codex-linux 1.0.0

package/src/main/security/SSOManager.ts

@@ -0,0 +1,241 @@
+import { EventEmitter } from 'events';
+import log from 'electron-log';
+import fetch from 'node-fetch';
+
+export interface SSOConfig {
+  provider: 'okta' | 'azure-ad' | 'google' | 'custom';
+  clientId: string;
+  clientSecret?: string;
+  tenantId?: string;
+  domain?: string;
+  redirectUri: string;
+  scopes: string[];
+}
+
+export interface SSOUser {
+  id: string;
+  email: string;
+  name: string;
+  groups: string[];
+  roles: string[];
+  accessToken: string;
+  refreshToken?: string;
+  expiresAt: Date;
+}
+
+export interface AuthResult {
+  success: boolean;
+  user?: SSOUser | null;
+  error?: string;
+}
+
+export class SSOManager extends EventEmitter {
+  private config: SSOConfig | null = null;
+  private currentUser: SSOUser | null = null;
+  private tokenEndpoint = '';
+  private userEndpoint = '';
+
+  constructor() {
+    super();
+  }
+
+  configure(config: SSOConfig): void {
+    this.config = config;
+    
+    // Set endpoints based on provider
+    switch (config.provider) {
+      case 'okta':
+        this.tokenEndpoint = `${config.domain}/oauth2/v1/token`;
+        this.userEndpoint = `${config.domain}/oauth2/v1/userinfo`;
+        break;
+      case 'azure-ad':
+        this.tokenEndpoint = `https://login.microsoftonline.com/${config.tenantId}/oauth2/v2.0/token`;
+        this.userEndpoint = 'https://graph.microsoft.com/v1.0/me';
+        break;
+      case 'google':
+        this.tokenEndpoint = 'https://oauth2.googleapis.com/token';
+        this.userEndpoint = 'https://www.googleapis.com/oauth2/v2/userinfo';
+        break;
+      default:
+        if (config.domain) {
+          this.tokenEndpoint = `${config.domain}/oauth/token`;
+          this.userEndpoint = `${config.domain}/oauth/userinfo`;
+        }
+    }
+
+    log.info('SSO configured', { provider: config.provider });
+  }
+
+  getAuthorizationUrl(state: string): string {
+    if (!this.config) throw new Error('SSO not configured');
+
+    const params = new URLSearchParams({
+      client_id: this.config.clientId,
+      redirect_uri: this.config.redirectUri,
+      response_type: 'code',
+      scope: this.config.scopes.join(' '),
+      state,
+    });
+
+    switch (this.config.provider) {
+      case 'okta':
+        return `${this.config.domain}/oauth2/v1/authorize?${params}`;
+      case 'azure-ad':
+        return `https://login.microsoftonline.com/${this.config.tenantId}/oauth2/v2.0/authorize?${params}`;
+      case 'google':
+        return `https://accounts.google.com/o/oauth2/v2/auth?${params}`;
+      default:
+        return `${this.config?.domain}/oauth/authorize?${params}`;
+    }
+  }
+
+  async handleCallback(code: string): Promise<AuthResult> {
+    if (!this.config) return { success: false, error: 'SSO not configured' };
+
+    try {
+      const tokens = await this.exchangeCodeForTokens(code);
+      const user = await this.fetchUserInfo(tokens.access_token);
+      
+      this.currentUser = {
+        id: user.id || '',
+        email: user.email || '',
+        name: user.name || '',
+        groups: user.groups || [],
+        roles: user.roles || [],
+        accessToken: tokens.access_token,
+        refreshToken: tokens.refresh_token,
+        expiresAt: new Date(Date.now() + tokens.expires_in * 1000),
+      };
+
+      this.emit('user:loggedIn', this.currentUser);
+      return { success: true, user: this.currentUser };
+    } catch (error: unknown) {
+      const message = error instanceof Error ? error.message : 'Unknown error';
+      log.error('SSO callback error:', error);
+      return { success: false, error: message };
+    }
+  }
+
+  private async exchangeCodeForTokens(code: string): Promise<{
+    access_token: string;
+    refresh_token?: string;
+    expires_in: number;
+  }> {
+    const params = new URLSearchParams({
+      code,
+      client_id: this.config!.clientId,
+      client_secret: this.config!.clientSecret || '',
+      redirect_uri: this.config!.redirectUri,
+      grant_type: 'authorization_code',
+    });
+
+    const response = await fetch(this.tokenEndpoint, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: params.toString(),
