codehere 1.0.1 → 1.0.3

package/dist/infrastructure/hooks/audit-tip-signature.js

@@ -1,336 +0,0 @@
-/**
- * R2 · sign the live audit-chain TIP with the machine's persisted ed25519 key.
- *
- * The hash chain catches a NAIVE edit, but a determined attacker can edit a
- * mid-chain entry and RE-WALK every later hash to produce a chain that verifies
- * green (`computeEntryHash` is public). Signing the tip closes that for anyone
- * who verifies with the public key: a re-walk changes the hash of the SIGNED
- * entry, so the stored signature — made with a key the tamperer doesn't hold —
- * no longer matches. Truncation below the signed point likewise fails.
- *
- * VERIFICATION IS AN ANCESTOR CHECK, not a tip-equality check (devil's-advocate
- * audit 2026-06-09 caught the original tip-equality version false-alarming
- * "tampered" on honest chains): the chain appends CONTINUOUSLY (every tool call,
- * spawns, overrides) while signing happens at session completion — so the signed
- * entry is usually an ANCESTOR of the live tip, and that is honest. Verification
- * asserts the signed (seq, entryHash) still exists UNMODIFIED at that seq.
- * Entries appended after the most recent signing are not yet covered — they're
- * covered by the next completion's signature. The protected prefix only ever
- * grows.
- *
- * `rm <audit>.tipsig` bypass (same audit): once a chain has EVER been signed, a
- * missing signature file must BLOCK — otherwise the forger just deletes the
- * sidecar. Sign-state lives in the keystore dir (`keys/audit-sign-state.json`),
- * separate from the audit file, so an attacker who deletes the sidecar but not
- * the keystore is caught. NOTE: sign-state is LOCAL-ONLY and path-keyed — it does
- * NOT travel with an exported chain, so deleted-sidecar detection only works on
- * the machine that signed; an exported/shared chain carries its `.tipsig` but a
- * recipient can't tell it was ever signed if the sidecar is stripped. (An
- * owner-level attacker who can also rewrite the keystore defeats this entirely —
- * see HONEST SCOPE; the real fix is R1's daemon-held key + R3's external anchor.)
- *
- * R1 DOES NOT CLOSE THE OWNER GAP — evaluated 2026-08-08. A daemon-held key is
- * still reachable by the owner, because the daemon runs as the owner. R1 raises
- * the cost of the attack; it does not change who can defeat it. Only an EXTERNAL
- * anchor does, and that collides head-on with local-first + zero telemetry: an
- * anchor has to be outside the machine to be an anchor. Those two values are in
- * direct tension and no amount of local cryptography resolves it.
- *
- * THE ANCHOR THAT FITS, and it needs no service of ours: the user's own git
- * remote. `git notes --ref=codehere-audit` on HEAD carries the signed tip, and
- * nothing leaves the machine until the USER pushes — which they were doing
- * anyway. Proven end-to-end 2026-08-08 in a throwaway repo:
- *   · the commit SHA is unchanged and the working tree stays clean (non-invasive)
- *   · a history rewrite ORPHANS the note, so the rewrite is visible
- *   · after the owner deletes the note locally, the REMOTE still holds it and a
- *     reviewer can fetch it back and read the original tip hash
- *   · erasing the remote copy needs an explicit destructive push, which shows up
- *     in host audit logs / branch protection / anyone who already fetched
- * So it converts "silently forgeable by the owner" into "forgeable only by a
- * visible act on a third party the owner does not solely control" — the same
- * standard a signed git commit gets, no more and no less. It is NOT
- * cryptographic owner-proofing; nothing local-first can be. Known costs:
- * refs/notes are not pushed by default (needs a refspec), and a user who never
- * pushes has no witness. It also lands exactly on the PR surface.
- * NOT BUILT — this is the evaluation, not the feature.
