codetrellis 0.0.0-stage → 0.2.0

package/src/backend/services/peer-audit-service.js

@@ -0,0 +1,123 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var peer_audit_service_exports = {};
+__export(peer_audit_service_exports, {
+  _resetAuditCache: () => _resetAuditCache,
+  flushAudit: () => flushAudit,
+  listPeerAudit: () => listPeerAudit,
+  recordPeerAudit: () => recordPeerAudit,
+  terminalAuditDetail: () => terminalAuditDetail
+});
+module.exports = __toCommonJS(peer_audit_service_exports);
+var import_node_fs = __toESM(require("node:fs"));
+var import_node_path = __toESM(require("node:path"));
+var import_persistence = require("./persistence");
+var import_retention = require("./retention");
+const MAX_ENTRIES = import_retention.DEVICE_LOG_CAP;
+function trimOld(all, now = Date.now()) {
+  const cutoff = (0, import_retention.retentionCutoff)(now);
+  if (cutoff !== null) {
+    const keepFrom = all.findIndex((e) => Date.parse(e.at) >= cutoff);
+    all.splice(0, keepFrom === -1 ? all.length : keepFrom);
+  }
+  if (all.length > MAX_ENTRIES) all.splice(0, all.length - MAX_ENTRIES);
+}
+let entries = null;
+let flushTimer = null;
+function auditPath() {
+  return import_node_path.default.join((0, import_persistence.getSettingsDir)(), "peer-audit.json");
+}
+function ensureLoaded() {
+  if (entries) return entries;
+  try {
+    const raw = JSON.parse(import_node_fs.default.readFileSync(auditPath(), "utf-8"));
+    entries = Array.isArray(raw) ? raw.slice(-MAX_ENTRIES) : [];
+    trimOld(entries);
+  } catch {
+    entries = [];
+  }
+  return entries;
+}
+function scheduleFlush() {
+  if (flushTimer) return;
+  flushTimer = setTimeout(() => {
+    flushTimer = null;
+    flushAudit();
+  }, 1e3);
+  if (typeof flushTimer === "object" && flushTimer && "unref" in flushTimer) {
+    flushTimer.unref();
+  }
+}
+function flushAudit() {
+  if (!entries) return;
+  try {
+    const dir = import_node_path.default.dirname(auditPath());
+    if (!import_node_fs.default.existsSync(dir)) import_node_fs.default.mkdirSync(dir, { recursive: true });
+    import_node_fs.default.writeFileSync(auditPath(), JSON.stringify(entries, null, 2), "utf-8");
+  } catch (err) {
+    console.warn("[PeerAudit] Failed to persist:", err);
+  }
+}
+function recordPeerAudit(entry) {
+  const all = ensureLoaded();
+  all.push({ at: (/* @__PURE__ */ new Date()).toISOString(), ...entry });
+  trimOld(all);
+  scheduleFlush();
+}
+function listPeerAudit(opts = {}) {
+  const all = ensureLoaded();
+  const filtered = opts.fingerprint ? all.filter((e) => e.fingerprint === opts.fingerprint) : all;
+  const limit = Math.min(Math.max(opts.limit ?? 200, 1), MAX_ENTRIES);
+  return filtered.slice(-limit).reverse();
+}
+function terminalAuditDetail(params) {
+  const id = params.terminalId ?? params.id;
+  if (typeof id === "string" && id) return `terminal ${sanitiseId(id)}`;
+  if (typeof params.index === "number" && Number.isFinite(params.index)) {
+    return `terminal #${params.index}`;
+  }
+  return void 0;
+}
+function sanitiseId(id) {
+  return id.replace(/[^A-Za-z0-9_-]/g, "").slice(0, 64);
+}
+function _resetAuditCache() {
+  entries = null;
+  if (flushTimer) {
+    clearTimeout(flushTimer);
+    flushTimer = null;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  _resetAuditCache,
+  flushAudit,
+  listPeerAudit,
+  recordPeerAudit,
+  terminalAuditDetail
+});

package/src/backend/services/peer-auth.js

@@ -0,0 +1,153 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var peer_auth_exports = {};
+__export(peer_auth_exports, {
+  CHALLENGE_TTL_MS: () => CHALLENGE_TTL_MS,
+  PeerAuthError: () => PeerAuthError,
+  canonicalChallenge: () => canonicalChallenge,
+  computeAnswerMac: () => computeAnswerMac,
+  computeChallengeMac: () => computeChallengeMac,
+  computeReconnectAnswerMac: () => computeReconnectAnswerMac,
+  computeReconnectOfferMac: () => computeReconnectOfferMac,
+  deriveConfirmationCode: () => deriveConfirmationCode,
+  generateSharedSecret: () => generateSharedSecret,
+  isUsableSecret: () => isUsableSecret,
+  issueChallenge: () => issueChallenge,