+    });
+
+    if (!response.ok) {
+      throw new Error(`Token exchange failed: ${response.statusText}`);
+    }
+
+    const data = await response.json() as {
+      access_token: string;
+      refresh_token?: string;
+      expires_in: number;
+    };
+    return data;
+  }
+
+  private async fetchUserInfo(accessToken: string): Promise<Partial<SSOUser>> {
+    const response = await fetch(this.userEndpoint, {
+      headers: { 'Authorization': `Bearer ${accessToken}` },
+    });
+
+    if (!response.ok) {
+      throw new Error(`User info fetch failed: ${response.statusText}`);
+    }
+
+    const data = await response.json() as {
+      sub?: string;
+      id?: string;
+      email?: string;
+      mail?: string;
+      userPrincipalName?: string;
+      name?: string;
+      groups?: string[];
+      roles?: string[];
+    };
+
+    return {
+      id: data.sub || data.id || '',
+      email: data.email || data.mail || data.userPrincipalName || '',
+      name: data.name || '',
+      groups: data.groups || [],
+      roles: data.roles || [],
+    };
+  }
+
+  async refreshToken(): Promise<boolean> {
+    if (!this.currentUser?.refreshToken) return false;
+
+    try {
+      const params = new URLSearchParams({
+        refresh_token: this.currentUser.refreshToken,
+        client_id: this.config!.clientId,
+        client_secret: this.config!.clientSecret || '',
+        grant_type: 'refresh_token',
+      });
+
+      const response = await fetch(this.tokenEndpoint, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: params.toString(),
+      });
+
+      if (!response.ok) {
+        throw new Error('Token refresh failed');
+      }
+
+      const tokens = await response.json() as {
+        access_token: string;
+        refresh_token?: string;
+        expires_in: number;
+      };
+      
+      this.currentUser.accessToken = tokens.access_token;
+      this.currentUser.refreshToken = tokens.refresh_token || this.currentUser.refreshToken;
+      this.currentUser.expiresAt = new Date(Date.now() + tokens.expires_in * 1000);
+
+      this.emit('token:refreshed', this.currentUser);
+      return true;
+    } catch (error) {
+      log.error('Token refresh error:', error);
+      return false;
+    }
+  }
+
+  logout(): void {
+    this.currentUser = null;
+    this.emit('user:loggedOut');
+  }
+
+  getCurrentUser(): SSOUser | null {
+    return this.currentUser;
+  }
+
+  isAuthenticated(): boolean {
+    return this.currentUser !== null;
+  }
+
+  getAccessToken(): string | null {
+    return this.currentUser?.accessToken || null;
+  }
+
+  cleanup(): void {
+    this.currentUser = null;
+    this.removeAllListeners();
+  }
+}
+
+export default SSOManager;

package/src/main/security/SecurityManager.ts

@@ -0,0 +1,139 @@
+import crypto from 'crypto';
+import { app } from 'electron';
+import * as path from 'path';
+import * as fs from 'fs/promises';
+import log from 'electron-log';
+
+const API_KEYS = new Set<string>();
+
+export class SecurityManager {
+  private algorithm = 'aes-256-gcm';
+  private keyFile: string;
+  private masterKey: Buffer | null = null;
+
+  constructor() {
+    this.keyFile = path.join(app.getPath('userData'), 'encryption.key');
+  }
+
+  async initialize(): Promise<void> {
+    try {
+      const keyData = await fs.readFile(this.keyFile);
+      this.masterKey = keyData;
+    } catch {
+      this.masterKey = crypto.randomBytes(32);
+      await fs.mkdir(path.dirname(this.keyFile), { recursive: true });
+      await fs.writeFile(this.keyFile, this.masterKey, { mode: 0o600 });
+    }
+    await this.loadApiKeys();
+  }
+
+  private async loadApiKeys(): Promise<void> {
+    const apiKeysPath = path.join(app.getPath('userData'), 'api-keys.enc');
+    try {
+      const encryptedData = await fs.readFile(apiKeysPath, 'utf-8');
+      const keys = JSON.parse(this.decrypt(encryptedData)) as string[];
+      keys.forEach((k) => API_KEYS.add(k));
+    } catch {
+      const defaultKey = crypto.randomBytes(32).toString('hex');
+      API_KEYS.add(defaultKey);
+      await this.saveApiKeys();
