@saadnvd1/agent-os 0.3.561 → 0.3.565

package/lib/db/migrations.ts

@@ -10,14 +10,43 @@ import {
 import type Database from "better-sqlite3";
 import { moveSchedulesToRecipes } from "./schedules-move";
 
-interface Migration {
+// HOW TO ADD A MIGRATION: append an object with a timestamp `key`, never an
+// integer `id`: `key: "YYYYMMDDTHHMM_snake_name"` (UTC, e.g.
+// "20261014T0130_share_links"). Hand-picked numbers collide when two tasks run
+// in parallel and the loser is silently skipped on databases that already
+// applied the winner. Ids 1..88 are legacy: they run first, by number, and
+// never change. Timestamp keys run after them, in lexical order. Never edit a
+// migration that has shipped; add a new one. lib/db/migrations.test.ts
+// enforces all of this.
+interface LegacyMigration {
   id: number;
+  key?: undefined;
   name: string;
   up: (db: Database.Database) => void;
 }
+interface KeyedMigration {
+  key: string;
+  id?: undefined;
+  name?: undefined;
+  up: (db: Database.Database) => void;
+}
+export type Migration = LegacyMigration | KeyedMigration;
+
+export const migrationKey = (m: Migration): string => m.key ?? String(m.id);
+const migrationName = (m: Migration): string =>
+  m.name ?? (m.key as string).replace(/^\d{8}T\d{4}_/, "");
+
+// Legacy ids sort before every timestamp key.
+function compareToUpTo(m: Migration, upTo: number | string): number {
+  if (typeof upTo === "number") {
+    return m.id === undefined ? 1 : m.id - upTo;
+  }
+  if (m.id !== undefined) return -1;
+  return m.key < upTo ? -1 : m.key > upTo ? 1 : 0;
+}
 
 // All migrations in order - never modify existing ones, only add new
-const migrations: Migration[] = [
+export const migrations: Migration[] = [
   {
     id: 1,
     name: "add_group_path_to_sessions",
@@ -2137,12 +2166,34 @@ const migrations: Migration[] = [
       `);
     },
   },
+  {
+    id: 89,
+    name: "passkeys_device_keys",
+    up: (db) => {
+      // A paired device's own approval key (Secure Enclave, Face ID) sits in
+      // the passkeys table beside the browser passkeys: type 'device', bound
+      // to the device that made it. Additive; existing rows read as webauthn.
+      const columns = db.prepare(`PRAGMA table_info(passkeys)`).all() as {
+        name: string;
+      }[];
+      if (!columns.some((c) => c.name === "type"))
+        db.exec(
+          `ALTER TABLE passkeys ADD COLUMN type TEXT NOT NULL DEFAULT 'webauthn'`
+        );
+      if (!columns.some((c) => c.name === "device_id"))
+        db.exec(`ALTER TABLE passkeys ADD COLUMN device_id TEXT`);
+      db.exec(
+        `CREATE INDEX IF NOT EXISTS idx_passkeys_device ON passkeys(device_id)`
+      );
+    },
+  },
 ];
 
-// `upTo`: stop after this id (tests that start from an older database).
+// `upTo`: stop after this legacy id or timestamp key, inclusive (tests that
+// start from an older database).
 export function runMigrations(
   db: Database.Database,
-  upTo = Number.POSITIVE_INFINITY
+  upTo?: number | string
 ): void {
   // Create migrations tracking table
   db.exec(`
@@ -2152,31 +2203,59 @@ export function runMigrations(
       applied_at TEXT NOT NULL DEFAULT (datetime('now'))
     )
   `);
+  // Timestamp-keyed rows get an auto id and carry their key here; legacy rows
+  // (key NULL) keep meaning "applied" by their integer id.
+  const cols = db.prepare(`PRAGMA table_info(_migrations)`).all() as {
+    name: string;
+  }[];
+  if (!cols.some((c) => c.name === "key")) {
+    try {
+      db.exec(`ALTER TABLE _migrations ADD COLUMN key TEXT`);
+    } catch (error) {
+      if (!String(error).includes("duplicate column")) throw error;
+    }
+  }
+  db.exec(
+    `CREATE UNIQUE INDEX IF NOT EXISTS idx_migrations_key ON _migrations(key)`
+  );
 
