@skylandnpm/octopus-proxy 0.1.53 → 0.1.54

package/README.md

@@ -119,6 +119,16 @@ octopus-proxy status
 
 `octopus-proxy doctor` 会分别显示当前命令和已安装服务的 Node.js 路径、版本及最低要求（Node.js >= 22）。服务检查读取已保存的 launchd/systemd 定义，再执行其中 Node 的 `--version`；版本过低、路径失效或版本输出无法识别都会标记为失败。配置无效时仍会检查 Node；尚未安装服务时提示未检查服务版本。`doctor --fix` 重写服务定义后会重新检查保存的 Node 路径和版本。
 
+## 连接工作区时报 `ec_asn1.cc / p_ec.cc DECODE_ERROR`
+
+如果服务在线，但 Claw 在 TLS 握手时显示上述错误，可能是主机身份由 macOS 自带的 LibreSSL 生成，证书使用了客户端不支持的显式椭圆曲线参数。这与服务是否在线、密码是否正确是不同的检查阶段；旧版本更新包也会保留已有证书。
+
+这不是旧 macOS 独有的问题：在 macOS 26.6.2 的 `/usr/bin/openssl`（LibreSSL 3.3.6）上也已复现。Proxy 通过 PATH 查找 `openssl`，只用它生成身份文件；实际 TLS 连接使用 Node 自身的 OpenSSL。交互终端和 launchd 服务的 PATH 可能不同，因此终端安装新版 OpenSSL 不代表服务会使用它。升级 macOS 或替换命令不会自动转换已有身份文件。
+
+包含此修复的版本会在启动或运行 `octopus-proxy identity` 时检查身份编码，把旧的显式参数转换为 `named_curve` 并重新签发证书，保留原来的私钥数值和公钥。正常的命名曲线证书不会重写，已有指纹保持不变；TLS 1.3、主机密码认证和指纹校验保持原有要求。转换旧证书后，编码变化会使其 SHA-256 指纹变化；首次连接应与主机上的 `octopus-proxy identity` 输出核对。使用自定义配置时带上原来的 `--config <path>`。
+
+命名曲线编码遵循 [RFC 5480 §2.1.1](https://www.rfc-editor.org/rfc/rfc5480#section-2.1.1)，继续使用 P-256 和 SHA-256。兼容处理不启用旧 TLS 协议、不放宽客户端证书解析，也不自动覆盖已固定的主机指纹。macOS 26 及后续版本保持这些安全要求；当前实机验证环境为 macOS 26.6.2，后续系统版本仍需实际回归验证。
+
 ## 发布
 
 在 `apps/octopus-proxy` 目录执行 `npm run publish`：先递增 `package.json` 的补丁版本，再编译，最后发布。即使编译或发布失败，版本号也会保留递增结果，重试时继续递增。版本更新不会自动创建 Git 提交或标签。先登录有权发布 `@skylandnpm` 包的 npm 账号：

package/dist/{chunk-X7FBZI2P.js → chunk-NJNANA6A.js}

@@ -7600,8 +7600,8 @@ var proxyVersion = JSON.parse(readFileSync(new URL("../package.json", import.met
 
