@tsconfigdotjson/vibe-os 0.0.0-stage → 0.1.0

package/server/ssh-ca.ts

@@ -0,0 +1,368 @@
+// vibe-os is its own short-lived SSH certificate authority.
+//
+// The browser generates an ed25519 keypair inside the WASM sandbox and keeps
+// the private half in IndexedDB — it never leaves the tab. It POSTs only the
+// public half here, and gets back a certificate signed by this CA, valid for a
+// few hours. The VPS trusts exactly one line in ~/.ssh/authorized_keys:
+//
+//     cert-authority ssh-ed25519 AAAA... vibe-os-ca
+//
+// That is the whole enrollment story: no key to copy and paste, no private key
+// on the wire, no sshd_config edit, and no root. Revoking access to every
+// browser that ever connected is deleting that one line.
+//
+// Certificates also carry a per-pane `force-command` critical option, which is
+// how each pane lands in its own persistent dtach session (see certificate.ts's
+// caller). sshd allocates the PTY because the client asks for a shell, then
+// runs the forced command inside it — so resize and job control behave.
+
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import {
+  appendFile,
+  chmod,
+  mkdir,
+  mkdtemp,
+  readFile,
+  rm,
+  writeFile,
+} from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { promisify } from "node:util";
+import { pathExists } from "./fsx.ts";
+import { log } from "./log.ts";
+
+const run = promisify(execFile);
+
+/** Public key types we are willing to sign. Certificates are rejected. */
+const SIGNABLE_KEY_TYPE =
+  /^(ssh-ed25519|ecdsa-sha2-nistp(256|384|521)|ssh-rsa|sk-ssh-ed25519@openssh\.com|sk-ecdsa-sha2-nistp256@openssh\.com)$/;
+
+/**
+ * Ceiling on a posted public key. Exported because `server/api.ts` pre-checks
+ * `content-length` against it: two constants meant one limit rejected at the
+ * HTTP edge and a different, smaller one rejected here with the same message.
+ */
+export const MAX_PUBKEY_BYTES = 8 * 1024;
+
+export interface SignOptions {
+  /** Public key in authorized_keys form, as posted by the browser. */
+  publicKey: string;
+  /** Unix user the certificate is valid for. */
+  principal: string;
+  /** Human-readable identity; sshd logs this on every login. */
+  identity: string;
+  /** Optional forced command, e.g. `dtach new-session -A -s vibe-1`. */
+  forceCommand?: string;
+  /** Certificate lifetime in seconds. */
+  ttlSeconds: number;
+}
+
+/**
+ * Confirms ssh-keygen is on PATH.
+ *
+ * The probe has to be side-effect free: several of ssh-keygen's flags generate
+ * key material as a side effect (`-A` writes host keys), so this asks it to
+ * fingerprint a path that cannot exist. That always exits non-zero — the only
+ * outcome we care about is whether the binary was found at all.
+ */
+export async function requireSshKeygen(): Promise<void> {
+  try {
+    await run("ssh-keygen", ["-l", "-f", "/nonexistent/vibe-os-probe"], {
+      timeout: 5_000,
+    });
+  } catch (err: unknown) {
+    if ((err as NodeJS.ErrnoException)?.code === "ENOENT") {
+      throw new Error(
+        "ssh-keygen was not found on PATH — install openssh-client",
+      );
+    }
+  }
+}
+
+export class SshCa {
+  readonly keyPath: string;
+  readonly pubPath: string;
+  private publicKeyLine = "";
+  private serialCounter = 0n;
+
+  constructor(stateDir: string) {
+    this.keyPath = path.join(stateDir, "ca");
+    this.pubPath = path.join(stateDir, "ca.pub");
+  }
+
+  /** The CA's public key in authorized_keys form, without the trailing newline. */
+  get publicKey(): string {
+    if (!this.publicKeyLine)
+      throw new Error("CA not initialised — call ensure() first");
+    return this.publicKeyLine;
+  }
+
+  /** Creates the CA keypair if it does not exist yet. Idempotent. */
+  async ensure(): Promise<void> {
+    await mkdir(path.dirname(this.keyPath), { recursive: true, mode: 0o700 });
+    await chmod(path.dirname(this.keyPath), 0o700).catch(() => {});
+
+    if (!(await pathExists(this.keyPath))) {
+      // ssh-keygen refuses to overwrite without prompting, so a stale .pub with
+      // no private half has to go first.