-  // Get already applied migrations
   const applied = new Set(
-    (db.prepare(`SELECT id FROM _migrations`).all() as { id: number }[]).map(
-      (r) => r.id
-    )
+    (
+      db.prepare(`SELECT id, key FROM _migrations`).all() as {
+        id: number;
+        key: string | null;
+      }[]
+    ).map((r) => r.key ?? String(r.id))
   );
 
   // Use INSERT OR IGNORE to handle concurrent workers
-  const insertMigration = db.prepare(
+  const insertLegacy = db.prepare(
     `INSERT OR IGNORE INTO _migrations (id, name) VALUES (?, ?)`
   );
+  const insertKeyed = db.prepare(
+    `INSERT OR IGNORE INTO _migrations (key, name) VALUES (?, ?)`
+  );
+  const record = (m: Migration) =>
+    m.key === undefined
+      ? insertLegacy.run(m.id, m.name)
+      : insertKeyed.run(m.key, migrationName(m));
 
   for (const migration of migrations) {
-    if (applied.has(migration.id) || migration.id > upTo) continue;
+    const key = migrationKey(migration);
+    const name = migrationName(migration);
+    if (
+      applied.has(key) ||
+      (upTo !== undefined && compareToUpTo(migration, upTo) > 0)
+    )
+      continue;
 
     try {
       migration.up(db);
-      const result = insertMigration.run(migration.id, migration.name);
+      const result = record(migration);
       if (result.changes > 0) {
-        console.log(`Migration ${migration.id}: ${migration.name} applied`);
+        console.log(`Migration ${key}: ${name} applied`);
       } else {
-        console.log(
-          `Migration ${migration.id}: ${migration.name} skipped (concurrent apply)`
-        );
+        console.log(`Migration ${key}: ${name} skipped (concurrent apply)`);
       }
     } catch (error) {
       // Some migrations may fail if columns already exist (from old system or concurrent worker)
@@ -2186,15 +2265,10 @@ export function runMigrations(
         errorMsg.includes("duplicate column") ||
         errorMsg.includes("already exists")
       ) {
-        insertMigration.run(migration.id, migration.name);
-        console.log(
-          `Migration ${migration.id}: ${migration.name} skipped (already applied)`
-        );
+        record(migration);
+        console.log(`Migration ${key}: ${name} skipped (already applied)`);
       } else {
-        console.error(
-          `Migration ${migration.id}: ${migration.name} failed:`,
-          error
-        );
+        console.error(`Migration ${key}: ${name} failed:`, error);
         throw error;
       }
     }

package/lib/orchestrator/passkey-asks.ts

@@ -3,8 +3,11 @@
 // Declining a new passkey's ask revokes it.
 
 import type { PasskeyRow } from "../security/passkeys";
+import { revokeDeviceKeys } from "../security/device-keys";
+import { revokeDevice } from "../security/devices";
 import {
   AskRefused,
+  resolvePasskeyAsks,
   passkeySubject,
   raiseAsk,
   revokedPasskeySubject,
@@ -54,3 +57,14 @@ export function raisePasskeyAsks(
   }
   return n;
 }
+
+// Signing a device out takes its approval key with it, and the revoke goes
+// on the asks list like any other.
+export function revokeDeviceAndKeys(deviceId: string, place: string): boolean {
+  const changed = revokeDevice(deviceId);
+  for (const key of revokeDeviceKeys(deviceId)) {
+    resolvePasskeyAsks(key.id, "revoked");
+    raisePasskeyAsks(key, place, "revoked");
+  }
+  return changed;
+}

