@vellumai/assistant 0.6.6 → 0.7.1

package/src/runtime/auth/token-service.ts

@@ -25,7 +25,7 @@ import { dirname, join } from "node:path";
 import { getIsContainerized } from "../../config/env-registry.js";
 import { getLogger } from "../../util/logger.js";
 import { getDeprecatedDir } from "../../util/platform.js";
-import { CURRENT_POLICY_EPOCH, isStaleEpoch } from "./policy.js";
+import { isStaleEpoch } from "./policy.js";
 import type { ScopeProfile, TokenAudience, TokenClaims } from "./types.js";
 
 const log = getLogger("token-service");
@@ -215,17 +215,6 @@ export function initAuthSigningKey(key: Buffer): void {
   _authSigningKey = key;
 }
 
-/**
- * Check whether the auth signing key has been initialized.
- *
- * Useful for out-of-process contexts (CLI) that may run without
- * daemon startup, where callers need to decide whether they can
- * mint JWTs or must fall back to the legacy shared-secret token.
- */
-export function isSigningKeyInitialized(): boolean {
-  return _authSigningKey !== undefined;
-}
-
 /**
  * Reset the signing key to undefined. **Test-only** — used to simulate a
  * fresh CLI subprocess where initAuthSigningKey() was never called.
@@ -380,105 +369,6 @@ export function verifyToken(
   return { ok: true, claims };
 }
 
-// ---------------------------------------------------------------------------
-// Daemon delivery token
-// ---------------------------------------------------------------------------
-
-/**
- * Mint a short-lived JWT for daemon-to-gateway delivery callbacks.
- *
- * Used when the daemon needs to call gateway /deliver/* endpoints. The
- * gateway's deliver-auth middleware validates aud=vellum-daemon, so both
- * sides share the same signing key and audience convention.
- *
- * sub=svc:daemon:self, scope_profile=gateway_service_v1
- */
-export function mintDaemonDeliveryToken(): string {
-  return mintToken({
-    aud: "vellum-daemon",
-    sub: "svc:daemon:self",
-    scope_profile: "gateway_service_v1",
-    policy_epoch: CURRENT_POLICY_EPOCH,
-    ttlSeconds: 60,
-  });
-}
-
-// ---------------------------------------------------------------------------
-// Edge relay token
-// ---------------------------------------------------------------------------
-
-/**
- * Mint a short-lived JWT for relay WebSocket connections through the gateway.
- *
- * The gateway's relay WS handler validates tokens with validateEdgeToken(),
- * which expects aud=vellum-gateway. This is distinct from daemon delivery
- * tokens (aud=vellum-daemon) used for gateway /deliver/* endpoints.
- *
- * sub=svc:daemon:self, scope_profile=gateway_service_v1
- */
-export function mintEdgeRelayToken(): string {
-  return mintToken({
-    aud: "vellum-gateway",
-    sub: "svc:daemon:self",
-    scope_profile: "gateway_service_v1",
-    policy_epoch: CURRENT_POLICY_EPOCH,
-    ttlSeconds: 60,
-  });
-}
-
-// ---------------------------------------------------------------------------
-// UI page token
-// ---------------------------------------------------------------------------
-
-/**
- * Mint a long-lived JWT for embedding in browser-served UI pages
- * (brain-graph).
- *
- * These pages make API calls that route through the gateway, which validates
- * tokens with validateEdgeToken() expecting aud=vellum-gateway. A 1-hour TTL
- * gives users enough time to interact with the page (including using Refresh
- * buttons) without the token expiring mid-session.
- *
- * Uses the dedicated ui_page_v1 scope profile which grants only settings.read
- * — the minimum needed for the brain-graph data endpoint those pages call.
- */
-export function mintUiPageToken(): string {
-  return mintToken({
-    aud: "vellum-gateway",
-    sub: "svc:daemon:self",
-    scope_profile: "ui_page_v1",
-    policy_epoch: CURRENT_POLICY_EPOCH,
-    ttlSeconds: 3600,
-  });
-}
-
-// ---------------------------------------------------------------------------
-// Pairing bearer token
-// ---------------------------------------------------------------------------
-
-/**
- * Mint a JWT bearer token for the iOS pairing flow.
- *
- * Minted once at daemon startup and reused for all pairing approvals
- * during this daemon's lifetime. The token is stored on approved pairing
- * entries and returned in HTTP responses as a legacy compatibility field.
- * (iOS clients also receive proper JWT credentials via mintCredentialPair.)
- *
- * The 24-hour TTL covers a typical daemon lifecycle. The daemon re-mints
- * on each restart since the signing key is stable across restarts.
- *
- * aud=vellum-daemon, sub=svc:daemon:pairing, scope_profile=gateway_service_v1
- */
-export function mintPairingBearerToken(): string {
-  return mintToken({
-    aud: "vellum-daemon",
-    sub: "svc:daemon:pairing",
-    scope_profile: "gateway_service_v1",
-    policy_epoch: CURRENT_POLICY_EPOCH,
-    ttlSeconds: 86400, // 24 hours — covers a typical daemon lifecycle
-  });
-}
-
 // ---------------------------------------------------------------------------
 // Hash
 // ---------------------------------------------------------------------------

