borgmcp 1.1.14 → 2.0.1

package/dist/server-trust.js

@@ -0,0 +1,225 @@
+import { createHash, timingSafeEqual, X509Certificate } from 'node:crypto';
+import { constants } from 'node:fs';
+import { open } from 'node:fs/promises';
+import { request as httpsRequest } from 'node:https';
+import { homedir } from 'node:os';
+import { join, resolve } from 'node:path';
+import { Readable } from 'node:stream';
+import { BorgServerTrustError } from './server-errors.js';
+// CR5 TLS LATTICE: OpenSSL/Node TLS certificate-verification error codes. A raw
+// CA / cert-chain / SAN failure from the pinned transport is a potential MITM and
+// MUST be a TERMINAL trust-mismatch verdict — never a transient 'restart' blip.
+// Connection refusal / reset / timeout are NOT in here: those stay raw transport
+// errors so the seat probe classifies them as `unreachable` (genuinely transient).
+const TLS_TRUST_ERROR_CODES = new Set([
+    'DEPTH_ZERO_SELF_SIGNED_CERT',
+    'SELF_SIGNED_CERT_IN_CHAIN',
+    'UNABLE_TO_GET_ISSUER_CERT',
+    'UNABLE_TO_GET_ISSUER_CERT_LOCALLY',
+    'UNABLE_TO_VERIFY_LEAF_SIGNATURE',
+    'CERT_UNTRUSTED',
+    'CERT_CHAIN_TOO_LONG',
+    'HOSTNAME_MISMATCH',
+    'ERR_TLS_CERT_ALTNAME_INVALID',
+]);
+/**
+ * True iff `code` is a PINNED-TRANSPORT certificate-verification failure (bad CA,
+ * unverifiable chain, self-signed leaf, expired/not-yet-valid cert, or a SAN /
+ * hostname mismatch). These are terminal trust-mismatch — a restart never fixes a
+ * wrong cert. `CERT_*` covers the OpenSSL verify family (CERT_HAS_EXPIRED,
+ * CERT_NOT_YET_VALID, CERT_REVOKED, …); `ERR_TLS_CERT*` covers Node's SAN check.
+ */
+function isPinnedTransportTrustFailure(code) {
+    if (!code)
+        return false;
+    return (code.startsWith('CERT_') ||
+        code.startsWith('ERR_TLS_CERT') ||
+        TLS_TRUST_ERROR_CODES.has(code));
+}
+const trustCache = new Map();
+function serverDataDirectory() {
+    return resolve(process.env.BORG_SERVER_DATA_DIR ?? join(homedir(), '.borg', 'server'));
+}
+async function readTrustFile(path) {
+    let handle;
+    try {
+        handle = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            throw new Error('Borg server trust files were not found');
+        }
+        throw new Error('Borg server trust files could not be opened safely');
+    }
+    try {
+        const metadata = await handle.stat();
+        if (!metadata.isFile() || (metadata.mode & 0o077) !== 0) {
+            throw new Error('Borg server trust files must be private regular files');
+        }
+        if (typeof process.getuid === 'function' && metadata.uid !== process.getuid()) {
+            throw new Error('Borg server trust files must be owned by the current user');
+        }
+        return await handle.readFile('utf8');
+    }
+    finally {
+        await handle.close();
+    }
+}
+function decodeTrustConfig(value) {
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        throw new Error('Borg server trust metadata is invalid');
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error('Borg server trust metadata is invalid');
+    }
+    const fingerprint = parsed.ca_spki_sha256;
+    if (typeof fingerprint !== 'string' || !/^[a-f0-9]{64}$/i.test(fingerprint)) {
+        throw new Error('Borg server trust metadata is missing a valid CA identity');
+    }
+    return { ca_spki_sha256: fingerprint.toLowerCase() };
+}
+function verifyCaIdentity(certificate, expected) {
+    let parsed;
+    try {
+        parsed = new X509Certificate(certificate);
+    }
+    catch {
+        throw new Error('Borg server CA certificate is invalid');
+    }
+    if (!parsed.ca)
+        throw new Error('Borg server trust anchor is not a CA certificate');
+    const actual = createHash('sha256')
+        .update(parsed.publicKey.export({ type: 'spki', format: 'der' }))
+        .digest();
+    const expectedBytes = Buffer.from(expected, 'hex');
+    if (expectedBytes.length !== actual.length || !timingSafeEqual(actual, expectedBytes)) {
+        throw new Error('Borg server CA certificate does not match its pinned identity');
+    }
+    return `spki-sha256:${actual.toString('hex')}`;
+}
+function responseHeaders(rawHeaders) {
+    const headers = new Headers();
+    for (let index = 0; index < rawHeaders.length; index += 2) {
+        const name = rawHeaders[index];
+        const value = rawHeaders[index + 1];
+        if (name !== undefined && value !== undefined)
+            headers.append(name, value);
+    }
+    return headers;
+}
+function requestBody(value) {
+    if (value === null || value === undefined)
+        return undefined;
+    if (typeof value === 'string')
+        return value;
+    if (value instanceof Uint8Array)
+        return value;
+    if (value instanceof ArrayBuffer)
+        return new Uint8Array(value);
+    throw new Error('Borg server transport received an unsupported request body');