package/lib/orchestrator/rebase.ts

@@ -29,6 +29,7 @@ import type { TaskPR } from "../tasks/state";
 import { run } from "../tasks/gh";
 import { isAllowedBase } from "../tasks/session";
 import { git as runGit, gitFetch, revParse } from "../git-exec";
+import { addWorktree } from "../worktree-add";
 import { comparePatches } from "./patch";
 import { outputOf, type Runner } from "../stacks/git";
 import { restackedHeads, stackNotice } from "../stacks/restack";
@@ -289,7 +290,13 @@ async function rebaseAt(
 ): Promise<{ sha: string }> {
   const dir = fs.mkdtempSync(path.join(os.tmpdir(), "aos-rebase-"));
   try {
-    await deps.runner("git", ["worktree", "add", "--detach", dir, head], repo);
+    await addWorktree(
+      (args, cwd) => deps.runner("git", args, cwd),
+      repo,
+      dir,
+      head,
+      ["--detach"]
+    );
     try {
       await deps.runner("git", ["rebase", onto], dir);
     } catch (error) {

package/lib/orchestrator/repo.ts

@@ -9,15 +9,9 @@ import type { Session } from "../db";
 import { SKILL_DIRS } from "../agents/skill-dirs";
 import { getDefaultBranch } from "../git";
 import { getProject } from "../projects";
-import {
-  git,
-  gitFetch,
-  gitOk,
-  isGitError,
-  worktreeAdd,
-  worktreeRemove,
-} from "../git-exec";
+import { git, gitFetch, gitOk, isGitError, worktreeRemove } from "../git-exec";
 import { expandHome } from "../tasks/session";
+import { addWorktree } from "../worktree-add";
 
 export function repoOf(task: Session): string {
   const project = task.project_id ? getProject(task.project_id) : null;
@@ -169,7 +163,9 @@ export async function checkout(repo: string, sha: string): Promise<string> {
   const dir = fs.realpathSync(
     fs.mkdtempSync(path.join(os.tmpdir(), "aos-review-"))
   );
-  await worktreeAdd(repo, ["--detach", dir, sha]);
+  await addWorktree((args, cwd) => git(cwd, args), repo, dir, sha, [
+    "--detach",
+  ]);
   const staged = await git(dir, ["ls-files", "-s"]);
   for (const line of staged.split("\n"))
     if (line.startsWith("120000 "))

package/lib/security/device-key-message.ts

@@ -0,0 +1,27 @@
+// What a paired device signs to prove a person is there. Client-safe (no
+// database, no node modules), so the app builds the same bytes the server
+// checks. The server rebuilds it from its own record of the challenge; what
+// the client says it signed is never used.
+
+export const DEVICE_KEY_DOMAIN = "AgentOS device approval v1";
+
+export interface DeviceKeyMessage {
+  challenge: string;
+  purpose: string;
+  binding: string;
+  deviceId: string;
+}
+
+export function deviceKeyMessage(m: DeviceKeyMessage): string {
+  return [
+    DEVICE_KEY_DOMAIN,
+    m.challenge,
+    m.purpose,
+    m.binding,
+    m.deviceId,
+  ].join("\n");
+}
+
+// A device key's relying-party id in the passkeys table. It can never equal
+// a host name, so the browser flow never sees these keys.
+export const deviceRp = (deviceId: string) => `device:${deviceId}`;