+  macsEqual: () => macsEqual,
+  outstandingChallengeCount: () => outstandingChallengeCount,
+  resetChallenges: () => resetChallenges,
+  verifyChallengeResponse: () => verifyChallengeResponse
+});
+module.exports = __toCommonJS(peer_auth_exports);
+var import_node_crypto = require("node:crypto");
+const CHALLENGE_TTL_MS = 3e4;
+const MAX_OUTSTANDING = 256;
+const SECRET_BYTES = 32;
+const NONCE_BYTES = 32;
+class PeerAuthError extends Error {
+  code = "EPEER_AUTH";
+  constructor(message) {
+    super(message);
+    this.name = "PeerAuthError";
+  }
+}
+function generateSharedSecret() {
+  return (0, import_node_crypto.randomBytes)(SECRET_BYTES).toString("hex");
+}
+function isUsableSecret(secret) {
+  return typeof secret === "string" && /^[0-9a-f]{64,}$/i.test(secret);
+}
+function canonicalChallenge(pairingId, nonce, expiresAt) {
+  return ["ct-peer-auth:v1", pairingId, nonce, String(expiresAt)].join("\n");
+}
+function computeChallengeMac(secretHex, pairingId, nonce, expiresAt) {
+  if (!isUsableSecret(secretHex)) {
+    throw new PeerAuthError("No usable pairing secret \u2014 the device must be paired again");
+  }
+  return (0, import_node_crypto.createHmac)("sha256", Buffer.from(secretHex, "hex")).update(canonicalChallenge(pairingId, nonce, expiresAt)).digest("hex");
+}
+function macsEqual(a, b) {
+  if (typeof a !== "string" || typeof b !== "string") return false;
+  if (a.length !== b.length || a.length === 0) return false;
+  try {
+    return (0, import_node_crypto.timingSafeEqual)(Buffer.from(a, "utf-8"), Buffer.from(b, "utf-8"));
+  } catch {
+    return false;
+  }
+}
+function computeAnswerMac(code, nonce, fingerprint) {
+  const normalised = String(fingerprint ?? "").replace(/[^0-9A-Fa-f]/g, "").toUpperCase();
+  return (0, import_node_crypto.createHmac)("sha256", Buffer.from(String(code), "utf-8")).update(["ct-pair:v5", nonce, normalised].join("\n")).digest("hex");
+}
+function computeReconnectOfferMac(secretHex, pairingId, challengeNonce, fingerprint) {
+  if (!isUsableSecret(secretHex)) {
+    throw new PeerAuthError("No usable pairing secret \u2014 the device must be paired again");
+  }
+  const normalised = String(fingerprint ?? "").replace(/[^0-9A-Fa-f]/g, "").toUpperCase();
+  return (0, import_node_crypto.createHmac)("sha256", Buffer.from(secretHex, "hex")).update(["ct-reconnect-offer:v1", pairingId, challengeNonce, normalised].join("\n")).digest("hex");
+}
+function computeReconnectAnswerMac(secretHex, pairingId, nonce, fingerprint) {
+  if (!isUsableSecret(secretHex)) {
+    throw new PeerAuthError("No usable pairing secret \u2014 the device must be paired again");
+  }
+  const normalised = String(fingerprint ?? "").replace(/[^0-9A-Fa-f]/g, "").toUpperCase();
+  return (0, import_node_crypto.createHmac)("sha256", Buffer.from(secretHex, "hex")).update(["ct-reconnect-answer:v1", pairingId, nonce, normalised].join("\n")).digest("hex");
+}
+const outstanding = /* @__PURE__ */ new Map();
+function purgeExpired(now) {
+  for (const [nonce, c] of outstanding) {
+    if (c.expiresAt <= now) outstanding.delete(nonce);
+  }
+}
+function issueChallenge(pairingId, now = Date.now()) {
+  purgeExpired(now);
+  while (outstanding.size >= MAX_OUTSTANDING) {
+    const oldest = outstanding.keys().next();
+    if (oldest.done) break;
+    outstanding.delete(oldest.value);
+  }
+  const nonce = (0, import_node_crypto.randomBytes)(NONCE_BYTES).toString("hex");
+  const expiresAt = now + CHALLENGE_TTL_MS;
+  outstanding.set(nonce, { pairingId, expiresAt });
+  return { nonce, expiresAt };
+}
+function verifyChallengeResponse(args, now = Date.now()) {
+  purgeExpired(now);
+  const issued = outstanding.get(args.nonce);
+  outstanding.delete(args.nonce);
+  if (!issued) return { ok: false, reason: "unknown or already-used challenge" };
+  if (issued.expiresAt <= now) return { ok: false, reason: "challenge expired" };
+  if (issued.pairingId !== args.pairingId) return { ok: false, reason: "challenge was issued for a different device" };
+  if (issued.expiresAt !== args.expiresAt) return { ok: false, reason: "expiry does not match the issued challenge" };
