-prf-page.tsx            ← JSX template; <script>{BROWSER_BUNDLE}</script>
-```
-
-## build.ts change
-Before compiling `ozy-signing-agent`, add one `Bun.build` call targeting `passkey-prf-browser.ts` with `target: 'browser'` and `minify: true`. Write the first output's text to `passkey-prf-browser-bundle.ts` as a generated string constant. The generated file should be gitignored or marked as generated.
-
-## Benefits
-- Browser code can import shared constants (e.g. `FUTURE_TOOL_NAME`) — TypeScript catches mismatches
-- HTML template is plain JSX — no backslash escaping, readable structure
-- `<script>` block is just `{BROWSER_BUNDLE}` — no structural noise

package/src/modules/ssh-agent/session/impl.ts

@@ -1,328 +0,0 @@
-import { Deferred, Effect, Option, pipe, Result, Layer } from "effect";
-import { effunct, implementing, type EffectGen } from "effective-modules";
-import { SSHPubkey, CredentialId, SSHKeyPair } from "@/modules/common/crypto/impl";
-import { renderCallerTree } from "@/common/render-caller-tree";
-import { BunHttpServer } from "@effect/platform-bun";
-import { randomUUID } from "node:crypto";
-import { agentModules } from "@/modules/ssh-agent";
-import { commonModules } from "@/modules/common";
-import { SessionError, type ISession, type SetupInput, SetupOutput, StartSessionInput, type SignInput } from "./interface";
-import { AgentRpcGroup } from "./interface-rpc";
-import { prfFlow, PrfInput, type PrfResult } from "./prf-flow";
-import { AGENT_PORT_FILE_PATH, CURRENT_VERSION, DEFAULT_SESSION_TIMEOUT_SECONDS } from "@/common/constants";
-import { HttpRouter, HttpServer } from "effect/unstable/http";
-import { RpcServer, RpcSerialization } from "effect/unstable/rpc";
-import { writeFileSync } from "node:fs";
-import { using } from "@/common/effective-modules-extensions";
-
-export interface ActiveSession {
-  id: string;
-  definition: StartSessionInput;
-  // The indices match the expected sign requests which were received
-  receivedSignRequests: {
-    deferredResponse: Deferred.Deferred<Buffer, SessionError>;
-    signRequest: SignInput;
-  }[];
-  totalReceived: number;
-  pubkey: string;
-  credentialId: string;
-  completed: boolean;
-}
-
-const { OSPlatform, Crypto, KeyMapStore } = commonModules;
-const { Session } = agentModules;
-
-const SIGN_REQUESTS_COLLECTION_TIMEOUT_SECONDS = 3;
-
-export class SessionImpl extends implementing(Session).uses(OSPlatform, Crypto, KeyMapStore) implements ISession {
-  private activeSession: Option.Option<ActiveSession> = Option.none();
-  private keyCache = new Map<string, SSHKeyPair>();
-
-  private *abortSession(session: ActiveSession, onlyCheckRequestsAccumulated: boolean): EffectGen<void> {
-    if (session.completed) return;
-    let timeout = session.definition.timeoutSeconds;
-    if (onlyCheckRequestsAccumulated) {
-      const expected = session.definition.expectedSignRequests.length;
-      const actual = session.receivedSignRequests.length;
-      if (expected === actual) {
-        yield* Effect.log(`All sign requests were received for session ${session.id} within ${SIGN_REQUESTS_COLLECTION_TIMEOUT_SECONDS} seconds`);
-        return;
-      } else {
-        yield* Effect.log(`After ${SIGN_REQUESTS_COLLECTION_TIMEOUT_SECONDS} seconds only ${actual}/${expected} sign requests were received for session ${session.id}. Aborting`);
-        timeout = SIGN_REQUESTS_COLLECTION_TIMEOUT_SECONDS;
-      }
-    } else {
-      yield* Effect.log(`Aborting session ${session.id} after ${timeout} seconds`);
-    }
-    if (Option.isSome(this.activeSession) && this.activeSession.value.id === session.id) {
-      this.activeSession = Option.none();
-    }
-    // Fail all the sign requests.