package/lib/security/device-keys.ts

@@ -0,0 +1,75 @@
+/**
+ * A paired device's approval key: P-256, made in the phone's Secure Enclave
+ * and unlocked by Face ID, Touch ID or the passcode. Only the public key is
+ * kept, in the passkeys table (type 'device', rp_id device:<id>).
+ */
+
+import crypto from "crypto";
+import { getDb } from "@/lib/db";
+import type { PasskeyRow } from "./passkeys";
+
+// The fixed prefix of a P-256 SubjectPublicKeyInfo; the 65-byte X9.63 point
+// follows it.
+const SPKI_P256_PREFIX = Buffer.from(
+  "3059301306072a8648ce3d020106082a8648ce3d030107034200",
+  "hex"
+);
+
+export const newDeviceKeyId = () =>
+  crypto.randomBytes(16).toString("base64url");
+
+// The app sends the key as an uncompressed X9.63 point. Throws unless it's a
+// real point on the curve.
+export function spkiFromRawP256(raw: Buffer): Buffer {
+  if (raw.length !== 65 || raw[0] !== 0x04)
+    throw new Error("Not a P-256 public key");
+  const spki = Buffer.concat([SPKI_P256_PREFIX, raw]);
+  crypto.createPublicKey({ key: spki, format: "der", type: "spki" });
+  return spki;
+}
+
+// iOS signs with ecdsaSignatureMessageX962SHA256, which is DER.
+export function verifyDeviceSignature(
+  spki: Buffer,
+  message: string,
+  signature: Buffer
+): boolean {
+  try {
+    return crypto.verify(
+      "sha256",
+      Buffer.from(message),
+      { key: spki, format: "der", type: "spki", dsaEncoding: "der" },
+      signature
+    );
+  } catch {
+    return false;
+  }
+}
+
+export function activeDeviceKey(deviceId: string): PasskeyRow | null {
+  return (
+    (getDb()
+      .prepare(
+        `SELECT * FROM passkeys WHERE type = 'device' AND device_id = ? AND revoked_at IS NULL`
+      )
+      .get(deviceId) as PasskeyRow | undefined) ?? null
+  );
+}
+
+// Revokes every active key of this device; returns them so the caller can
+// raise the "revoked" asks.
+export function revokeDeviceKeys(deviceId: string): PasskeyRow[] {
+  const keys = getDb()
+    .prepare(
+      `SELECT * FROM passkeys WHERE type = 'device' AND device_id = ? AND revoked_at IS NULL`
+    )
+    .all(deviceId) as PasskeyRow[];
+  if (keys.length)
+    getDb()
+      .prepare(
+        `UPDATE passkeys SET revoked_at = datetime('now')
+         WHERE type = 'device' AND device_id = ? AND revoked_at IS NULL`
+      )
+      .run(deviceId);
+  return keys;
+}

package/lib/security/passkeys.ts

@@ -19,12 +19,15 @@ export interface PasskeyRow {
   created_at: string;
   last_used_at: string | null;
   revoked_at: string | null;
+  // 'webauthn' (a browser passkey) or 'device' (a paired device's own key).
+  type: "webauthn" | "device";
+  device_id: string | null;
 }
 
 export type PasskeyView = Omit<PasskeyRow, "public_key" | "counter">;
 
 const VIEW = `id, transports, rp_id, name, registered_via, registered_from,
-  user_agent, created_at, last_used_at, revoked_at`;
+  user_agent, created_at, last_used_at, revoked_at, type, device_id`;
 
 export function listPasskeys(): PasskeyView[] {
   return getDb()
@@ -66,12 +69,14 @@ export function addPasskey(p: {
   via: string;
   from: string | null;
   userAgent: string | null;
+  type?: "webauthn" | "device";
+  deviceId?: string | null;
 }): PasskeyRow {
   getDb()
     .prepare(
       `INSERT INTO passkeys (id, public_key, counter, transports, rp_id, name,
-         registered_via, registered_from, user_agent)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`
+         registered_via, registered_from, user_agent, type, device_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
     )
     .run(
       p.id,
@@ -82,7 +87,9 @@ export function addPasskey(p: {
       p.name.trim().slice(0, 80) || "Passkey",
       p.via,
       p.from,
-      p.userAgent?.slice(0, 300) ?? null
+      p.userAgent?.slice(0, 300) ?? null,
+      p.type ?? "webauthn",
+      p.deviceId ?? null
     );
   return getPasskey(p.id)!;
 }

package/lib/security/presence-http.ts

@@ -5,7 +5,17 @@ import { NextResponse } from "next/server";
 import { REMOTE_HEADER } from "./auth";
 import type { Approver } from "./approver";
 import { getDevice } from "./devices";
-import { PresenceError } from "./presence";
+import type { AuthenticationResponseJSON } from "@simplewebauthn/server";
+import type { NextRequest } from "next/server";
+import type { PasskeyRow } from "./passkeys";
+import {
+  PresenceError,
+  relyingParty,
+  verifyDevicePresence,
+  verifyPresence,
+  type DeviceSignature,
+  type PresencePurpose,
+} from "./presence";
 
 export function placeOf(approver: Approver, headers: Headers): string {
   if (approver.via === "loopback") return "this machine";
@@ -14,6 +24,44 @@ export function placeOf(approver: Approver, headers: Headers): string {
   return getDevice(approver.deviceId ?? "")?.name ?? "a paired device";
 }
 
