enigma-memory 0.1.18 → 0.1.22

package/packages/terminal-console/phantom-bridge.mjs

@@ -0,0 +1,637 @@
+// Enigma Sovereign Terminal — Cryptographically Authenticated Phantom Browser Companion Bridge
+// Enforces domain-separated Ed25519 signature verification (Sign-In with Solana),
+// server-side balance fetching, strict Host/Origin checking (no wildcard CORS), exact 64 KiB body limits, and XSS prevention.
+
+import http from 'node:http';
+import crypto from 'node:crypto';
+import { spawn } from 'node:child_process';
+
+export const SOLANA_MAINNET_RPC = 'https://api.mainnet-beta.solana.com';
+export const OFFICIAL_TOKEN_CA = 'EknDj8VZUHL6FhV9pSk3m6xP2U2sDzwjRDVstKeQpump';
+
+const ED25519_SPKI_PREFIX = Buffer.from('302a300506032b6570032100', 'hex');
+const BASE58_ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';
+const BASE58_MAP = new Map();
+for (let i = 0; i < BASE58_ALPHABET.length; i += 1) BASE58_MAP.set(BASE58_ALPHABET[i], BigInt(i));
+
+const MAX_BODY_BYTES = 64 * 1024; // 64 KiB limit
+
+export function decodeBase58(str, expectedLength = undefined) {
+  if (typeof str !== 'string' || str.length === 0) return null;
+  let num = 0n;
+  for (let i = 0; i < str.length; i += 1) {
+    const val = BASE58_MAP.get(str[i]);
+    if (val === undefined) return null;
+    num = num * 58n + val;
+  }
+  let hex = num.toString(16);
+  if (hex.length % 2 !== 0) hex = '0' + hex;
+  const bytes = hex ? Buffer.from(hex, 'hex') : Buffer.alloc(0);
+  let leadingZeros = 0;
+  for (let i = 0; i < str.length && str[i] === '1'; i += 1) {
+    leadingZeros += 1;
+  }
+  const result = Buffer.concat([Buffer.alloc(leadingZeros), bytes]);
+  if (typeof expectedLength === 'number' && expectedLength > 0) {
+    if (result.length < expectedLength) {
+      return Buffer.concat([Buffer.alloc(expectedLength - result.length), result]);
+    }
+    if (result.length > expectedLength) {
+      const excess = result.length - expectedLength;
+      for (let i = 0; i < excess; i++) {
+        if (result[i] !== 0) return null;
+      }
+      return result.subarray(excess);
+    }
+    return result;
+  }
+  return result;
+}
+
+export function encodeBase58(buffer) {
+  if (!Buffer.isBuffer(buffer) || buffer.length === 0) return '';
+  let leadingZeros = 0;
+  for (let i = 0; i < buffer.length && buffer[i] === 0; i += 1) {
+    leadingZeros += 1;
+  }
+  let num = BigInt('0x' + (buffer.toString('hex') || '0'));
+  let encoded = '';
+  while (num > 0n) {
+    const rem = Number(num % 58n);
+    num = num / 58n;
+    encoded = BASE58_ALPHABET[rem] + encoded;
+  }
+  return '1'.repeat(leadingZeros) + encoded;
+}
+
+export function buildPhantomChallenge({ origin, nonce, issuedAt, expiresAt }) {
+  return [
+    'Enigma Sovereign Terminal Session Authentication',
+    `Origin: ${origin}`,
+    `Nonce: ${nonce}`,
+    `Issued At: ${issuedAt}`,
+    `Expires At: ${expiresAt}`,
+    'Statement: Sign this challenge to prove authority over your Solana wallet for the Enigma Terminal session. Zero private keys leave your wallet.',
+  ].join('\n');
+}
+
+function readCappedBody(req, res, callback) {
+  let body = '';
+  let bytes = 0;
+  let rejected = false;
+
+  req.on('data', (chunk) => {
+    if (rejected) return;
+    bytes += chunk.length;
+    if (bytes > MAX_BODY_BYTES) {
+      rejected = true;
+      req.pause();
+      res.writeHead(413, {
+        'Content-Type': 'application/json',
+        'Connection': 'close',
+      });
+      res.end(JSON.stringify({ ok: false, error: 'payload too large' }));
+      req.resume();
+      return;
+    }
+    body += chunk;
+  });
+  req.on('end', () => {
+    if (!rejected) {
+      callback(body);
+    }
+  });
+}
+
+export class PhantomBrowserBridge {
+  constructor(options = {}) {
+    this.port = options.port !== undefined ? options.port : 0; // 0 = dynamic OS port
+    this.host = '127.0.0.1';
+    this.cluster = options.cluster || 'mainnet-beta';
+    this.rpcUrl = options.rpcUrl || SOLANA_MAINNET_RPC;
+    this.server = null;
+    this.activeSession = null;
+    this.connectedWallet = null;
+    this.onWalletConnected = options.onWalletConnected || null;
+    this.fetchFn = options.fetchFn || globalThis.fetch;
+  }
+
+  // Generate an authenticated ephemeral session challenge
+  createSession() {
+    const nonce = crypto.randomBytes(32).toString('hex');