+      await rm(this.pubPath, { force: true });
+      await run("ssh-keygen", [
+        "-q",
+        "-t",
+        "ed25519",
+        "-f",
+        this.keyPath,
+        "-N",
+        "",
+        "-C",
+        `vibe-os-ca@${os.hostname()}`,
+      ]);
+      log.ok(`generated SSH certificate authority at ${this.keyPath}`);
+    }
+
+    // Outside the branch above on purpose. A key restored from a backup, copied
+    // from another box, or written by an older version under a loose umask
+    // would otherwise keep whatever mode it arrived with — and ssh-keygen signs
+    // with a world-readable CA without complaining. This is the one key whose
+    // disclosure mints certificates for any principal.
+    await chmod(this.keyPath, 0o600).catch(() => {});
+
+    this.publicKeyLine = (await readFile(this.pubPath, "utf8")).trim();
+    if (!this.publicKeyLine) throw new Error(`${this.pubPath} is empty`);
+  }
+
+  /**
+   * Adds the `cert-authority` line to authorized_keys so sshd will accept any
+   * certificate this CA signs. Idempotent — matches on the key blob, so a
+   * hand-edited comment or extra options on the line are left alone.
+   */
+  async trustInAuthorizedKeys(homeDir: string): Promise<"added" | "present"> {
+    const sshDir = path.join(homeDir, ".ssh");
+    const file = path.join(sshDir, "authorized_keys");
+
+    await mkdir(sshDir, { recursive: true, mode: 0o700 });
+    await chmod(sshDir, 0o700).catch(() => {});
+
+    const blob = this.publicKey.split(/\s+/)[1];
+    if (!blob) throw new Error("malformed CA public key");
+
+    let current = "";
+    if (await pathExists(file)) current = await readFile(file, "utf8");
+    if (current.includes(blob)) return "present";
+
+    const prefix = current.length === 0 || current.endsWith("\n") ? "" : "\n";
+    await appendFile(
+      file,
+      `${prefix}# added by vibe-os — trusts browser-held keys certified by this host\ncert-authority ${this.publicKey}\n`,
+      { mode: 0o600 },
+    );
+    await chmod(file, 0o600).catch(() => {});
+    return "added";
+  }
+
+  /**
+   * Signs a browser-supplied public key.
+   *
+   * Everything reaching ssh-keygen goes through an argv array, never a shell,
+   * so a hostile `forceCommand` or public key cannot break out into command
+   * execution. The key itself is still validated because ssh-keygen will
+   * happily sign anything shaped like a key, and we do not want to mint
+   * certificates from certificates.
+   */
+  async signUserCert(opts: SignOptions): Promise<string> {
+    const publicKey = normalisePublicKey(opts.publicKey);
+
+    // mkdtemp, not a name we compose ourselves: it creates the directory
+    // atomically with an unpredictable suffix, so nothing in a world-writable
+    // /tmp can pre-create the path (or a symlink at it) and have us write key
+    // material somewhere else.
+    const tmp = await mkdtemp(path.join(os.tmpdir(), "vibe-os-sign-"));
+    await chmod(tmp, 0o700).catch(() => {});
+    const keyFile = path.join(tmp, "id.pub");
+    const certFile = path.join(tmp, "id-cert.pub");
+
+    try {
+      await writeFile(keyFile, `${publicKey}\n`, { mode: 0o600 });
+
+      const args = [
+        "-q",
+        "-s",
+        this.keyPath,
+        "-I",
+        opts.identity,
+        "-n",
+        opts.principal,
+        // A little slack on the lower bound: the browser's clock is not ours.
