@withbuddi/buddi 0.1.0-pre.38 → 0.1.0-pre.39

package/node_modules/@buddi/gateway/dist/web/server.js

@@ -64,7 +64,7 @@ import { OnboardingRefusal, WEB_ONBOARDING_STEPS, WEB_ONBOARDING_SURFACE, claimO
 import { TakeOnRefusal, readTakeOn, startTakeOn } from './take-on.js';
 import { TelegramWebError, saveTelegramToken, telegramBot, telegramDevices, telegramPairing, telegramStatus, unpairTelegramDevice, } from './telegram.js';
 import { PAGE_ROUTE, sendPageFile, actOnPage, actRateLimited, listPageDescriptors, runPageQuery, } from './pages.js';
-import { listSecrets, secretUses, secretsAct } from './secrets.js';
+import { listSecrets, ownerLoginKey, ownerLoginNames, ownerLoginStore, secretUses, secretsAct } from './secrets.js';
 import { sayRoute, transcribeRoute } from './speech.js';
 import { createServer } from 'node:http';
 import { asksEachTime, getAction, idleRolloverMs, inRecovery, listMissions, listPendingActions, isJobState, parseAgentFile, setSentinelEnabled, snoozeFinding, snoozeFindings, unmuteFindings } from '@buddi/core';
@@ -474,6 +474,15 @@ export function createWebApp(deps) {
             await chat?.continueAfterGiveBack({ conversationId: info.conversationId, agentId: info.agentId });
         })().catch((err) => log(`browser: carrying on after the page was given back failed: ${err instanceof Error ? err.message : String(err)}`));
     });
+    /*
+     * A sign-in the owner made on a page they held, kept when they say Save
+     * (docs/browser.md, "Saving a sign-in"): the browser host's keeper hands the
+     * pair to core's owner-secret store, as the owner, and to nothing else.
+     */
+    {
+        const loginDeps = { pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now };
+        (deps.browser ?? browserHost(deps.env ?? process.env)).logins?.useStore(ownerLoginStore(loginDeps), ownerLoginNames(loginDeps), ownerLoginKey(deps.env ?? process.env));
+    }
     const streams = new StreamBudget();
     // A bundle script's run asks every time: its card offers no standing permission (`asksEachTime`).
     const permissionScopes = (tool, envelope) => deps.registry.lookup(tool)?.reusableApproval && !asksEachTime(envelope)
@@ -1219,7 +1228,7 @@ export function createWebApp(deps) {
             agentIds: () => deps.catalog.list().map((a) => a.id),
         });
         /** The Keys and secrets page (docs/owner-secrets.md §6): core's own queries and ownerOnly tools. */
-        const secretsDeps = () => ({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now });
+        const secretsDeps = () => ({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now, ...(browser.logins ? { logins: browser.logins } : {}) });
         /** Talking to buddi on the dashboard: the speech plugin's two tools, as the owner. */
         const speechDeps = () => ({ pool: deps.pool, registry: deps.registry, ctx: deps.ctx, now: deps.now, agents: () => deps.catalog.list() });
         /** The same, for the version and upgrade routes. */
@@ -2579,12 +2588,33 @@ export function createWebApp(deps) {
          */
         /*
          * "Set it up for me": start a run (202, then poll GET …/setup), stop the
-         * health wait, or remove what buddi made. From this machine only, like the
-         * setting it fills in.
+         * health wait, remove what buddi made, or forget the kept API token. From
+         * this machine only, like the setting it fills in.
          */
-        if (path === '/api/access/cloudflare-access/setup' || path === '/api/access/cloudflare-access/setup/stop' || path === '/api/access/cloudflare-access/setup/remove') {
+        if (path === '/api/access/cloudflare-access/setup' || path === '/api/access/cloudflare-access/setup/stop' || path === '/api/access/cloudflare-access/setup/remove' || path === '/api/access/cloudflare-access/setup/forget-token') {
             if (session.via !== 'local')
                 return sendJson(res, 403, { error: 'Change this from the computer buddi runs on.' });
+            /*
+             * Forget the token: drop the owner secret. Not while a run holds it.
