cofluxd 2.7.0 → 2.9.0

package/coflux.mjs

@@ -5,11 +5,14 @@ import { randomUUID } from "node:crypto";
 import { parseArgs } from "node:util";
 import { spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
+import { request as httpRequest } from "node:http";
 import { homedir } from "node:os";
 import { join } from "node:path";
 const HOME = process.env.COFLUX_HOME || join(homedir(), ".coflux");
-// Native integration owns explicit workspace selection and conversation state.
-if (process.argv[2] === "agent" || (process.argv[2] === "workspace" && process.argv[3] === "enter")) {
+// Native integration owns explicit workspace selection and conversation state. `secret` is native
+// only too: it speaks the worker's kernel-attested socket and masks child output, and one
+// implementation of that is enough (plan 20260926-agent-secret-input).
+if (process.argv[2] === "agent" || process.argv[2] === "secret" || (process.argv[2] === "workspace" && process.argv[3] === "enter")) {
   const native = process.env.COFLUX_AGENT_BUNDLE
     ? join(process.env.COFLUX_AGENT_BUNDLE, "coflux")
     : join(HOME, "bin", "coflux");
@@ -33,6 +36,93 @@ function localGatewayPort() {
   }
   return { ok: true, port };
 }
+
+/* ---------------------- local transport (plan 20260926-agent-endpoint-hardening) ---------------------- */
+// `/agent` and `/hook` reach the worker over its kernel-attested Unix socket first; the worker reads
+// this process's pid from the kernel, so the body carries no pid/ppid there. The loopback TCP port
+// is used only when the socket is **absent** (no file, or nobody listening: an older worker), and
+// only then is COFLUX_LOCAL_GATEWAY_PORT read. A reply from the socket, refusals included, is final
+// and never retried over TCP; a connect refused for any other reason (a sandbox's EPERM/EACCES)
+// fails hard and names the socket. Mirrors `local_post` in crates/cli/src/gateway.rs.
+// The path mirrors `SOCKET_FILE` in crates/worker/src/agent_socket.rs.
+const AGENT_SOCKET = join(HOME, "ipc", "agent.sock");
+/** The worker never binds a longer socket path (sun_path limits), so a longer one is absent. */
+const MAX_SOCKET_PATH_BYTES = 100;
+
+/**
+ * One HTTP/1.1 POST over the agent socket.
+ * → { ok: true, status, text } | { ok: false, kind: "absent" | "denied" | "transport", message }
+ */
+function socketPost(path, payload, timeoutMs) {
+  if (Buffer.byteLength(AGENT_SOCKET) > MAX_SOCKET_PATH_BYTES) return Promise.resolve({ ok: false, kind: "absent" });
+  return new Promise((resolve) => {
+    let settled = false;
+    let timedOut = false;
+    const finish = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve(result);
+    };
+    const req = httpRequest(
+      {
+        socketPath: AGENT_SOCKET,
+        path,
+        method: "POST",
+        agent: false,
+        headers: { "content-type": "application/json", "content-length": Buffer.byteLength(payload), connection: "close" },
+      },
+      (res) => {
+        const chunks = [];
+        res.on("data", (chunk) => chunks.push(chunk));
+        res.on("end", () => finish({ ok: true, status: res.statusCode, text: Buffer.concat(chunks).toString("utf8") }));
+        res.on("error", (error) => finish({ ok: false, kind: "transport", message: error?.message || String(error) }));
+      },
+    );
+    const timer = setTimeout(() => {
+      timedOut = true;
+      req.destroy(new Error("请求超时"));
+    }, timeoutMs);
+    req.on("error", (error) => {
+      if (!timedOut && error?.syscall === "connect") {
+        if (error.code === "ENOENT" || error.code === "ECONNREFUSED") return finish({ ok: false, kind: "absent" });
+        return finish({
+          ok: false,
+          kind: "denied",
+          message: `cannot connect to the coflux daemon's agent socket at ${AGENT_SOCKET} (${error.code || error.message}); this process is not allowed to reach it (a sandbox without local network access?)`,
+        });
+      }
+      finish({ ok: false, kind: "transport", message: error?.message || String(error) });
+    });
+    req.end(payload);
+  });
+}
+
+/**
+ * POST one JSON body to the local daemon: the agent socket first, the TCP gateway only when the
+ * socket is absent. `body.pid`/`body.ppid` are transport business: dropped on the socket, set to