+}
+/**
+ * Minimal fetch-compatible HTTPS transport bound to one origin and one
+ * explicit local CA. Node's global fetch cannot consume the server-owned CA,
+ * and disabling certificate validation would collapse the authority boundary.
+ */
+export function createPinnedServerFetch(origin, caCertificate) {
+    const authority = new URL(origin);
+    if (authority.protocol !== 'https:' || authority.origin !== origin) {
+        throw new Error('Borg server trust requires a canonical HTTPS origin');
+    }
+    return (async (input, init = {}) => {
+        const url = input instanceof Request ? new URL(input.url) : new URL(input.toString());
+        if (url.origin !== authority.origin || url.protocol !== 'https:') {
+            throw new Error('Borg server transport refused a cross-authority request');
+        }
+        if (input instanceof Request) {
+            throw new Error('Borg server transport requires an explicit URL and request options');
+        }
+        if (init.signal?.aborted)
+            throw new DOMException('This operation was aborted', 'AbortError');
+        const body = requestBody(init.body);
+        const headers = new Headers(init.headers);
+        return await new Promise((resolvePromise, rejectPromise) => {
+            const request = httpsRequest({
+                protocol: 'https:',
+                hostname: url.hostname.replace(/^\[(.*)\]$/, '$1'),
+                port: url.port || 443,
+                path: `${url.pathname}${url.search}`,
+                method: init.method ?? 'GET',
+                headers: Object.fromEntries(headers.entries()),
+                ca: caCertificate,
+                rejectUnauthorized: true,
+                minVersion: 'TLSv1.3',
+            }, (incoming) => {
+                const status = incoming.statusCode ?? 500;
+                if (init.redirect === 'error' && status >= 300 && status < 400) {
+                    incoming.resume();
+                    rejectPromise(new Error('Borg server redirect refused'));
+                    return;
+                }
+                const noBody = init.method === 'HEAD' || status === 204 || status === 304;
+                const stream = noBody
+                    ? null
+                    : Readable.toWeb(incoming);
+                if (noBody)
+                    incoming.resume();
+                resolvePromise(new Response(stream, {
+                    status,
+                    statusText: incoming.statusMessage,
+                    headers: responseHeaders(incoming.rawHeaders),
+                }));
+            });
+            const abort = () => {
+                request.destroy(new DOMException('This operation was aborted', 'AbortError'));
+            };
+            init.signal?.addEventListener('abort', abort, { once: true });
+            request.once('close', () => init.signal?.removeEventListener('abort', abort));
+            request.once('error', (error) => {
+                // CR5: a pinned-transport CERT/CA/SAN verification failure is TERMINAL trust
+                // — type it as BorgServerTrustError so the seat probe returns `trust-mismatch`
+                // (never `indeterminate` → "restart"). Connection refusal/reset/timeout carry
+                // a transport errno (or an AbortError) and are rethrown RAW so the probe
+                // classifies them as `unreachable`.
+                const code = error.code;
+                if (isPinnedTransportTrustFailure(code)) {
+                    rejectPromise(new BorgServerTrustError(`Borg server presented a certificate that failed pinned verification (${code})`));
+                    return;
+                }
+                rejectPromise(error);
+            });
+            if (body !== undefined)
+                request.write(body);
+            request.end();
+        });
+    });
+}
+export async function loadBorgServerTrust(origin, dataDirectory = serverDataDirectory()) {
+    const key = `${dataDirectory}\0${origin}`;
+    let pending = trustCache.get(key);
+    if (!pending) {
+        pending = (async () => {
+            const [certificate, configText] = await Promise.all([
+                readTrustFile(join(dataDirectory, 'ca.crt')),
+                readTrustFile(join(dataDirectory, 'server.json')),
+            ]);
+            const config = decodeTrustConfig(configText);
+            const identity = verifyCaIdentity(certificate, config.ca_spki_sha256);
+            return {
+                identity,
+                fetchImpl: createPinnedServerFetch(origin, certificate),
+            };
+        })();
+        trustCache.set(key, pending);
+        pending.catch(() => trustCache.delete(key));
+    }
+    return pending;
+}
+export function __clearServerTrustCacheForTest() {
+    trustCache.clear();
+}
+//# sourceMappingURL=server-trust.js.map

