beehaven 0.8.16

package/dist/health.js

@@ -0,0 +1,56 @@
+// ============================================================================
+// Beehaven Daemon — Health Monitor
+// Tracks uptime, connectivity, and activity. Exposes /health on the watcher socket.
+// ============================================================================
+import { logger } from './logger.js';
+export class HealthMonitor {
+    getConnected;
+    getPendingCount;
+    version;
+    startedAt = Date.now();
+    lastEventAt = null;
+    watchdogTimer = null;
+    watchdogLastPing = Date.now();
+    constructor(getConnected, getPendingCount, version) {
+        this.getConnected = getConnected;
+        this.getPendingCount = getPendingCount;
+        this.version = version;
+    }
+    recordEvent() {
+        this.lastEventAt = Date.now();
+        this.watchdogLastPing = Date.now();
+    }
+    getStatus() {
+        const now = Date.now();
+        const connected = this.getConnected();
+        const lastEventAge = this.lastEventAt ? Math.round((now - this.lastEventAt) / 1000) : null;
+        let status = 'healthy';
+        if (!connected)
+            status = 'degraded';
+        if (!connected && lastEventAge !== null && lastEventAge > 300)
+            status = 'unhealthy';
+        return {
+            status,
+            uptime: Math.round((now - this.startedAt) / 1000),
+            connected,
+            lastEventAge,
+            pendingRequests: this.getPendingCount(),
+            version: this.version,
+            pid: process.pid,
+        };
+    }
+    /** Start watchdog — logs warning if no activity for 60s */
+    startWatchdog() {
+        this.watchdogTimer = setInterval(() => {
+            const elapsed = Date.now() - this.watchdogLastPing;
+            if (elapsed > 60000) {
+                logger.warn('health', `Watchdog: no activity for ${Math.round(elapsed / 1000)}s`);
+            }
+            this.watchdogLastPing = Date.now(); // reset so we don't spam
+        }, 30000);
+    }
+    stop() {
+        if (this.watchdogTimer)
+            clearInterval(this.watchdogTimer);
+    }
+}

package/dist/ipc-auth.js

@@ -0,0 +1,299 @@
+/**
+ * IPC auth — scope-aware shared secrets between daemon and local clients.
+ *
+ * Threat model: any process running as the same user can connect to
+ * /tmp/beehaven-ipc.sock (it's chmod 0600, which only restricts other users).
+ * Without per-scope auth, any same-user process can invoke privileged
+ * verbs — extract the Firebase ID token via `get-token`, run arbitrary
+ * SQL, install marketplace packages with code execution.
+ *
+ * Defense layers:
+ *   1. Socket file mode 0600 + parent dir 0700 (kernel-enforced same-user).
+ *   2. Per-launch token rotation (fresh tokens every daemon start).
+ *   3. Constant-time compare (timingSafeEqual).
+ *   4. *Two-token scope split* — see "Scope model" below.
+ *
+ * ── Scope model ──────────────────────────────────────────────────────
+ * Two distinct tokens, two distinct files:
+ *
+ *   ~/.beehaven/ipc-auth      → consumer scope (always exists)
+ *   ~/.beehaven/ipc-auth-dev  → developer scope (only if HIVE_DEV_MODE=1
+ *                                or the Mac app's Settings → Developer
+ *                                Mode toggle is on)
+ *
+ * Mwah CLI reads the consumer token only. Beehaven CLI reads the
+ * developer token (falling back to consumer when dev mode is off, in
+ * which case privileged verbs fail closed).
+ *
+ * The daemon stores both (when minted) and tags each authenticated
+ * client with its scope on the auth handshake. The IPC server gates
+ * verbs by scope:
+ *
+ *   consumer  → ping, auth, app-rpc (local buildings), rpc to home,
+ *               session:announce, subscribe, send
+ *   developer → everything consumer plus get-token, daemon-fetch,
+ *               shell, sql, marketplace:install, admin:* RPC actions
+ *
+ * Even if a malicious script in consumer mode reads ~/.beehaven/ipc-auth
+ * and authenticates, it cannot exfiltrate the Firebase ID token, run
+ * SQL, install packages, or call admin verbs. The blast radius is
+ * scoped to what mwah itself does.
