@songsid/agend 2.1.6-beta.6 → 2.1.6-beta.7

package/dist/secret-store.d.ts

@@ -0,0 +1,25 @@
+export declare const SECRET_ENV_KEY: RegExp;
+export interface SecretSnapshot {
+    exists: boolean;
+    content: string;
+}
+export interface SecretStoreOptions {
+    /** A test seam; production uses fsync and atomic rename below. */
+    fsync?: (fd: number) => void;
+}
+/** Replace one KEY=value while retaining comments and unrelated variables. */
+export declare function upsertSecretEnvLine(existing: string, key: string, value: string): string;
+export declare class SecretStore {
+    readonly path: string;
+    private readonly allowedKeys;
+    private readonly fsync;
+    constructor(path: string, allowedKeys?: ReadonlySet<string>, opts?: SecretStoreOptions);
+    private rejectSymlink;
+    private validateKey;
+    snapshot(): SecretSnapshot;
+    /** Atomic replacement; callers should retain snapshot() for rollback. */
+    replace(content: string): void;
+    private fsyncDirectory;
+    restore(snapshot: SecretSnapshot): void;
+    write(key: string, value: string): SecretSnapshot;
+}

package/dist/secret-store.js

@@ -0,0 +1,165 @@
+/**
+ * Small, deliberately boring secret store for the running Settings API.
+ *
+ * Secrets live in the existing .env file for compatibility with the CLI, but
+ * all writes go through this module.  The write is same-directory atomic,
+ * owner-only, and returns a snapshot that can be restored when an adapter
+ * rebuild fails.  No exception from this module includes the secret value.
+ */
+import { closeSync, fsyncSync, lstatSync, mkdirSync, openSync, readFileSync, renameSync, unlinkSync, writeSync, chmodSync, } from "node:fs";
+import { randomBytes } from "node:crypto";
+import { dirname, join } from "node:path";
+export const SECRET_ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+const RESERVED_ENV_KEYS = new Set([
+    "PATH", "HOME", "PWD", "SHELL", "ENV", "BASH_ENV", "NODE_OPTIONS", "LD_PRELOAD",
+]);
+function fsyncDirectory(path, fsync) {
+    const fd = openSync(path, "r");
+    try {
+        fsync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+}
+/** Replace one KEY=value while retaining comments and unrelated variables. */
+export function upsertSecretEnvLine(existing, key, value) {
+    const lines = existing.split(/\r?\n/);
+    let replaced = false;
+    const next = lines.map(line => {
+        const match = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        if (!match || match[1] !== key)
+            return line;
+        replaced = true;
+        return `${key}=${value}`;
+    });
+    if (!replaced) {
+        while (next.length && next[next.length - 1] === "")
+            next.pop();
+        next.push(`${key}=${value}`);
+    }
+    return next.join("\n").replace(/\n*$/, "\n");
+}
+export class SecretStore {
+    path;
+    allowedKeys;
+    fsync;
+    constructor(path, allowedKeys = new Set(), opts = {}) {
+        this.path = path;
+        this.allowedKeys = allowedKeys;
+        this.fsync = opts.fsync ?? fsyncSync;
+        mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
+        this.rejectSymlink(path);
+    }
+    rejectSymlink(path) {
+        try {
+            if (lstatSync(path).isSymbolicLink())
+                throw new Error("secret file must not be a symlink");
+        }
+        catch (err) {
+            if (err.code !== "ENOENT")
+                throw err;
+        }
+    }
+    validateKey(key) {
+        if (!SECRET_ENV_KEY.test(key) || RESERVED_ENV_KEYS.has(key))
+            throw new Error("secret key is not allowed");
+        if (this.allowedKeys.size > 0 && !this.allowedKeys.has(key))
+            throw new Error("secret key is not configured for a connection");
+    }
+    snapshot() {
+        this.rejectSymlink(this.path);
+        try {
+            return { exists: true, content: readFileSync(this.path, "utf8") };
+        }
+        catch (err) {
+            if (err.code === "ENOENT")
+                return { exists: false, content: "" };
+            throw new Error("secret file could not be read");
+        }
+    }
+    /** Atomic replacement; callers should retain snapshot() for rollback. */
+    replace(content) {
+        this.rejectSymlink(this.path);
+        const dir = dirname(this.path);
+        const temp = join(dir, `.${this.path.split(/[\\/]/).pop() ?? "env"}.${process.pid}.${randomBytes(8).toString("hex")}.tmp`);
+        let fd;
+        try {
+            fd = openSync(temp, "wx", 0o600);
+            writeSync(fd, content, undefined, "utf8");
+            this.fsync(fd);
+            closeSync(fd);
+            fd = undefined;
+            // chmod is deliberately a hard error: a successful rename with loose
+            // permissions is never reported as an applied secret.
+            chmodSync(temp, 0o600);
+            this.rejectSymlink(temp);
+            renameSync(temp, this.path);
+            this.fsyncDirectory(dir);
+        }
+        catch (err) {
+            if (fd !== undefined) {
+                try {
+                    closeSync(fd);
+                }
+                catch { /* best effort */ }
+            }
+            try {
+                unlinkSync(temp);
+            }
+            catch { /* best effort */ }
+            if (err instanceof Error && /secret file must not be a symlink/.test(err.message))
+                throw err;
+            throw new Error("secret file could not be written atomically");
+        }
+    }
+    fsyncDirectory(path) {
+        try {
+            fsyncDirectory(path, this.fsync);
+        }
+        catch {
+            throw new Error("secret directory could not be synced");
+        }
+    }
+    restore(snapshot) {
+        if (snapshot.exists)
+            this.replace(snapshot.content);
+        else {
+            this.rejectSymlink(this.path);
+            try {
+                unlinkSync(this.path);
+            }
+            catch (err) {
+                if (err.code !== "ENOENT")
+                    throw new Error("secret rollback could not remove file");
+            }
+            try {
+                this.fsyncDirectory(dirname(this.path));
+            }
+            catch {
+                throw new Error("secret rollback could not sync directory");
+            }
+        }
+    }
+    write(key, value) {
+        this.validateKey(key);
+        if (!value || /[\r\n\0]/.test(value))
+            throw new Error("secret value is invalid");
+        const before = this.snapshot();
+        try {
+            this.replace(upsertSecretEnvLine(before.content, key, value));
+        }
+        catch (err) {
+            // A directory fsync can fail after rename has already replaced the
+            // target. Restore the snapshot here so callers never see a failed write
+            // with a new secret left on disk.
+            try {
+                this.restore(before);
+            }
+            catch { /* caller reports rollback failure */ }
+            throw err;
+        }
+        return before;
+    }
+}
+//# sourceMappingURL=secret-store.js.map