package/dist/server-trust.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-trust.js","sourceRoot":"","sources":["../src/server-trust.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3E,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,gFAAgF;AAChF,kFAAkF;AAClF,gFAAgF;AAChF,iFAAiF;AACjF,mFAAmF;AACnF,MAAM,qBAAqB,GAAG,IAAI,GAAG,CAAC;IACpC,6BAA6B;IAC7B,2BAA2B;IAC3B,2BAA2B;IAC3B,mCAAmC;IACnC,iCAAiC;IACjC,gBAAgB;IAChB,qBAAqB;IACrB,mBAAmB;IACnB,8BAA8B;CAC/B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,SAAS,6BAA6B,CAAC,IAAwB;IAC7D,IAAI,CAAC,IAAI;QAAE,OAAO,KAAK,CAAC;IACxB,OAAO,CACL,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QACxB,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAC/B,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,CAChC,CAAC;AACJ,CAAC;AAaD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAoC,CAAC;AAE/D,SAAS,mBAAmB;IAC1B,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAY;IACvC,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACvE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,QAAQ,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAa;IACtC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,WAAW,GAAI,MAAkC,CAAC,cAAc,CAAC;IACvE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,WAAW,CAAC,WAAW,EAAE,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,WAAmB,EAAE,QAAgB;IAC7D,IAAI,MAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,eAAe,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACpF,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SAChC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;SAChE,MAAM,EAAE,CAAC;IACZ,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACnD,IAAI,aAAa,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,CAAC;QACtF,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,eAAe,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAS,eAAe,CAAC,UAAoB;IAC3C,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC7E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,UAAU;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,KAAK,YAAY,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC/D,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,MAAc,EAAE,aAAqB;IAC3E,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,KAAK,EAAE,KAA6B,EAAE,OAAoB,EAAE,EAAqB,EAAE;QACzF,MAAM,GAAG,GAAG,KAAK,YAAY,OAAO,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;QACtF,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;QACxF,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC;QAE7F,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,MAAM,IAAI,OAAO,CAAW,CAAC,cAAc,EAAE,aAAa,EAAE,EAAE;YACnE,MAAM,OAAO,GAAG,YAAY,CAAC;gBAC3B,QAAQ,EAAE,QAAQ;gBAClB,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,CAAC;gBAClD,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG;gBACrB,IAAI,EAAE,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,EAAE;gBACpC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;gBAC5B,OAAO,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAC9C,EAAE,EAAE,aAAa;gBACjB,kBAAkB,EAAE,IAAI;gBACxB,UAAU,EAAE,SAAS;aACtB,EAAE,CAAC,QAAQ,EAAE,EAAE;gBACd,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,IAAI,GAAG,CAAC;gBAC1C,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;oBAC/D,QAAQ,CAAC,MAAM,EAAE,CAAC;oBAClB,aAAa,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;oBACzD,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;gBAC1E,MAAM,MAAM,GAAG,MAAM;oBACnB,CAAC,CAAC,IAAI;oBACN,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;gBAC3D,IAAI,MAAM;oBAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;gBAC9B,cAAc,CAAC,IAAI,QAAQ,CAAC,MAAM,EAAE;oBAClC,MAAM;oBACN,UAAU,EAAE,QAAQ,CAAC,aAAa;oBAClC,OAAO,EAAE,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;iBAC9C,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,CAAC;YAEH,MAAM,KAAK,GAAG,GAAS,EAAE;gBACvB,OAAO,CAAC,OAAO,CAAC,IAAI,YAAY,CAAC,4BAA4B,EAAE,YAAY,CAAC,CAAC,CAAC;YAChF,CAAC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;YAC9E,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC9B,6EAA6E;gBAC7E,+EAA+E;gBAC/E,8EAA8E;gBAC9E,yEAAyE;gBACzE,oCAAoC;gBACpC,MAAM,IAAI,GAAI,KAA+B,CAAC,IAAI,CAAC;gBACnD,IAAI,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;oBACxC,aAAa,CACX,IAAI,oBAAoB,CACtB,wEAAwE,IAAI,GAAG,CAChF,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;gBACD,aAAa,CAAC,KAAK,CAAC,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,IAAI,IAAI,KAAK,SAAS;gBAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC5C,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAgB,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAc,EACd,aAAa,GAAG,mBAAmB,EAAE;IAErC,MAAM,GAAG,GAAG,GAAG,aAAa,KAAK,MAAM,EAAE,CAAC;IAC1C,IAAI,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE;YACpB,MAAM,CAAC,WAAW,EAAE,UAAU,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAClD,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;gBAC5C,aAAa,CAAC,IAAI,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC;aAClD,CAAC,CAAC;YACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAC7C,MAAM,QAAQ,GAAG,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;YACtE,OAAO;gBACL,QAAQ;gBACR,SAAS,EAAE,uBAAuB,CAAC,MAAM,EAAE,WAAW,CAAC;aACxD,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;QACL,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,UAAU,CAAC,KAAK,EAAE,CAAC;AACrB,CAAC"}

