@tyvm/knowhow 0.0.159 → 0.0.160

package/src/workerRegistry.ts

@@ -1,152 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-import * as os from "os";
-import { spawn, ChildProcess } from "child_process";
-
-interface WorkerRegistry {
-  workers: string[];
-}
-
-function getWorkerRegistryPath(): string {
-  return path.join(os.homedir(), ".knowhow", "workers.json");
-}
-
-export async function loadWorkerRegistry(): Promise<WorkerRegistry> {
-  const registryPath = getWorkerRegistryPath();
-  
-  try {
-    if (fs.existsSync(registryPath)) {
-      const content = await fs.promises.readFile(registryPath, "utf8");
-      return JSON.parse(content);
-    }
-  } catch (error) {
-    console.warn("Failed to load worker registry:", error);
-  }
-  
-  return { workers: [] };
-}
-
-export async function saveWorkerRegistry(registry: WorkerRegistry): Promise<void> {
-  const registryPath = getWorkerRegistryPath();
-  const dir = path.dirname(registryPath);
-  
-  // Ensure the directory exists
-  if (!fs.existsSync(dir)) {
-    await fs.promises.mkdir(dir, { recursive: true });
-  }
-  
-  await fs.promises.writeFile(
-    registryPath,
-    JSON.stringify(registry, null, 2),
-    "utf8"
-  );
-}
-
-export async function registerWorkerPath(workerPath: string): Promise<void> {
-  const registry = await loadWorkerRegistry();
-  const normalizedPath = path.resolve(workerPath);
-  
-  if (!registry.workers.includes(normalizedPath)) {
-    registry.workers.push(normalizedPath);
-    await saveWorkerRegistry(registry);
-    console.log(`✓ Registered worker path: ${normalizedPath}`);
-  } else {
-    console.log(`Worker path already registered: ${normalizedPath}`);
-  }
-}
-
-export async function unregisterWorkerPath(workerPath: string): Promise<void> {
-  const registry = await loadWorkerRegistry();
-  const normalizedPath = path.resolve(workerPath);
-  
-  const index = registry.workers.indexOf(normalizedPath);
-  if (index !== -1) {
-    registry.workers.splice(index, 1);
-    await saveWorkerRegistry(registry);
-    console.log(`✓ Unregistered worker path: ${normalizedPath}`);
-  } else {
-    console.log(`Worker path not found in registry: ${normalizedPath}`);
-  }
-}
-
-export async function listWorkerPaths(): Promise<string[]> {
-  const registry = await loadWorkerRegistry();
-  return registry.workers;
-}
-
-export async function clearWorkerRegistry(): Promise<void> {
-  await saveWorkerRegistry({ workers: [] });
-  console.log("✓ Cleared all registered worker paths");
-}
-
-interface WorkerProcess {
-  path: string;
-  process: ChildProcess;
-}
-
-export async function startAllWorkers(): Promise<void> {
-  const workerPaths = await listWorkerPaths();
-  
-  if (workerPaths.length === 0) {
-    console.log("No workers registered. Use 'knowhow worker --register' to register workers.");
-    return;
-  }
-  
-  console.log(`Starting ${workerPaths.length} worker(s)...`);
-  
-  const processes: WorkerProcess[] = [];
-  
-  for (const workerPath of workerPaths) {
-    if (!fs.existsSync(workerPath)) {
-      console.warn(`⚠ Worker path does not exist: ${workerPath}`);
-      continue;
-    }
-    
-    console.log(`Starting worker at: ${workerPath}`);
-    
-    const workerProcess = spawn("knowhow", ["worker"], {
-      cwd: workerPath,
-      stdio: "inherit",
-      detached: false,
-    });
-    
-    workerProcess.on("error", (error) => {
-      console.error(`Error in worker at ${workerPath}:`, error);
-    });
-    
-    workerProcess.on("exit", (code, signal) => {
-      console.log(`Worker at ${workerPath} exited with code ${code} and signal ${signal}`);
-    });
-    
-    processes.push({ path: workerPath, process: workerProcess });
-  }
-  
-  console.log(`\n✓ Started ${processes.length} worker(s)`);
-  console.log("Press Ctrl+C to stop all workers\n");
-  
-  // Handle graceful shutdown
-  const shutdownHandler = () => {
-    console.log("\nShutting down all workers...");
-    
-    for (const { path: workerPath, process: proc } of processes) {
-      console.log(`Stopping worker at: ${workerPath}`);
-      proc.kill("SIGTERM");
-    }
-    
-    // Give processes time to shut down gracefully
-    setTimeout(() => {
-      for (const { process: proc } of processes) {
-        if (!proc.killed) {
-          proc.kill("SIGKILL");
-        }
