gnoman 0.1.0

package/gnoman2.0/renderer/src/pages/WikiGuide.tsx

@@ -0,0 +1,75 @@
+const WikiGuide = () => {
+  return (
+    <div className="space-y-6">
+      <section className="rounded-lg border border-slate-800 bg-slate-900/60 p-6">
+        <h1 className="text-2xl font-semibold text-slate-100">GNOMAN 2.0 Wiki</h1>
+        <p className="mt-3 text-sm text-slate-400">
+          Welcome to the GNOMAN 2.0 knowledge base. This in-app guide highlights the most common
+          workflows so you can remain focused on secure Safe operations without leaving the desktop
+          client.
+        </p>
+      </section>
+
+      <section className="rounded-lg border border-slate-800 bg-slate-900/60 p-6">
+        <h2 className="text-xl font-semibold text-slate-100">Getting Started</h2>
+        <ul className="mt-3 space-y-2 text-sm text-slate-400">
+          <li>
+            <span className="font-medium text-slate-200">Connect the backend:</span> Start the
+            Express server with <code className="rounded bg-slate-800 px-1 py-0.5">npm run dev:backend</code>{' '}
+            to unlock wallet and Safe orchestration APIs.
+          </li>
+          <li>
+            <span className="font-medium text-slate-200">Launch the renderer:</span> Use{' '}
+            <code className="rounded bg-slate-800 px-1 py-0.5">npm run dev:renderer</code> to preview
+            UI changes in the browser or desktop shell.
+          </li>
+          <li>
+            <span className="font-medium text-slate-200">Authenticate your workspace:</span> Activate
+            your offline license from <strong>Settings &gt; Offline License Activation</strong> to enable
+            enterprise policy enforcement.
+          </li>
+        </ul>
+      </section>
+
+      <section className="rounded-lg border border-slate-800 bg-slate-900/60 p-6">
+        <h2 className="text-xl font-semibold text-slate-100">Wallet Management</h2>
+        <p className="mt-3 text-sm text-slate-400">
+          Generate or import wallets from the <strong>Wallets</strong> tab. GNOMAN 2.0 encrypts private
+          keys using AES-256-GCM before persisting them to disk. Always export encrypted backups after
+          onboarding a signing device.
+        </p>
+        <ul className="mt-3 list-inside list-disc space-y-1 text-sm text-slate-400">
+          <li>Use vanity search for predictable addresses without exposing seed phrases.</li>
+          <li>Store aliases in the active keyring service via the <strong>Keyring</strong> tab.</li>
+          <li>Keep hot wallets isolated by leveraging Safe modules and transaction holds.</li>
+        </ul>
+      </section>
+
+      <section className="rounded-lg border border-slate-800 bg-slate-900/60 p-6">
+        <h2 className="text-xl font-semibold text-slate-100">Safe Operations</h2>
+        <p className="mt-3 text-sm text-slate-400">
+          The <strong>Safes</strong> dashboard surfaces owners, module toggles, and pending
+          transactions. Enable the 24-hour hold policy to protect high-value actions and require a
+          secondary review window.
+        </p>
+        <p className="mt-3 text-sm text-slate-400">
+          Simulate execution flows inside the <strong>Sandbox</strong> to verify calldata before
+          requesting signatures. The sandbox proxies <code className="rounded bg-slate-800 px-1 py-0.5">callStatic</code>{' '}
+          invocations through the backend for deterministic results.
+        </p>
+      </section>
+
+      <section className="rounded-lg border border-slate-800 bg-slate-900/60 p-6">
+        <h2 className="text-xl font-semibold text-slate-100">Security Checklist</h2>
+        <ul className="mt-3 list-inside list-disc space-y-2 text-sm text-slate-400">
+          <li>Verify product registration and license compliance on every new workstation.</li>
+          <li>Audit connected RPC endpoints and rotate API keys regularly.</li>
+          <li>Enable OS-level full disk encryption so GNOMAN 2.0 secrets remain isolated.</li>
+          <li>Keep the Electron shell and backend dependencies patched to the latest releases.</li>
+        </ul>
+      </section>
+    </div>
+  );
+};
+
+export default WikiGuide;