package/dist/secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-store.js","sourceRoot":"","sources":["../src/secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,SAAS,EAET,SAAS,EACT,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,UAAU,EACV,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,cAAc,GAAG,gCAAgC,CAAC;AAC/D,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,YAAY;CAChF,CAAC,CAAC;AAYH,SAAS,cAAc,CAAC,IAAY,EAAE,KAA2B;IAC/D,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC/C,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,mBAAmB,CAAC,QAAgB,EAAE,GAAW,EAAE,KAAa;IAC9E,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAC3E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC5C,QAAQ,GAAG,IAAI,CAAC;QAChB,OAAO,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,CAAC,GAAG,EAAE,CAAC;QAC/D,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,OAAO,WAAW;IAIX;IACQ;IAJF,KAAK,CAAuB;IAE7C,YACW,IAAY,EACJ,cAAmC,IAAI,GAAG,EAAE,EAC7D,OAA2B,EAAE;QAFpB,SAAI,GAAJ,IAAI,CAAQ;QACJ,gBAAW,GAAX,WAAW,CAAiC;QAG7D,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;QACrC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAEO,aAAa,CAAC,IAAY;QAChC,IAAI,CAAC;YACH,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QAC7F,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,GAAW;QAC7B,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC1G,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAChI,CAAC;IAED,QAAQ;QACN,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,CAAC;YAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAAC,CAAC;QAC1E,OAAO,GAAG,EAAE,CAAC;YACX,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;YAC5F,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,OAAe;QACrB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,KAAK,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3H,IAAI,EAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACjC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACf,SAAS,CAAC,EAAE,CAAC,CAAC;YAAC,EAAE,GAAG,SAAS,CAAC;YAC9B,qEAAqE;YACrE,sDAAsD;YACtD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACvB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;YACzB,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAAC,CAAC;YAC5E,IAAI,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACrD,IAAI,GAAG,YAAY,KAAK,IAAI,mCAAmC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC7F,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAEO,cAAc,CAAC,IAAY;QACjC,IAAI,CAAC;YAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACzC,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAAC,CAAC;IACpE,CAAC;IAED,OAAO,CAAC,QAAwB;QAC9B,IAAI,QAAQ,CAAC,MAAM;YAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;aAC/C,CAAC;YACJ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,CAAC;gBAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBAC1C,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC;gBAAC,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;YAAC,CAAC;QACzH,CAAC;IACH,CAAC;IAED,KAAK,CAAC,GAAW,EAAE,KAAa;QAC9B,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACjF,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAChE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mEAAmE;YACnE,wEAAwE;YACxE,kCAAkC;YAClC,IAAI,CAAC;gBAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,qCAAqC,CAAC,CAAC;YAC7E,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/settings-api.d.ts