+ * this process's on TCP.
+ * → { ok: true, status, text } | { ok: false, kind: "refused" | "transport", message }
+ */
+async function localPost(path, body, timeoutMs) {
+  const { pid: _pid, ppid: _ppid, ...rest } = body;
+  const viaSocket = await socketPost(path, JSON.stringify(rest), timeoutMs);
+  if (viaSocket.ok || viaSocket.kind === "transport") return viaSocket;
+  if (viaSocket.kind === "denied") return { ok: false, kind: "refused", message: viaSocket.message };
+  const portResult = localGatewayPort();
+  if (!portResult.ok) return { ok: false, kind: "refused", message: portResult.error };
+  try {
+    const res = await fetch(`http://127.0.0.1:${portResult.port}${path}`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ ...rest, pid: process.pid, ppid: process.ppid }),
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+    return { ok: true, status: res.status, text: await res.text() };
+  } catch (error) {
+    return { ok: false, kind: "transport", message: error?.message || String(error) };
+  }
+}
 /* ------------------------------ hook：agent 事件信使 ------------------------------ */
 // agent hook 的上报信使：用户在 claude/codex 的 hook 配置里指向本命令，事件发生时它把
 // 事件名转发给本机 worker 的固定 gateway（POST /hook），供活动状态判定。
@@ -85,11 +175,6 @@ async function cmdHook() {
       hookDebug("payload 缺事件名，忽略");
       return;
     }
-    const portResult = localGatewayPort();
-    if (!portResult.ok) {
-      hookDebug(portResult.error);
-      return;
-    }
     const notification = payload.notification_type ?? payload.notificationType;
     const body = {
       agent,
@@ -106,13 +191,9 @@ async function cmdHook() {
       backgroundTasks: Array.isArray(payload.background_tasks) ? payload.background_tasks.length : undefined,
     };
     hookDebug("POST /hook", JSON.stringify(body));
-    const res = await fetch(`http://127.0.0.1:${portResult.port}/hook`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify(body),
-      signal: AbortSignal.timeout(HOOK_POST_TIMEOUT_MS),
-    });
-    hookDebug(`响应 ${res.status}`);
+    // The agent socket first; the gateway port is resolved only when the socket is absent.
+    const res = await localPost("/hook", body, HOOK_POST_TIMEOUT_MS);
+    hookDebug(res.ok ? `响应 ${res.status}` : res.message);
   } catch (error) {
     hookDebug(error?.message || String(error));
   } finally {
@@ -163,23 +244,15 @@ function agentTimeoutMs() {
 // failure may be re-sent with the same submissionId (the daemon deduplicates on it); re-sending a
 // "refused" request accomplishes nothing. Mirrors `AgentError` in crates/cli/src/gateway.rs.
 async function agentPostResult(body) {
-  const portResult = localGatewayPort();
-  if (!portResult.ok) return { ok: false, kind: "refused", message: portResult.error };
-  let res;
-  try {
-    res = await fetch(`http://127.0.0.1:${portResult.port}/agent`, {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ ...body, pid: process.pid, ppid: process.ppid, cwd: callerCwd() }),
-      signal: AbortSignal.timeout(agentTimeoutMs()),
-    });
-  } catch (error) {
-    const detail = error?.message || error;
-    return { ok: false, kind: "transport", message: `连不上本机 daemon：${detail}（daemon 没在跑？查看 Coflux.app 或 cofluxd status）` };
+  const res = await localPost("/agent", { ...body, cwd: callerCwd() }, agentTimeoutMs());
+  if (!res.ok) {
+    if (res.kind === "refused") return res;
+    return { ok: false, kind: "transport", message: `连不上本机 daemon：${res.message}（daemon 没在跑？查看 Coflux.app 或 cofluxd status）` };
   }
   let parsed = null;
-  try { parsed = await res.json(); } catch { /* 非 JSON 响应按下面的兜底报错处理 */ }
-  if (!res.ok || !parsed?.ok) return { ok: false, kind: "refused", message: parsed?.error || `daemon 返回 ${res.status}` };
+  try { parsed = JSON.parse(res.text); } catch { /* 非 JSON 响应按下面的兜底报错处理 */ }
+  const success = res.status >= 200 && res.status < 300;
+  if (!success || !parsed?.ok) return { ok: false, kind: "refused", message: parsed?.error || `daemon 返回 ${res.status}` };
   return { ok: true, value: parsed };
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cofluxd",
-  "version": "2.7.0",
+  "version": "2.9.0",
   "description": "Coflux 无界面宿主（cofluxd）与统一操作工具（coflux）",
   "type": "module",
   "bin": {