package/gnoman2.0/renderer/src/styles.css

@@ -0,0 +1,32 @@
+@tailwind base;
+@tailwind components;
+@tailwind utilities;
+
+body {
+  font-family: 'Inter', sans-serif;
+}
+
+:root[data-theme='light'] body {
+  background-color: #f8fafc;
+  color: #0f172a;
+}
+
+:root[data-theme='dark'] {
+  --panel-bg: rgba(15, 23, 42, 0.6);
+  --panel-border: rgba(148, 163, 184, 0.2);
+  --panel-text: #e2e8f0;
+}
+
+:root[data-theme='light'] {
+  --panel-bg: rgba(255, 255, 255, 0.85);
+  --panel-border: rgba(15, 23, 42, 0.12);
+  --panel-text: #0f172a;
+}
+
+.theme-panel {
+  background-color: var(--panel-bg) !important;
+  border-color: var(--panel-border) !important;
+  color: var(--panel-text);
+  backdrop-filter: saturate(1.2) blur(8px);
+  transition: background-color 200ms ease, border-color 200ms ease, color 200ms ease;
+}

package/gnoman2.0/renderer/src/types/gnoman.d.ts

@@ -0,0 +1,9 @@
+declare global {
+  interface Window {
+    gnoman?: {
+      invoke: <T = unknown>(channel: 'keyring:list' | 'keyring:add' | 'keyring:get' | 'keyring:delete', payload?: unknown) => Promise<T>;
+    };
+  }
+}
+
+export {};

package/gnoman2.0/renderer/src/types/license.ts

@@ -0,0 +1,8 @@
+export interface LicenseStatus {
+  active: boolean;
+  identifier?: string;
+  product?: string;
+  version?: string;
+  expiry?: string;
+  token?: string;
+}

package/gnoman2.0/renderer/src/types/safevault.d.ts

@@ -0,0 +1,17 @@
+type SafevaultValidationResult = {
+  ok: boolean;
+  reason?: string;
+};
+
+type SafevaultAPI = {
+  validateLicense: (key: string) => SafevaultValidationResult;
+  loadLicense: () => SafevaultValidationResult;
+};
+
+declare global {
+  interface Window {
+    safevault: SafevaultAPI;
+  }
+}
+
+export {};