+      log.info('Generated new default API key');
+    }
+  }
+
+  private async saveApiKeys(): Promise<void> {
+    const apiKeysPath = path.join(app.getPath('userData'), 'api-keys.enc');
+    const encrypted = this.encrypt(JSON.stringify([...API_KEYS]));
+    await fs.writeFile(apiKeysPath, encrypted, { mode: 0o600 });
+  }
+
+  async validateApiKey(apiKey: string): Promise<boolean> {
+    return API_KEYS.has(apiKey);
+  }
+
+  async addApiKey(apiKey: string): Promise<void> {
+    API_KEYS.add(apiKey);
+    await this.saveApiKeys();
+  }
+
+  async removeApiKey(apiKey: string): Promise<void> {
+    API_KEYS.delete(apiKey);
+    await this.saveApiKeys();
+  }
+
+  encrypt(text: string): string {
+    if (!this.masterKey) {
+      throw new Error('Security manager not initialized');
+    }
+
+    const iv = crypto.randomBytes(16);
+    const cipher = crypto.createCipheriv(this.algorithm, this.masterKey, iv);
+    
+    let encrypted = cipher.update(text, 'utf8', 'hex');
+    encrypted += cipher.final('hex');
+    
+    const authTag = (cipher as any).getAuthTag();
+    
+    return iv.toString('hex') + ':' + authTag.toString('hex') + ':' + encrypted;
+  }
+
+  decrypt(encryptedData: string): string {
+    if (!this.masterKey) {
+      throw new Error('Security manager not initialized');
+    }
+
+    const parts = encryptedData.split(':');
+    if (parts.length !== 3) {
+      throw new Error('Invalid encrypted data format');
+    }
+
+    const iv = Buffer.from(parts[0], 'hex');
+    const authTag = Buffer.from(parts[1], 'hex');
+    const encrypted = parts[2];
+
+    const decipher = crypto.createDecipheriv(this.algorithm, this.masterKey, iv);
+    (decipher as any).setAuthTag(authTag);
+
+    let decrypted = decipher.update(encrypted, 'hex', 'utf8');
+    decrypted += decipher.final('utf8');
+
+    return decrypted;
+  }
+
+  hash(data: string): string {
+    return crypto.createHash('sha256').update(data).digest('hex');
+  }
+
+  generateSecureToken(length: number = 32): string {
+    return crypto.randomBytes(length).toString('base64url');
+  }
+
+  async rotateKey(): Promise<void> {
+    const newKey = crypto.randomBytes(32);
+    
+    const backupFile = this.keyFile + '.backup';
+    await fs.copyFile(this.keyFile, backupFile);
+    
+    await fs.writeFile(this.keyFile, newKey, { mode: 0o600 });
+    
+    this.masterKey = newKey;
+    await this.saveApiKeys();
+  }
+
+  async reEncryptData(_dataMap: Map<string, string>): Promise<void> {
+    throw new Error('Key rotation with data re-encryption is not yet implemented. All encrypted data will become unreadable after key rotation. Manual intervention required.');
+  }
+
+  secureCompare(a: string, b: string): boolean {
+    if (a.length !== b.length) {
+      return false;
+    }
+    
+    let result = 0;
+    for (let i = 0; i < a.length; i++) {
+      result |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    }
+    
+    return result === 0;
+  }
+}

package/src/main/skills/SkillsManager.ts

@@ -0,0 +1,218 @@
+import * as path from 'path';
+import * as fs from 'fs/promises';
+import * as yaml from 'yaml';
+import log from 'electron-log';
+import { Skill, SkillFile, SkillConfig, SkillParameter } from '../../shared/types';
+import { v4 as uuidv4 } from 'uuid';
+
+const DEFAULT_SKILLS_DIR = path.join(__dirname, '../../assets/skills');
+const USER_SKILLS_DIR = path.join(process.env.HOME || '~', '.config', 'codex', 'skills');
+
+export class SkillsManager {
+  private skills: Map<string, Skill> = new Map();
+  private userSkillsPath: string;
+
+  constructor(userSkillsPath?: string) {
+    this.userSkillsPath = userSkillsPath || USER_SKILLS_DIR;
+  }
+
+  async initialize(): Promise<void> {
+    // Ensure user skills directory exists
+    await fs.mkdir(this.userSkillsPath, { recursive: true });
+
+    // Load built-in skills
+    await this.loadSkillsFromDirectory(DEFAULT_SKILLS_DIR);
+
+    // Load user skills
+    await this.loadSkillsFromDirectory(this.userSkillsPath);
+
+    log.info(`Loaded ${this.skills.size} skills`);
+  }
+
+  async listSkills(): Promise<Skill[]> {
+    return Array.from(this.skills.values()).sort((a, b) => 
+      a.name.localeCompare(b.name)