+        "-V",
+        `-5m:+${Math.max(1, Math.round(opts.ttlSeconds / 60))}m`,
+        "-z",
+        String(this.nextSerial()),
+      ];
+      if (opts.forceCommand)
+        args.push("-O", `force-command=${opts.forceCommand}`);
+      args.push(keyFile);
+
+      await run("ssh-keygen", args, { timeout: 15_000 });
+      const cert = await readFile(certFile, "utf8");
+      if (!cert.includes("-cert-v01@openssh.com")) {
+        throw new Error("ssh-keygen did not produce a certificate");
+      }
+      return cert;
+    } finally {
+      await rm(tmp, { recursive: true, force: true });
+    }
+  }
+
+  private nextSerial(): bigint {
+    this.serialCounter += 1n;
+    return BigInt(Date.now()) * 1000n + (this.serialCounter % 1000n);
+  }
+}
+
+/** Validates and trims a public key posted by the browser. Throws on anything suspect. */
+export function normalisePublicKey(raw: string): string {
+  if (raw.length > MAX_PUBKEY_BYTES) throw new Error("public key too large");
+
+  const line = raw.trim();
+  if (line.includes("\n") || line.includes("\r"))
+    throw new Error("public key must be a single line");
+
+  const [type, blob] = line.split(/\s+/, 2);
+  if (!type || !blob) throw new Error("malformed public key");
+  if (type.includes("-cert-v01@openssh.com"))
+    throw new Error("refusing to certify a certificate");
+  if (!SIGNABLE_KEY_TYPE.test(type))
+    throw new Error(`unsupported key type: ${type}`);
+  if (!/^[A-Za-z0-9+/]+={0,3}$/.test(blob))
+    throw new Error("malformed public key body");
+
+  // The base64 blob must decode to a key whose embedded type matches the
+  // declared one — otherwise a caller could mislabel a key to slip past the
+  // type check above.
+  const decoded = Buffer.from(blob, "base64");
+  if (decoded.length < 4) throw new Error("malformed public key body");
+  const nameLength = decoded.readUInt32BE(0);
+  if (nameLength > 64 || decoded.length < 4 + nameLength)
+    throw new Error("malformed public key body");
+  const embedded = decoded.subarray(4, 4 + nameLength).toString("ascii");
+  if (embedded !== type)
+    throw new Error("public key type does not match its body");
+
+  // Re-emit without any client-supplied comment.
+  return `${type} ${blob}`;
+}
+
+/**
+ * Finds this host's SSH host key so the browser can pin it and skip the
+ * trust-on-first-use prompt.
+ *
+ * The order matters: it mirrors the order golang.org/x/crypto/ssh offers host
+ * key algorithms, so the key we pin is the one sshd will actually present.
+ * If none is readable we return null and the browser falls back to prompting.
+ */
+/**
+ * OpenSSH-style SHA256 fingerprint of a public key line.
+ *
+ * Computed here rather than in the browser because `crypto.subtle` does not
+ * exist on a non-secure origin, and plain HTTP on a bare IP — the default way
+ * this thing gets run — is exactly that.
+ */
+export function fingerprint(publicKeyLine: string): string | null {
+  const blob = publicKeyLine.trim().split(/\s+/)[1];
+  if (!blob) return null;
+  try {
+    const digest = createHash("sha256")
+      .update(Buffer.from(blob, "base64"))
+      .digest("base64");
+    return `SHA256:${digest.replace(/=+$/, "")}`;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Host key types in the order the client will actually pick them.
+ *
+ * This is golang.org/x/crypto/ssh's `supportedHostKeyAlgos` order, which puts
+ * ECDSA ahead of Ed25519 — the opposite of what OpenSSH does, and the opposite
+ * of what looks reasonable. Getting it wrong is not harmless: pinning a key the
+ * server holds but does not present makes every pane report the host key as
+ * *changed*, which reads like an attack rather than a misconfiguration.
+ */
+const HOST_KEY_TYPES = ["ecdsa", "rsa", "ed25519"] as const;
+
+/**
+ * Finds the host key the SSH target will actually present, so the browser can
+ * pin it and skip the trust-on-first-use prompt.
+ *
+ * Asking the target with ssh-keyscan beats reading /etc/ssh/*.pub: it works
+ * when the bridge points somewhere other than this machine, it needs no file
+ * permissions, and it cannot pin a key that sshd is not actually serving.
+ * Reading the local files stays as a fallback for when ssh-keyscan is missing.