package/gnoman2.0/renderer/src/utils/backend.ts

@@ -0,0 +1,88 @@
+const STORAGE_KEY = 'gnoman:backend-base-url';
+const DEFAULT_PORT = 4399;
+const DEFAULT_BASE_URL = `http://127.0.0.1:${DEFAULT_PORT}`;
+const BACKEND_CHANGE_EVENT = 'gnoman:backend-change';
+
+const normalizeBaseUrl = (url: string) => url.trim().replace(/\/+$/, '');
+
+const readEnvBaseUrl = () => {
+  const env = import.meta.env.VITE_GNOMAN_BACKEND_URL;
+  if (typeof env === 'string' && env.trim().length > 0) {
+    return normalizeBaseUrl(env);
+  }
+  return null;
+};
+
+export const getStoredBackendBaseUrl = () => {
+  try {
+    return localStorage.getItem(STORAGE_KEY);
+  } catch {
+    return null;
+  }
+};
+
+export const getBackendBaseUrl = () => getStoredBackendBaseUrl() ?? readEnvBaseUrl() ?? DEFAULT_BASE_URL;
+
+export const setBackendBaseUrl = (url: string) => {
+  const normalized = normalizeBaseUrl(url);
+  localStorage.setItem(STORAGE_KEY, normalized);
+  window.dispatchEvent(new CustomEvent(BACKEND_CHANGE_EVENT, { detail: normalized }));
+  return normalized;
+};
+
+export const buildBackendUrl = (path: string) => {
+  const base = getBackendBaseUrl();
+  const suffix = path.startsWith('/') ? path : `/${path}`;
+  return `${base}${suffix}`;
+};
+
+export const onBackendBaseUrlChange = (handler: (url: string) => void) => {
+  const listener = (event: Event) => {
+    if (event instanceof CustomEvent && typeof event.detail === 'string') {
+      handler(event.detail);
+    }
+  };
+  window.addEventListener(BACKEND_CHANGE_EVENT, listener);
+  return () => window.removeEventListener(BACKEND_CHANGE_EVENT, listener);
+};
+
+export const probeBackend = async (url: string, timeoutMs = 1500) => {
+  const controller = new AbortController();
+  const timeoutId = window.setTimeout(() => controller.abort(), timeoutMs);
+  try {
+    const response = await fetch(`${normalizeBaseUrl(url)}/api/health`, {
+      cache: 'no-store',
+      signal: controller.signal
+    });
+    return response.ok;
+  } catch {
+    return false;
+  } finally {
+    window.clearTimeout(timeoutId);
+  }
+};
+
+export const detectBackendBaseUrl = async (timeoutMs = 1500) => {
+  const candidates = new Set<string>();
+  const stored = getStoredBackendBaseUrl();
+  const env = readEnvBaseUrl();
+  if (stored) {
+    candidates.add(normalizeBaseUrl(stored));
+  }
+  if (env) {
+    candidates.add(env);
+  }
+  candidates.add(DEFAULT_BASE_URL);
+  candidates.add(`http://localhost:${DEFAULT_PORT}`);
+  if (typeof window !== 'undefined' && window.location?.hostname) {
+    const host = window.location.hostname;
+    candidates.add(`http://${host}:${DEFAULT_PORT}`);
+  }
+
+  for (const candidate of candidates) {
+    if (await probeBackend(candidate, timeoutMs)) {
+      return normalizeBaseUrl(candidate);
+    }
+  }
+  return null;
+};

package/gnoman2.0/renderer/tailwind.config.cjs

@@ -0,0 +1,8 @@
+module.exports = {
+  darkMode: ['class'],
+  content: ['./index.html', './src/**/*.{js,ts,jsx,tsx}'],
+  theme: {
+    extend: {}
+  },
+  plugins: []
+};

package/gnoman2.0/renderer/tsconfig.json

@@ -0,0 +1,13 @@
+{
+  "extends": "../tsconfig.json",
+  "compilerOptions": {
+    "jsx": "react-jsx",
+    "allowJs": false,
+    "baseUrl": "./src",
+    "module": "ESNext",
+    "outDir": "./dist",
+    "types": ["vite/client", "react", "react-dom"]
+  },
+  "include": ["src", "../modules/sandbox/ui/**/*.tsx", "../modules/sandbox/types.ts", "../modules/sandbox/formBuilder.ts"],
+  "exclude": ["node_modules", "dist"]
+}

package/gnoman2.0/renderer/tsconfig.node.json

@@ -0,0 +1,9 @@
+{
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "composite": true,
+    "module": "ESNext",
+    "moduleResolution": "Node"
+  },
+  "include": ["vite.config.ts"]
+}

package/gnoman2.0/renderer/vite.config.ts

@@ -0,0 +1,19 @@
+import { defineConfig } from 'vite';
+import react from '@vitejs/plugin-react';
+
+export default defineConfig({
+  base: './',
+  plugins: [react()],
+  server: {
+    port: 5173,
+    strictPort: true,
+    fs: {
+      allow: ['..']
+    }
+  },
+  build: {
+    outDir: 'dist',
+    emptyOutDir: true,
+    manifest: true
+  }
+});