-    const error = SessionError.cases.SessionTimedOut.make({
-      seconds: timeout
-    });
-    session.completed = true;
-    for (let i = 0; i < session.definition.expectedSignRequests.length; ++i) {
-      const maybeReceived = Option.fromNullishOr(session.receivedSignRequests[i]);
-      if (Option.isNone(maybeReceived)) continue;
-      const { deferredResponse } = maybeReceived.value;
-      yield* Deferred.fail(deferredResponse, error);
-    }
-  }
-
-  *startSession({expectedCommonAncestorPID, expectedSignRequests, timeoutSeconds, pubkey}: StartSessionInput): EffectGen<void, SessionError> {
-    if (Option.isSome(this.activeSession)) {
-      const activeId = this.activeSession.value.id;
-      yield* Effect.log(`Blocked attempt to start session while ongoing active session ${activeId}`);
-      return yield* Effect.fail(SessionError.cases.InterruptingSession.make({ id: activeId }));
-    }
-    const maybeCredential = yield* pipe(
-      effunct(this.dependencies.KeyMapStore.getCredentialByPubkey)(SSHPubkey.fromAuthorizedKey(pubkey)),
-      Effect.catch(err => Effect.fail(SessionError.cases.InternalError.make({
-        reason: `Failed to read from key map store: ${err}`
-      })))
-    )
-    if (Option.isNone(maybeCredential)) {
-      return yield* Effect.fail(SessionError.cases.PubkeyNotRegistered.make({
-        pubkey
-      }));
-    }
-    const id = randomUUID();
-    const session: ActiveSession = {
-      definition: {expectedCommonAncestorPID, expectedSignRequests, timeoutSeconds, pubkey},
-      receivedSignRequests: [],
-      id,
-      totalReceived: 0,
-      pubkey,
-      credentialId: maybeCredential.value,
-      completed: false
-    };
-    this.activeSession = Option.some(session);
-    const n = expectedSignRequests.length;
-    yield* Effect.log(`Starting session ${id} for ${new CredentialId(maybeCredential.value).humanReadableName} (${maybeCredential.value}). Expecting ${n} sign request${n === 1 ? '' : 's'}`);
-    // 2 timeouts. 
-    // - One for just collecting all requests in the session.
-    Effect.runFork(pipe(
-      effunct(this.abortSession)(session, true),
-      Effect.delay(`${SIGN_REQUESTS_COLLECTION_TIMEOUT_SECONDS} seconds`)
-    ));
-    // - Another which abandons the session if the actual prf flow hasn't happened yet  
-    Effect.runFork(pipe(
-      effunct(this.abortSession)(session, false),
-      Effect.delay(`${timeoutSeconds} seconds`)
-    ));
-  }
-
-  private isSignRequestInSession(session: ActiveSession, signRequest: SignInput): Option.Option<{index: number}> {
-    if (session.pubkey !== signRequest.pubkey.authorizedKey) {
-      return Option.none();
-    }
-    const trustedParentPid = session.definition.expectedCommonAncestorPID;
-    let foundTrustedParentPid = false;
-    for (let i = 0; i < signRequest.callerTree.length; ++i) {
-      if (signRequest.callerTree[i]!.pid === trustedParentPid) {
-        foundTrustedParentPid = true;
-        break;
-      }
-    }
-    if (!foundTrustedParentPid) {
-      return Option.none();
-    }
-    for (let i = 0; i < session.definition.expectedSignRequests.length; ++i) {
-      const { expectedCallerChain } = session.definition.expectedSignRequests[i]!;
-      let j = 0;
-      for (; j < expectedCallerChain.length; ++j) {
-        const expected = expectedCallerChain[j]!;
-        const actual = signRequest.callerTree[j];
-        if (
-          actual.command !== expected.command ||
-          Option.getOrNull(actual.directory) !== Option.getOrNull(expected.directory)
-        ) {
-          break;
-        }
-      }
-      if (j === expectedCallerChain.length) {
-        // Found match
-        return Option.some({index: i});
-      }
-    }
-    return Option.none();
-  }
-
-  private *cacheKey(keyPair: SSHKeyPair, credentialId: CredentialId, cacheMinutes: number): EffectGen<void> {
-    const pubkey = keyPair.pubkey.authorizedKey;
-    this.keyCache.set(pubkey, keyPair);
-    Effect.runFork(pipe(
-      Effect.sync(() => { this.keyCache.delete(pubkey); }),
-      Effect.andThen(Effect.log(`Cache entry revoked for ${pubkey} (${credentialId.humanReadableName}) after ${cacheMinutes} minutes`)),
-      Effect.delay(`${cacheMinutes} minutes`)
-    ));