package/src/runtime/capability-tokens.ts

@@ -1,41 +1,27 @@
 /**
- * Capability token minting and verification for scoped, short-lived tokens
- * issued to the chrome extension (and other thin clients) so they can submit
- * results back to the runtime without a full guardian-bound JWT.
+ * Capability token verification for scoped, short-lived tokens issued to the
+ * chrome extension (and other thin clients).
  *
- * Design:
- *   - Tokens are HMAC-SHA256 signed over a JSON claims payload.
- *   - Claims include a bound capability, guardian id, nonce, and expiry.
- *   - Signing uses a long-lived random secret persisted to
- *     `~/.vellum/protected/` with 0600 permissions. The protected
- *     directory sits outside the workspace per AGENTS.md: workspace
- *     directories must not hold security-sensitive material.
- *   - The secret is generated once on first launch and reused across
- *     subsequent daemon restarts so previously-minted tokens still verify.
- *   - Tests inject their own secret via `setCapabilityTokenSecretForTests`.
+ * Both minting and verification are owned by the gateway
+ * (`gateway/src/auth/capability-tokens.ts`). The daemon delegates
+ * verification to the gateway via IPC so it never needs to read the
+ * HMAC secret from the filesystem.
  *
- * The encoded token format is `<base64url(payload)>.<base64url(sig)>`.
+ * Test-only helpers (`mintHostBrowserCapability`,
+ * `setCapabilityTokenSecretForTests`, `resetCapabilityTokenSecretForTests`)
+ * implement the same HMAC logic in-process so assistant tests can create
+ * and verify tokens without a live gateway.
  */
 
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-import {
-  chmodSync,
-  existsSync,
-  mkdirSync,
-  readFileSync,
-  renameSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
-import { dirname, join } from "node:path";
 
+import { ipcCall } from "../ipc/gateway-client.js";
 import { getLogger } from "../util/logger.js";
-import { getDataDir, getProtectedDir } from "../util/platform.js";
 
 const log = getLogger("capability-tokens");
 
 // ---------------------------------------------------------------------------
-// Types
+// Types (mirror the gateway's types for consumer convenience)
 // ---------------------------------------------------------------------------
 
 /** Capability identifiers that can be bound to a capability token. */
@@ -58,213 +44,10 @@ export interface CapabilityToken {
 }
 
 // ---------------------------------------------------------------------------
-// Secret lifecycle
+// In-process HMAC helpers (shared between test mint/verify and IPC verify)
 // ---------------------------------------------------------------------------
 