 // src/host-identity.ts
 import { execFile } from "node:child_process";
-import { createHash, randomUUID, X509Certificate } from "node:crypto";
-import { chmod, mkdir, open, readFile as readFile2, rename, stat as stat2, unlink } from "node:fs/promises";
+import { createHash, createPrivateKey, createPublicKey, randomUUID, X509Certificate } from "node:crypto";
+import { chmod, mkdir, open, readFile as readFile2, rename, stat as stat2, unlink, writeFile } from "node:fs/promises";
 import { join as join2 } from "node:path";
 import { promisify } from "node:util";
 var run = promisify(execFile);
@@ -7613,20 +7613,43 @@ async function ensureHostIdentity(stateDirectory) {
   const certPath = join2(stateDirectory, "host-identity-cert.pem");
   const keyExists = await stat2(keyPath).then(() => true, () => false);
   const certExists = await stat2(certPath).then(() => true, () => false);
+  for (const path of [keyPath, certPath]) {
+    const info = await stat2(path).catch((error) => {
+      if (error.code === "ENOENT") return void 0;
+      throw error;
+    });
+    if (info && (info.mode & 63) !== 0) throw new Error("Host identity permissions must be 0600");
+  }
+  if (certExists && !keyExists) throw new Error("Host identity private key is missing");
   const suffix = randomUUID();
   const temporaryKey = join2(stateDirectory, `.host-key-${suffix}`);
   const temporaryCert = join2(stateDirectory, `.host-cert-${suffix}`);
   try {
     if (!keyExists) {
       await (await open(temporaryKey, "wx", 384)).close();
-      await run("openssl", ["genpkey", "-algorithm", "EC", "-pkeyopt", "ec_paramgen_curve:P-256", "-out", temporaryKey], { timeout: 15e3 });
+      await run("openssl", ["genpkey", "-algorithm", "EC", "-pkeyopt", "ec_paramgen_curve:P-256", "-pkeyopt", "ec_param_enc:named_curve", "-out", temporaryKey], { timeout: 15e3 });
       await chmod(temporaryKey, 384);
       await rename(temporaryKey, keyPath);
     }
-    if (!certExists) {
+    const privateKey = createPrivateKey(await readFile2(keyPath));
+    const existingCertificate = certExists ? new X509Certificate(await readFile2(certPath)) : void 0;
+    if (existingCertificate && !existingCertificate.checkPrivateKey(privateKey)) throw new Error("Host identity certificate does not match private key");
+    const normalizedKey = privateKey.asymmetricKeyType === "ec" ? createPrivateKey({ key: privateKey.export({ format: "jwk" }), format: "jwk" }) : privateKey;
+    const publicKey = createPublicKey(normalizedKey).export({ type: "spki", format: "der" });
+    const normalizeKey = !createPublicKey(privateKey).export({ type: "spki", format: "der" }).equals(publicKey);
+    const renewCertificate = !existingCertificate || !existingCertificate.publicKey.export({ type: "spki", format: "der" }).equals(publicKey);
+    if (normalizeKey || renewCertificate) {
+      await writeFile(temporaryKey, normalizedKey.export({ type: "pkcs8", format: "pem" }), { mode: 384, flag: "wx" });
+    }
+    if (renewCertificate) {
       await (await open(temporaryCert, "wx", 384)).close();
-      await run("openssl", ["req", "-new", "-x509", "-sha256", "-days", "3650", "-key", keyPath, "-out", temporaryCert, "-subj", "/CN=octopus-proxy"], { timeout: 15e3 });
+      await run("openssl", ["req", "-new", "-x509", "-sha256", "-days", "3650", "-key", temporaryKey, "-out", temporaryCert, "-subj", "/CN=octopus-proxy"], { timeout: 15e3 });
+      const certificate = new X509Certificate(await readFile2(temporaryCert));
+      if (!certificate.checkPrivateKey(normalizedKey) || !certificate.publicKey.export({ type: "spki", format: "der" }).equals(publicKey)) throw new Error("Host identity certificate normalization failed");
       await chmod(temporaryCert, 384);
+    }
+    if (normalizeKey || renewCertificate) await rename(temporaryKey, keyPath);
+    if (renewCertificate) {
       await rename(temporaryCert, certPath);
     }
   } finally {
@@ -7883,13 +7906,13 @@ import { basename as basename2, dirname as dirname3, join as join3 } from "node:
 import { createHash as createHash3, randomUUID as randomUUID4 } from "node:crypto";
 
 // src/storage.ts
-import { mkdir as mkdir3, readFile as readFile3, rename as rename2, writeFile } from "node:fs/promises";
+import { mkdir as mkdir3, readFile as readFile3, rename as rename2, writeFile as writeFile2 } from "node:fs/promises";
 import { dirname as dirname2 } from "node:path";
 import { randomUUID as randomUUID3 } from "node:crypto";
 async function atomicJson(path, value) {
   await mkdir3(dirname2(path), { recursive: true, mode: 448 });
   const temp = `${path}.${randomUUID3()}.tmp`;
-  await writeFile(temp, JSON.stringify(value), { mode: 384 });
+  await writeFile2(temp, JSON.stringify(value), { mode: 384 });
   await rename2(temp, path);
 }
 async function readJson(path) {
@@ -8344,7 +8367,7 @@ function pageHistory(input, payload) {
 // src/artifacts.ts
 import { createHash as createHash5 } from "node:crypto";
 import { join as join5 } from "node:path";
-import { readFile as readFile4, writeFile as writeFile2, mkdir as mkdir4, stat as stat5 } from "node:fs/promises";
+import { readFile as readFile4, writeFile as writeFile3, mkdir as mkdir4, stat as stat5 } from "node:fs/promises";
 var Artifacts = class {
   constructor(workspace, directory, emit) {
     this.workspace = workspace;
@@ -8400,7 +8423,7 @@ var Artifacts = class {
         if (previous?.hash !== hash || previous.deleted) {
           const dir = join5(this.directory, project, "blobs");
           await mkdir4(dir, { recursive: true, mode: 448 });
-          await writeFile2(join5(dir, hash), data, { mode: 384 });
+          await writeFile3(join5(dir, hash), data, { mode: 384 });
           record2.revisions.push({ hash, timestamp: (/* @__PURE__ */ new Date()).toISOString() });
           changed = true;
         }
@@ -8453,7 +8476,7 @@ var Artifacts = class {
 // src/secure-chat.ts
 import WebSocket from "ws";
 import { Duplex } from "node:stream";
-import { createPublicKey, randomUUID as randomUUID7, verify } from "node:crypto";
+import { createPublicKey as createPublicKey2, randomUUID as randomUUID7, verify } from "node:crypto";
 import { userInfo as userInfo2 } from "node:os";
 import { TLSSocket, createSecureContext } from "node:tls";
 