-      }
-      process.exit(0);
-    }, 5000);
-  };
-  
-  process.on("SIGINT", shutdownHandler);
-  process.on("SIGTERM", shutdownHandler);
-  
-  // Keep the process alive
-  await new Promise(() => {});
-}

package/src/workers/auth/PasskeySetup.ts

@@ -1,181 +0,0 @@
-import http from "../../utils/http";
-import { KNOWHOW_API_URL } from "../../services/KnowhowClient";
-import { openBrowser } from "../../auth/browserLogin";
-import { Spinner } from "../../auth/spinner";
-import { getConfig, updateConfig } from "../../config";
-import { PasskeySetupSession, PasskeySetupStatus, PasskeyCredential } from "./types";
-
-/**
- * Service that handles the CLI-side passkey setup flow.
- *
- * Flow:
- *  1. POST /api/worker/passkey/setup/session  → get sessionId + browserUrl
- *  2. Open browser to browserUrl
- *  3. Poll /api/worker/passkey/setup/status/:sessionId until status === 'complete'
- *  4. Save the returned credential to local config
- */
-export class PasskeySetupService {
-  private baseUrl: string;
-
-  constructor(baseUrl: string = KNOWHOW_API_URL) {
-    if (!baseUrl) {
-      throw new Error("KNOWHOW_API_URL environment variable not set");
-    }
-    this.baseUrl = baseUrl;
-  }
-
-  /**
-   * Run the full passkey setup flow.
-   */
-  async setup(jwt: string): Promise<void> {
-    const spinner = new Spinner();
-
-    try {
-      spinner.start("Creating passkey setup session");
-      const session = await this.createSetupSession(jwt);
-      spinner.stop();
-
-      await openBrowser(session.browserUrl);
-      console.log(
-        `\nIf the browser didn't open automatically, please visit:\n  ${session.browserUrl}\n`
-      );
-
-      spinner.start("Waiting for passkey registration in browser…");
-
-      const credential = await this.pollForCompletion(session.sessionId, spinner);
-
-      spinner.stop();
-      spinner.start("Saving passkey credential to config");
-
-      await this.saveCredential(credential);
-
-      spinner.stop();
-      console.log("✅ Passkey registered successfully!");
-      console.log(
-        "   Worker will now require passkey authentication for new connections."
-      );
-    } catch (error) {
-      spinner.stop();
-      throw error;
-    }
-  }
-
-  /**
-   * Remove passkey requirement from config.
-   */
-  async reset(): Promise<void> {
-    const config = await getConfig();
-
-    if (!config.worker?.auth?.passkey) {
-      console.log("ℹ️  No passkey configured for this worker.");
-      return;
-    }
-
-    const updatedConfig = {
-      ...config,
-      worker: {
-        ...config.worker,
-        auth: {
-          ...config.worker.auth,
-          required: false,
-          passkey: undefined,
-        },
-      },
-    };
-
-    await updateConfig(updatedConfig);
-    console.log("✅ Passkey requirement removed from config.");
-  }
-
-  // ---------------------------------------------------------------------------
-  // Private helpers
-  // ---------------------------------------------------------------------------
-
-  private async createSetupSession(jwt: string): Promise<PasskeySetupSession> {
-    try {
-      const response = await http.post<PasskeySetupSession>(
-        `${this.baseUrl}/api/worker/passkey/setup/session`,
-        {},
-        {
-          headers: { Authorization: `Bearer ${jwt}` },
-        }
-      );
-      return response.data;
-    } catch (error) {
-      if (http.isHttpError(error)) {
-        throw new Error(
-          `Failed to create passkey setup session: ${error.message}`
-        );
-      }
-      throw error;
-    }
-  }
-
-  private async pollForCompletion(
-    sessionId: string,
-    spinner: Spinner
-  ): Promise<PasskeyCredential> {
-    const maxAttempts = 60; // 5 minutes at 5-second intervals
-    let attempt = 0;
-
-    while (attempt < maxAttempts) {
-      attempt++;
-
-      try {
-        const response = await http.get<PasskeySetupStatus>(
-          `${this.baseUrl}/api/worker/passkey/setup/status/${sessionId}`
-        );
-
-        const { status, credential } = response.data;
-
-        if (status === "complete" && credential) {
-          return credential;
-        } else if (status === "expired") {
-          throw new Error(
-            "Passkey setup session expired. Please run 'knowhow worker --passkey' again."