+    const now = Date.now();
+    const issuedAt = new Date(now).toISOString();
+    const expiresAt = new Date(now + 5 * 60 * 1000).toISOString(); // 5 min expiry
+    const origin = `http://${this.host}:${this.port || 8765}`;
+    const challenge = buildPhantomChallenge({ origin, nonce, issuedAt, expiresAt });
+
+    this.activeSession = {
+      nonce,
+      issuedAt,
+      expiresAt,
+      challenge,
+      consumed: false,
+      wallet: null,
+    };
+    return this.activeSession;
+  }
+
+  // Fetch verified SOL balance server-side directly from RPC
+  async fetchVerifiedBalance(pubkey) {
+    try {
+      const res = await this.fetchFn(this.rpcUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+          jsonrpc: '2.0',
+          id: 'balance-verify',
+          method: 'getBalance',
+          params: [pubkey],
+        }),
+      });
+      const data = await res.json();
+      const lamports = Number(data.result?.value);
+      if (Number.isFinite(lamports) && lamports >= 0) {
+        return (lamports / 1e9).toFixed(4);
+      }
+    } catch {
+      // Fallback on RPC failure
+    }
+    return '0.0000';
+  }
+
+  // Cryptographically verify the Ed25519 signature
+  verifyAuthSignature({ publicKey, signatureHex, nonce }) {
+    if (!this.activeSession || this.activeSession.nonce !== nonce) {
+      return { ok: false, error: 'invalid or unknown session nonce' };
+    }
+
+    if (this.activeSession.consumed) {
+      return { ok: false, error: 'session challenge has already been consumed (replay rejected)' };
+    }
+
+    if (Date.now() > Date.parse(this.activeSession.expiresAt)) {
+      return { ok: false, error: 'session challenge has expired' };
+    }
+
+    const pubkeyBytes = decodeBase58(publicKey);
+    if (!pubkeyBytes || pubkeyBytes.length !== 32) {
+      return { ok: false, error: 'invalid Base58 Ed25519 public key' };
+    }
+
+    const sigBytes = Buffer.from(signatureHex || '', 'hex');
+    if (sigBytes.length !== 64) {
+      return { ok: false, error: 'invalid Ed25519 signature length (expected 64 bytes)' };
+    }
+
+    try {
+      const spkiDer = Buffer.concat([ED25519_SPKI_PREFIX, pubkeyBytes]);
+      const keyObject = crypto.createPublicKey({
+        key: spkiDer,
+        format: 'der',
+        type: 'spki',
+      });
+
+      const messageBuffer = Buffer.from(this.activeSession.challenge, 'utf8');
+      const verified = crypto.verify(null, messageBuffer, keyObject, sigBytes);
+
+      if (!verified) {
+        return { ok: false, error: 'Ed25519 signature verification failed for claimed public key' };
+      }
+
+      // Atomically consume the session
+      this.activeSession.consumed = true;
+      return { ok: true, publicKey };
+    } catch (err) {
+      return { ok: false, error: `cryptographic verification error: ${err.message}` };
+    }
+  }
+
+  // Validate Host and Origin headers on the bridge
+  validateBridgeSecurity(req, res) {
+    const rawHost = req.headers['host'];
+    if (!rawHost) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: 'host header required' }));
+      return false;
+    }
+
+    let parsedHost;
+    try {
+      parsedHost = new URL(`http://${rawHost}`);
+    } catch {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: 'malformed host header' }));
+      return false;
+    }
+
+    const hostName = parsedHost.hostname.toLowerCase();
+    const hostPort = Number(parsedHost.port || 80);
+    const validHostName = hostName === '127.0.0.1' || hostName === 'localhost';
+    const validHostPort = this.port === 0 || hostPort === this.port;
+
+    if (!validHostName || !validHostPort) {
+      res.writeHead(403, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({ ok: false, error: 'host header rejected: must match exact bridge port' }));
+      return false;
+    }
+
+    const rawOrigin = req.headers['origin'];
+    if (rawOrigin) {
+      let parsedOrigin;
+      try {
+        parsedOrigin = new URL(rawOrigin);
+      } catch {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'malformed origin header' }));
+        return false;
+      }
+
+      const originName = parsedOrigin.hostname.toLowerCase();
+      const originPort = Number(parsedOrigin.port || 80);
+      const validOrigin = (originName === '127.0.0.1' || originName === 'localhost') && (this.port === 0 || originPort === this.port);
+