+ *
+ * ── Backward compat ──────────────────────────────────────────────────
+ * The legacy single-token shape (one file, full access) is gone. Old
+ * CLIs that pre-date this change get *consumer* scope automatically —
+ * they don't request a scope on auth, and the daemon defaults missing
+ * scopes to consumer. Any script that relied on `beehaven rpc get-token`
+ * working in a non-dev daemon will now get UNAUTHORIZED — that's the
+ * intended security improvement.
+ */
+import { randomBytes, timingSafeEqual } from 'crypto';
+import { readFileSync, writeFileSync, existsSync, chmodSync, mkdirSync, unlinkSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+import { keychain } from './keychain.js';
+const AUTH_DIR = join(homedir(), '.beehaven');
+const AUTH_FILE_CONSUMER = join(AUTH_DIR, 'ipc-auth');
+const AUTH_FILE_DEVELOPER = join(AUTH_DIR, 'ipc-auth-dev');
+const KEYCHAIN_ACCOUNT_CONSUMER = 'ipc-auth';
+const KEYCHAIN_ACCOUNT_DEVELOPER = 'ipc-auth-dev';
+const FILE_FOR_SCOPE = {
+    consumer: AUTH_FILE_CONSUMER,
+    developer: AUTH_FILE_DEVELOPER,
+};
+const KEYCHAIN_ACCOUNT_FOR_SCOPE = {
+    consumer: KEYCHAIN_ACCOUNT_CONSUMER,
+    developer: KEYCHAIN_ACCOUNT_DEVELOPER,
+};
+/**
+ * Mint fresh IPC auth tokens on daemon startup.
+ *
+ * Always mints a consumer token. Mints a developer token only when
+ * `developerMode` is true — i.e. the user explicitly opted into dev
+ * mode (HIVE_DEV_MODE=1 env var, or the Mac app's tray toggle).
+ * Without dev mode, no developer token exists on disk and beehaven CLI
+ * commands that need it fail with UNAUTHORIZED. That is the intended
+ * security default.
+ */
+export function mintIpcAuthTokens(opts) {
+    try {
+        mkdirSync(AUTH_DIR, { recursive: true, mode: 0o700 });
+    }
+    catch { }
+    const consumer = writeScopedToken('consumer');
+    if (opts.developerMode) {
+        const developer = writeScopedToken('developer');
+        return { consumer, developer };
+    }
+    // Dev mode is off — actively *clear* any stale developer token left
+    // from a previous launch. Otherwise a user who toggled dev mode off
+    // would still have a usable developer token on disk.
+    clearScopedToken('developer');
+    return { consumer, developer: null };
+}
+function writeScopedToken(scope) {
+    const token = randomBytes(32).toString('hex');
+    const file = FILE_FOR_SCOPE[scope];
+    // Atomic-ish write: unlink first to drop any stale perms, then create
+    // with mode 0600 from the start. The chmod is belt + braces because
+    // mode is advisory in writeFileSync on some platforms.
+    try {
+        if (existsSync(file))
+            unlinkSync(file);
+    }
+    catch { }
+    writeFileSync(file, token, { mode: 0o600 });
+    try {
+        chmodSync(file, 0o600);
+    }
+    catch { }
+    /**
+     * ⚠⚠ THE IPC TOKEN IS NOT MIRRORED TO THE KEYCHAIN, AND THAT IS THE FIX FOR A MODAL DIALOG.
+     *
+     * The daemon is spawned DETACHED, so it has no Aqua security session — and `security
+     * add-generic-password` in that context cannot resolve a default keychain. macOS answers with a
+     * BLOCKING system window:
+     *
+     *     A keychain cannot be found to store "ipc auth"
+     *
+     * Reported from a real machine, and dismissing it opened TWO MORE — because the app spawns the
+     * daemon three times per launch (boot, then `daemon.install()`'s deliberate restart after
+     * sign-in). Three mints, three dialogs. The machine's keychain is fine; the SESSION is not.