package/dist/setup-confirm.d.ts

@@ -12,8 +12,8 @@
  *
  * SECURITY (SR-light, gh#818 221c43df): the disclosure lists file PATHS +
  * at most the PUBLIC `BORG_API_URL` — there is NO token/secret in the
- * written config to echo. Tokens live in the AES-256-GCM keychain, and
- * Step-1 runs BEFORE OAuth, so at mutation time no token even exists.
+ * written config to echo. Local credentials live in the local 0600-permission
+ * seat store, and the written config never contains a token or secret.
  */
 export interface ConfigMutationTarget {
     /** Human-readable config file path (tilde form). */
@@ -77,7 +77,7 @@ export declare function parseYesFlag(argv: string[]): boolean;
  *
  * The disclosure + confirm prompt exists to obtain informed consent for the
  * config writes Step-1 performs (gh#818). On a pure refresh — the normal
- * OAuth-refresh re-run where every DETECTED agent CLI already has the full
+ * setup re-run where every DETECTED agent CLI already has the full
  * borg setup (MCP server registered AND every hook write already applied) —
  * there is no mutation to consent to, so the prompt is redundant and skipped.
  *

package/dist/setup-confirm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-confirm.d.ts","sourceRoot":"","sources":["../src/setup-confirm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,WAAW,oBAAoB;IACnC,oDAAoD;IACpD,IAAI,EAAE,MAAM,CAAC;IACb,2BAA2B;IAC3B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB,GAAG,oBAAoB,EAAE,CA6BzB;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,oBAAoB,EAAE,GAC9B,MAAM,CAUR;AAED,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,OAAO,CAAC;AAElD,MAAM,WAAW,yBAAyB;IACxC,sCAAsC;IACtC,KAAK,EAAE,OAAO,CAAC;IACf,sCAAsC;IACtC,GAAG,EAAE,OAAO,CAAC;IACb;;;;OAIG;IACH,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACjC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,eAAe,CAAC,CAK1B;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAEpD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;IAClB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,kBAAkB,EAAE,OAAO,CAAC;IAC5B,qBAAqB,EAAE,OAAO,CAAC;IAC/B,iBAAiB,EAAE,OAAO,CAAC;IAC3B,gBAAgB,EAAE,OAAO,CAAC;CAC3B,GAAG,OAAO,CAMV"}

