@saadnvd1/agent-os 0.3.560 → 0.3.564

package/lib/orchestrator/untrusted.ts

@@ -20,8 +20,8 @@ const TOKEN_PATTERNS: RegExp[] = [...SECRET_TOKENS, /\b[a-fA-F0-9]{40,}\b/g];
 
 // A long base64-ish run that reads as random rather than as a path or a
 // slug: mixed case, digits, few separators.
-const BASE64_RUN = /[A-Za-z0-9+/_-]{40,}={0,2}/g;
-const looksRandom = (s: string) =>
+export const BASE64_RUN = /[A-Za-z0-9+/_-]{40,}={0,2}/g;
+export const looksRandom = (s: string) =>
   /[A-Z]/.test(s) &&
   /[a-z]/.test(s) &&
   /[0-9]/.test(s) &&
@@ -31,6 +31,16 @@ const looksRandom = (s: string) =>
 export const SECRET_ASSIGNMENT =
   /^(\s*(?:export\s+)?[A-Z][A-Z0-9_]*(?:KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|CREDENTIALS?|AUTH)[A-Z0-9_]*\s*[=:]\s*).+$/gm;
 
+// A URL's userinfo (https://key@host, postgres://user:pw@host) and a query
+// parameter that carries a credential (?token=, &api_key=).
+export const URL_USERINFO = /\b([a-z][a-z0-9+.-]*:\/\/)[^@\s/]+@/gi;
+export const SECRET_PARAM =
+  /([?&][\w.-]*(?:key|token|secret|password|auth|sig|code)[\w.-]*=)[^&\s#]+/gi;
+
+// A private key block's opening line.
+export const PRIVATE_KEY_BLOCK =
+  /-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?(?:-----END (?:[A-Z]+ )?PRIVATE KEY-----|$)/g;
+
 // The password in a URL: postgres://user:secret@host.
 const URL_PASSWORD = /\b([a-z][a-z0-9+.-]*:\/\/[^:\s/@]+:)[^@\s]+@/gi;
 

package/lib/security/demo.ts

@@ -65,6 +65,7 @@ export const STATIC_SIBLINGS = [
   "me",
   "items",
   "network",
+  "preview",
   "queue",
   "status",
 ];

package/lib/security/device-key-message.ts

@@ -0,0 +1,27 @@
+// What a paired device signs to prove a person is there. Client-safe (no
+// database, no node modules), so the app builds the same bytes the server
+// checks. The server rebuilds it from its own record of the challenge; what
+// the client says it signed is never used.
+
+export const DEVICE_KEY_DOMAIN = "AgentOS device approval v1";
+
+export interface DeviceKeyMessage {
+  challenge: string;
+  purpose: string;
+  binding: string;
+  deviceId: string;
+}
+
+export function deviceKeyMessage(m: DeviceKeyMessage): string {
+  return [
+    DEVICE_KEY_DOMAIN,
+    m.challenge,
+    m.purpose,
+    m.binding,
+    m.deviceId,
+  ].join("\n");
+}
+
+// A device key's relying-party id in the passkeys table. It can never equal
+// a host name, so the browser flow never sees these keys.
+export const deviceRp = (deviceId: string) => `device:${deviceId}`;