-          );
-        }
-      } catch (error) {
-        if (http.isHttpError(error) && error.status === 408) {
-          // Timeout — keep polling
-        } else if (!(error instanceof Error && error.message.includes("expired"))) {
-          // Re-throw non-timeout, non-expected errors
-          throw error;
-        } else {
-          throw error;
-        }
-      }
-
-      await this.sleep(5000);
-    }
-
-    throw new Error("Passkey setup timed out. Please try again.");
-  }
-
-  private async saveCredential(credential: PasskeyCredential): Promise<void> {
-    const config = await getConfig();
-
-    const updatedConfig = {
-      ...config,
-      worker: {
-        ...config.worker,
-        auth: {
-          ...config.worker?.auth,
-          required: true,
-          passkey: {
-            publicKey: credential.publicKey,
-            credentialId: credential.credentialId,
-            algorithm: credential.algorithm,
-          },
-          sessionDurationHours: config.worker?.auth?.sessionDurationHours ?? 3,
-        },
-      },
-    };
-
-    await updateConfig(updatedConfig);
-  }
-
-  private async sleep(ms: number): Promise<void> {
-    return new Promise((resolve) => setTimeout(resolve, ms));
-  }
-}

package/src/workers/auth/WorkerPasskeyAuth.ts

@@ -1,190 +0,0 @@
-import crypto from "crypto";
-import { verifyAuthenticationResponse } from "@simplewebauthn/server";
-
-/**
- * Manages the locked/unlocked state of the worker's passkey auth.
- * When the worker has passkey configured, it starts locked.
- * The user must call `unlock` with a valid WebAuthn assertion to unlock.
- * The worker verifies the signature locally using the stored public key.
- */
-
-export interface PasskeyConfig {
-  publicKey: string;    // base64url-encoded COSE public key
-  credentialId: string; // base64url-encoded credential ID
-  algorithm: number;    // e.g. -7 for ES256
-}
-
-export interface UnlockParams {
-  /** base64url-encoded signature from WebAuthn assertion */
-  signature: string;
-  /** base64url-encoded credential ID */
-  credentialId: string;
-  /** base64url-encoded authenticatorData */
-  authenticatorData: string;
-  /** base64url-encoded clientDataJSON */
-  clientDataJSON: string;
-  /** The challenge that was signed (base64url) */
-  challenge: string;
-}
-
-export class WorkerPasskeyAuthService {
-  private locked = true;
-  private sessionExpiry: number | null = null;
-  private sessionDurationMs: number;
-  // Pending challenge: base64url
-  private pendingChallenge: string | null = null;
-  private pendingChallengeExpiry: number | null = null;
-  private readonly CHALLENGE_TTL_MS = 5 * 60 * 1000; // 5 minutes
-
-  constructor(
-    private passkeyConfig: PasskeyConfig,
-    sessionDurationHours: number = 3
-  ) {
-    this.sessionDurationMs = sessionDurationHours * 60 * 60 * 1000;
-  }
-
-  isLocked(): boolean {
-    if (!this.locked) {
-      // Check if session has expired
-      if (this.sessionExpiry && Date.now() > this.sessionExpiry) {
-        console.log("🔒 Passkey session expired, locking worker");
-        this.locked = true;
-        this.sessionExpiry = null;
-      }
-    }
-    return this.locked;
-  }
-
-  /**
-   * Generate a new challenge for the client to sign.
