@vellumai/assistant 0.7.1 → 0.7.3

package/src/runtime/capability-tokens.ts

@@ -1,190 +0,0 @@
-/**
- * Capability token verification for scoped, short-lived tokens issued to the
- * chrome extension (and other thin clients).
- *
- * Both minting and verification are owned by the gateway
- * (`gateway/src/auth/capability-tokens.ts`). The daemon delegates
- * verification to the gateway via IPC so it never needs to read the
- * HMAC secret from the filesystem.
- *
- * Test-only helpers (`mintHostBrowserCapability`,
- * `setCapabilityTokenSecretForTests`, `resetCapabilityTokenSecretForTests`)
- * implement the same HMAC logic in-process so assistant tests can create
- * and verify tokens without a live gateway.
- */
-
-import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
-
-import { ipcCall } from "../ipc/gateway-client.js";
-import { getLogger } from "../util/logger.js";
-
-const log = getLogger("capability-tokens");
-
-// ---------------------------------------------------------------------------
-// Types (mirror the gateway's types for consumer convenience)
-// ---------------------------------------------------------------------------
-
-/** Capability identifiers that can be bound to a capability token. */
-export type Capability = "host_browser_command";
-
-/** Claims encoded in the signed payload. */
-export interface CapabilityClaims {
-  capability: Capability;
-  guardianId: string;
-  /** 16-byte random nonce, hex-encoded. Prevents replay across fresh mints. */
-  nonce: string;
-  /** ms-since-epoch expiry. */
-  expiresAt: number;
-}
-
-/** A freshly-minted capability token and its absolute expiry. */
-export interface CapabilityToken {
-  token: string;
-  expiresAt: number;
-}
-
-// ---------------------------------------------------------------------------
-// In-process HMAC helpers (shared between test mint/verify and IPC verify)
-// ---------------------------------------------------------------------------
-
-let _testSecret: Buffer | undefined;
-
-function base64urlEncode(buf: Buffer): string {
-  return buf
-    .toString("base64")
-    .replace(/\+/g, "-")
-    .replace(/\//g, "_")
-    .replace(/=+$/, "");
-}
-
-function base64urlDecode(s: string): Buffer {
-  const pad = s.length % 4 === 0 ? 0 : 4 - (s.length % 4);
-  const b64 = s.replace(/-/g, "+").replace(/_/g, "/") + "=".repeat(pad);
-  return Buffer.from(b64, "base64");
-}
-
-function sign(payload: string, secret: Buffer): string {
-  return base64urlEncode(createHmac("sha256", secret).update(payload).digest());
-}
-
-// ---------------------------------------------------------------------------
-// Verify (production: gateway IPC, test: in-process)
-// ---------------------------------------------------------------------------
-
-/**
- * Verify a capability token.
- *
- * In production, delegates to the gateway via IPC. In tests (when a
- * secret has been injected via `setCapabilityTokenSecretForTests`),
- * verifies in-process so tests don't need a live gateway.
- *
- * Returns the decoded claims on success or null on any failure.
- */
-export async function verifyHostBrowserCapability(
-  token: string,
-): Promise<CapabilityClaims | null> {
-  if (typeof token !== "string" || token.length === 0) return null;
-
-  // Test path: in-process verification with the injected secret.
-  if (_testSecret) {
-    return verifyInProcess(token, _testSecret);
-  }
-
-  // Production path: delegate to the gateway.
-  try {
-    const result = await ipcCall("verify_capability_token", { token });
-    if (!result || typeof result !== "object") return null;
-
-    const claims = result as Record<string, unknown>;
-    if (claims.valid === false) return null;
-    if (claims.capability !== "host_browser_command") return null;
-    if (
-      typeof claims.guardianId !== "string" ||
-      claims.guardianId.length === 0
-    ) {
-      return null;
-    }
-
-    return claims as unknown as CapabilityClaims;
-  } catch (err) {
-    log.warn({ err }, "Failed to verify capability token via gateway IPC");
-    return null;
-  }
-}
-
-function verifyInProcess(
-  token: string,
-  secret: Buffer,
-): CapabilityClaims | null {
-  const dot = token.indexOf(".");
-  if (dot < 0) return null;
-  const payload = token.slice(0, dot);
-  const sig = token.slice(dot + 1);
-  if (!payload || !sig) return null;
-
-  const expected = sign(payload, secret);
-  const a = Buffer.from(sig, "utf8");
-  const b = Buffer.from(expected, "utf8");
-  if (a.length !== b.length) return null;
-  if (!timingSafeEqual(a, b)) return null;
-
-  let claims: CapabilityClaims;
-  try {
-    claims = JSON.parse(
-      base64urlDecode(payload).toString("utf8"),
-    ) as CapabilityClaims;
-  } catch {
-    return null;
-  }
-
-  if (!claims || typeof claims !== "object") return null;
-  if (claims.capability !== "host_browser_command") return null;
-  if (typeof claims.guardianId !== "string" || claims.guardianId.length === 0) {
-    return null;
-  }
-  if (typeof claims.expiresAt !== "number" || claims.expiresAt <= Date.now()) {
-    return null;
-  }
-  return claims;
-}
-
-// ---------------------------------------------------------------------------
-// Test-only helpers
-// ---------------------------------------------------------------------------
-
-/**
- * Mint a capability token in-process. Test-only — production minting is
- * done by the gateway.
- */
-export function mintHostBrowserCapability(
-  guardianId: string,
-  ttlMs: number = 30 * 60 * 1000,
-): CapabilityToken {
-  const secret = _testSecret;
-  if (!secret) {
-    throw new Error(
-      "capability token secret not set — call setCapabilityTokenSecretForTests() first",
-    );
-  }
-  const expiresAt = Date.now() + ttlMs;
-  const nonce = randomBytes(16).toString("hex");
-  const claims: CapabilityClaims = {
-    capability: "host_browser_command",
-    guardianId,
-    nonce,
-    expiresAt,
-  };
-  const payload = base64urlEncode(Buffer.from(JSON.stringify(claims), "utf8"));
-  const sig = sign(payload, secret);
-  return { token: `${payload}.${sig}`, expiresAt };
-}
-
-/** Inject a deterministic secret for tests. */
-export function setCapabilityTokenSecretForTests(secret: Buffer): void {
-  _testSecret = secret;
-}
-
-/** Reset the test secret. */
-export function resetCapabilityTokenSecretForTests(): void {
-  _testSecret = undefined;
-}