package/dist/setup-confirm.js

@@ -1,2 +1,126 @@
-function r(e){const o=[];return e.claude&&(o.push({file:"~/.claude.json",change:"registers the borg MCP server"}),o.push({file:"~/.claude/settings.json",change:"adds a UserPromptSubmit hook"})),e.codex&&(o.push({file:"~/.codex/config.toml",change:"registers the borg MCP server"}),o.push({file:"~/.codex/hooks.json",change:"adds SessionStart + UserPromptSubmit hooks"})),e.opencode&&o.push({file:"~/.config/opencode/opencode.json",change:"registers the borg MCP server (with BORG_SESSION activation)"}),o}function t(e){const o=[];o.push("borg setup will register the borg MCP server in your agent config:");for(const n of e)o.push(`  \u2022 ${n.file}  (${n.change})`);return o.push('These changes are additive and reversible \u2014 remove the "borg" entries to undo.'),o.join(`
-`)}async function i(e){return!e.isTTY||e.yes||await e.confirm()?"proceed":"abort"}function c(e){return e.includes("--yes")||e.includes("-y")}function s(e){return e.claude&&(!e.claudeMcpConfigured||e.claudeHookPending)||e.codex&&(!e.codexMcpConfigured||e.codexHookPending)||e.opencode&&!e.opencodeMcpConfigured}export{r as configMutationTargets,i as confirmConfigMutation,t as formatConfigMutationDisclosure,c as parseYesFlag,s as setupMutationPending};
+/**
+ * gh#818 P3 — disclose + confirm the `borg setup` global-config mutation.
+ *
+ * Step-1 of the setup wizard writes the user's GLOBAL agent config
+ * (registers the borg MCP server + hooks). Before gh#818 this happened
+ * silently on first run. This module adds informed-consent disclosure:
+ * it lists WHICH files will be written (well-known `os.homedir()` paths)
+ * and asks to continue before the first mutation.
+ *
+ * Pure / dep-injected (mirrors `resolveCliChoice` + `setup-action.ts`) so
+ * the decision is unit-testable without spawning a prompt or touching argv.
+ *
+ * SECURITY (SR-light, gh#818 221c43df): the disclosure lists file PATHS +
+ * at most the PUBLIC `BORG_API_URL` — there is NO token/secret in the
+ * written config to echo. Local credentials live in the local 0600-permission
+ * seat store, and the written config never contains a token or secret.
+ */
+/**
+ * The set of global config files Step-1 writes, scoped to the detected
+ * agent CLIs. Paths mirror `config-utils.ts`:
+ *   Claude Code: ~/.claude.json (MCP server) + ~/.claude/settings.json (hook)
+ *   Codex:       ~/.codex/config.toml (MCP server) + ~/.codex/hooks.json (hooks)
+ *   OpenCode:    ~/.config/opencode/opencode.json (MCP server)
+ */
+export function configMutationTargets(deps) {
+    const targets = [];
+    if (deps.claude) {
+        targets.push({
+            file: '~/.claude.json',
+            change: 'registers the borg MCP server',
+        });
+        targets.push({
+            file: '~/.claude/settings.json',
+            change: 'adds a UserPromptSubmit hook',
+        });
+    }
+    if (deps.codex) {
+        targets.push({
+            file: '~/.codex/config.toml',
+            change: 'registers the borg MCP server',
+        });
+        targets.push({
+            file: '~/.codex/hooks.json',
+            change: 'adds SessionStart + UserPromptSubmit hooks',
+        });
+    }
+    if (deps.opencode) {
+        targets.push({
+            file: '~/.config/opencode/opencode.json',
+            change: 'registers the borg MCP server (with BORG_SESSION activation)',
+        });
+    }
+    return targets;
+}
+/**
+ * Disclosure text: the files Step-1 will write + an undo note. Pure so SR
+ * can pin "lists paths only, no secret". Lists the public `BORG_API_URL`
+ * only by reference (the MCP-server registration env), never a credential.
+ */
+export function formatConfigMutationDisclosure(targets) {
+    const lines = [];
+    lines.push('borg setup will register the borg MCP server in your agent config:');
+    for (const t of targets) {
+        lines.push(`  • ${t.file}  (${t.change})`);
+    }
+    lines.push('These changes are additive and reversible — remove the "borg" entries to undo.');
+    return lines.join('\n');
+}
+/**
+ * Decide whether to proceed with the Step-1 config mutation.
+ *
+ * The six CR-binding build-gate items (gh#818, 3b3e85a5) live here:
+ *   1. (THE load-bearing headless no-regress) non-TTY → 'proceed' WITHOUT
+ *      prompting. We return before touching `confirm`, so a non-TTY run
+ *      (CI / pipe / headless) never reads stdin → no hang.
+ *   2. `--yes`/`-y` → 'proceed' without prompting (scripted-but-TTY +
+ *      explicit non-interactive). No collision with --no-browser/--device.
+ *   3. TTY + interactive → ask; decline → 'abort' (the caller exits BEFORE
+ *      any write).
+ *   6. This dep-injected shape IS the testable seam.
+ */
+export async function confirmConfigMutation(deps) {
+    if (!deps.isTTY)
+        return 'proceed'; // item 1 — never block on stdin
+    if (deps.yes)
+        return 'proceed'; // item 2 — explicit bypass
+    const ok = await deps.confirm(); // item 3 — interactive consent
+    return ok ? 'proceed' : 'abort';
+}
+/**
+ * Scan argv for the `--yes` / `-y` bypass. Kept separate so the flag set
+ * is pinned in tests (item 2 — no collision with the existing
+ * --no-browser/--device scan in setup.ts).
+ */
+export function parseYesFlag(argv) {
+    return argv.includes('--yes') || argv.includes('-y');
+}
+/**
+ * gh#844 — whether Step-1 has ANY config mutation worth disclosing.
+ *
+ * The disclosure + confirm prompt exists to obtain informed consent for the
+ * config writes Step-1 performs (gh#818). On a pure refresh — the normal
+ * setup re-run where every DETECTED agent CLI already has the full
+ * borg setup (MCP server registered AND every hook write already applied) —
+ * there is no mutation to consent to, so the prompt is redundant and skipped.
+ *
+ * CRITICAL (gh#844 SR finding 8d9c732e): the gate must cover the FULL disclosed
+ * mutation set — MCP registration AND every hook write (claude UserPromptSubmit
+ * + the legacy SessionStart removal; codex SessionStart + UserPromptSubmit) —
+ * not MCP registration alone. Otherwise an MCP-configured user with a pending
+ * hook write (e.g. a pre-gh#673 upgrader whose legacy global hook must be
+ * removed) would have settings.json mutated with consent silently skipped.
+ * Caller derives `claudeHookPending`/`codexHookPending` from the SAME peeks
+ * that gate the individual writers, so the gate and the writers cannot drift.
+ *
+ * Scoped to DETECTED CLIs: a claude-only user is never gated on codex config
+ * state (and vice-versa). A naive `!isMcpServerConfigured() ||
+ * !isCodexMcpServerConfigured()` gate would mis-fire for single-CLI users —
+ * the absent CLI's config is unconfigured, so the OR would always be true.
+ */
+export function setupMutationPending(deps) {
+    return ((deps.claude && (!deps.claudeMcpConfigured || deps.claudeHookPending)) ||
+        (deps.codex && (!deps.codexMcpConfigured || deps.codexHookPending)) ||
+        (deps.opencode && !deps.opencodeMcpConfigured));
+}
+//# sourceMappingURL=setup-confirm.js.map

