@paydlux/agent 0.1.15 → 0.1.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@paydlux/agent",
-  "version": "0.1.15",
+  "version": "0.1.17",
   "description": "Payments for AI agents that a human approves. Spending mandates enforced on the Stellar ledger: 2-of-2 vault, pre-authorised transaction envelopes, HTTP 402, USDC.",
   "type": "module",
   "main": "./dist/index.js",
@@ -16,6 +16,8 @@
     "phone-app/index.html",
     "phone-app/app.js",
     "phone-app/xdr.js",
+    "phone-app/verify.js",
+    "phone-app/sw.js",
     "phone-app/app.css",
     "phone-app/manifest.webmanifest",
     "phone-app/icon-192.png",
@@ -41,7 +43,7 @@
     "test:stellar": "tsx stellar/demo.ts",
     "test:portal": "tsx stellar/xss-check.ts",
     "test:mandate": "tsx stellar/mandate-check.ts",
-    "test:phone": "tsx stellar/phone-check.ts && tsx stellar/desk-split-check.ts && tsx stellar/mandate-check.ts && tsx stellar/e2e-phone.ts && tsx phone-app/xdr-check.ts && tsx phone-app/app-check.ts && tsx phone-app/desk-app-check.ts && tsx ios/bridge-check.ts",
+    "test:phone": "tsx stellar/phone-check.ts && tsx stellar/desk-split-check.ts && tsx stellar/mandate-check.ts && tsx stellar/e2e-phone.ts && tsx phone-app/xdr-check.ts && tsx phone-app/app-check.ts && tsx phone-app/desk-app-check.ts && tsx ios/bridge-check.ts && tsx phone-app/ui-check.ts",
     "test:ios": "tsx ios/bridge-check.ts",
     "test:link": "swiftc ios/PaydluxApprover/LinkResolver.swift ios/Checks/linkcheck/main.swift -o \"$TMPDIR/linkcheck\" && \"$TMPDIR/linkcheck\"",
     "test:seed": "DEVELOPER_DIR=/Library/Developer/CommandLineTools /usr/bin/swiftc -target arm64-apple-macosx14.0 ios/PaydluxApprover/Seed.swift ios/PaydluxApprover/Hex.swift ios/Checks/main.swift -o \"$TMPDIR/seedcheck\" && \"$TMPDIR/seedcheck\"",

package/phone-app/app.js

@@ -19,9 +19,14 @@
 
 const X = globalThis.PaydluxXdr;
 const $ = (id) => document.getElementById(id);
-const show = (id, on = true) => $(id).classList.toggle("hidden", !on);
-const set = (id, v) => { $(id).textContent = v == null || v === "" ? "\u2014" : String(v); };
-const err = (id, msg) => { $(id).textContent = msg || ""; };
+// Null-safe on purpose. `$(id).classList` on a missing id throws, and a throw
+// here aborts the rest of the boot sequence — which is how one stale id in
+// paintKeyState left the queue panel permanently hidden and the Approve buttons
+// unreachable in the native app. A missing element is a cosmetic miss, not a
+// reason to stop rendering the queue.
+const show = (id, on = true) => { const el = $(id); if (el) el.classList.toggle("hidden", !on); };
+const set = (id, v) => { const el = $(id); if (el) el.textContent = v == null || v === "" ? "\u2014" : String(v); };
+const err = (id, msg) => { const el = $(id); if (el) el.textContent = msg || ""; };
 
 // A short buzz on the two moments that matter. iOS ignores vibrate(); Android
 // and desktop honour it. Guarded so it is never an uncaught error.
@@ -188,8 +193,11 @@ function paintKeyState() {
   if (have) {
     set("who", approverPublic || "held by this app");
     // In the native app the seed lives in the Keychain and the page has no way
-    // to write it, so the paste box would be a lie.
-    if (native.available()) show("seedRow", false);
+    // to write it, so the paste box would be a lie — and the remove button
+    // worse: idbDel() below clears the browser key, which does not exist here,
+    // so it would look like it worked while the real key stayed on the device.
+    // Removal belongs to the app (its menu, and the enrol screen), not the page.
+    if (native.available()) show("forget", false);
   }
 }
 
@@ -500,8 +508,9 @@ async function signAndSubmit() {
     // file computed, so the native side is asked to sign exactly what was on
     // screen and is never handed a transaction to interpret.
     const pre = X.signaturePreimage(hash);
-    const sig = new Uint8Array(await signPreimage(X.hex(pre)));
     if (!approverPubBytes) throw new Error("this device lost the approver's public key — re-import it");
+    if (!globalThis.PaydluxVerify) throw new Error("this approver page is missing verify.js — nothing was signed");
+    const sig = new Uint8Array(await signPreimage(X.hex(pre)));
     // Prove the signature came from the key this screen named, before a byte
     // of it leaves the device. A bridge that signs with some other key is then
     // useless: its output never reaches the ledger.
@@ -575,6 +584,7 @@ async function readPasted() {
       throw new Error("that is not the hash the seller quoted \u2014 nothing was signed");
     }
     const sig = new Uint8Array(await signPreimage(X.hex(X.signaturePreimage(hash))));
+    if (!globalThis.PaydluxVerify) throw new Error("this approver page is missing verify.js \u2014 nothing was signed");
     if (!await globalThis.PaydluxVerify.verifySignature(sig, hash, approverPubBytes)) {
       throw new Error("the signature does not match this key — nothing was produced");
     }