+// What a request sends to prove a person: a browser's passkey assertion, or
+// a paired device's signature from its own key.
+export interface PresenceProof {
+  assertion?: AuthenticationResponseJSON;
+  deviceSignature?: DeviceSignature;
+}
+
+// A device signature counts only from the device whose key it is; anything
+// else goes through the browser passkey check as before.
+export function requirePresence(
+  request: NextRequest,
+  approver: Approver,
+  proof: PresenceProof | null | undefined,
+  purpose: PresencePurpose,
+  binding: string
+): Promise<PasskeyRow> {
+  if (proof?.deviceSignature) {
+    if (approver.via !== "device" || !approver.deviceId)
+      return Promise.reject(
+        new PresenceError("Only a paired device can sign with its own key")
+      );
+    return Promise.resolve().then(() =>
+      verifyDevicePresence(
+        approver.deviceId!,
+        proof.deviceSignature,
+        purpose,
+        binding
+      )
+    );
+  }
+  return verifyPresence(
+    relyingParty(request.headers),
+    proof?.assertion,
+    purpose,
+    binding
+  );
+}
+
 export function refusalResponse(error: unknown): NextResponse {
   if (error instanceof PresenceError)
     return NextResponse.json(

package/lib/security/presence.ts

@@ -23,6 +23,14 @@ import {
   type RegistrationResponseJSON,
 } from "@simplewebauthn/server";
 import { getDb } from "@/lib/db";
+import { deviceKeyMessage, deviceRp } from "./device-key-message";
+import {
+  activeDeviceKey,
+  newDeviceKeyId,
+  revokeDeviceKeys,
+  spkiFromRawP256,
+  verifyDeviceSignature,
+} from "./device-keys";
 import {
   activePasskeys,
   markBootstrapped,
@@ -319,3 +327,179 @@ export async function verifyRegistration(
     });
   })();
 }
+
+// ---- A paired device's own key (Secure Enclave, Face ID) ----
+
+export interface DeviceSignature {
+  keyId: string;
+  challenge: string;
+  signature: string;
+}
+
+export interface DeviceOptions {
+  challenge: string;
+  keyId: string;
+  message: string;
+}
+
+const newChallenge = () => crypto.randomBytes(32).toString("base64url");
+
+// Options for a device-key assertion, or null when the device has no key.
+export function deviceAssertionOptions(
+  deviceId: string,
+  purpose: PresencePurpose,
+  binding: string
+): DeviceOptions | null {
+  const key = activeDeviceKey(deviceId);
+  if (!key) return null;
+  const challenge = newChallenge();
+  storeChallenge(challenge, "assert", purpose, binding, deviceRp(deviceId));
+  return {
+    challenge,
+    keyId: key.id,
+    message: deviceKeyMessage({ challenge, purpose, binding, deviceId }),
+  };
+}
+
+// Checks a device's signature over exactly this challenge, purpose and
+// binding, by that device's own active key. The message is rebuilt here
+// from what the server issued.
+export function verifyDevicePresence(
+  deviceId: string,
+  proof: DeviceSignature | null | undefined,
+  purpose: PresencePurpose,
+  binding: string
+): PasskeyRow {
+  if (!proof?.keyId || !proof.challenge || !proof.signature)
+    throw new PresenceError("This needs your Face ID or Touch ID");
+  const key = getPasskey(proof.keyId);
+  if (
+    !key ||
+    key.type !== "device" ||
+    key.revoked_at ||
+    key.device_id !== deviceId
+  )
+    throw new PresenceError("Unknown passkey");
+  // Spent before the signature is checked: one try per challenge.
+  takeChallenge(
+    proof.challenge,
+    "assert",
+    purpose,
+    binding,
+    deviceRp(deviceId)
+  );
+  const message = deviceKeyMessage({
+    challenge: proof.challenge,
+    purpose,
+    binding,
+    deviceId,
+  });
+  if (
+    !verifyDeviceSignature(
+      key.public_key,
+      message,
+      Buffer.from(proof.signature, "base64url")