+    );
+  }
+
+  async getSkill(skillId: string): Promise<Skill | null> {
+    return this.skills.get(skillId) || null;
+  }
+
+  async createSkill(config: Partial<Skill>): Promise<Skill> {
+    const skill: Skill = {
+      id: uuidv4(),
+      name: config.name || 'Untitled Skill',
+      description: config.description || '',
+      version: config.version || '1.0.0',
+      author: config.author || 'Anonymous',
+      tags: config.tags || [],
+      files: config.files || [],
+      config: config.config || {
+        entryPoint: 'index.md',
+        parameters: [],
+        dependencies: [],
+        permissions: []
+      },
+      createdAt: new Date(),
+      updatedAt: new Date()
+    };
+
+    this.skills.set(skill.id, skill);
+    await this.saveSkill(skill);
+    
+    log.info(`Created skill ${skill.id} (${skill.name})`);
+    return skill;
+  }
+
+  async updateSkill(skillId: string, updates: Partial<Skill>): Promise<Skill> {
+    const skill = this.skills.get(skillId);
+    if (!skill) {
+      throw new Error(`Skill ${skillId} not found`);
+    }
+
+    Object.assign(skill, updates, { updatedAt: new Date() });
+    await this.saveSkill(skill);
+    
+    log.info(`Updated skill ${skillId}`);
+    return skill;
+  }
+
+  async deleteSkill(skillId: string): Promise<void> {
+    const skill = this.skills.get(skillId);
+    if (!skill) {
+      throw new Error(`Skill ${skillId} not found`);
+    }
+
+    // Delete skill directory
+    const skillPath = path.join(this.userSkillsPath, skill.name);
+    await fs.rmdir(skillPath, { recursive: true }).catch(() => {});
+
+    this.skills.delete(skillId);
+    log.info(`Deleted skill ${skillId}`);
+  }
+
+  async searchSkills(query: string, tags?: string[]): Promise<Skill[]> {
+    let results = Array.from(this.skills.values());
+
+    if (query) {
+      const lowerQuery = query.toLowerCase();
+      results = results.filter(skill =>
+        skill.name.toLowerCase().includes(lowerQuery) ||
+        skill.description.toLowerCase().includes(lowerQuery) ||
+        skill.tags.some(tag => tag.toLowerCase().includes(lowerQuery))
+      );
+    }
+
+    if (tags && tags.length > 0) {
+      results = results.filter(skill =>
+        tags.some(tag => skill.tags.includes(tag))
+      );
+    }
+
+    return results;
+  }
+
+  private async loadSkillsFromDirectory(dir: string): Promise<void> {
+    try {
+      const entries = await fs.readdir(dir, { withFileTypes: true });
+      
+      for (const entry of entries) {
+        if (entry.isDirectory()) {
+          await this.loadSkillFromPath(path.join(dir, entry.name));
+        }
+      }
+    } catch (error) {
+      log.warn(`Failed to load skills from ${dir}:`, error);
+    }
+  }
+
+  private async loadSkillFromPath(skillPath: string): Promise<void> {
+    try {
+      const configPath = path.join(skillPath, 'skill.yaml');
+      let config: any = {};
+
+      try {
+        const configContent = await fs.readFile(configPath, 'utf-8');
+        config = yaml.parse(configContent);
+      } catch {
+        // No config file, use defaults
+      }
+
+      // Load files
+      const files: SkillFile[] = [];
+      const entries = await fs.readdir(skillPath, { withFileTypes: true });
+
+      for (const entry of entries) {
+        if (!entry.isDirectory()) {
+          const filePath = path.join(skillPath, entry.name);
+          const content = await fs.readFile(filePath, 'utf-8');
+          
+          let type: SkillFile['type'] = 'instruction';
+          if (entry.name.endsWith('.template')) type = 'template';
+          else if (entry.name.endsWith('.tool')) type = 'tool';
+          else if (entry.name === 'skill.yaml') type = 'config';
+
+          files.push({
+            path: entry.name,
+            content,
+            type
+          });
+        }
+      }
+
+      const skill: Skill = {
+        id: config.id || uuidv4(),
+        name: config.name || path.basename(skillPath),
+        description: config.description || '',
+        version: config.version || '1.0.0',
+        author: config.author || 'Unknown',
+        tags: config.tags || [],
+        files,
