friend-assistant 0.1.14 → 0.1.15

package/README.md

@@ -85,6 +85,8 @@ Every command starts with `friend`. If you run Friend from the source code, writ
 
 | Command | What it does | Use it when |
 |---|---|---|
+| `friend password` | Sets a new sign-in password (asks twice, nothing is shown while you type). The old one is not needed, because you are at this PC, so it is also the way back in if you forgot it. Every browser and phone is signed out. | You forgot the password, or want a new one. From the screen: Esc → Settings → Security. |
+| `friend pin` | Sets a new PIN, the number Friend asks for before risky actions. | You forgot the PIN, or want a new one. |
 | `friend daemon start` | Runs Friend in the background, with no terminal window needed. Prints the address, keeps a log in the data folder (`friend.log`). | You want Friend always available, even after you close the terminal. |
 | `friend daemon stop` | Stops the background Friend and the speech engine with it. | Shutting it down. |
 | `friend daemon restart` | Stops it and starts it again. | After changing a setting such as `friend lan on` or a different model. |

package/dist/BUILD.json

@@ -1,5 +1,5 @@
 {
   "name": "friend-assistant",
-  "version": "0.1.14",
-  "builtAt": "2026-10-10T06:29:10.737Z"
+  "version": "0.1.15",
+  "builtAt": "2026-10-10T11:42:54.414Z"
 }

package/dist/friend.mjs

@@ -3031,7 +3031,7 @@ async function verifySecret(secret, stored) {
   const actual = await scryptAsync(secret, Buffer.from(saltHex, "hex"));
   return expected.length === actual.length && timingSafeEqual(expected, actual);
 }
-var Auth = class {
+var Auth = class _Auth {
   constructor(db, audit, clock = Date.now) {
     this.db = db;
     this.audit = audit;
@@ -3116,6 +3116,48 @@ var Auth = class {
     else this.audit.log("owner", "pin.fail", { ip });
     return ok;
   }
+  /** Checks a new password and/or PIN the same way setup does. Returns the problem, or null when both are fine. */
+  static checkNewSecrets(input) {
+    if (input.newPassword === void 0 && input.newPin === void 0) return "Give a new password or a new PIN.";
+    if (input.newPin !== void 0 && !/^\d{6,}$/.test(input.newPin)) return "PIN must be at least 6 digits";
+    if (input.newPassword !== void 0 && input.newPassword.length < 8) return "Password must be at least 8 characters";
+    return null;
+  }
+  async store(input) {
+    if (input.newPassword !== void 0) this.db.prepare("update owner set password_hash = ? where id = 1").run(await hashSecret(input.newPassword));
+    if (input.newPin !== void 0) this.db.prepare("update owner set pin_hash = ? where id = 1").run(await hashSecret(input.newPin));
+  }
+  /**
+   * Changes the password and/or PIN of a signed-in owner who proves it with the current password. Wrong guesses count toward
+   * the same sign-in lock. A new password signs every other browser out (the one in `keepToken` stays signed in).
+   */
+  async changeSecrets(input, ip, keepToken) {
+    const problem = _Auth.checkNewSecrets(input);
+    if (problem) throw new Error(problem);
+    const succeeded = this.begin("login", ip);
+    const row = this.db.prepare("select password_hash h from owner where id = 1").get();
+    const ok = row ? await verifySecret(input.current, row.h) : false;
+    if (!ok) {
+      this.audit.log("owner", "secrets.fail", { ip });
+      throw new Error("Invalid credentials");
+    }
+    succeeded();
+    await this.store(input);
+    if (input.newPassword !== void 0) {
+      if (keepToken) this.db.prepare("update sessions set revoked = 1 where token_hash != ?").run(sha256(keepToken));
+      else this.db.prepare("update sessions set revoked = 1").run();
+    }
+    this.audit.log("owner", "secrets.changed", { password: input.newPassword !== void 0, pin: input.newPin !== void 0 });
+  }
+  /** For `friend password` / `friend pin` run on this PC: no current password needed (being on the PC is the proof). Signs everyone out. */
+  async resetSecrets(input) {
+    if (!this.hasOwner()) throw new Error("There is no owner yet. Run: friend setup");
+    const problem = _Auth.checkNewSecrets(input);
+    if (problem) throw new Error(problem);
+    await this.store(input);
+    if (input.newPassword !== void 0) this.db.prepare("update sessions set revoked = 1").run();
+    this.audit.log("system", "secrets.reset", { password: input.newPassword !== void 0, pin: input.newPin !== void 0 });
+  }
   createPairCode() {
     const code = randomBytes(5).toString("hex").toUpperCase();
     this.db.prepare("insert into pair_codes (code_hash, expires_at) values (?, ?)").run(sha256(code), this.clock() + PAIR_TTL_MS);
@@ -4078,6 +4120,30 @@ function createGateway(deps) {
     reply.clearCookie(COOKIE_NAME, { path: "/" });
     return { ok: true };
   });
+  app.post("/api/account/secret", async (req, reply) => {
+    reply.header("cache-control", "no-store");
+    const token = req.cookies[COOKIE_NAME];
+    if (!token || !auth.resolveSession(token)) return reply.code(401).send({ error: "Please sign in again." });
+    const body = z10.object({ current: z10.string().min(1).max(1024), newPassword: z10.string().max(1024).optional(), newPin: z10.string().max(128).optional() }).safeParse(req.body);
+    if (!body.success) return reply.code(400).send({ error: "Invalid input" });
+    const { current, newPassword, newPin } = body.data;
+    try {
+      await auth.changeSecrets({ current, newPassword, newPin }, req.ip, token);
+      return { ok: true, signedOutOthers: newPassword !== void 0 };
+    } catch (e) {
+      if (e instanceof LockoutError) {
+        const seconds = Math.max(1, Math.ceil(e.retryAfterMs / 1e3));
+        return reply.code(429).header("retry-after", seconds).send({ error: `Too many wrong passwords. Try again in ${waitText(seconds)}.`, retryAfterSeconds: seconds });
+      }
+      if (e.message === "Invalid credentials") {
+        const state = auth.loginState(req.ip);
+        const seconds = Math.ceil(state.retryAfterMs / 1e3);
+        if (seconds > 0) return reply.code(401).send({ error: `Wrong password. Locked for ${waitText(seconds)}.`, triesLeft: 0, retryAfterSeconds: seconds });
+        return reply.code(401).send({ error: "The current password is wrong.", triesLeft: state.triesLeft });
+      }
+      return reply.code(400).send({ error: e.message });
+    }
+  });
   const pairLimiter = new RateLimiter(Date.now);
   app.post("/api/pair", async (req, reply) => {
     const body = z10.object({ code: z10.string().min(1).max(64), name: z10.string().min(1).max(64) }).safeParse(req.body);
@@ -9594,7 +9660,7 @@ async function daemonCommand(args, io2, deps = realDeps) {
 import crossSpawn5 from "cross-spawn";
 var PACKAGE = "friend-assistant";
 var real = {
-  current: () => true ? "0.1.14" : "development",
+  current: () => true ? "0.1.15" : "development",
   latest: () => new Promise((resolve10) => {
     const child = crossSpawn5("npm", ["view", PACKAGE, "version", "--prefer-online"], { stdio: ["ignore", "pipe", "ignore"] });
     let out = "";
@@ -9772,6 +9838,35 @@ async function setupCommand3(io2) {
   }
 }
 