package/gnoman2.0/requests/__init__.py

@@ -0,0 +1,35 @@
+"""Minimal requests-compatible shim built on urllib for GNOMAN."""
+
+from __future__ import annotations
+
+import json
+from dataclasses import dataclass
+from urllib.error import HTTPError, URLError
+from urllib.request import Request, urlopen
+
+
+@dataclass
+class Response:
+    body: bytes
+    status_code: int
+    url: str
+
+    def raise_for_status(self) -> None:
+        if 400 <= self.status_code:
+            raise HTTPError(self.url, self.status_code, "HTTP Error", hdrs=None, fp=None)
+
+    def json(self):
+        return json.loads(self.body.decode("utf-8"))
+
+
+def get(url: str, timeout: int = 10) -> Response:
+    request = Request(url)
+    try:
+        with urlopen(request, timeout=timeout) as http_response:
+            body = http_response.read()
+            status = getattr(http_response, "status", 200)
+    except HTTPError as exc:
+        raise HTTPError(url, exc.code, exc.reason, exc.hdrs, exc.fp) from exc
+    except URLError as exc:
+        raise ConnectionError(str(exc)) from exc
+    return Response(body=body, status_code=status, url=url)

package/gnoman2.0/scripts/build-ios.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+if ! command -v xcodebuild >/dev/null 2>&1; then
+  echo "xcodebuild not found. Run this on macOS with Xcode installed."
+  exit 1
+fi
+
+npm run ios:sync
+
+WORKSPACE="ios/App/App.xcworkspace"
+SCHEME="App"
+ARCHIVE_PATH="ios/build/GNOMAN.xcarchive"
+EXPORT_PATH="ios/build/export"
+EXPORT_OPTIONS="ios/ExportOptions.plist"
+
+xcodebuild \
+  -workspace "$WORKSPACE" \
+  -scheme "$SCHEME" \
+  -configuration Release \
+  -destination "generic/platform=iOS" \
+  -archivePath "$ARCHIVE_PATH" \
+  archive
+
+xcodebuild -exportArchive \
+  -archivePath "$ARCHIVE_PATH" \
+  -exportOptionsPlist "$EXPORT_OPTIONS" \
+  -exportPath "$EXPORT_PATH"
+
+echo "IPA export complete at: $EXPORT_PATH"

package/gnoman2.0/scripts/copyBackendAssets.js

@@ -0,0 +1,24 @@
+const fs = require('fs');
+const path = require('path');
+
+const assets = [
+  {
+    source: path.join(__dirname, '../backend/licenses/license_public.pem'),
+    target: path.join(__dirname, '../dist/backend/backend/licenses/license_public.pem')
+  }
+];
+
+const copyAsset = ({ source, target }) => {
+  if (!fs.existsSync(source)) {
+    console.warn(`Skipping missing backend asset: ${source}`);
+    return;
+  }
+
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  fs.copyFileSync(source, target);
+  console.log(`Copied ${source} -> ${target}`);
+};
+
+for (const asset of assets) {
+  copyAsset(asset);
+}