+        config: {
+          entryPoint: config.entryPoint || 'index.md',
+          parameters: config.parameters || [],
+          dependencies: config.dependencies || [],
+          permissions: config.permissions || []
+        },
+        createdAt: config.createdAt ? new Date(config.createdAt) : new Date(),
+        updatedAt: config.updatedAt ? new Date(config.updatedAt) : new Date()
+      };
+
+      this.skills.set(skill.id, skill);
+    } catch (error) {
+      log.error(`Failed to load skill from ${skillPath}:`, error);
+    }
+  }
+
+  private async saveSkill(skill: Skill): Promise<void> {
+    const skillPath = path.join(this.userSkillsPath, skill.name);
+    await fs.mkdir(skillPath, { recursive: true });
+
+    // Save config
+    const configPath = path.join(skillPath, 'skill.yaml');
+    const config = {
+      id: skill.id,
+      name: skill.name,
+      description: skill.description,
+      version: skill.version,
+      author: skill.author,
+      tags: skill.tags,
+      entryPoint: skill.config.entryPoint,
+      parameters: skill.config.parameters,
+      dependencies: skill.config.dependencies,
+      permissions: skill.config.permissions,
+      createdAt: skill.createdAt,
+      updatedAt: skill.updatedAt
+    };
+    await fs.writeFile(configPath, yaml.stringify(config), 'utf-8');
+
+    // Save files
+    for (const file of skill.files) {
+      if (file.type !== 'config') {
+        const filePath = path.join(skillPath, file.path);
+        await fs.writeFile(filePath, file.content, 'utf-8');
+      }
+    }
+  }
+}

package/src/main/ssh/SSHManager.ts

@@ -0,0 +1,86 @@
+import { EventEmitter } from 'events';
+import log from 'electron-log';
+
+interface SSHConnection {
+  id: string;
+  name: string;
+  host: string;
+  port: number;
+  username: string;
+  privateKeyPath?: string;
+  password?: string;
+  status: 'disconnected' | 'connecting' | 'connected' | 'error';
+  error?: string;
+}
+
+export class SSHManager extends EventEmitter {
+  private connections: Map<string, SSHConnection> = new Map();
+
+  constructor() {
+    super();
+    log.warn('SSH support requires "ssh2" package. Run: npm install ssh2');
+  }
+
+  async addConnection(config: Omit<SSHConnection, 'id' | 'status'>): Promise<SSHConnection> {
+    const connection: SSHConnection = {
+      ...config,
+      id: `ssh-${Date.now()}`,
+      status: 'disconnected'
+    };
+
+    this.connections.set(connection.id, connection);
+    this.emit('connection:added', connection);
+    log.info(`SSH connection added: ${connection.name} (${connection.host})`);
+    
+    return connection;
+  }
+
+  async removeConnection(connectionId: string): Promise<void> {
+    this.connections.delete(connectionId);
+    this.emit('connection:removed', { connectionId });
+    log.info(`SSH connection removed: ${connectionId}`);
+  }
+
+  async connect(_connectionId: string): Promise<void> {
+    throw new Error('SSH support not available. Install ssh2 package.');
+  }
+
+  async disconnect(_connectionId: string): Promise<void> {
+    // No-op
+  }
+
+  async executeCommand(_connectionId: string, _command: string): Promise<string> {
+    throw new Error('SSH support not available. Install ssh2 package.');
+  }
+
+  async readFile(_connectionId: string, _remotePath: string): Promise<string> {
+    throw new Error('SSH support not available. Install ssh2 package.');
+  }
+
+  async writeFile(_connectionId: string, _remotePath: string, _content: string): Promise<void> {
+    throw new Error('SSH support not available. Install ssh2 package.');
+  }
+
+  async listDirectory(_connectionId: string, _remotePath: string): Promise<any[]> {
+    throw new Error('SSH support not available. Install ssh2 package.');
+  }
+
+  getConnections(): SSHConnection[] {
+    return Array.from(this.connections.values());
+  }
+
+  getConnection(connectionId: string): SSHConnection | undefined {
+    return this.connections.get(connectionId);
+  }
+
+  isConnected(_connectionId: string): boolean {
+    return false;
+  }
+
+  cleanup(): void {
+    this.connections.clear();
+    this.removeAllListeners();
+  }
+}
+
+export default SSHManager;