+      if (!validOrigin) {
+        res.writeHead(403, { 'Content-Type': 'application/json' });
+        res.end(JSON.stringify({ ok: false, error: 'cross-origin request rejected' }));
+        return false;
+      }
+    }
+
+    return true;
+  }
+
+  // Handle incoming HTTP request
+  handleRequest(req, res) {
+    if (!this.validateBridgeSecurity(req, res)) return true;
+
+    const url = new URL(req.url, `http://${this.host}:${this.port || 80}`);
+
+    // Strict CORS: only echo exact local origin if valid
+    const origin = req.headers['origin'];
+    if (origin) {
+      res.setHeader('Access-Control-Allow-Origin', origin);
+      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, OPTIONS');
+      res.setHeader('Access-Control-Allow-Headers', 'Content-Type');
+    }
+
+    if (req.method === 'OPTIONS') {
+      res.writeHead(204);
+      res.end();
+      return true;
+    }
+
+    // Status endpoint for terminal polling
+    if (url.pathname === '/api/wallet/status' || url.pathname === '/api/status') {
+      res.writeHead(200, { 'Content-Type': 'application/json' });
+      res.end(JSON.stringify({
+        ok: true,
+        connected: Boolean(this.connectedWallet),
+        wallet: this.connectedWallet,
+        cluster: this.cluster,
+        tokenCa: OFFICIAL_TOKEN_CA,
+      }));
+      return true;
+    }
+
+    // Callback endpoint with Ed25519 signature verification and server-side balance fetching
+    if (url.pathname === '/api/callback' && req.method === 'POST') {
+      readCappedBody(req, res, async (body) => {
+        try {
+          const data = JSON.parse(body || '{}');
+          const verification = this.verifyAuthSignature(data);
+
+          if (!verification.ok) {
+            res.writeHead(403, { 'Content-Type': 'application/json' });
+            res.end(JSON.stringify({ ok: false, error: verification.error }));
+            return;
+          }
+
+          // Fetch verified balance server-side (ignore untrusted client-reported balance)
+          const verifiedBalance = await this.fetchVerifiedBalance(verification.publicKey);
+
+          this.connectedWallet = {
+            publicKey: verification.publicKey,
+            balance: verifiedBalance,
+            cluster: this.cluster,
+            authenticatedAt: new Date().toISOString(),
+          };
+
+          this.activeSession.wallet = this.connectedWallet;
+
+          if (typeof this.onWalletConnected === 'function') {
+            this.onWalletConnected(this.connectedWallet);
+          }
+
+          res.writeHead(200, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: true, wallet: this.connectedWallet }));
+        } catch (err) {
+          res.writeHead(500, { 'Content-Type': 'application/json' });
+          res.end(JSON.stringify({ ok: false, error: err.message }));
+        }
+      });
+      return true;
+    }
+
+    // Serve the browser companion page
+    if (url.pathname === '/' || url.pathname === '/connect') {
+      const sessionNonce = url.searchParams.get('session') || (this.activeSession ? this.activeSession.nonce : '');
+      const challenge = this.activeSession ? this.activeSession.challenge : '';
+      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.end(this.renderCompanionHtml(sessionNonce, challenge));
+      return true;
+    }
+
+    return false;
+  }
+
+  // Start the local companion server
+  async startServer() {
+    if (this.server) return `http://${this.host}:${this.port}`;
+
+    return new Promise((resolve, reject) => {
+      this.server = http.createServer((req, res) => {
+        const handled = this.handleRequest(req, res);
+        if (!handled) {
+          res.writeHead(404, { 'Content-Type': 'text/plain' });
+          res.end('Not Found');
+        }
+      });
+
+      this.server.on('error', (err) => {
+        reject(err);
+      });
+
+      this.server.listen(this.port, this.host, () => {
+        const addr = this.server.address();
+        this.port = addr.port;
+        resolve(`http://${this.host}:${this.port}`);
+      });
+    });
+  }
+
+  // Open the companion URL in the user's real browser
+  async openInSystemBrowser(sessionNonce) {
+    const url = `http://${this.host}:${this.port}/connect?session=${sessionNonce}`;
+    const startCmd = process.platform === 'win32' ? 'start' : process.platform === 'darwin' ? 'open' : 'xdg-open';