+  if (!isUsableSecret(args.secret)) return { ok: false, reason: "device has no pairing secret \u2014 re-pair required" };
+  const expected = computeChallengeMac(args.secret, args.pairingId, args.nonce, issued.expiresAt);
+  if (!macsEqual(expected, args.mac)) return { ok: false, reason: "incorrect proof" };
+  return { ok: true };
+}
+function resetChallenges() {
+  outstanding.clear();
+}
+function outstandingChallengeCount() {
+  return outstanding.size;
+}
+function deriveConfirmationCode(nonce, fingerprintA, fingerprintB) {
+  const sorted = [normaliseFp(fingerprintA), normaliseFp(fingerprintB)].sort();
+  const hash = (0, import_node_crypto.createHash)("sha256").update(`${nonce}:${sorted[0]}:${sorted[1]}`).digest("hex");
+  return (parseInt(hash.slice(0, 8), 16) % 1e6).toString().padStart(6, "0");
+}
+function normaliseFp(fp) {
+  return String(fp ?? "").replace(/[^0-9A-Fa-f]/g, "").toUpperCase();
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CHALLENGE_TTL_MS,
+  PeerAuthError,
+  canonicalChallenge,
+  computeAnswerMac,
+  computeChallengeMac,
+  computeReconnectAnswerMac,
+  computeReconnectOfferMac,
+  deriveConfirmationCode,
+  generateSharedSecret,
+  isUsableSecret,
+  issueChallenge,
+  macsEqual,
+  outstandingChallengeCount,
+  resetChallenges,
+  verifyChallengeResponse
+});

package/src/backend/services/peer-capabilities.js

@@ -0,0 +1,209 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var peer_capabilities_exports = {};
+__export(peer_capabilities_exports, {
+  ALL_CAPABILITIES: () => ALL_CAPABILITIES,
+  DEFAULT_GRANTS: () => DEFAULT_GRANTS,
+  METHOD_CAPABILITIES: () => METHOD_CAPABILITIES,
+  PeerAuthorizationError: () => PeerAuthorizationError,
+  assertPeerMayCall: () => assertPeerMayCall,
+  listAuthorisedMethods: () => listAuthorisedMethods
+});
+module.exports = __toCommonJS(peer_capabilities_exports);
+const ALL_CAPABILITIES = Object.freeze([
+  "read",
+  "write",
+  "project",
+  "files",
+  "capture",
+  "settings",
+  "terminal"
+]);
+const METHOD_CAPABILITIES = Object.freeze({
+  // ── read ────────────────────────────────────────────────────────────
+  "changes.summary": "read",
+  "channel.events": "read",
+  "channel.eventsSinceSeq": "read",
+  "channel.get": "read",
+  "channel.thread": "read",
+  "deviation.list": "read",
+  "graph.directory": "read",
+  "graph.file": "read",
+  "graph.fileSearch": "read",
+  "graph.overview": "read",
+  "graph.scene": "read",
+  "graph.search": "read",
+  "plan.copyAsPrompt": "read",
+  "plan.document": "read",
+  "plan.get": "read",
+  "plan.item.get": "read",
+  "plan.items": "read",
+  "plan.list": "read",
+  "plan.nextItem": "read",
+  "plan.status": "read",
+  "plan.template.list": "read",
+  // Phase 29 mobile review flow. All four are read-only by
+  // construction: review and pr-draft never touch the repository (the
+  // agent does the git and opens the PR with its own credentials), and
+  // comparands / compare only read snapshots. 'read' is therefore the
+  // right grant — giving them 'project' would hand a phone more than
+  // the flow needs.
+  "review.comparands": "read",
+  "review.compare": "read",
+  "review.get": "read",
+  "review.prDraft": "read",
+  "review.queue": "read",
+  "stack.summary": "read",
+  "playForward.summary": "read",
+  // Phase 32 C4.3a — the recurring series, and starting the run due now.
+  "recurring.list": "read",
+  "power.status": "read",
+  "project.active": "read",
+  "project.list": "read",
+  "settings.get": "read",
+  "sysdoc.list": "read",
+  "sysdoc.read": "read",
+  "diagnostics.flush": "read",
+  // Phase 31 §12 — what is waiting on a person, and one item's criteria.
+  "criteria.awaiting": "read",
+  "criteria.list": "read",
+  // A plan's budget and the agent changes still flagged (mobile-budget.ts).
+  "budget.get": "read",
+  "freeze.get": "read",
+  // Phase 32 B4.4 — what is held for the person (mobile-breakpoints.ts).
+  "breakpoint.waiting": "read",
+  // Phase 32 B7.6 — proposed spec changes, in the desktop's words (mobile-proposals.ts).