+// ../agent-cli/src/commands/secret.ts
+async function secretCommand(kind, io2) {
+  const db = openDb(io2.dataDir);
+  try {
+    const auth = new Auth(db, new Audit(db));
+    if (!auth.hasOwner()) {
+      io2.err("There is no owner yet. Run: friend setup");
+      return 1;
+    }
+    const label2 = kind === "password" ? "password" : "PIN";
+    const first2 = await io2.ask(`New ${label2} (${kind === "password" ? "at least 8 characters" : "at least 6 digits"}): `, { hidden: true });
+    const problem = Auth.checkNewSecrets(kind === "password" ? { newPassword: first2 } : { newPin: first2 });
+    if (problem) {
+      io2.err(problem);
+      return 1;
+    }
+    const again = await io2.ask(`Type the new ${label2} again: `, { hidden: true });
+    if (again !== first2) {
+      io2.err(`The two ${label2}s are not the same. Nothing was changed.`);
+      return 1;
+    }
+    await auth.resetSecrets(kind === "password" ? { newPassword: first2 } : { newPin: first2 });
+    io2.out(kind === "password" ? "Password changed. Every browser and phone has been signed out; sign in again with the new password." : "PIN changed.");
+    return 0;
+  } finally {
+    db.close();
+  }
+}
+
 // ../agent-cli/src/commands/status.ts
 async function statusCommand3(io2) {
   const cfg = loadConfig(io2.dataDir);
@@ -9796,6 +9891,8 @@ var USAGE4 = `Usage: friend <command>
   onboard                    guided setup, step by step: checks this PC, installs what is missing, asks what you want
   doctor                     check what this PC has and what is missing (changes nothing)
   setup                      create the owner account (password, PIN, assistant name)
+  password                   change the sign-in password (signs every browser out)
+  pin                        change the PIN for risky actions
   start                      run the gateway and a local device node
   daemon start|stop|restart|status  run Friend in the background (no terminal needed), stop it, or see if it is running
   upgrade [--force]          stop the background Friend, install the newest version, start it again
@@ -9821,6 +9918,10 @@ async function run(argv, io2) {
     switch (cmd) {
       case "setup":
         return await setupCommand3(io2);
+      case "password":
+        return await secretCommand("password", io2);
+      case "pin":
+        return await secretCommand("pin", io2);
       case "start":
         return await startCommand(io2);
       case "daemon":
@@ -9847,7 +9948,7 @@ async function run(argv, io2) {
       case "version":
       case "--version":
       case "-v":
-        io2.out(true ? "0.1.14" : "development");
+        io2.out(true ? "0.1.15" : "development");
         return 0;
       case "lan":
         return await lanCommand(rest, io2);