+
+    if (process.platform === 'win32') {
+      spawn('cmd.exe', ['/c', 'start', '', url], { detached: true, stdio: 'ignore' }).unref();
+    } else {
+      spawn(startCmd, [url], { detached: true, stdio: 'ignore' }).unref();
+    }
+
+    return url;
+  }
+
+  // Idempotently close the server and release sockets
+  async close() {
+    if (!this.server) return;
+    return new Promise((resolve) => {
+      this.server.close(() => {
+        this.server = null;
+        resolve();
+      });
+    });
+  }
+
+  async stopServer() {
+    return this.close();
+  }
+
+  // Render the glowing Phantom Browser Companion HTML page with in-wallet signMessage
+  renderCompanionHtml(nonce, challengeText) {
+    const escapedChallenge = JSON.stringify(challengeText || '');
+    return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>Connect Phantom — Enigma Sovereign Terminal</title>
+  <style>
+    :root {
+      color-scheme: dark;
+      --bg: #07090e;
+      --card-bg: #0d121c;
+      --border: #1e283d;
+      --orange: #ff7a1a;
+      --green: #14f195;
+      --cyan: #00f0ff;
+      --text: #f0f4f8;
+      --dim: #7f8ea3;
+      --font-mono: "Geist Mono", Consolas, monospace;
+    }
+    * { box-sizing: border-box; margin: 0; padding: 0; }
+    body {
+      background: var(--bg);
+      color: var(--text);
+      font-family: var(--font-mono);
+      min-height: 100vh;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      padding: 20px;
+    }
+    .bridge-card {
+      width: 100%;
+      max-width: 540px;
+      background: var(--card-bg);
+      border: 1px solid var(--border);
+      border-radius: 16px;
+      padding: 32px;
+      box-shadow: 0 20px 60px rgba(0,0,0,0.5);
+    }
+    .header {
+      display: flex;
+      align-items: center;
+      gap: 12px;
+      margin-bottom: 20px;
+      border-bottom: 1px solid var(--border);
+      padding-bottom: 16px;
+    }
+    .logo-icon { font-size: 24px; color: var(--orange); }
+    h1 { font-size: 16px; font-weight: 700; letter-spacing: 0.06em; }
+    .badge {
+      font-size: 11px;
+      font-weight: 700;
+      color: var(--green);
+      background: rgba(20,241,149,0.1);
+      border: 1px solid rgba(20,241,149,0.3);
+      padding: 3px 8px;
+      border-radius: 6px;
+      margin-left: auto;
+    }
+    .desc { font-size: 13px; color: var(--dim); line-height: 1.6; margin-bottom: 20px; }
+    .status-box {
+      background: rgba(0,0,0,0.3);
+      border: 1px solid var(--border);
+      border-radius: 8px;
+      padding: 16px;
+      margin-bottom: 20px;
+      font-size: 12px;
+    }
+    .status-row { display: flex; justify-content: space-between; margin-bottom: 8px; }
+    .status-row:last-child { margin-bottom: 0; }
+    .label { color: var(--dim); }
+    .val { font-weight: 700; color: var(--text); }
+    .val.green { color: var(--green); }
+    .val.orange { color: var(--orange); }
+    .challenge-preview {
+      font-size: 11px;
+      color: #8c9bb0;
+      background: #06080d;
+      border: 1px solid var(--border);
+      border-radius: 6px;
+      padding: 10px;
+      margin-bottom: 20px;
+      white-space: pre-wrap;
+      max-height: 120px;
+      overflow-y: auto;
+    }
+    .connect-btn {
+      width: 100%;
+      background: linear-gradient(135deg, #ab9ff2, #7a66f0);
+      border: 1px solid #c4baff;
+      color: #0b091a;
+      font-family: inherit;
+      font-size: 14px;
+      font-weight: 800;
+      padding: 14px;
+      border-radius: 8px;
+      cursor: pointer;
+      display: flex;
+      align-items: center;
+      justify-content: center;
+      gap: 8px;
+      transition: all 0.2s ease;
+    }
+    .connect-btn:hover {
+      transform: translateY(-2px);
+      box-shadow: 0 8px 24px rgba(122,102,240,0.4);
+    }
+    .notice {
+      margin-top: 20px;
+      font-size: 11px;
+      color: var(--dim);
+      text-align: center;
+      line-height: 1.5;
+    }
+  </style>
+</head>
+<body>
+  <div class="bridge-card">
+    <div class="header">
+      <span class="logo-icon">⚡</span>
+      <h1>ENIGMA TERMINAL COMPANION</h1>
+      <span class="badge">SOLANA MAINNET</span>
+    </div>
+    <p class="desc">
+      Sign the domain-separated authentication challenge in Phantom to verify wallet ownership for your Enigma Terminal session. Your private key stays safely in Phantom.