+  "proposal.list": "read",
+  "proposal.get": "read",
+  // Phase 32 A4.2 — what overlaps, in the desktop's words (mobile-awareness.ts).
+  "awareness.needsYou": "read",
+  "awareness.signal": "read",
+  // Phase 32 A4.3 — the lines of work and their turns (mobile-workstreams.ts).
+  "workstreams.list": "read",
+  "workstreams.detail": "read",
+  // ── write ───────────────────────────────────────────────────────────
+  "channel.post": "write",
+  // Phase 31 §12 — a person's approval or send-back. `write` admits it;
+  // the handler also requires a CONFIRMED pairing, because the sign-off is
+  // recorded as the person's (mobile-approvals.ts).
+  "criterion.decide": "write",
+  // Marking an agent's budget change seen: also needs a CONFIRMED pairing.
+  "budget.acknowledge": "write",
+  "freeze.acknowledge": "write",
+  // Answering a held call: also needs a CONFIRMED pairing, and is audited.
+  "breakpoint.answer": "write",
+  // Deciding a spec change: also a CONFIRMED pairing, audited; the person's, never an agent's.
+  "proposal.decide": "write",
+  "playForward.decide": "write",
+  "recurring.start": "write",
+  // Answering a signal or replying to its agents: also a CONFIRMED pairing, audited.
+  "awareness.answer": "write",
+  "awareness.reply": "write",
+  "channel.resolve": "write",
+  "comment.add": "write",
+  "deviation.resolve": "write",
+  "input.respond": "write",
+  "item.ref.add": "write",
+  "item.ref.remove": "write",
+  "plan.create": "write",
+  "plan.delete": "write",
+  "plan.file.discover": "write",
+  "plan.file.export": "write",
+  "plan.file.import": "write",
+  "plan.item.create": "write",
+  "plan.item.update": "write",
+  "plan.template.create": "write",
+  "plan.update": "write",
+  "sysdoc.create": "write",
+  "sysdoc.delete": "write",
+  "sysdoc.update": "write",
+  "sysdoc.verify": "write",
+  // ── project ─────────────────────────────────────────────────────────
+  "project.alias": "project",
+  "project.close": "project",
+  "project.open": "project",
+  "project.pin": "project",
+  "project.remove": "project",
+  "project.rescan": "project",
+  // ── files ───────────────────────────────────────────────────────────
+  // Separated from `read` because these return file CONTENT and enumerate
+  // directories, rather than the plan/graph metadata `read` covers.
+  // Phase 31 §12 — the cited place in a piece of evidence: file content,
+  // read through the same confined reader as read_material.
+  "artefact.preview": "files",
+  "fs.browse": "files",
+  "graph.fileSource": "files",
+  // ── settings ────────────────────────────────────────────────────────
+  // Includes `device.exposeMobileApi`. A device must not be able to widen
+  // its own reach, so this is not granted by default.
+  "settings.update": "settings",
+  // ── terminal — COMMAND EXECUTION ────────────────────────────────────
+  "terminal.create": "terminal",
+  "terminal.history": "terminal",
+  "terminal.kill": "terminal",
+  "terminal.list": "terminal",
+  "terminal.read": "terminal",
+  "terminal.resize": "terminal",
+  "terminal.stream": "terminal",
+  "terminal.write": "terminal"
+});
+const DEFAULT_GRANTS = Object.freeze([
+  "read",
+  "write",
+  "project",
+  "files"
+]);
+class PeerAuthorizationError extends Error {
+  code = "EPEER_FORBIDDEN";
+  constructor(message) {
+    super(message);
+    this.name = "PeerAuthorizationError";
+  }
+}
+function assertPeerMayCall(method, grants, opts = { confirmed: false }) {
+  const required = METHOD_CAPABILITIES[method];
+  if (!required) {
+    throw new PeerAuthorizationError(
+      `Method "${method}" is not authorised for peers. Every method must be listed in METHOD_CAPABILITIES; unlisted methods are refused.`
+    );
+  }
+  const held = grants ?? [];
+  if (!held.includes(required)) {
+    throw new PeerAuthorizationError(
+      `Device${opts.alias ? ` "${opts.alias}"` : ""} does not hold the "${required}" capability required by "${method}"`
+    );
+  }
+  if (required === "terminal" && !opts.confirmed) {
+    throw new PeerAuthorizationError(
+      `"${method}" runs commands on this machine and requires a confirmed pairing`
+    );
+  }
+  return required;
+}
+function listAuthorisedMethods() {
+  return Object.keys(METHOD_CAPABILITIES);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ALL_CAPABILITIES,
+  DEFAULT_GRANTS,
+  METHOD_CAPABILITIES,
+  PeerAuthorizationError,
+  assertPeerMayCall,
+  listAuthorisedMethods
+});