package/lib/security/device-keys.ts

@@ -0,0 +1,75 @@
+/**
+ * A paired device's approval key: P-256, made in the phone's Secure Enclave
+ * and unlocked by Face ID, Touch ID or the passcode. Only the public key is
+ * kept, in the passkeys table (type 'device', rp_id device:<id>).
+ */
+
+import crypto from "crypto";
+import { getDb } from "@/lib/db";
+import type { PasskeyRow } from "./passkeys";
+
+// The fixed prefix of a P-256 SubjectPublicKeyInfo; the 65-byte X9.63 point
+// follows it.
+const SPKI_P256_PREFIX = Buffer.from(
+  "3059301306072a8648ce3d020106082a8648ce3d030107034200",
+  "hex"
+);
+
+export const newDeviceKeyId = () =>
+  crypto.randomBytes(16).toString("base64url");
+
+// The app sends the key as an uncompressed X9.63 point. Throws unless it's a
+// real point on the curve.
+export function spkiFromRawP256(raw: Buffer): Buffer {
+  if (raw.length !== 65 || raw[0] !== 0x04)
+    throw new Error("Not a P-256 public key");
+  const spki = Buffer.concat([SPKI_P256_PREFIX, raw]);
+  crypto.createPublicKey({ key: spki, format: "der", type: "spki" });
+  return spki;
+}
+
+// iOS signs with ecdsaSignatureMessageX962SHA256, which is DER.
+export function verifyDeviceSignature(
+  spki: Buffer,
+  message: string,
+  signature: Buffer
+): boolean {
+  try {
+    return crypto.verify(
+      "sha256",
+      Buffer.from(message),
+      { key: spki, format: "der", type: "spki", dsaEncoding: "der" },
+      signature
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function activeDeviceKey(deviceId: string): PasskeyRow | null {
+  return (
+    (getDb()
+      .prepare(
+        `SELECT * FROM passkeys WHERE type = 'device' AND device_id = ? AND revoked_at IS NULL`
+      )
+      .get(deviceId) as PasskeyRow | undefined) ?? null
+  );
+}
+
+// Revokes every active key of this device; returns them so the caller can
+// raise the "revoked" asks.
+export function revokeDeviceKeys(deviceId: string): PasskeyRow[] {
+  const keys = getDb()
+    .prepare(
+      `SELECT * FROM passkeys WHERE type = 'device' AND device_id = ? AND revoked_at IS NULL`
+    )
+    .all(deviceId) as PasskeyRow[];
+  if (keys.length)
+    getDb()
+      .prepare(
+        `UPDATE passkeys SET revoked_at = datetime('now')
+         WHERE type = 'device' AND device_id = ? AND revoked_at IS NULL`
+      )
+      .run(deviceId);
+  return keys;
+}

package/lib/security/passkeys.ts

@@ -19,12 +19,15 @@ export interface PasskeyRow {
   created_at: string;
   last_used_at: string | null;
   revoked_at: string | null;
+  // 'webauthn' (a browser passkey) or 'device' (a paired device's own key).
+  type: "webauthn" | "device";
+  device_id: string | null;
 }
 
 export type PasskeyView = Omit<PasskeyRow, "public_key" | "counter">;
 
 const VIEW = `id, transports, rp_id, name, registered_via, registered_from,
-  user_agent, created_at, last_used_at, revoked_at`;
+  user_agent, created_at, last_used_at, revoked_at, type, device_id`;
 
 export function listPasskeys(): PasskeyView[] {
   return getDb()
@@ -66,12 +69,14 @@ export function addPasskey(p: {
   via: string;
   from: string | null;
   userAgent: string | null;
+  type?: "webauthn" | "device";
+  deviceId?: string | null;
 }): PasskeyRow {
   getDb()
     .prepare(
       `INSERT INTO passkeys (id, public_key, counter, transports, rp_id, name,
-         registered_via, registered_from, user_agent)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+         registered_via, registered_from, user_agent, type, device_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
     )
     .run(
       p.id,
@@ -82,7 +87,9 @@ export function addPasskey(p: {
       p.name.trim().slice(0, 80) || "Passkey",
       p.via,
       p.from,
-      p.userAgent?.slice(0, 300) ?? null
+      p.userAgent?.slice(0, 300) ?? null,
+      p.type ?? "webauthn",
+      p.deviceId ?? null
     );
   return getPasskey(p.id)!;
 }

package/lib/security/presence-http.ts

@@ -5,7 +5,17 @@ import { NextResponse } from "next/server";
 import { REMOTE_HEADER } from "./auth";
 import type { Approver } from "./approver";
 import { getDevice } from "./devices";
-import { PresenceError } from "./presence";
+import type { AuthenticationResponseJSON } from "@simplewebauthn/server";
+import type { NextRequest } from "next/server";
+import type { PasskeyRow } from "./passkeys";
+import {
+  PresenceError,
+  relyingParty,
+  verifyDevicePresence,
+  verifyPresence,
+  type DeviceSignature,
+  type PresencePurpose,
+} from "./presence";
 
 export function placeOf(approver: Approver, headers: Headers): string {
   if (approver.via === "loopback") return "this machine";
@@ -14,6 +24,44 @@ export function placeOf(approver: Approver, headers: Headers): string {
   return getDevice(approver.deviceId ?? "")?.name ?? "a paired device";
 }
 