-let _secret: Buffer | undefined;
-
-/**
- * Returns the canonical path where the capability-token secret is
- * persisted: `~/.vellum/protected/capability-token-secret`. The protected
- * directory is the canonical location for security-sensitive material
- * and sits outside the workspace (which AGENTS.md forbids for secrets).
- */
-function getSecretPath(): string {
-  return join(getProtectedDir(), "capability-token-secret");
-}
-
-/**
- * Legacy path under `workspace/data/` where earlier builds persisted the
- * capability-token secret. We keep this as a read-only migration source
- * so existing deployments don't regenerate their secret (and invalidate
- * every outstanding token) on upgrade — the first launch after the
- * upgrade copies the legacy file into `getProtectedDir()` and removes it
- * from the workspace.
- */
-function getLegacySecretPath(): string {
-  return join(getDataDir(), "capability-token-secret");
-}
-
-/**
- * Path overrides used by unit tests to drive the secret lifecycle
- * without touching the real `~/.vellum/` tree. Production callers must
- * omit this argument so the canonical paths (`getProtectedDir()` +
- * `getDataDir()`) are used.
- */
-export interface CapabilityTokenSecretPaths {
-  /** Protected-directory secret path (authoritative). */
-  secretPath: string;
-  /** Legacy workspace-directory secret path (migration source). */
-  legacySecretPath: string;
-}
-
-/**
- * Load the capability-token secret from disk or generate and persist a new
- * one. Atomically writes with mode 0o600 so the secret is not readable by
- * other users on the same host.
- *
- * Migration: if the secret exists only at the legacy workspace path, copy
- * it into the protected directory and delete the workspace copy so we do
- * not leave security-sensitive material inside `workspace/`.
- *
- * The optional `paths` argument is for unit tests only — production
- * callers must omit it and use the canonical `~/.vellum/protected/` /
- * `~/.vellum/workspace/data/` paths.
- */
-export function loadOrCreateCapabilityTokenSecret(
-  paths?: CapabilityTokenSecretPaths,
-): Buffer {
-  const keyPath = paths?.secretPath ?? getSecretPath();
-  const legacyPath = paths?.legacySecretPath ?? getLegacySecretPath();
-  if (existsSync(keyPath)) {
-    try {
-      const raw = readFileSync(keyPath);
-      if (raw.length === 32) {
-        return raw;
-      }
-      log.warn(
-        { keyPath, length: raw.length },
-        "capability token secret has unexpected length — regenerating",
-      );
-    } catch (err) {
-      log.warn(
-        { err, keyPath },
-        "Failed to read capability token secret — regenerating",
-      );
-    }
-  }
-
-  // Attempt to migrate a legacy workspace-directory secret before we
-  // generate a fresh one. If this succeeds we end up with the legacy
-  // secret persisted at the protected path and the workspace copy
-  // removed, preserving every outstanding token across the upgrade.
-  const migrated = migrateLegacyCapabilityTokenSecret(keyPath, legacyPath);
-  if (migrated) {
-    return migrated;
-  }
-
-  const fresh = randomBytes(32);
-  writeSecretAtomic(keyPath, fresh);
-  log.info("Capability token secret generated and persisted");
-  return fresh;
-}
-
-/**
- * Write `secret` to `keyPath` atomically with mode 0o600. Ensures the
- * parent directory exists.
- */
-function writeSecretAtomic(keyPath: string, secret: Buffer): void {
-  const dir = dirname(keyPath);
-  if (!existsSync(dir)) {
-    mkdirSync(dir, { recursive: true });
-  }
-  const tmpPath = `${keyPath}.tmp.${process.pid}`;
-  writeFileSync(tmpPath, secret, { mode: 0o600 });
-  renameSync(tmpPath, keyPath);
-  try {
-    chmodSync(keyPath, 0o600);
-  } catch (err) {
-    log.warn(
-      { err, keyPath },
-      "Failed to chmod capability token secret after write",
-    );
-  }
-}
-
-/**
- * If a pre-migration capability token secret exists under the workspace
- * data directory, copy it into the protected directory and remove the
- * workspace copy. Returns the migrated secret if migration ran
- * successfully, or `undefined` if there was nothing to migrate or the
- * migration failed.
- */
-function migrateLegacyCapabilityTokenSecret(
-  secretPath: string,
-  legacyPath: string,
-): Buffer | undefined {
-  if (!existsSync(legacyPath)) {
-    return undefined;
-  }
-  try {
-    const raw = readFileSync(legacyPath);
-    if (raw.length !== 32) {
-      log.warn(
-        { legacyPath, length: raw.length },
-        "legacy capability token secret has unexpected length — ignoring",
-      );
-      return undefined;
-    }
-    writeSecretAtomic(secretPath, raw);
-    try {
-      unlinkSync(legacyPath);
-    } catch (err) {
-      log.warn(
-        { err, legacyPath },
-        "Failed to remove legacy workspace capability token secret after migration",
-      );
-    }
-    log.info(
-      { from: legacyPath, to: secretPath },
-      "Migrated capability token secret out of workspace into protected directory",
-    );
-    return raw;
-  } catch (err) {
-    log.warn(
-      { err, legacyPath },
-      "Failed to migrate legacy capability token secret — regenerating",
-    );
-    return undefined;
-  }
-}
-
-/**
- * Initialize the module-level secret. Called once at daemon startup. Safe
- * to call multiple times — subsequent calls overwrite the cached value
- * (useful in tests that reset state).
- */
-export function initCapabilityTokenSecret(secret: Buffer): void {
-  if (secret.length !== 32) {
-    throw new Error(
-      `capability token secret must be 32 bytes, got ${secret.length}`,
-    );
-  }
-  _secret = secret;
-}
-
-/**
- * Test-only helper to inject a deterministic secret.
- */
-export function setCapabilityTokenSecretForTests(secret: Buffer): void {
-  _secret = secret;
-}
-
-/**
- * Reset the cached secret. Test-only — exposed so test isolation can
- * force a reload from disk.
- */
-export function resetCapabilityTokenSecretForTests(): void {
-  _secret = undefined;
-}
-
-function getSecret(): Buffer {
-  if (_secret) return _secret;
-  if (process.env.NODE_ENV === "test") {
-    _secret = randomBytes(32);
-    return _secret;
-  }
-  // Lazy load — daemon startup is expected to call
-  // `initCapabilityTokenSecret(loadOrCreateCapabilityTokenSecret())` but
-  // we fall back to a disk load here so unit tests and early call sites
-  // don't have to depend on startup ordering.
-  _secret = loadOrCreateCapabilityTokenSecret();
-  return _secret;
-}
-
-// ---------------------------------------------------------------------------
-// Mint / verify
-// ---------------------------------------------------------------------------
-
-const DEFAULT_TTL_MS = 30 * 60 * 1000; // 30 minutes
+let _testSecret: Buffer | undefined;
 