+             * Cloudflare still honours it until the owner revokes it there.
+             */
+            if (path.endsWith('/forget-token')) {
+                const lease = claimSetupOperation('setup');
+                if (!lease)
+                    return sendJson(res, 409, { error: setupBusySentence(setupOperation()) });
+                try {
+                    try {
+                        await tokenStore().remove();
+                    }
+                    catch {
+                        return sendJson(res, 409, { error: 'The token could not be forgotten. Check that the vault is unlocked, then try again.' });
+                    }
+                    return sendJson(res, 200, await setupView());
+                }
+                finally {
+                    lease.release();
+                }
+            }
             /*
              * One operation at a time (cloudflare-setup's lock, claimed before the
              * first await and held to the end): a second setup or a removal while
@@ -2623,8 +2653,7 @@ export function createWebApp(deps) {
                     setupRun = run;
                     const progress = await removeCloudflareSetup({ ...setupDepsFor(token, lease), host: str(body.host) || undefined }, (p) => { run.progress = p; });
                     run.progress = progress;
-                    if (!progress.error)
-                        await tokens.remove().catch(() => undefined);
+                    // The token stays kept: the panel offers to forget it (…/setup/forget-token), and Set it up again reuses it.
                     return sendJson(res, 200, await setupView());
                 }
                 const input = { host: str(body.host), email: str(body.email), zone: str(body.zone) || undefined, adopt: body.adopt === true };
@@ -2787,6 +2816,30 @@ export function createWebApp(deps) {
             const answered = await browser.touch?.({ conversationId: body.conversationId, text: body.answer });
             return sendJson(res, 200, { ...(answered && 'answered' in answered ? answered : {}), status: browser.status({ conversationId: body.conversationId }) });
         }
+        /*
+         * "Save this login for amazon.com?" answered in the Page tab: Save, Not
+         * now or Never for this site. The owner's session and CSRF, like every
+         * write here; the body names the question, never a password — that is in
+         * the browser host's keeper, which hands it to the owner-secret store on
+         * Save and drops it otherwise.
+         */
+        if (path === '/api/browser/login') {
+            const body = await readJsonBody(req);
+            const decision = body?.decision;
+            if (typeof body?.id !== 'string' || body.id.length > 80 || (decision !== 'save' && decision !== 'later' && decision !== 'never')) {
+                return sendJson(res, 400, { error: 'Expected {id: string, decision: save|later|never}' });
+            }
+            if (!browser.logins)
+                return sendJson(res, 409, { error: 'This host keeps no sign-ins.' });
+            try {
+                const answer = await browser.logins.decide(body.id, decision);
+                return sendJson(res, 200, { outcome: answer.outcome, ...(answer.saved ? { saved: { name: answer.saved.name, site: answer.saved.site, username: answer.saved.username, savedAt: answer.saved.savedAt } } : {}) });
+            }
+            catch {
+                // Never the error's own words: they are the store's, and the store had the password.
+                return sendJson(res, 409, { error: 'buddi could not keep that login. Add it in Settings → Keys and secrets.' });
+            }
+        }
         const control = /^\/api\/browser\/(stop|takeover|resume|release)$/.exec(path);
         if (control) {
             const body = await readJsonBody(req);
@@ -2806,6 +2859,9 @@ export function createWebApp(deps) {
                 // Whether this screen can be driven from here at all. The dashboard
                 // shows the mode's own sentence when it cannot.
                 const taken = sessionId ?? status.session?.id;
+                // A page in the owner's Chrome is taken over where it is: its tab came to the front there, so no frame will come.
+                if (action === 'takeover' && status.held)
+                    return sendJson(res, 200, { ...status, hand: false });
                 const offer = action === 'takeover' && taken ? browser.hand?.({ sessionId: taken }) : undefined;
                 /*
                  * "Your browser" with Chrome closed: the take-over itself succeeds (the