-   * Returns base64url-encoded challenge bytes.
-   */
-  generateChallenge(): string {
-    const challengeBytes = crypto.randomBytes(32);
-    const challenge = challengeBytes.toString("base64url");
-    this.pendingChallenge = challenge;
-    this.pendingChallengeExpiry = Date.now() + this.CHALLENGE_TTL_MS;
-    return challenge;
-  }
-
-  /**
-   * Attempt to unlock the worker by verifying a WebAuthn assertion.
-   * Returns true if the signature is valid and the worker is now unlocked.
-   */
-  async unlock(params: UnlockParams): Promise<{ success: boolean; reason?: string }> {
-    // Verify the challenge matches what we issued
-    if (!this.pendingChallenge) {
-      return { success: false, reason: "No pending challenge. Call getChallenge first." };
-    }
-    if (this.pendingChallengeExpiry && Date.now() > this.pendingChallengeExpiry) {
-      this.pendingChallenge = null;
-      this.pendingChallengeExpiry = null;
-      return { success: false, reason: "Challenge expired. Please request a new challenge." };
-    }
-
-    // Verify the challenge in clientDataJSON matches our pending challenge
-    let clientData: { type: string; challenge: string; origin: string };
-    try {
-      const clientDataBytes = Buffer.from(params.clientDataJSON, "base64url");
-      clientData = JSON.parse(clientDataBytes.toString("utf8"));
-    } catch {
-      return { success: false, reason: "Invalid clientDataJSON" };
-    }
-
-    // The challenge in clientDataJSON is base64url-encoded
-    if (clientData.challenge !== this.pendingChallenge) {
-      return { success: false, reason: "Challenge mismatch" };
-    }
-
-    if (clientData.type !== "webauthn.get") {
-      return { success: false, reason: "Invalid clientData type" };
-    }
-
-    // Verify credential ID matches our stored credential
-    if (params.credentialId !== this.passkeyConfig.credentialId) {
-      return { success: false, reason: "Unknown credential" };
-    }
-
-    // Verify the signature using @simplewebauthn/server
-    const valid = await this.verifySignature(params, clientData.origin);
-    if (!valid) {
-      return { success: false, reason: "Invalid signature" };
-    }
-
-    // Unlock!
-    this.locked = false;
-    this.sessionExpiry = Date.now() + this.sessionDurationMs;
-    this.pendingChallenge = null;
-    this.pendingChallengeExpiry = null;
-
-    const expiresAt = new Date(this.sessionExpiry).toISOString();
-    console.log(`🔓 Worker unlocked! Session expires at ${expiresAt}`);
-    return { success: true };
-  }
-
-  lock(): void {
-    this.locked = true;
-    this.sessionExpiry = null;
-    this.pendingChallenge = null;
-    this.pendingChallengeExpiry = null;
-    console.log("🔒 Worker locked");
-  }
-
-  getSessionInfo() {
-    if (this.locked || !this.sessionExpiry) {
-      return { locked: true, expiresAt: null };
-    }
-    return {
-      locked: false,
-      expiresAt: new Date(this.sessionExpiry).toISOString(),
-    };
-  }
-
-  /**
-   * Returns the credential ID stored in the passkey config.
-   */
-  getCredentialId(): string {
-    return this.passkeyConfig.credentialId;
-  }
-
-  // ---------------------------------------------------------------------------
-  // Signature verification via @simplewebauthn/server
-  // ---------------------------------------------------------------------------
-
-  /**
-   * Verify a WebAuthn assertion using @simplewebauthn/server's verifyAuthenticationResponse.
-   * This handles all COSE key format complexity automatically.