 function base64urlEncode(buf: Buffer): string {
   return buf
@@ -284,56 +67,62 @@ function sign(payload: string, secret: Buffer): string {
   return base64urlEncode(createHmac("sha256", secret).update(payload).digest());
 }
 
-/**
- * Mint a capability token bound to the `host_browser_command` capability
- * for the given guardian id. Default TTL is 30 minutes.
- */
-export function mintHostBrowserCapability(
-  guardianId: string,
-  ttlMs: number = DEFAULT_TTL_MS,
-): CapabilityToken {
-  const expiresAt = Date.now() + ttlMs;
-  const nonce = randomBytes(16).toString("hex");
-  const claims: CapabilityClaims = {
-    capability: "host_browser_command",
-    guardianId,
-    nonce,
-    expiresAt,
-  };
-  const payload = base64urlEncode(Buffer.from(JSON.stringify(claims), "utf8"));
-  const sig = sign(payload, getSecret());
-  return { token: `${payload}.${sig}`, expiresAt };
-}
+// ---------------------------------------------------------------------------
+// Verify (production: gateway IPC, test: in-process)
+// ---------------------------------------------------------------------------
 
 /**
- * Verify a capability token minted by `mintHostBrowserCapability`.
- *
- * Returns the decoded claims on success or null if the signature is
- * invalid, the payload is malformed, the token has expired, or the bound
- * capability is not `host_browser_command`.
+ * Verify a capability token.
  *
- * Signature comparison uses `timingSafeEqual` to avoid leaking the secret
- * through timing side channels.
+ * In production, delegates to the gateway via IPC. In tests (when a
+ * secret has been injected via `setCapabilityTokenSecretForTests`),
+ * verifies in-process so tests don't need a live gateway.
  *
- * The `/v1/browser-relay` WebSocket upgrade handler in `http-server.ts`
- * (`handleBrowserRelayUpgrade`) calls this to authenticate self-hosted
- * chrome extensions on the capability-token branch before falling
- * through to the JWT compatibility path. The `/v1/host-browser-result`
- * POST route may also call it (see that route's auth handling) when a
- * result is posted back with a capability-token bearer instead of a
- * guardian-bound JWT.
+ * Returns the decoded claims on success or null on any failure.
  */
-export function verifyHostBrowserCapability(
+export async function verifyHostBrowserCapability(
+  token: string,
+): Promise<CapabilityClaims | null> {
+  if (typeof token !== "string" || token.length === 0) return null;
+
+  // Test path: in-process verification with the injected secret.
+  if (_testSecret) {
+    return verifyInProcess(token, _testSecret);
+  }
+
+  // Production path: delegate to the gateway.
+  try {
+    const result = await ipcCall("verify_capability_token", { token });
+    if (!result || typeof result !== "object") return null;
+
+    const claims = result as Record<string, unknown>;
+    if (claims.valid === false) return null;
+    if (claims.capability !== "host_browser_command") return null;
+    if (
+      typeof claims.guardianId !== "string" ||
+      claims.guardianId.length === 0
+    ) {
+      return null;
+    }
+
+    return claims as unknown as CapabilityClaims;
+  } catch (err) {
+    log.warn({ err }, "Failed to verify capability token via gateway IPC");
+    return null;
+  }
+}
+
+function verifyInProcess(
   token: string,
+  secret: Buffer,
 ): CapabilityClaims | null {
-  if (typeof token !== "string") return null;
   const dot = token.indexOf(".");
   if (dot < 0) return null;
   const payload = token.slice(0, dot);
   const sig = token.slice(dot + 1);
   if (!payload || !sig) return null;
 