@@ -26,6 +26,8 @@ import type { IncomingMessage, ServerResponse } from "node:http";
 import type { Logger } from "./logger.js";
 import type { FleetConfig, RawFleetConfig } from "./types.js";
 import { type ApplyJob, type ApplyJobStore, type SelfRestartResult } from "./apply-job.js";
+import { type ConnectionMetadata, type ConnectionBinding, type BindingProbe, type SecretApplyJob, type ProviderSecretApplyJob } from "./connection-secrets.js";
+import type { ProviderSecretStatus } from "./provider-secret-registry.js";
 export interface SettingsApiContext {
     fleetConfig: FleetConfig | null;
     configPath: string | null;
@@ -54,6 +56,105 @@ export interface SettingsApiContext {
     fleetSignatureMismatchKeys?(): string[] | null;
     /** True when a running adapter is already long-polling this bot token. */
     isBotTokenInUse?(token: string): boolean;
+    /** Secure Connections & Bots operations. The outer fleet HTTP server has
+     * already authenticated the Settings web session before this handler runs. */
+    listSecureConnections?(): ConnectionMetadata[];
+    verifyConnectionSecret?(input: {
+        connectionId: string;
+        secret: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): Promise<{
+        ok: true;
+        verification_id: string;
+        expires_at: number;
+        identity?: {
+            id: string | null;
+            username: string | null;
+        };
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    startConnectionSecretApply?(input: {
+        connectionId: string;
+        verificationId: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): {
+        job: SecretApplyJob;
+        reused: boolean;
+    } | {
+        busy: SecretApplyJob | null;
+    } | {
+        error: string;
+    };
+    getConnectionSecretApply?(jobId: string, sessionBinding: string): SecretApplyJob | null;
+    /** Generic provider API-key verifier registry (#861). */
+    providerSecretsEnabled?(): boolean;
+    listProviderSecrets?(): ProviderSecretStatus[];
+    verifyProviderSecret?(input: {
+        specId: string;
+        secret: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): Promise<{
+        ok: true;
+        verification_id: string;
+        expires_at: number;
+        spec_id: string;
+        activation: "next_use" | "reload_hook";
+    } | {
+        ok: false;
+        status: string;
+        error: string;
+    }>;
+    startProviderSecretApply?(input: {
+        specId: string;
+        verificationId: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): {
+        job: ProviderSecretApplyJob;
+        reused: boolean;
+    } | {
+        busy: ProviderSecretApplyJob | null;
+    } | {
+        error: string;
+    };
+    getProviderSecretApply?(jobId: string, sessionBinding: string): ProviderSecretApplyJob | null;
+    verifyConnectionBinding?(input: {
+        connectionId: string;
+        binding: {
+            group_id?: unknown;
+            general_channel_id?: unknown;
+        };
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): Promise<{
+        ok: true;
+        verification_id: string;
+        expires_at: number;
+        binding: ConnectionBinding;
+        probe: BindingProbe;
+    } | {
+        ok: false;
+        error: string;
+    }>;
+    startConnectionBindingApply?(input: {
+        connectionId: string;
+        verificationId: string;
+        sessionBinding: string;
+        idempotencyKey: string;
+    }): {
+        job: SecretApplyJob;
+        reused: boolean;
+    } | {
+        busy: SecretApplyJob | null;
+    } | {
+        error: string;
+    };
+    getConnectionBindingApply?(jobId: string, sessionBinding: string): SecretApplyJob | null;
 }
 /** An explicit user-authored YAML mutation that must be persisted even when
  * its value equals the defaults-expanded runtime snapshot. */