package/src/signals/bash.ts

@@ -1,198 +0,0 @@
-/**
- * Handle bash debug signals delivered via signal files from the CLI.
- *
- * Each invocation writes JSON to a unique `signals/bash.<requestId>` file.
- * ConfigWatcher detects the new file and invokes {@link handleBashSignal},
- * which reads the payload, spawns the command, and writes the result to
- * `signals/bash.<requestId>.result` for the CLI to pick up.
- *
- * Per-request filenames avoid dropped commands when overlapping invocations
- * race on the same signal file.
- *
- * **Security**: This handler is gated behind the `VELLUM_DEBUG` environment
- * variable. When debug mode is off (the default), the daemon ignores bash
- * signal files entirely. This prevents untrusted file-write operations
- * (e.g. from prompt injection or a compromised skill) from bypassing the
- * normal tool-approval flow for shell execution.
- */
-
-import { spawn } from "node:child_process";
-import { readFileSync, unlinkSync, writeFileSync } from "node:fs";
-import { join } from "node:path";
-
-import { getIsContainerized } from "../config/env-registry.js";
-import { getLogger } from "../util/logger.js";
-import { getSignalsDir, getWorkspaceDir } from "../util/platform.js";
-
-const log = getLogger("signal:bash");
-
-function isDebugMode(): boolean {
-  return (
-    process.env.VELLUM_DEBUG === "1" || process.env.VELLUM_DEBUG === "true"
-  );
-}
-
-const DEFAULT_TIMEOUT_MS = 30_000;
-
-interface BashSignalPayload {
-  requestId: string;
-  command: string;
-  timeoutMs?: number;
-}
-
-interface BashSignalResult {
-  requestId: string;
-  stdout: string;
-  stderr: string;
-  exitCode: number | null;
-  timedOut: boolean;
-  error?: string;
-}
-
-function writeResult(requestId: string, result: BashSignalResult): void {
-  try {
-    writeFileSync(
-      join(getSignalsDir(), `bash.${requestId}.result`),
-      JSON.stringify(result),
-    );
-  } catch (err) {
-    log.error({ err, requestId }, "Failed to write bash signal result");
-  }
-}
-
-/**
- * Read a `signals/bash.<requestId>` file, execute the command, and write
- * the result to `signals/bash.<requestId>.result`. Called by ConfigWatcher
- * when a matching signal file is created or modified.
- */
-export function handleBashSignal(filename: string): void {
-  if (getIsContainerized()) return;
-
-  if (!isDebugMode()) {
-    log.warn(
-      { filename },
-      "Bash signal ignored — debug mode is not enabled (set VELLUM_DEBUG=1)",
-    );
-    // Write an error result so the CLI gets a clear rejection instead of timing out.
-    const match = filename.match(/^bash\.(.+)$/);
-    if (match) {
-      writeResult(match[1], {
-        requestId: match[1],
-        stdout: "",
-        stderr: "",
-        exitCode: null,
-        timedOut: false,
-        error:
-          "Bash signals are disabled. The running assistant process must have been started with VELLUM_DEBUG=1 (setting it on the CLI command alone is not enough). Restart the assistant with: vellum sleep && VELLUM_DEBUG=1 vellum wake",
-      });
-    }
-    return;
-  }
-
-  const signalPath = join(getSignalsDir(), filename);
-  let raw: string;
-  try {