+     *
+     * ⚠ AND IT BLOCKS THE MINT. `spawnSync` waits on that window, so the token is not written while
+     * it is open — which is how a daemon ends up alive, owning the socket, with no token. Measured
+     * separately at 153 SECONDS on one keychain call.
+     *
+     * ⚠ THE MIRROR BOUGHT ALMOST NOTHING. This token is EPHEMERAL — minted per launch, scrubbed on
+     * shutdown, and stored in a 0600 file that is the primary source. `readScopedToken`'s keychain
+     * fallback only matters when the file is absent, and by design that means no daemon is running,
+     * so there is nothing for a stale keychain copy to authenticate against.
+     *
+     * ⚠ THIS IS NOT A CLAIM THAT THE KEYCHAIN IS UNSAFE. Long-lived secrets (the relay refresh
+     * token, Claude credentials) still belong there. A per-launch socket token does not.
+     */
+    void keychain; // still imported for `clearScopedToken`, which reaps any legacy mirror
+    return token;
+}
+function clearScopedToken(scope, expected) {
+    /**
+     * ⚠ A MISMATCH MEANS A NEWER DAEMON OWNS IT — leave it alone. See `clearIpcAuthToken`.
+     * An unreadable file is treated as ours: failing to scrub is the weaker outcome of the two.
+     */
+    if (expected) {
+        let current = '';
+        try {
+            current = readFileSync(FILE_FOR_SCOPE[scope], 'utf8').trim();
+        }
+        catch { /* treat as ours */ }
+        if (current && current !== expected)
+            return;
+    }
+    try {
+        if (existsSync(FILE_FOR_SCOPE[scope]))
+            unlinkSync(FILE_FOR_SCOPE[scope]);
+    }
+    catch { }
+    try {
+        keychain.delete(KEYCHAIN_ACCOUNT_FOR_SCOPE[scope]);
+    }
+    catch { }
+}
+/**
+ * Read the consumer IPC token. Used by mwah and any other consumer-
+ * scope client.
+ */
+export function readIpcAuthToken() {
+    return readScopedToken('consumer');
+}
+/**
+ * Read the scoped IPC token. Falls back to keychain if file is missing
+ * (e.g. /tmp was cleared but daemon still running).
+ */
+export function readScopedToken(scope) {
+    const file = FILE_FOR_SCOPE[scope];
+    try {
+        if (existsSync(file)) {
+            const token = readFileSync(file, 'utf-8').trim();
+            if (token)
+                return token;
+        }
+    }
+    catch { }
+    try {
+        return keychain.get(KEYCHAIN_ACCOUNT_FOR_SCOPE[scope]);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Remove all auth tokens on daemon shutdown so leftover file contents
+ * can't authenticate a connection to a newly-launched daemon. (The
+ * new daemon mints fresh tokens anyway — belt + suspenders.)
+ */
+export function clearIpcAuthToken(mine) {
+    /**
+     * ⚠⚠ ONLY SCRUB WHAT THIS DAEMON MINTED — an unconditional clear DELETES A LIVE DAEMON'S TOKEN.
+     *
+     * Shutdown used to clear both scopes outright. That is correct for the last daemon standing and
+     * WRONG during a restart, which is the common case: `daemon.install()` deliberately restarts
+     * after sign-in, so two daemons overlap. The order that bites is
+     *
+     *     A mints T1  ->  B starts and mints T2 (overwriting the file)  ->  A finishes shutting
+     *     down and deletes T2
+     *
+     * leaving B alive, owning the socket, with NO token on disk. Every later call then answers "the
+     * daemon is still starting — it has not minted an IPC token yet" FOREVER, and the tray sits on
+     * "Checking…" because `workspace:list` can never succeed. Reproduced on this machine: one
+     * daemon, pid file matching, socket owned, `~/.beehaven/ipc-auth` absent.