package/dist/setup-confirm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-confirm.js","sourceRoot":"","sources":["../src/setup-confirm.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAIrC;IACC,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QAChB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,yBAAyB;YAC/B,MAAM,EAAE,8BAA8B;SACvC,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,sBAAsB;YAC5B,MAAM,EAAE,+BAA+B;SACxC,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,qBAAqB;YAC3B,MAAM,EAAE,4CAA4C;SACrD,CAAC,CAAC;IACL,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,kCAAkC;YACxC,MAAM,EAAE,8DAA8D;SACvE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAA+B;IAE/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,CAAC,IAAI,CAAC,oEAAoE,CAAC,CAAC;IACjF,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,CAAC,IAAI,CACR,gFAAgF,CACjF,CAAC;IACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAiBD;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA+B;IAE/B,IAAI,CAAC,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC,CAAC,gCAAgC;IACnE,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC,CAAC,2BAA2B;IAC3D,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,+BAA+B;IAChE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAAc;IACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACvD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,UAAU,oBAAoB,CAAC,IASpC;IACC,OAAO,CACL,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,mBAAmB,IAAI,IAAI,CAAC,iBAAiB,CAAC,CAAC;QACtE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACnE,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAC/C,CAAC;AACJ,CAAC"}

package/dist/setup.d.ts

@@ -3,9 +3,11 @@
  * Borg MCP Setup Wizard
  *
  * Interactive setup flow:
- * 1. Configure Claude Code MCP settings
- * 2. Google OAuth authentication
- * 3. Subscription setup (web dashboard or Stripe)
+ * 1. Configure agent CLI MCP settings + orientation hooks
+ * 2. Print how to connect to a local self-hosted Borg server
+ *
+ * There is no cloud authority: setup offers/executes NO cloud auth, Google
+ * auth, subscription, or checkout.
  */
 export {};
 //# sourceMappingURL=setup.d.ts.map

package/dist/setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.d.ts","sourceRoot":"","sources":["../src/setup.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG"}