-    yield* Effect.log(`Cached key ${pubkey} (${credentialId.humanReadableName}) for ${cacheMinutes} minutes`);
-  }
-
-  private *resolveAllSignRequests(session: ActiveSession): EffectGen<void> {
-    // By setting it to none here, we technically do allow parallel sessions, the
-    // caveat is there's an expectation that all requests for a session are retrieved
-    // in a short time frame. In the future we may have a backlog of non matching signing requests
-    // and sessions
-    this.activeSession = Option.none();
-    const credential = new CredentialId(session.credentialId);
-
-    const cachedKeyPair = this.keyCache.get(session.pubkey);
-    let prfResult: Result.Result<PrfResult, SessionError>;
-    if (cachedKeyPair) {
-      yield* Effect.log(`Using cached key for session ${session.id}`);
-      prfResult = Result.succeed({ keyPair: cachedKeyPair, credentialId: credential });
-    } else {
-      prfResult = yield* pipe(
-        effunct(prfFlow)(PrfInput.DerivePubkeyForRequests({session})),
-        Effect.scoped,
-        Effect.provide(this.context),
-        Effect.result
-      );
-      if (Result.isSuccess(prfResult)) {
-        const { keyPair } = prfResult.success;
-        const derivedPubkey = keyPair.pubkey.authorizedKey;
-        if (derivedPubkey !== session.pubkey) {
-          yield* Effect.log(`PRF derived pubkey ${derivedPubkey} but session expects ${session.pubkey}`);
-          prfResult = Result.fail(SessionError.cases.InternalError.make({
-            reason: `PRF derived pubkey ${derivedPubkey} does not match session pubkey ${session.pubkey}`
-          }));
-        } else if (prfResult.success.cacheMinutes !== undefined) {
-          yield* this.cacheKey(keyPair, credential, prfResult.success.cacheMinutes);
-        }
-      }
-    }
-
-    session.completed = true;
-    if (Result.isFailure(prfResult)) {
-      yield* Effect.log(`PRF flow failed for session ${session.id}: ${JSON.stringify(prfResult.failure)}`);
-    } else {
-      yield* Effect.log(`PRF flow succeeded for session ${session.id}`);
-    }
-    let totalSigned = 0;
-    for (const req of session.receivedSignRequests) {
-      if (Result.isSuccess(prfResult)) {
-        const { keyPair } = prfResult.success;
-        const sigResult = yield* Effect.result(Effect.try({
-          try: () => keyPair.sign(req.signRequest.data),
-          catch: (e) => SessionError.cases.InternalError.make({ reason: String(e) }),
-        }));
-        if (Result.isSuccess(sigResult)) {
-          totalSigned++;
-          yield* Effect.log(`(${totalSigned}/${session.receivedSignRequests.length}) Signed ${req.signRequest.data.length} bytes for session ${session.id}`);
-          yield* Deferred.succeed(req.deferredResponse, sigResult.success);
-        } else {
-          yield* Effect.log(`Signing failed for session ${session.id}: ${JSON.stringify(sigResult.failure)}`);
-          yield* Deferred.fail(req.deferredResponse, sigResult.failure);
-        }
-      } else {
-        yield* Deferred.fail(req.deferredResponse, prfResult.failure);
-      }
-
-    }
-  }
-
-  *sign(signRequest: SignInput): EffectGen<Buffer, SessionError> {
-    const {pubkey, callerTree} = signRequest;
-    // On the no active session case. We create one.
-    if (Option.isNone(this.activeSession)) {
-      yield* Effect.log(`Received sign request when no session exists. Chain:\n${renderCallerTree(callerTree.slice(-3))}`);
-      yield* this.startSession({
-        expectedCommonAncestorPID: callerTree[callerTree.length - 1].pid,
-        expectedSignRequests: [{
-          expectedCallerChain: callerTree
-        }],
-        timeoutSeconds: DEFAULT_SESSION_TIMEOUT_SECONDS,
-        pubkey: pubkey.authorizedKey
-      })
-    }
-    if (Option.isNone(this.activeSession)) {
-      return yield* Effect.fail(SessionError.cases.InternalError.make({
-        reason: "Invariant violation. Active session not set after calling startSession"
-      }));
-    }
-    const session = this.activeSession.value;
-    const maybeIndex = this.isSignRequestInSession(session, signRequest);
-    if (Option.isNone(maybeIndex)) {
-      // TODO: we could instead create a queue of backed-up sign requests and give
-      //       a very short window for each session to collect its requests.