- *
- * HONEST SCOPE: this defends against a 3RD PARTY (or the owner sharing an export)
- * editing the chain after it was signed. It does NOT defend against the agent or
- * owner who CAN reach the signing key + keystore and re-sign / rewrite sign-state
- * — that needs a daemon-held key the agent can't reach (R1) + an external anchor
- * (R3). SIGNATURE-ORACLE limit (R1.3): a signature attests the daemon
- * RECORDED the entry — never that the described tool call actually happened
- * (any local process can POST an honest-shaped entry). Surface wording must
- * stay "recorded-by-daemon"-shaped. The tip signature also TRANSITIVELY
- * notarizes the whole prefix — including hook-direct entries and any
- * well-chained same-uid direct append (even one carrying a forged
- * writer:'daemon'; the endpoint's rejection binds only endpoint callers).
- * Until R3 the honest words remain
- * "integrity-checked" + "signed at
- * write-time".
- *
- * Deliberately standalone (reads the chain from the file itself) so the audit
- * hot-path in claude-sdk-hook.ts never has to import the signing stack — keeps
- * the dependency graph acyclic.
- */
-import { existsSync, readFileSync, writeFileSync, chmodSync, mkdirSync, openSync, fstatSync, readSync, closeSync, renameSync, } from 'fs';
-import { join } from 'path';
-import { sign as edSign, verify as edVerify } from 'crypto';
-import { loadOrCreateKeypair, keysDir } from '../orchestration/thread-key-store.js';
-import { exportPublicPem, importPublicPem, publicKeyToBase64, } from '../../application/use-cases/thread-export.js';
-/** Read the audit chain's current tip (last real line's seq + entryHash).
- *  TAIL-READ (last 64KB), not a full-file read: sign-at-write (R1.3) calls
- *  this per daemon append on a file with no rotation — a full read is O(N)
- *  on the daemon event loop, measured 4-5ms on a 6.4MB chain vs 0.2ms for
- *  the tail (refuter B2). The tip is by definition in the tail. */
-export function readAuditTip(auditFile) {
-    if (!existsSync(auditFile))
-        return null;
-    try {
-        const fd = openSync(auditFile, 'r');
-        let text;
-        try {
-            const size = fstatSync(fd).size;
-            const start = Math.max(0, size - 65536);
-            const buf = Buffer.alloc(size - start);
-            readSync(fd, buf, 0, buf.length, start);
-            text = buf.toString('utf-8');
-            if (start > 0)
-                text = text.slice(text.indexOf('\n') + 1); // drop partial first line
-        }
-        finally {
-            closeSync(fd);
-        }
-        const lines = text.trimEnd().split('\n');
-        for (let i = lines.length - 1; i >= 0; i--) {
-            const line = lines[i].trim();
-            if (!line)
-                continue;
-            const e = JSON.parse(line);
-            if (typeof e.seq === 'number' && typeof e.entryHash === 'string') {
-                return { seq: e.seq, entryHash: e.entryHash };
-            }
-            return null; // last real line is a pre-chain legacy entry → no tip to sign
-        }
-    }
-    catch {
-        /* unreadable / malformed → no tip */
-    }
-    return null;
-}
-/** Read the entry hash recorded at a given seq, or null if no such entry. */
-function readEntryHashAtSeq(auditFile, seq) {
-    if (!existsSync(auditFile))
-        return null;
-    try {
-        for (const line of readFileSync(auditFile, 'utf-8').split('\n')) {
-            const t = line.trim();
-            if (!t)
-                continue;
-            const e = JSON.parse(t);
-            if (e.seq === seq && typeof e.entryHash === 'string')
-                return e.entryHash;
-        }
-    }
-    catch {
-        /* malformed line mid-file → treat as not found (the chain verifier reports it) */
-    }
-    return null;
-}
-function tipSigPath(auditFile) {
-    return auditFile + '.tipsig';
-}
-function tipMessage(tip) {
-    return Buffer.from(`${tip.seq}:${tip.entryHash}`, 'utf-8');
-}