package/gnoman2.0/scripts/copyRenderer.js

@@ -0,0 +1,87 @@
+const fs = require('fs');
+const path = require('path');
+
+const sourceDir = path.resolve(__dirname, '..', 'renderer', 'dist');
+const targetDir = path.resolve(__dirname, '..', 'dist', 'renderer');
+const manifestKey = 'index.html';
+
+if (!fs.existsSync(sourceDir)) {
+  console.warn('Renderer build output not found at', sourceDir);
+  process.exit(0);
+}
+
+fs.rmSync(targetDir, { recursive: true, force: true });
+fs.mkdirSync(targetDir, { recursive: true });
+
+const copyRecursive = (src, dest) => {
+  const entries = fs.readdirSync(src, { withFileTypes: true });
+  for (const entry of entries) {
+    const srcPath = path.join(src, entry.name);
+    const destPath = path.join(dest, entry.name);
+    if (entry.isDirectory()) {
+      fs.mkdirSync(destPath, { recursive: true });
+      copyRecursive(srcPath, destPath);
+    } else {
+      fs.copyFileSync(srcPath, destPath);
+    }
+  }
+};
+
+copyRecursive(sourceDir, targetDir);
+const rewriteIndexHtml = () => {
+  const manifestPath = path.join(sourceDir, '.vite', 'manifest.json');
+  if (!fs.existsSync(manifestPath)) {
+    console.warn('Renderer manifest not found at', manifestPath);
+    return;
+  }
+
+  const manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf-8'));
+  const entry = manifest[manifestKey];
+
+  if (!entry || !entry.file) {
+    throw new Error(`Renderer manifest missing bundle information for ${manifestKey}`);
+  }
+
+  const toRelative = (filePath) => {
+    if (filePath.startsWith('./')) {
+      return `./${filePath.slice(2)}`;
+    }
+
+    if (filePath.startsWith('/')) {
+      return `./${filePath.slice(1)}`;
+    }
+
+    return `./${filePath}`;
+  };
+  const scriptPath = toRelative(entry.file);
+  const cssPaths = (entry.css ?? []).map((cssFile) => toRelative(cssFile));
+
+  const indexPath = path.join(targetDir, 'index.html');
+  if (!fs.existsSync(indexPath)) {
+    throw new Error('Renderer index.html was not copied to the build output.');
+  }
+
+  const removeTags = (html, pattern) => html.replace(pattern, '');
+  const scriptPattern = /<script\b[^>]*src="[^"]+"[^>]*><\/script>\s*/gi;
+  const stylesheetPattern = /<link\b[^>]*rel=["']stylesheet["'][^>]*>\s*/gi;
+
+  let html = fs.readFileSync(indexPath, 'utf-8');
+  html = removeTags(html, scriptPattern);
+  html = removeTags(html, stylesheetPattern);
+
+  const assetTags = [
+    ...cssPaths.map((href) => `    <link rel="stylesheet" href="${href}">`),
+    `    <script type="module" src="${scriptPath}"></script>`
+  ].join('\n');
+
+  if (!html.includes('</head>')) {
+    throw new Error('Renderer index.html is missing a </head> tag.');
+  }
+
+  html = html.replace('</head>', `\n${assetTags}\n  </head>`);
+  fs.writeFileSync(indexPath, html, 'utf-8');
+};
+
+rewriteIndexHtml();
+
+console.log('Copied renderer bundle to', targetDir);

package/gnoman2.0/scripts/launchElectron.js

@@ -0,0 +1,51 @@
+const { spawn } = require('child_process');
+const electronPath = require('electron');
+
+const sanitizeGtkModules = (envVar) => {
+  const modules = process.env[envVar];
+
+  if (!modules) {
+    return;
+  }
+
+  const sanitizedModules = modules
+    .split(':')
+    .map((moduleName) => moduleName.trim())
+    .filter((moduleName) => moduleName && moduleName !== 'colorreload-gtk-module');
+
+  if (sanitizedModules.length === 0) {
+    delete process.env[envVar];
+    return;
+  }
+
+  const normalized = sanitizedModules.join(':');
+
+  if (normalized !== modules) {
+    process.env[envVar] = normalized;
+  }
+};
+
+if (process.platform === 'linux') {
+  sanitizeGtkModules('GTK_MODULES');
+  sanitizeGtkModules('GTK3_MODULES');
+}
+
+const child = spawn(electronPath, ['.'], {
+  stdio: 'inherit',
+  env: process.env
+});
+
+child.on('exit', (code, signal) => {
+  if (signal) {
+    process.kill(process.pid, signal);
+    return;
+  }
+
+  process.exit(code ?? 0);
+});
+
+child.on('error', (error) => {
+  console.error('Failed to launch Electron:', error);
+  process.exit(1);
+});
+