-  const expected = sign(payload, getSecret());
+  const expected = sign(payload, secret);
   const a = Buffer.from(sig, "utf8");
   const b = Buffer.from(expected, "utf8");
   if (a.length !== b.length) return null;
@@ -353,9 +142,6 @@ export function verifyHostBrowserCapability(
   if (typeof claims.guardianId !== "string" || claims.guardianId.length === 0) {
     return null;
   }
-  if (typeof claims.nonce !== "string" || claims.nonce.length === 0) {
-    return null;
-  }
   if (typeof claims.expiresAt !== "number" || claims.expiresAt <= Date.now()) {
     return null;
   }
@@ -363,52 +149,42 @@ export function verifyHostBrowserCapability(
 }
 
 // ---------------------------------------------------------------------------
-// Dev-only fallback token file
+// Test-only helpers
 // ---------------------------------------------------------------------------
 
 /**
- * Path to the dev-pairing fallback token file. The runtime writes a freshly
- * minted capability token to this location on daemon startup so developers
- * can manually pair the chrome extension without wiring the native
- * messaging helper. Production users should pair via the native helper
- * (PRs 7/12/13).
- */
-export function getDaemonTokenFilePath(): string {
-  // Stored under the per-instance protected directory. Both writer and
-  // reader run in the same daemon process, so they resolve the same
-  // per-instance path (honoring BASE_DATA_DIR for multi-instance setups).
-  // This is a dev-only convenience path — production pairing goes through
-  // the native messaging flow.
-  return join(getProtectedDir(), "daemon-token");
-}
-
-/**
- * Write a freshly-minted capability token to the per-instance dev token
- * file (see `getDaemonTokenFilePath`) with 0600 permissions. Swallows
- * errors so a failure here never blocks daemon startup — this is a
- * dev-convenience path, not a production auth requirement.
+ * Mint a capability token in-process. Test-only — production minting is
+ * done by the gateway.
  */
-export function writeDaemonTokenFallback(guardianId: string): void {
-  try {
-    const { token } = mintHostBrowserCapability(guardianId);
-    const filePath = getDaemonTokenFilePath();
-    const dir = dirname(filePath);
-    if (!existsSync(dir)) {
-      mkdirSync(dir, { recursive: true });
-    }
-    const tmpPath = `${filePath}.tmp.${process.pid}`;
-    writeFileSync(tmpPath, token, { mode: 0o600 });
-    renameSync(tmpPath, filePath);
-    try {
-      chmodSync(filePath, 0o600);
-    } catch {
-      // best-effort
-    }
-    log.info({ filePath }, "Dev capability token written to daemon-token file");
-  } catch (err) {
-    log.warn(
-      { err },
-      "Failed to write dev capability token file; manual pairing still available via /v1/browser-extension-pair",
+export function mintHostBrowserCapability(
+  guardianId: string,
+  ttlMs: number = 30 * 60 * 1000,
+): CapabilityToken {
+  const secret = _testSecret;
+  if (!secret) {
+    throw new Error(
+      "capability token secret not set — call setCapabilityTokenSecretForTests() first",
     );
   }
+  const expiresAt = Date.now() + ttlMs;
+  const nonce = randomBytes(16).toString("hex");
+  const claims: CapabilityClaims = {
+    capability: "host_browser_command",
+    guardianId,
+    nonce,
+    expiresAt,
+  };
+  const payload = base64urlEncode(Buffer.from(JSON.stringify(claims), "utf8"));
+  const sig = sign(payload, secret);
+  return { token: `${payload}.${sig}`, expiresAt };
+}
+
+/** Inject a deterministic secret for tests. */
+export function setCapabilityTokenSecretForTests(secret: Buffer): void {
+  _testSecret = secret;
+}
+
+/** Reset the test secret. */
+export function resetCapabilityTokenSecretForTests(): void {
+  _testSecret = undefined;
 }

package/src/runtime/channel-approval-types.ts

@@ -14,12 +14,7 @@ import type { GuardianDecisionAction } from "./guardian-decision-types.js";
 // ---------------------------------------------------------------------------
 
 /** The set of actions a user can take on an approval prompt. */
-export type ApprovalAction =
-  | "approve_once"
-  | "approve_10m"
-  | "approve_conversation"
-  | "approve_always"
-  | "reject";
+export type ApprovalAction = "approve_once" | "reject";
 
 /** An action presented to the user as a tappable button or text option. */
 export interface ApprovalActionOption {