-      return yield* Effect.fail(SessionError.cases.InterruptingSession.make({
-        id: session.id
-      }));
-    }
-    const {index} = maybeIndex.value;
-    const deferredResponse = yield* Deferred.make<Buffer, SessionError>();
-    session.receivedSignRequests[index] = {
-      deferredResponse,
-      signRequest
-    }
-    session.totalReceived++;
-    const totalExpected = session.definition.expectedSignRequests.length;
-    yield* Effect.log(`Got matching signature request. ${totalExpected - session.totalReceived} remaining`);
-    if (session.totalReceived > totalExpected) {
-      return yield* Effect.fail(SessionError.cases.InternalError.make({
-        reason: `Only expected to get ${totalExpected} signature requests. Got ${session.totalReceived} instead`
-      }));
-    }
-
-    if (session.totalReceived === totalExpected) {
-      yield* Effect.log(`All ${totalExpected} expected signature requests received for session ${session.id}. Initiating passkey verification.`);
-      yield* this.resolveAllSignRequests(session);
-    }
-
-    return yield* Deferred.await(deferredResponse);
-  }
-
-  *setup(input: SetupInput): EffectGen<SetupOutput, SessionError> {
-    const { keyPair, credentialId: derivedCredentialId, cacheMinutes } = yield* pipe(
-      effunct(prfFlow)(PrfInput.DerivePubkeyOnly({ pubkey: input.pubkey, credentialId: input.credentialId, username: input.username })),
-      Effect.scoped,
-      Effect.provide(this.context)
-    );
-
-    const derivedPubkey = keyPair.pubkey.authorizedKey;
-
-    if (Option.isSome(input.pubkey) && derivedPubkey !== input.pubkey.value) {
-      return yield* Effect.fail(SessionError.cases.PubkeyMismatch.make({ expected: input.pubkey.value, derived: derivedPubkey }));
-    }
-
-    yield* Effect.log(`Derived key for ${derivedCredentialId.humanReadableName} (${derivedCredentialId.base58})`);
-
-    yield* pipe(
-      effunct(this.dependencies.KeyMapStore.addKey)(keyPair.pubkey, derivedCredentialId.base58),
-      Effect.mapError(reason => SessionError.cases.InternalError.make({ reason }))
-    );
-
-    if (cacheMinutes !== undefined) {
-      yield* this.cacheKey(keyPair, derivedCredentialId, cacheMinutes);
-    }
-
-    return { pubkey: derivedPubkey, credentialId: derivedCredentialId.base58 };
-  }
-
-  public static makeRpcLayer() {
-    const writePortFile = Layer.effectDiscard(
-      Effect.gen(function* () {
-        const server = yield* HttpServer.HttpServer;
-        if (server.address._tag !== "TcpAddress") {
-          return Effect.die(`Invariant server address of ${JSON.stringify(server.address)}`);
-        }
-        writeFileSync(AGENT_PORT_FILE_PATH, server.address.port.toString());
-      })
-    );
-    return pipe(
-      RpcServer.layerHttp({ group: AgentRpcGroup, path: "/rpc", protocol: "http" }),
-      Layer.provideMerge(AgentRpcGroup.toLayer({
-        GetVersion: () => Effect.succeed({ version: CURRENT_VERSION }),
-        StartSession: using(Session).startSession,
-        Setup: using(Session).setup,
-      })),
-      HttpRouter.serve,
-      Layer.provideMerge(writePortFile),
-      Layer.provideMerge(BunHttpServer.layer({ port: 0 })),
-      Layer.provideMerge(RpcSerialization.layerJson),
-      Layer.provideMerge(this.Layer)
-    );
-  }
-}

package/src/modules/ssh-agent/session/interface-rpc.ts

@@ -1,24 +0,0 @@
-import { Schema } from "effect";
-import { Rpc, RpcGroup } from "effect/unstable/rpc";
-import { SessionError, SetupInput, SetupOutput, StartSessionInput } from "./interface";
-
-const GetVersionRpc = Rpc.make("GetVersion", {
-  payload: {},
-  success: Schema.Struct({ version: Schema.String }),
-  error: Schema.Never,
-});
-
-const SetupRpc = Rpc.make("Setup", {
-  payload: SetupInput,
-  success: SetupOutput,
-  error: SessionError,
-});
-
-const StartSessionRpc = Rpc.make("StartSession", {
-  payload: StartSessionInput,
-  success: Schema.Void,
-  error: SessionError,
-});
-
-export const AgentRpcGroup = RpcGroup.make(GetVersionRpc, StartSessionRpc, SetupRpc);
-export type AgentRpcGroup = typeof AgentRpcGroup;