package/phone-app/sw.js

@@ -0,0 +1,80 @@
+// Paydlux approver — offline shell cache.
+//
+// What this caches, and what it must never cache:
+//
+//   CACHED   index.html, app.js, xdr.js, the icons, the manifest. These are the
+//            app itself: client code with no secret and no payment data in it,
+//            byte-identical for every visitor. Caching them is what lets the
+//            installed app launch from the home screen with no signal and still
+//            show its own key, instead of a Safari error page.
+//
+//   NEVER    /queue, /challenge/*, /signed/*, /approve, /deny, /list, /healthz,
+//            or anything carrying ?k=. Those hold payment amounts, payee
+//            addresses, signed transactions and the portal key. A payment
+//            answer left in a cache is a payment answer a later request could
+//            be shown instead of a live one — and approving a stale challenge is
+//            exactly the failure this app exists to prevent.
+//
+// Strategy: network-first for the shell, so an online phone always runs the
+// current code (a security fix must reach it on the next open, not the next
+// reinstall). Cache is the fallback when the network is not there at all.
+const SHELL = [
+  "./",
+  "./app.js",
+  "./xdr.js",
+  "./verify.js",
+  "./manifest.webmanifest",
+  "./icon-192.png",
+  "./icon-512.png",
+];
+const CACHE = "paydlux-approver-v3";
+
+// A path is cacheable only if it is one of the shell files, by exact name.
+// Everything else — including any future API route — falls through untouched.
+const isShell = (url) => {
+  if (url.search !== "") return false;                 // any query = never cached
+  const file = url.pathname.replace(/^.*\/phone\//, "").replace(/\/$/, "") || "index.html";
+  return ["", "index.html", "app.js", "xdr.js", "verify.js", "manifest.webmanifest",
+          "icon-192.png", "icon-512.png"].includes(file);
+};
+
+self.addEventListener("install", (e) => {
+  e.waitUntil((async () => {
+    const c = await caches.open(CACHE);
+    // Individual puts, not addAll: one missing icon must not abort the shell.
+    for (const path of SHELL) {
+      try { await c.add(new Request(path, { cache: "reload" })); } catch { /* keep going */ }
+    }
+    self.skipWaiting();
+  })());
+});
+
+self.addEventListener("activate", (e) => {
+  e.waitUntil((async () => {
+    // Drop every older shell cache. An old app.js sitting around is old signing
+    // code, and signing code is the one thing that must not go stale.
+    for (const k of await caches.keys()) if (k !== CACHE) await caches.delete(k);
+    self.clients.claim();
+  })());
+});
+
+self.addEventListener("fetch", (e) => {
+  const url = new URL(e.request.url);
+  if (e.request.method !== "GET" || url.origin !== self.location.origin || !isShell(url)) return;
+  e.respondWith((async () => {
+    try {
+      const fresh = await fetch(e.request, { cache: "reload" });
+      if (fresh.ok) {
+        const copy = fresh.clone();
+        const c = await caches.open(CACHE);
+        await c.put(url.pathname, copy);
+      }
+      return fresh;
+    } catch {
+      return (await caches.match(url.pathname))
+        // No cached shell either: answer plainly rather than let the browser
+        // show its own error page over the app.
+        || new Response("offline", { status: 503, headers: { "content-type": "text/plain" } });
+    }
+  })());
+});

package/phone-app/verify.js

@@ -0,0 +1,48 @@
+// Did the key this screen showed actually sign these bytes?
+//
+// Why this exists: the app asks something else to produce a signature — the
+// browser's WebCrypto, or the iOS app's Keychain-backed signer over a script
+// bridge. Anything that returns bytes without proving them is a black box. A
+// bridge that returned a signature from a different key than the one the review
+// screen named would have it attached to a real transaction and sent to the
+// ledger as if the human had approved it with the key they were shown.
+//
+// So the app checks the signature against the public key it displayed, over the
+// bytes it asked to be signed, before anything is sent. If the check fails,
+// nothing goes out and the human is told.
+//
+// Implementation note: this deliberately uses the platform's Ed25519 verify,
+// not a hand-written one. The app already depends on WebCrypto Ed25519 to sign
+// (see importSecretSeedPair in xdr.js), so verifying adds no new dependency —
+// and a second hand-rolled curve implementation inside a payment approver would
+// be a second place to be wrong, in the one component whose whole job is to be
+// right about who signed.
+"use strict";
+
+/**
+ * verifySignature(sigBytes, hashHex, pubBytes) -> Promise<boolean>
+ *
+ * A Stellar approver signature covers the 32-byte transaction hash (that is
+ * what signaturePreimage returns, and what the ledger verifies), so the app
+ * verifies over the identical bytes it asked to be signed.
+ */
+async function verifySignature(sig, hashHex, pub) {
+  const X = globalThis.PaydluxXdr;
+  if (!(sig instanceof Uint8Array) || sig.length !== 64) return false;
+  if (!(pub instanceof Uint8Array) || pub.length !== 32) return false;
+  if (!/^[0-9a-f]{64}$/.test(hashHex)) return false;
+  try {
+    // The public key is imported as a verify-only key: it cannot sign, and it
+    // cannot be exported into something that could.
+    const key = await crypto.subtle.importKey(
+      "raw", pub, { name: "Ed25519" }, false, ["verify"]);
+    return await crypto.subtle.verify(
+      "Ed25519", key, sig, X.signaturePreimage(hashHex));
+  } catch {
+    // A platform without WebCrypto Ed25519 cannot verify, and must not pretend
+    // it did. Callers treat false as "nothing was sent".
+    return false;
+  }
+}
+
+globalThis.PaydluxVerify = { verifySignature };