+ *
+ * The type order matters — the pinned key has to be the one that wins
+ * negotiation, not merely one the server happens to hold. Returns null if
+ * nothing is discoverable, and the browser prompts once instead.
+ */
+export async function discoverHostKey(
+  host: string,
+  port: number,
+): Promise<string | null> {
+  for (const type of HOST_KEY_TYPES) {
+    try {
+      const { stdout } = await run(
+        "ssh-keyscan",
+        ["-t", type, "-p", String(port), "-T", "5", host],
+        {
+          timeout: 10_000,
+        },
+      );
+      // Output is "<host> <type> <base64>". The leading host field is not part
+      // of the key, and sshterm keys its known-hosts entry by endpoint name.
+      const line = stdout
+        .split("\n")
+        .find((l) => l.trim() && !l.startsWith("#"));
+      const parts = line?.trim().split(/\s+/);
+      if (parts && parts.length >= 3) return `${parts[1]} ${parts[2]}`;
+    } catch {
+      // server does not offer this type, or no ssh-keyscan — try the next
+    }
+  }
+
+  // Reading this box's own host keys only answers the question when the bridge
+  // points at this box. With --ssh-host aimed elsewhere it would pin the wrong
+  // machine's key, and every pane would then report the host key as changed —
+  // which reads as an attack rather than the misconfiguration it is.
+  if (!isLocalHost(host)) return null;
+
+  for (const type of HOST_KEY_TYPES) {
+    try {
+      const line = (await readFile(`/etc/ssh/ssh_host_${type}_key.pub`, "utf8"))
+        .trim()
+        .split("\n")[0]
+        ?.trim();
+      if (line) return line;
+    } catch {
+      // unreadable or absent — try the next
+    }
+  }
+  return null;
+}
+
+/** Does this name refer to the machine we are running on? */
+function isLocalHost(host: string): boolean {
+  const h = host
+    .trim()
+    .toLowerCase()
+    .replace(/^\[|\]$/g, "");
+  return (
+    h === "localhost" ||
+    h === "127.0.0.1" ||
+    h === "::1" ||
+    h === "0.0.0.0" ||
+    h === "" ||
+    h === os.hostname().toLowerCase()
+  );
+}

package/server/static.ts

@@ -0,0 +1,147 @@
+import path from "node:path";
+import { BUILD_ID, EMBEDDED } from "./assets.generated.ts";
+import { IMMUTABLE_CACHE_CONTROL } from "./http.ts";
+
+/**
+ * Serves the built web app.
+ *
+ * Two things earn their keep here: precompressed variants (ssh.wasm is ~20MB
+ * raw and about a fifth of that as brotli, and it is on the critical path of
+ * the very first page load), and an SPA fallback so deep links work.
+ *
+ * Assets resolve from the embedded manifest first, then from disk. In a
+ * compiled binary the manifest holds everything and the disk is never touched;
+ * under `bun run` the manifest is empty and everything comes off disk. Both
+ * paths end at Bun.file, so there is only one code path to get right.
+ */
+
+/** Vite writes content-hashed filenames into assets/, so those cache forever. */
+const IMMUTABLE = /\/assets\/[^/]+-[A-Za-z0-9_-]{8,}\.[a-z0-9]+$/;
+
+const MIME: Record<string, string> = {
+  ".html": "text/html; charset=utf-8",
+  ".js": "text/javascript; charset=utf-8",
+  ".css": "text/css; charset=utf-8",
+  ".json": "application/json; charset=utf-8",
+  // Required for WebAssembly.instantiateStreaming to take the fast path.
+  ".wasm": "application/wasm",
+  ".svg": "image/svg+xml",
+  ".png": "image/png",
+  ".jpg": "image/jpeg",
+  ".jpeg": "image/jpeg",
+  ".webp": "image/webp",
+  ".avif": "image/avif",
+  ".gif": "image/gif",
+  ".ico": "image/x-icon",
+  ".woff2": "font/woff2",
+  ".txt": "text/plain; charset=utf-8",
+};
+
+function cacheControl(urlPath: string): string {
+  if (IMMUTABLE.test(urlPath)) return IMMUTABLE_CACHE_CONTROL;
+  if (urlPath.endsWith(".html") || urlPath === "/") return "no-cache";
+  // ssh.wasm and wasm_exec.js are big but do change on upgrade: let the client
+  // keep them and revalidate cheaply with an ETag.