+// What a request sends to prove a person: a browser's passkey assertion, or
+// a paired device's signature from its own key.
+export interface PresenceProof {
+  assertion?: AuthenticationResponseJSON;
+  deviceSignature?: DeviceSignature;
+}
+
+// A device signature counts only from the device whose key it is; anything
+// else goes through the browser passkey check as before.
+export function requirePresence(
+  request: NextRequest,
+  approver: Approver,
+  proof: PresenceProof | null | undefined,
+  purpose: PresencePurpose,
+  binding: string
+): Promise<PasskeyRow> {
+  if (proof?.deviceSignature) {
+    if (approver.via !== "device" || !approver.deviceId)
+      return Promise.reject(
+        new PresenceError("Only a paired device can sign with its own key")
+      );
+    return Promise.resolve().then(() =>
+      verifyDevicePresence(
+        approver.deviceId!,
+        proof.deviceSignature,
+        purpose,
+        binding
+      )
+    );
+  }
+  return verifyPresence(
+    relyingParty(request.headers),
+    proof?.assertion,
+    purpose,
+    binding
+  );
+}
+
 export function refusalResponse(error: unknown): NextResponse {
   if (error instanceof PresenceError)
     return NextResponse.json(

package/lib/security/presence.ts

@@ -23,6 +23,14 @@ import {
   type RegistrationResponseJSON,
 } from "@simplewebauthn/server";
 import { getDb } from "@/lib/db";
+import { deviceKeyMessage, deviceRp } from "./device-key-message";
+import {
+  activeDeviceKey,
+  newDeviceKeyId,
+  revokeDeviceKeys,
+  spkiFromRawP256,
+  verifyDeviceSignature,
+} from "./device-keys";
 import {
   activePasskeys,
   markBootstrapped,
@@ -319,3 +327,179 @@ export async function verifyRegistration(
     });
   })();
 }
+
+// ---- A paired device's own key (Secure Enclave, Face ID) ----
+
+export interface DeviceSignature {
+  keyId: string;
+  challenge: string;
+  signature: string;
+}
+
+export interface DeviceOptions {
+  challenge: string;
+  keyId: string;
+  message: string;
+}
+
+const newChallenge = () => crypto.randomBytes(32).toString("base64url");
+
+// Options for a device-key assertion, or null when the device has no key.
+export function deviceAssertionOptions(
+  deviceId: string,
+  purpose: PresencePurpose,
+  binding: string
+): DeviceOptions | null {
+  const key = activeDeviceKey(deviceId);
+  if (!key) return null;
+  const challenge = newChallenge();
+  storeChallenge(challenge, "assert", purpose, binding, deviceRp(deviceId));
+  return {
+    challenge,
+    keyId: key.id,
+    message: deviceKeyMessage({ challenge, purpose, binding, deviceId }),
+  };
+}
+
+// Checks a device's signature over exactly this challenge, purpose and
+// binding, by that device's own active key. The message is rebuilt here
+// from what the server issued.
+export function verifyDevicePresence(
+  deviceId: string,
+  proof: DeviceSignature | null | undefined,
+  purpose: PresencePurpose,
+  binding: string
+): PasskeyRow {
+  if (!proof?.keyId || !proof.challenge || !proof.signature)
+    throw new PresenceError("This needs your Face ID or Touch ID");
+  const key = getPasskey(proof.keyId);
+  if (
+    !key ||
+    key.type !== "device" ||
+    key.revoked_at ||
+    key.device_id !== deviceId
+  )
+    throw new PresenceError("Unknown passkey");
+  // Spent before the signature is checked: one try per challenge.
+  takeChallenge(
+    proof.challenge,
+    "assert",
+    purpose,
+    binding,
+    deviceRp(deviceId)
+  );
+  const message = deviceKeyMessage({
+    challenge: proof.challenge,
+    purpose,
+    binding,
+    deviceId,
+  });
+  if (
+    !verifyDeviceSignature(
+      key.public_key,
+      message,
+      Buffer.from(proof.signature, "base64url")
+    )
+  )
+    throw new PresenceError("Passkey check failed");
+  touchPasskey(key.id, key.counter);
+  return key;
+}
+
+// Options for registering this device's key: a challenge the new key signs.
+// Needs the same trust as a browser passkey (the free first one, or a code).
+export function deviceRegistrationOptions(
+  deviceId: string,
+  enrollCode?: string
+): { challenge: string; message: string } {
+  const binding = registrationBinding(enrollCode);
+  const challenge = newChallenge();
+  storeChallenge(
+    challenge,
+    "register",
+    "register",
+    binding,
+    deviceRp(deviceId)
+  );
+  return {
+    challenge,
+    message: deviceKeyMessage({
+      challenge,
+      purpose: "register",
+      binding,
+      deviceId,
+    }),
+  };
+}
+
+export function verifyDeviceRegistration(
+  deviceId: string,
+  body: {
+    publicKey: string;
+    challenge: string;
+    signature: string;
+    name: string;
+    hardware?: string;
+  },
+  meta: { via: string; from: string | null; userAgent: string | null },
+  enrollCode?: string
+): { key: PasskeyRow; replaced: PasskeyRow[] } {
+  const binding = registrationBinding(enrollCode);
+  let spki: Buffer;
+  try {
+    spki = spkiFromRawP256(Buffer.from(body.publicKey, "base64url"));
+  } catch {
+    throw new PresenceError("Not a usable key");
+  }
+  const message = deviceKeyMessage({
+    challenge: body.challenge,
+    purpose: "register",
+    binding,
+    deviceId,
+  });
+  if (
+    !verifyDeviceSignature(
+      spki,
+      message,
+      Buffer.from(body.signature, "base64url")
+    )
+  )
+    throw new PresenceError("The new key couldn't sign the request");
+  return getDb().transaction(() => {
+    takeChallenge(
+      body.challenge,
+      "register",
+      "register",
+      binding,
+      deviceRp(deviceId)
+    );
+    if (binding === "bootstrap") {
+      if (passkeysBootstrapped())
+        throw new PresenceError(
+          "A passkey was added meanwhile; get a code from it"
+        );
+      markBootstrapped();
+    } else {
+      const used = getDb()
+        .prepare(
+          `UPDATE passkey_enrollments SET used_at = ? WHERE code_hash = ? AND used_at IS NULL`
+        )
+        .run(now(), hash(enrollCode!)).changes;
+      if (used !== 1) throw new PresenceError("That code was already used");
+    }
+    // A reinstall makes a new key; the old one stops counting.
+    const replaced = revokeDeviceKeys(deviceId);
+    const hardware = body.hardware === "software" ? " (software key)" : "";
+    const key = addPasskey({
+      id: newDeviceKeyId(),
+      publicKey: spki,
+      counter: 0,
+      rpId: deviceRp(deviceId),
+      name: `${body.name.trim().slice(0, 60) || "Device"}${hardware}`,
+      type: "device",
+      deviceId,
+      ...meta,
+    });
+    return { key, replaced };
+  })();
+}