+    </p>
+    <div class="status-box">
+      <div class="status-row">
+        <span class="label">Session Nonce:</span>
+        <span class="val orange" id="nonceVal">${nonce.slice(0, 16)}...</span>
+      </div>
+      <div class="status-row">
+        <span class="label">Cluster:</span>
+        <span class="val green">Solana Mainnet (mainnet-beta)</span>
+      </div>
+      <div class="status-row">
+        <span class="label">Status:</span>
+        <span class="val" id="statusVal">Waiting for Phantom signature...</span>
+      </div>
+    </div>
+    <div class="challenge-preview" id="challengeBox"></div>
+    <button class="connect-btn" id="connectBtn" type="button">
+      <span>👻</span>
+      <span id="btnText">Sign Challenge & Connect</span>
+    </button>
+    <p class="notice">
+      🔒 Ed25519 Domain-Separated Signature • Single-use atomic nonce • Zero private keys exported
+    </p>
+  </div>
+
+  <script>
+    const sessionNonce = "${nonce}";
+    const challengeText = ${escapedChallenge};
+    const connectBtn = document.getElementById('connectBtn');
+    const btnText = document.getElementById('btnText');
+    const statusVal = document.getElementById('statusVal');
+    const challengeBox = document.getElementById('challengeBox');
+
+    if (challengeBox && challengeText) {
+      challengeBox.textContent = challengeText;
+    }
+
+    function getPhantomProvider() {
+      if ('phantom' in window && window.phantom?.solana?.isPhantom) {
+        return window.phantom.solana;
+      }
+      if ('solana' in window && window.solana?.isPhantom) {
+        return window.solana;
+      }
+      return null;
+    }
+
+    async function handleConnect() {
+      const provider = getPhantomProvider();
+      if (!provider) {
+        statusVal.textContent = 'Phantom extension not detected in this browser.';
+        statusVal.style.color = '#ff5555';
+        alert('Please install the Phantom Wallet extension from https://phantom.app and unlock it in Google Chrome.');
+        return;
+      }
+
+      try {
+        btnText.textContent = 'Awaiting Phantom Signature...';
+        const res = await provider.connect();
+        const pubkey = res.publicKey.toString();
+
+        // Sign the domain-separated authentication challenge
+        const encoded = new TextEncoder().encode(challengeText);
+        const signed = await provider.signMessage(encoded, 'utf8');
+        const signatureBytes = signed.signature || signed;
+        const signatureHex = Array.from(signatureBytes).map(b => b.toString(16).padStart(2, '0')).join('');
+
+        // Post signature back to terminal loopback server (server fetches verified balance via RPC)
+        const callbackRes = await fetch('/api/callback', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({
+            publicKey: pubkey,
+            signatureHex: signatureHex,
+            nonce: sessionNonce
+          })
+        });
+
+        const callbackData = await callbackRes.json();
+        if (!callbackData.ok) {
+          throw new Error(callbackData.error || 'Server signature verification failed');
+        }
+
+        const bal = callbackData.wallet?.balance || '0.0000';
+        statusVal.textContent = '✔ Authenticated: ' + pubkey.slice(0,4) + '...' + pubkey.slice(-4) + ' (' + bal + ' SOL)';
+        statusVal.className = 'val green';
+        btnText.textContent = '✔ Authenticated with Enigma Terminal';
+        connectBtn.style.background = '#14f195';
+        connectBtn.style.color = '#000';
+
+        setTimeout(() => {
+          document.body.innerHTML = '<div class="bridge-card" style="text-align:center"><h1 style="color:var(--green);margin-bottom:12px">✔ Wallet Authenticated Successfully!</h1><p class="desc">Cryptographic signature verified. You may now close this tab and return to the Enigma Terminal.</p></div>';
+        }, 1200);
+
+      } catch (err) {
+        statusVal.textContent = 'Authentication failed: ' + err.message;
+        btnText.textContent = 'Retry Phantom Connect';
+      }
+    }
+
+    connectBtn.addEventListener('click', handleConnect);
+    // Auto-prompt signature
+    setTimeout(handleConnect, 400);
+  </script>
+</body>
+</html>`;
+  }
+}