-function signStatePath() {
-    return join(keysDir(), 'audit-sign-state.json');
-}
-function loadSignState() {
-    try {
-        const raw = JSON.parse(readFileSync(signStatePath(), 'utf-8'));
-        if (raw && raw.schema === 1 && typeof raw.files === 'object')
-            return raw;
-    }
-    catch {
-        /* missing/corrupt → empty */
-    }
-    return { schema: 1, files: {} };
-}
-function recordSignState(auditFile, seq, signedAt) {
-    try {
-        mkdirSync(keysDir(), { recursive: true });
-        const state = loadSignState();
-        state.files[auditFile] = { seq, signedAt };
-        {
-            const tmpState = signStatePath() + '.tmp';
-            writeFileSync(tmpState, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
-            renameSync(tmpState, signStatePath());
-        }
-    }
-    catch {
-        /* best-effort — sign-state is a detection aid, never blocks signing */
-    }
-}
-/** Was this audit file ever signed (per the keystore's sign-state)? */
-export function chainWasSigned(auditFile) {
-    return !!loadSignState().files[auditFile];
-}
-/**
- * S9 · forget a chain's sign-state entry. ONLY for the mock practice chain:
- * the daemon wipes the mock chain at boot, and without pruning, the stale
- * sign-state key would flag the fresh chain as an rm-bypass (a false tamper
- * alarm in practice mode) while dead keys accumulate in the REAL keystore.
- * Never call this for a real chain — losing sign-state is losing detection.
- */
-export function pruneSignState(auditFile) {
-    try {
-        const state = loadSignState();
-        if (!state.files[auditFile])
-            return;
-        delete state.files[auditFile];
-        const tmpState = signStatePath() + '.tmp';
-        writeFileSync(tmpState, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
-        renameSync(tmpState, signStatePath());
-    }
-    catch {
-        /* best-effort — same contract as recordSignState */
-    }
-}
-// Cache the keypair per-process — loadOrCreateKeypair does disk I/O each call,
-// and signing happens repeatedly in a long-lived daemon.
-let cachedKeys = null;
-function keys() {
-    return (cachedKeys ??= loadOrCreateKeypair());
-}
-/**
- * Sign the current chain tip, writing `<auditFile>.tipsig` + recording
- * sign-state in the keystore. Best-effort: returns null (no-op) when there's
- * no chain yet. Never throws.
- */
-export function signAuditTip(auditFile, now = Date.now()) {
-    const tip = readAuditTip(auditFile);
-    if (!tip)
-        return null;
-    try {
-        const k = keys();
-        const sig = edSign(null, tipMessage(tip), k.privateKey).toString('base64');
-        const rec = {
-            schema: 1,
-            alg: 'ed25519',
-            seq: tip.seq,
-            entryHash: tip.entryHash,
-            sig,
-            pubPem: exportPublicPem(k.publicKey),
-            signedAt: now,
-        };
-        // Atomic (tmp+rename): per-write signing multiplies rewrite frequency
-        // ~1000x vs per-session — a crash mid-write must not leave a corrupt
-        // .tipsig that fails honest verification (refuter N1).
-        const tmpSig = tipSigPath(auditFile) + '.tmp';
-        writeFileSync(tmpSig, JSON.stringify(rec) + '\n', { mode: 0o600 });
-        renameSync(tmpSig, tipSigPath(auditFile));
-        try {
-            chmodSync(tipSigPath(auditFile), 0o600);
-        }
-        catch {
-            /* perms best-effort */
-        }
-        recordSignState(auditFile, tip.seq, now);
-        return rec;
-    }
-    catch {
-        return null; // signing must never break the path that called it
-    }
-}
-/**
- * Verify the tip signature against the chain. The signed (seq, entryHash) must
- * still be an UNMODIFIED ancestor of the current chain — appends since signing
- * are honest and expected (signing happens at session completion; the chain
- * grows continuously between completions). Pass `trustedKeys` to also check the
- * signer is known.