package/lib/security/soft-authenticator.ts

@@ -81,3 +81,24 @@ export function softAuthenticator(rpId = "localhost") {
     },
   };
 }
+
+// Tests only: a software stand-in for the app's Secure Enclave key. The
+// public key is the uncompressed X9.63 point the app sends; sign() gives a
+// DER signature, as iOS does.
+export function softDeviceKey() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ec", {
+    namedCurve: "P-256",
+  });
+  const jwk = publicKey.export({ format: "jwk" }) as { x: string; y: string };
+  return {
+    publicKey: b64url(
+      Buffer.concat([
+        Buffer.from([0x04]),
+        Buffer.from(jwk.x, "base64url"),
+        Buffer.from(jwk.y, "base64url"),
+      ])
+    ),
+    sign: (message: string) =>
+      b64url(crypto.sign("sha256", Buffer.from(message), privateKey)),
+  };
+}

package/lib/session-audit/normalize.ts

@@ -9,7 +9,7 @@ import { redact } from "../orchestrator/untrusted";
 /** Tokens a text costs, by the usual 4 characters a token. An estimate. */
 export const estTokens = (chars: number) => Math.ceil(chars / 4);
 
-const HOME = /\/(?:Users|home)\/[^/\s"']+/g;
+export const HOME = /\/(?:Users|home)\/[^/\s"']+/g;
 const WORKTREE = /~\/\.agent-os\/worktrees\/[^/\s"']+/g;
 const ORCH_DIR = /~\/\.agent-os\/orchestrators\/[^/\s"']+/g;
 const TMP = /\/(?:private\/)?(?:var\/folders|tmp)\/[^\s"']*/g;

package/lib/settings-url.ts

@@ -10,6 +10,7 @@ export const SETTINGS_SECTIONS = [
   "workspaces",
   "models",
   "devices",
+  "shares",
   "notifications",
   "recipes",
   "schedules",