+    )
+  )
+    throw new PresenceError("Passkey check failed");
+  touchPasskey(key.id, key.counter);
+  return key;
+}
+
+// Options for registering this device's key: a challenge the new key signs.
+// Needs the same trust as a browser passkey (the free first one, or a code).
+export function deviceRegistrationOptions(
+  deviceId: string,
+  enrollCode?: string
+): { challenge: string; message: string } {
+  const binding = registrationBinding(enrollCode);
+  const challenge = newChallenge();
+  storeChallenge(
+    challenge,
+    "register",
+    "register",
+    binding,
+    deviceRp(deviceId)
+  );
+  return {
+    challenge,
+    message: deviceKeyMessage({
+      challenge,
+      purpose: "register",
+      binding,
+      deviceId,
+    }),
+  };
+}
+
+export function verifyDeviceRegistration(
+  deviceId: string,
+  body: {
+    publicKey: string;
+    challenge: string;
+    signature: string;
+    name: string;
+    hardware?: string;
+  },
+  meta: { via: string; from: string | null; userAgent: string | null },
+  enrollCode?: string
+): { key: PasskeyRow; replaced: PasskeyRow[] } {
+  const binding = registrationBinding(enrollCode);
+  let spki: Buffer;
+  try {
+    spki = spkiFromRawP256(Buffer.from(body.publicKey, "base64url"));
+  } catch {
+    throw new PresenceError("Not a usable key");
+  }
+  const message = deviceKeyMessage({
+    challenge: body.challenge,
+    purpose: "register",
+    binding,
+    deviceId,
+  });
+  if (
+    !verifyDeviceSignature(
+      spki,
+      message,
+      Buffer.from(body.signature, "base64url")
+    )
+  )
+    throw new PresenceError("The new key couldn't sign the request");
+  return getDb().transaction(() => {
+    takeChallenge(
+      body.challenge,
+      "register",
+      "register",
+      binding,
+      deviceRp(deviceId)
+    );
+    if (binding === "bootstrap") {
+      if (passkeysBootstrapped())
+        throw new PresenceError(
+          "A passkey was added meanwhile; get a code from it"
+        );
+      markBootstrapped();
+    } else {
+      const used = getDb()
+        .prepare(
+          `UPDATE passkey_enrollments SET used_at = ? WHERE code_hash = ? AND used_at IS NULL`
+        )
+        .run(now(), hash(enrollCode!)).changes;
+      if (used !== 1) throw new PresenceError("That code was already used");
+    }
+    // A reinstall makes a new key; the old one stops counting.
+    const replaced = revokeDeviceKeys(deviceId);
+    const hardware = body.hardware === "software" ? " (software key)" : "";
+    const key = addPasskey({
+      id: newDeviceKeyId(),
+      publicKey: spki,
+      counter: 0,
+      rpId: deviceRp(deviceId),
+      name: `${body.name.trim().slice(0, 60) || "Device"}${hardware}`,
+      type: "device",
+      deviceId,
+      ...meta,
+    });
+    return { key, replaced };
+  })();
+}

package/lib/security/soft-authenticator.ts

@@ -81,3 +81,24 @@ export function softAuthenticator(rpId = "localhost") {
     },
   };
 }
+
+// Tests only: a software stand-in for the app's Secure Enclave key. The
+// public key is the uncompressed X9.63 point the app sends; sign() gives a
+// DER signature, as iOS does.
+export function softDeviceKey() {
+  const { publicKey, privateKey } = crypto.generateKeyPairSync("ec", {
+    namedCurve: "P-256",
+  });
+  const jwk = publicKey.export({ format: "jwk" }) as { x: string; y: string };
+  return {
+    publicKey: b64url(
+      Buffer.concat([
+        Buffer.from([0x04]),
+        Buffer.from(jwk.x, "base64url"),
+        Buffer.from(jwk.y, "base64url"),
+      ])
+    ),
+    sign: (message: string) =>
+      b64url(crypto.sign("sha256", Buffer.from(message), privateKey)),
+  };
+}