- */
-export function verifyAuditTip(auditFile, trustedKeys) {
-    const base = {
-        present: false,
-        expectedButMissing: false,
-        signatureValid: false,
-        ancestorIntact: false,
-        matchesTip: false,
-        trusted: false,
-        signerKeyB64: null,
-        reason: '',
-    };
-    if (!existsSync(tipSigPath(auditFile))) {
-        if (chainWasSigned(auditFile)) {
-            return {
-                ...base,
-                expectedButMissing: true,
-                reason: 'this chain was previously signed but the signature file is GONE — it may have been deleted to hide an edit',
-            };
-        }
-        return { ...base, reason: 'no tip signature on this chain' };
-    }
-    let rec;
-    try {
-        rec = JSON.parse(readFileSync(tipSigPath(auditFile), 'utf-8'));
-    }
-    catch {
-        return { ...base, present: true, reason: 'tip signature file is unreadable or corrupt' };
-    }
-    if (rec.alg !== 'ed25519' || typeof rec.entryHash !== 'string' || typeof rec.seq !== 'number') {
-        return { ...base, present: true, reason: 'tip signature is malformed' };
-    }
-    base.present = true;
-    let pub;
-    try {
-        pub = importPublicPem(rec.pubPem);
-    }
-    catch {
-        return { ...base, reason: 'tip signature carries an invalid public key' };
-    }
-    base.signerKeyB64 = publicKeyToBase64(pub);
-    base.trusted = !trustedKeys || trustedKeys.has(base.signerKeyB64);
-    try {
-        base.signatureValid = edVerify(null, tipMessage({ seq: rec.seq, entryHash: rec.entryHash }), pub, Buffer.from(rec.sig, 'base64'));
-    }
-    catch {
-        base.signatureValid = false;
-    }
-    const hashAtSeq = readEntryHashAtSeq(auditFile, rec.seq);
-    base.ancestorIntact = hashAtSeq !== null && hashAtSeq === rec.entryHash;
-    const tip = readAuditTip(auditFile);
-    base.matchesTip = !!tip && tip.seq === rec.seq && tip.entryHash === rec.entryHash;
-    if (!base.signatureValid)
-        base.reason = 'tip signature is invalid — forged or corrupt';
-    else if (!base.ancestorIntact)
-        base.reason =
-            'the signed entry is no longer intact in the chain — it was edited (re-walked) or truncated after signing';
-    else if (!base.trusted)
-        base.reason = 'chain is signed and intact, but by an untrusted key';
-    else if (base.matchesTip)
-        base.reason = "chain tip is signed and matches — no edits by anyone without this machine's key";
-    else
-        base.reason = `signed at seq ${rec.seq} · the chain has grown since · the signed prefix is intact`;
-    return base;
-}
-/**
- * Does the tip-signature state BLOCK verification? Blocks when:
- *  - sign-state says the chain was signed but the .tipsig is GONE (the
- *    delete-the-sidecar bypass), or
- *  - a signature is present but invalid, its signed entry is no longer an
- *    intact ancestor (edit/re-walk/truncation), or the signer is untrusted
- *    (an attacker re-signing a forgery with their OWN key would otherwise pass).
- * A never-signed chain does not block (pre-R2 chains stay valid). Kept pure —
- * this is the verdict the `audit verify` exit code depends on.
- */
-export function tipBlocksVerification(tip) {
-    if (tip.expectedButMissing)
-        return true;
-    return tip.present && (!tip.signatureValid || !tip.ancestorIntact || !tip.trusted);
-}
-/** Reset the per-process key cache (tests). */
-export function __resetTipKeyCache() {
-    cachedKeys = null;
-}
-//# sourceMappingURL=audit-tip-signature.js.map