-   */
-  private async verifySignature(params: UnlockParams, origin: string): Promise<boolean> {
-    try {
-      const { verified } = await verifyAuthenticationResponse({
-        response: {
-          id: params.credentialId,
-          rawId: params.credentialId,
-          response: {
-            authenticatorData: params.authenticatorData,
-            clientDataJSON: params.clientDataJSON,
-            signature: params.signature,
-          },
-          type: "public-key",
-          clientExtensionResults: {},
-        },
-        expectedChallenge: this.pendingChallenge!,
-        expectedOrigin: origin,
-        expectedRPID: new URL(origin).hostname,
-        credential: {
-          id: this.passkeyConfig.credentialId,
-          publicKey: Buffer.from(this.passkeyConfig.publicKey, "base64url"),
-          counter: 0,
-          transports: undefined,
-        },
-        requireUserVerification: false,
-      });
-
-      return verified;
-    } catch (err) {
-      console.error("Signature verification error:", err);
-      return false;
-    }
-  }
-}

package/src/workers/auth/WsMiddleware.ts

@@ -1,99 +0,0 @@
-import { WebSocket } from "ws";
-import EventEmitter from "events";
-
-/**
- * A middleware function that intercepts raw WebSocket messages before
- * they reach the transport/handler layer.
- *
- * - Call next() to pass the message through.
- * - Call next(err) to abort (the socket will be closed with code 1008 + reason).
- * - Sending a reply directly on ws is allowed (e.g. for auth challenges).
- */
-export type WsMiddlewareFn = (
-  ws: WebSocket,
-  data: Buffer | string,
-  next: (err?: Error) => void
-) => void | Promise<void>;
-
-export class WsMiddlewareStack {
-  private fns: WsMiddlewareFn[] = [];
-
-  use(fn: WsMiddlewareFn): this {
-    this.fns.push(fn);
-    return this;
-  }
-
-  /**
-   * Attach all middleware to a WebSocket, intercepting every "message" event.
-   * Once a message passes all middleware, onMessage is called.
-   * Use this for MCP transports where you control the message handler directly.
-   */
-  attach(ws: WebSocket, onMessage: (data: Buffer | string) => void): void {
-    ws.on("message", async (data: Buffer | string) => {
-      let i = 0;
-      const next = async (err?: Error): Promise<void> => {
-        if (err) {
-          console.error("WS middleware rejected message:", err.message);
-          ws.close(1008, err.message);
-          return;
-        }
-        const fn = this.fns[i++];
-        if (fn) {
-          await fn(ws, data, next);
-        } else {
-          onMessage(data);
-        }
-      };
-      await next();
-    });
-  }
-
-  /**
-   * Wrap a WebSocket so ALL incoming messages pass through this middleware
-   * before being dispatched to any subsequently-registered "message" listeners.
-   *
-   * Call this BEFORE any other code attaches "message" handlers (e.g. before
-   * initTunnelHandler). Uses Node.js EventEmitter ordering: our listener runs
-   * first because it was registered first.
-   *
-   * After wrapSocket(), any subsequent ws.on("message", handler) calls are
-   * redirected to an inner EventEmitter that only receives messages that have
-   * passed all middleware. This ensures the tunnel handler's listener is
-   * automatically gated by the middleware.
-   */
-  wrapSocket(ws: WebSocket): void {
-    const innerEmitter = new EventEmitter();
-
-    // Our listener runs first (registered before tunnel handler's listener).
-    ws.on("message", async (data: Buffer | string) => {
-      let i = 0;
-      const next = async (err?: Error): Promise<void> => {
-        if (err) {
-          console.error("WS middleware rejected message:", err.message);
-          ws.close(1008, err.message);
-          return;
-        }
-        const fn = this.fns[i++];
-        if (fn) {
-          await fn(ws, data, next);
-        } else {
-          // All middleware passed — dispatch to inner listeners
-          innerEmitter.emit("message", data);
-        }
-      };
-      await next();
-    });
-
-    // Redirect future ws.on("message", ...) calls to innerEmitter.
-    // This means createTunnelHandler()'s listener goes to innerEmitter,
-    // so it only receives messages that passed middleware.
-    const originalOn = ws.on.bind(ws);
-    (ws as any).on = (event: string, listener: (...args: any[]) => void) => {
-      if (event === "message") {
-        innerEmitter.on("message", listener);
-        return ws;
-      }
-      return originalOn(event, listener);
-    };
-  }
-}