+  return "public, max-age=0, must-revalidate";
+}
+
+function encodingsFor(req: Request): ("br" | "gzip")[] {
+  const accept = req.headers.get("accept-encoding") ?? "";
+  const out: ("br" | "gzip")[] = [];
+  if (/\bbr\b/.test(accept)) out.push("br");
+  if (/\bgzip\b/.test(accept)) out.push("gzip");
+  return out;
+}
+
+const SUFFIX = { br: ".br", gzip: ".gz" } as const;
+
+export function createStaticServer(webRoot: string) {
+  const root = path.resolve(webRoot);
+
+  /** Resolves a repo-relative asset path to something Bun.file can open. */
+  const locate = async (relative: string): Promise<string | null> => {
+    const embedded = EMBEDDED[`/${relative}`];
+    if (embedded) return embedded;
+
+    const onDisk = path.resolve(root, relative);
+    // path.resolve collapses "..", so one containment check is enough.
+    if (onDisk !== root && !onDisk.startsWith(root + path.sep)) return null;
+    return (await Bun.file(onDisk).exists()) ? onDisk : null;
+  };
+
+  return async function serveStatic(
+    req: Request,
+    urlPath: string,
+  ): Promise<Response | null> {
+    if (req.method !== "GET" && req.method !== "HEAD") return null;
+
+    let decoded: string;
+    try {
+      decoded = decodeURIComponent(urlPath);
+    } catch {
+      return null;
+    }
+    if (decoded.includes("\0")) return null;
+
+    let relative = decoded === "/" ? "index.html" : decoded.replace(/^\/+/, "");
+    let resolved = await locate(relative);
+    // What the cache policy is decided against. It follows the file actually
+    // served rather than the path asked for, so an SPA route gets index.html's
+    // `no-cache` instead of the extensionless default of `must-revalidate`.
+    let served = urlPath;
+
+    // SPA fallback: anything that is not a real file and does not look like an
+    // asset request gets index.html.
+    if (!resolved) {
+      if (path.extname(relative) !== "") return null;
+      relative = "index.html";
+      resolved = await locate(relative);
+      if (!resolved) return null;
+      served = "/index.html";
+    }
+
+    const type =
+      MIME[path.extname(relative).toLowerCase()] ?? "application/octet-stream";
+
+    let encoding: "br" | "gzip" | null = null;
+    let body = Bun.file(resolved);
+    for (const candidate of encodingsFor(req)) {
+      const alt = await locate(`${relative}${SUFFIX[candidate]}`);
+      if (alt) {
+        encoding = candidate;
+        body = Bun.file(alt);
+        break;
+      }
+    }
+
+    // `.size` works for both real files and files embedded in a compiled
+    // binary; `.stat()` returns undefined for the latter. Embedded assets have
+    // no mtime either, so BUILD_ID stands in as the thing that changes when the
+    // bytes do. The encoding is folded in so switching between br/gzip/identity
+    // can never reuse a cached body of the wrong shape.
+    const size = body.size;
+    let version = BUILD_ID;
+    if (!EMBEDDED[`/${relative}`]) {
+      const st = await Promise.resolve(body.stat()).catch(() => null);
+      if (st) version = Math.floor(st.mtimeMs).toString(16);
+    }
+    const etag = `W/"${size.toString(16)}-${version}${encoding ? `-${encoding}` : ""}"`;
+
+    const headers = new Headers({
+      "content-type": type,
+      "cache-control": cacheControl(served),
+      etag,
+      vary: "Accept-Encoding",
+    });
+    if (encoding) headers.set("content-encoding", encoding);
+
+    if (req.headers.get("if-none-match") === etag) {
+      return new Response(null, { status: 304, headers });
+    }
+
+    headers.set("content-length", String(size));
+    if (req.method === "HEAD")
+      return new Response(null, { status: 200, headers });
+    return new Response(body, { status: 200, headers });
+  };
+}