+     *
+     * ⚠ COMPARING THE VALUE IS THE FIX, not skipping the clear. The security reason for scrubbing is
+     * real (it shortens the window in which a captured token pairs with a live socket); what was
+     * missing is that a token this daemon did not write is somebody else's.
+     *
+     * ⚠ NO ARGUMENT MEANS "CLEAR REGARDLESS" and that is deliberate — an explicit `beehaven stop`
+     * wants everything gone, and a caller that cannot say what it minted must not silently leave a
+     * token behind.
+     */
+    clearScopedToken('consumer', mine?.consumer);
+    clearScopedToken('developer', mine?.developer);
+}
+/**
+ * Constant-time comparison. Defensive checks: rejects empty/short
+ * tokens even if the caller misconfigured the daemon to accept one.
+ * Real tokens are 64-char hex.
+ */
+export function verifyIpcAuthToken(presented, expected) {
+    if (typeof presented !== 'string' || typeof expected !== 'string')
+        return false;
+    if (presented.length < 32 || expected.length < 32)
+        return false;
+    if (presented.length !== expected.length)
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(presented, 'utf-8'), Buffer.from(expected, 'utf-8'));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Match a presented token against the daemon's known consumer +
+ * developer tokens, returning the scope it authenticates as (or null
+ * if neither matches). Used by ipc-server.ts on the auth handshake.
+ *
+ * Order: developer first so a successful developer-token match returns
+ * the higher scope. Consumer scope is the strict subset.
+ */
+export function resolveAuthScope(presented, tokens) {
+    if (tokens.developer && verifyIpcAuthToken(presented, tokens.developer)) {
+        return 'developer';
+    }
+    if (tokens.consumer && verifyIpcAuthToken(presented, tokens.consumer)) {
+        return 'consumer';
+    }
+    return null;
+}
+/**
+ * Resolve the best auth token available for the calling process.
+ *
+ * Resolution order:
+ *   1. BEEHAVEN_IPC_AUTH env var (used by the Electron app's spawned
+ *      child processes — they're in the daemon's trust domain).
+ *   2. If BEEHAVEN_IPC_SCOPE=developer is set OR `preferDeveloper` is
+ *      true, try the developer token first. Falls back to consumer
+ *      if dev mode isn't on.
+ *   3. The consumer token.
+ *
+ * The beehaven CLI sets BEEHAVEN_IPC_SCOPE=developer at startup (in
+ * its entry script) so calls automatically attempt developer scope.
+ * Mwah and other consumer-only callers don't set the env var and get
+ * consumer scope. When dev mode is off, even beehaven gracefully
+ * downgrades to consumer scope; privileged verbs then fail with
+ * FORBIDDEN_SCOPE rather than the connection breaking entirely.
+ */
+export function resolveClientAuthToken(opts) {
+    const fromEnv = process.env.BEEHAVEN_IPC_AUTH;
+    if (fromEnv && fromEnv.length >= 32)
+        return fromEnv;
+    const preferDeveloper = opts?.preferDeveloper === true || process.env.BEEHAVEN_IPC_SCOPE === 'developer';
+    if (preferDeveloper) {
+        const dev = readScopedToken('developer');
+        if (dev)
+            return dev;
+    }
+    return readScopedToken('consumer');
+}
+/**
+ * Read the developer-scope token specifically. Returns null when dev
+ * mode is off (no developer token on disk). Useful when a caller
+ * needs to explicitly check scope availability before proceeding.
+ */
+export function resolveDeveloperAuthToken() {
+    const fromEnv = process.env.BEEHAVEN_IPC_AUTH;
+    const scopeHint = process.env.BEEHAVEN_IPC_SCOPE;
+    if (fromEnv && fromEnv.length >= 32 && scopeHint === 'developer')
+        return fromEnv;
+    return readScopedToken('developer');
+}