package/skills/coflux/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: coflux
-description: Use coflux to enter workspaces, open terminals the user can see and take over, run commands in them, wait for those commands, read their scrollback, type into them, run one-shot commands on another device in the account and get their output, report progress, notify the user, obtain preview URLs, and hand a bounded mechanical sub-task to the built-in executor instead of spending your own context on it. Prefer zero-credential local commands in the current workspace; use the account CLI across workspaces and devices. Coordinates arrive through coflux-session or COFLUX_* variables.
+description: Use coflux to enter workspaces, open terminals the user can see and take over, run commands in them, wait for those commands, read their scrollback, type into them, run one-shot commands on another device in the account and get their output, report progress, notify the user, obtain preview URLs, get a secret (API key, password) from the user without the value entering your context, and hand a bounded mechanical sub-task to the built-in executor instead of spending your own context on it. Prefer zero-credential local commands in the current workspace; use the account CLI across workspaces and devices. Coordinates arrive through coflux-session or COFLUX_* variables.
 ---
 
 # Working inside coflux
@@ -14,7 +14,7 @@ and a way to operate the other workspaces and devices under the account when you
 
 | Track | Credentials | Reach | Use for |
 |---|---|---|---|
-| Local commands `coflux terminal/progress/notify/ports/executor` | none (the daemon identifies you by process tree) | **the workspace your cwd is in** | open, run, wait, read, send, close, report progress, call the user, preview URLs, hand a bounded sub-task to the built-in executor: the default; some actions require a server connection |
+| Local commands `coflux terminal/progress/notify/ports/executor/secret` | none (the daemon identifies you by process tree) | **the workspace your cwd is in** | open, run, wait, read, send, close, report progress, call the user, preview URLs, get a secret from the user, hand a bounded sub-task to the built-in executor: the default; some actions require a server connection |
 | Account CLI | app login or `coflux login` | all devices and workspaces in the account | child workspaces and remote terminals; JSON output |
 
 Of the local commands, `run`/`wait`/`read`/`send`/`close`/`progress`/`executor` complete
@@ -467,6 +467,49 @@ says so in one line — relay that to the user instead of retrying.
 **Images and other files are not an input.** The prompt is a task description with a size cap, not a
 file channel: point at paths inside the workspace instead of trying to hand anything over.
 
+### Get a secret from the user
+
+```sh
+coflux secret ask OPENAI_API_KEY --reason "Run the integration tests against the real API"
+coflux secret exec OPENAI_API_KEY -- pnpm test:integration
+coflux secret inject DATABASE_URL --file .env.local
+```
+
+When a task needs a value only the user has — an API key, a token, a database password — and it
+goes to a **non-interactive** destination (a command that reads it from the environment, or a
+dotenv/config file), ask for it with `coflux secret`. **Never ask the user to paste a secret into
+the chat**: that puts it in the transcript, the model provider's logs and on screen. With
+`coflux secret` you never see the value; you get a name and an outcome, and every use of the value
+goes back through coflux.
+
+- `ask NAME --reason "<why>"` shows a request card over this terminal on every Coflux desktop of
+  the account (plus one inbox notification). It blocks until the user answers, then prints exactly
+  one word: `provided`, `declined` or `cancelled` (closed card, timeout — default 10 minutes,
+  `--timeout <seconds>` — or the terminal ended). Exit status is 0 only for `provided`. Write the
+  reason for the user: say what the value is for and where it will go. NAME is an
+  environment-variable name. Asking again for a NAME replaces its value. On `declined`, do not ask
+  again unprompted; on `cancelled`, tell the user what you were waiting for before retrying. A
+  timeout with no card on the user's screen usually means their desktop app is too old — say so.
+- `exec NAME [NAME…] -- <cmd> [args…]` runs the command with each value in a same-name environment
+  variable, passes its exit status through, and shows every occurrence of a value in its output
+  as `***`. A NAME that was not provided in this terminal fails with a sentence telling you to
+  `ask` first.
+- `inject NAME --file <path> [--key KEY]` makes the daemon insert or update `KEY=value` (KEY
+  defaults to NAME) in a dotenv file inside the workspace your cwd is in. A new file is owner-only;
+  a path outside the workspace, including through a symlink, is refused. It prints only that the
+  file was written. Checking that the file is gitignored is yours.
+
+Values belong to **this terminal**: only processes in it can use them, and they are dropped when it
+ends (and when the user's device restarts its coflux runtime) — a new terminal must `ask` again.
+They live only in the local daemon's memory, never on disk or on the center. `coflux terminal read`
+and the center's copy of any terminal show a held value as `***`.
+
+Not for interactive prompts: an `ssh` or `sudo` password prompt stays with the user — open a
+terminal they can take over, `coflux notify` them, and `coflux terminal wait`. The built-in
+executor cannot use `coflux secret` (it is not a terminal process). And it prevents accidents, not
+a determined agent: once a value is in an environment variable or a file you can read, printing it
+on purpose would leak it — never do that.
+
 ### Errors from local commands
 
 Errors are one readable sentence; do what they say: "not inside a coflux terminal" = you are not
@@ -596,6 +639,8 @@ There is no `--workspace`, and there is **no stdin**.
 - A workspace has a cap on concurrently live terminals (default 8, including the user's own).
   On hitting the cap, `list` first: usually some finished terminals were never collected. If the
   user really filled it up, `notify` them instead of forcing it.
+- `coflux secret ask` needs the daemon connected to the center (the request reaches the user's
+  desktops through it) and fails at once otherwise; `exec` and `inject` stay local.
 - `new`/`list`/`ports`/`notify` and account commands need the daemon connected to the center; "letting the
   user see" is their whole point. `run`/`wait`/`read`/`send`/`close`/`progress` do not
   depend on the center. When disconnected they fail loudly rather than degrade silently.