package/lib/share/connect.ts

@@ -0,0 +1,86 @@
+/** Connect's share API, answered in terms the dialog can act on. */
+
+import { loadConnect } from "@/lib/connect/config";
+import {
+  ApiError,
+  clean,
+  listShares,
+  revokeShare,
+  uploadShare,
+  type RemoteShare,
+  type ShareExpiry,
+} from "@/lib/connect/control-api";
+
+export const NOT_LINKED = "Link this machine to Connect to share a link.";
+
+export class ShareError extends Error {
+  constructor(
+    message: string,
+    readonly status: number
+  ) {
+    super(message);
+  }
+}
+
+export const linked = () => loadConnect() !== null;
+
+function files() {
+  const f = loadConnect();
+  if (!f) throw new ShareError(NOT_LINKED, 409);
+  return f;
+}
+
+/** A failed call as a message that says what to do next. */
+function explain(err: unknown): never {
+  if (err instanceof ShareError) throw err;
+  if (err instanceof ApiError) {
+    if (err.status === 413)
+      throw new ShareError(
+        `Connect refused it as too big or over your quota: ${clean(err.message, 120)}`,
+        413
+      );
+    if (err.status === 429)
+      throw new ShareError(
+        "Too many shares just now. Try again in a few minutes.",
+        429
+      );
+    if (err.status === 401 || err.status === 403)
+      throw new ShareError(
+        "Connect doesn't accept this machine. Link it again in Settings → Devices & access.",
+        502
+      );
+    if (err.status === 404) throw new ShareError("Not found on Connect.", 404);
+    throw new ShareError(clean(err.message, 120), 502);
+  }
+  throw new ShareError("Couldn't reach Connect. Try again in a moment.", 502);
+}
+
+export async function createRemote(share: {
+  kind: "chat" | "artifact";
+  title: string;
+  html: string;
+  expiresIn: ShareExpiry;
+}) {
+  const { config, machineKey } = files();
+  try {
+    return await uploadShare(config, machineKey, share);
+  } catch (err) {
+    explain(err);
+  }
+}
+
+export async function listRemote(): Promise<RemoteShare[]> {
+  const { config, machineKey } = files();
+  return listShares(config, machineKey);
+}
+
+/** Revokes on Connect; a share Connect no longer has counts as revoked. */
+export async function revokeRemote(id: string): Promise<void> {
+  const { config, machineKey } = files();
+  try {
+    await revokeShare(config, machineKey, id);
+  } catch (err) {
+    if (err instanceof ApiError && err.status === 404) return;
+    explain(err);
+  }
+}

package/lib/share/context.ts

@@ -0,0 +1,50 @@
+import fs from "fs";
+import os from "os";
+import path from "path";
+import type { ShareContext } from "./redact";
+
+// Environment variables that hold a credential, by name.
+const SECRET_NAME = /(KEY|TOKEN|SECRET|PASSWORD|PASS|PWD|CREDENTIALS?|AUTH)/;
+const NOT_SECRET_NAME = /(SOCK|_FILE|_PATH|_DIR)$/;
+const USERINFO_URL = /^[a-z][a-z0-9+.-]*:\/\/[^@\s/]+@/i;
+
+export function envSecrets(env: NodeJS.ProcessEnv = process.env): string[] {
+  const out = new Set<string>();
+  for (const [name, value] of Object.entries(env)) {
+    if (!value || value.length < 8) continue;
+    const named = SECRET_NAME.test(name) && !NOT_SECRET_NAME.test(name);
+    if (named || (name.endsWith("_URL") && USERINFO_URL.test(value)))
+      out.add(value);
+  }
+  return [...out];
+}
+
+/** Host and HostName entries of an ssh config, wildcards left out. */
+export function sshHosts(config: string): string[] {
+  const out = new Set<string>();
+  for (const line of config.split("\n")) {
+    const m = line.match(/^\s*(?:Host|HostName)\s+(.+?)\s*$/i);
+    if (!m) continue;
+    for (const h of m[1].split(/\s+/))
+      if (!/[*?!]/.test(h) && !/^\d+\.\d+\.\d+\.\d+$/.test(h)) out.add(h);
+  }
+  return [...out];
+}
+
+/** This machine's details, read once per request. Every read fails soft. */
+export function shareContext(): ShareContext {
+  const home = os.homedir();
+  let user = "";
+  try {
+    user = os.userInfo().username;
+  } catch {
+    user = process.env.USER ?? "";
+  }
+  const hostname = os.hostname();
+  let ssh = "";
+  try {
+    ssh = fs.readFileSync(path.join(home, ".ssh", "config"), "utf8");
+  } catch {}
+  const hosts = [hostname, hostname.split(".")[0], ...sshHosts(ssh)];
+  return { home, user, secrets: envSecrets(), hosts };
+}