-    raw = readFileSync(signalPath, "utf-8");
-  } catch {
-    // File may already be deleted (e.g. re-trigger from our own unlinkSync).
-    return;
-  }
-
-  let payload: BashSignalPayload;
-  try {
-    payload = JSON.parse(raw) as BashSignalPayload;
-  } catch (err) {
-    log.error({ err, filename }, "Failed to parse bash signal file");
-    return;
-  }
-
-  try {
-    unlinkSync(signalPath);
-  } catch {
-    // Best-effort cleanup; the file may already be gone.
-  }
-
-  const { requestId, command, timeoutMs } = payload;
-
-  if (!requestId || typeof requestId !== "string") {
-    log.warn("Bash signal missing requestId");
-    return;
-  }
-  if (!command || typeof command !== "string") {
-    log.warn({ requestId }, "Bash signal missing command");
-    return;
-  }
-
-  const effectiveTimeout =
-    typeof timeoutMs === "number" && timeoutMs > 0
-      ? timeoutMs
-      : DEFAULT_TIMEOUT_MS;
-
-  log.info({ requestId, command }, "Executing bash signal command");
-
-  const stdoutChunks: Buffer[] = [];
-  const stderrChunks: Buffer[] = [];
-  let timedOut = false;
-  let resultWritten = false;
-
-  const child = spawn("bash", ["-c", command], {
-    cwd: getWorkspaceDir(),
-    stdio: ["ignore", "pipe", "pipe"],
-    detached: true,
-  });
-
-  const timer = setTimeout(() => {
-    timedOut = true;
-    try {
-      process.kill(-child.pid!, "SIGKILL");
-    } catch {
-      // Process group may have already exited.
-    }
-  }, effectiveTimeout);
-
-  child.stdout.on("data", (data: Buffer) => {
-    stdoutChunks.push(data);
-  });
-
-  child.stderr.on("data", (data: Buffer) => {
-    stderrChunks.push(data);
-  });
-
-  child.on("close", (code) => {
-    clearTimeout(timer);
-    if (resultWritten) return;
-    resultWritten = true;
-
-    const stdout = Buffer.concat(stdoutChunks).toString();
-    const stderr = Buffer.concat(stderrChunks).toString();
-
-    log.info(
-      { requestId, exitCode: code, timedOut },
-      "Bash signal command completed",
-    );
-
-    writeResult(requestId, {
-      requestId,
-      stdout,
-      stderr,
-      exitCode: code,
-      timedOut,
-    });
-  });
-
-  child.on("error", (err) => {
-    clearTimeout(timer);
-    if (resultWritten) return;
-    resultWritten = true;
-
-    log.error({ err, requestId }, "Failed to spawn bash signal command");
-    writeResult(requestId, {
-      requestId,
-      stdout: "",
-      stderr: "",
-      exitCode: null,
-      timedOut: false,
-      error: err.message,
-    });
-  });
-}

package/src/signals/mcp-reload.ts

@@ -1,18 +0,0 @@
-/**
- * Handle MCP reload signals from the CLI.
- *
- * When the CLI writes to `signals/mcp-reload`, the daemon's ConfigWatcher
- * detects the file change and invokes {@link handleMcpReloadSignal} to
- * restart MCP servers with the latest configuration.
- */
-
-import { reloadMcpServers } from "../daemon/mcp-reload-service.js";
-import { getLogger } from "../util/logger.js";
-
-const log = getLogger("signal:mcp-reload");
-
-export function handleMcpReloadSignal(): void {
-  reloadMcpServers().catch((err: unknown) => {
-    log.error({ err }, "MCP reload triggered by signal file failed");
-  });
-}