@@ -8741,7 +8764,7 @@ var SecureChat = class {
         if (key.length !== 32 || signature.length !== 64) throw new Error("Invalid device proof");
         const exporter = session.tls.exportKeyingMaterial(32, "EXPORTER-octopus-device-v1", Buffer.from(this.config.botId)).toString("base64");
         const proof = Buffer.from(`${this.config.botId}\0${id}\0${exporter}`);
-        if (!verify(null, proof, createPublicKey({ key: Buffer.concat([ED25519_SPKI, key]), format: "der", type: "spki" }), signature)) throw new Error("Invalid device proof");
+        if (!verify(null, proof, createPublicKey2({ key: Buffer.concat([ED25519_SPKI, key]), format: "der", type: "spki" }), signature)) throw new Error("Invalid device proof");
         const valid = await this.authenticate(this.config.stateDirectory, this.serviceAccount, String(message.password ?? ""));
         if (!valid) throw new Error("Host authentication failed");
         if (this.sessions.get(id) !== session) return;
@@ -10519,7 +10542,7 @@ function applyEdits(text, edits) {
 }
 
 // src/project-config.ts
-import { readFile as readFile5, writeFile as writeFile3, unlink as unlink6 } from "node:fs/promises";
+import { readFile as readFile5, writeFile as writeFile4, unlink as unlink6 } from "node:fs/promises";
 import { createHash as createHash7, randomUUID as randomUUID10 } from "node:crypto";
 var ProjectConfig = class {
   constructor(workspace, request) {
@@ -10573,7 +10596,7 @@ var ProjectConfig = class {
     else {
       const temporary = await this.workspace.path(project, `.octopus-config-${randomUUID10()}.tmp`, true);
       try {
-        await writeFile3(temporary, updated, { mode: 384, flag: "wx" });
+        await writeFile4(temporary, updated, { mode: 384, flag: "wx" });
         await this.workspace.publish(project, temporary, name);
       } finally {
         await unlink6(temporary).catch(() => {
@@ -11034,7 +11057,7 @@ function redact(value) {
 // src/runtime.ts
 import { spawn as spawn2 } from "node:child_process";
 import { createHash as createHash8 } from "node:crypto";
-import { mkdir as mkdir6, open as open5, readFile as readFile6, rm, writeFile as writeFile4 } from "node:fs/promises";
+import { mkdir as mkdir6, open as open5, readFile as readFile6, rm, writeFile as writeFile5 } from "node:fs/promises";
 import { createServer } from "node:net";
 import { join as join7 } from "node:path";
 var Runtime = class {
@@ -11138,7 +11161,7 @@ var Runtime = class {
       throw new Error(`\u65E0\u6CD5\u6267\u884C OpenCode \u547D\u4EE4 ${this.config.tool.command}\uFF1A${error instanceof Error ? error.message : String(error)}`);
     }
     try {
-      await writeFile4(this.endpointStatePath, JSON.stringify({
+      await writeFile5(this.endpointStatePath, JSON.stringify({
         configuredBaseUrl: this.config.tool.baseUrl,
         baseUrl: url.origin,
         passwordHash: this.passwordHash,

package/dist/cli.js

@@ -34,7 +34,7 @@ import {
   supportedPlatform,
   systemdUnitPath,
   toolSearchDirs
-} from "./chunk-X7FBZI2P.js";
+} from "./chunk-NJNANA6A.js";
 import {
   DESKTOP_PERMISSION_GUIDANCE,
   PlatformDesktop,

package/dist/main.js

@@ -2,7 +2,7 @@
 import {
   ConfigError,
   runDaemon
-} from "./chunk-X7FBZI2P.js";
+} from "./chunk-NJNANA6A.js";
 import "./chunk-XIJKEY4L.js";
 
 // src/main.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skylandnpm/octopus-proxy",
-  "version": "0.1.53",
+  "version": "0.1.54",
   "type": "module",
   "description": "Octopus host proxy: OpenCode, Codex, ZCode and Pi adapters with service installer CLI",
   "bin": {