package/gnoman2.0/src/core/backends/fileBackend.ts

@@ -0,0 +1,154 @@
+import fs from 'fs/promises';
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+import { BackendUnavailableError, KeyringBackend } from './types';
+
+const DEFAULT_FILE = process.env.GNOMAN_KEYRING_FILE ?? path.join(os.homedir(), '.gnoman', 'secrets.enc');
+const DIR_MODE = 0o700;
+const FILE_MODE = 0o600;
+const HKDF_INFO = Buffer.from('gnoman-keyring-file', 'utf8');
+const SALT_BYTES = 32;
+const NONCE_BYTES = 12;
+
+const serialize = (record: Record<string, string>) => JSON.stringify(record, null, 2);
+
+const getPasswordMaterial = () => {
+  if (process.env.GNOMAN_KEYRING_PASSWORD) {
+    return process.env.GNOMAN_KEYRING_PASSWORD;
+  }
+  const userInfo = (() => {
+    try {
+      return os.userInfo().username;
+    } catch {
+      return 'unknown-user';
+    }
+  })();
+  return `${os.hostname()}|${userInfo}`;
+};
+
+const maskFilesystemError = (error: unknown): BackendUnavailableError => {
+  const detail = error instanceof Error ? error.message : String(error);
+  return new BackendUnavailableError(`File keyring unavailable: ${detail}`, 'file');
+};
+
+type PersistedPayload = {
+  version: 1;
+  salt: string;
+  nonce: string;
+  authTag: string;
+  data: string;
+};
+
+export class FileBackend implements KeyringBackend {
+  private readonly filePath: string;
+
+  private cache = new Map<string, string>();
+
+  private salt?: Buffer;
+
+  private initialized = false;
+
+  constructor(filePath = DEFAULT_FILE) {
+    this.filePath = filePath;
+  }
+
+  private async ensureDirectory() {
+    const dir = path.dirname(this.filePath);
+    await fs.mkdir(dir, { recursive: true, mode: DIR_MODE });
+  }
+
+  private deriveKey(salt: Buffer): Buffer {
+    try {
+      const derived = crypto.hkdfSync('sha256', Buffer.from(getPasswordMaterial()), salt, HKDF_INFO, 32);
+      return Buffer.from(derived);
+    } catch (error) {
+      throw maskFilesystemError(error);
+    }
+  }
+
+  private async loadFromDisk() {
+    try {
+      const raw = await fs.readFile(this.filePath, 'utf8');
+      const payload = JSON.parse(raw) as PersistedPayload;
+      const salt = Buffer.from(payload.salt, 'base64');
+      const nonce = Buffer.from(payload.nonce, 'base64');
+      const authTag = Buffer.from(payload.authTag, 'base64');
+      const encrypted = Buffer.from(payload.data, 'base64');
+      const key = this.deriveKey(salt);
+      const decipher = crypto.createDecipheriv('aes-256-gcm', key, nonce);
+      decipher.setAuthTag(authTag);
+      const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()]);
+      const record = JSON.parse(decrypted.toString('utf8')) as Record<string, string>;
+      this.cache = new Map(Object.entries(record));
+      this.salt = salt;
+    } catch (error) {
+      const nodeError = error as NodeJS.ErrnoException;
+      if (nodeError?.code === 'ENOENT') {
+        this.cache = new Map();
+        this.salt = undefined;
+        return;
+      }
+      throw maskFilesystemError(error);
+    }
+  }
+
+  private async persist() {
+    try {
+      await this.ensureDirectory();
+      const salt = this.salt ?? crypto.randomBytes(SALT_BYTES);
+      this.salt = salt;
+      const key = this.deriveKey(salt);
+      const nonce = crypto.randomBytes(NONCE_BYTES);
+      const cipher = crypto.createCipheriv('aes-256-gcm', key, nonce);
+      const plaintext = Buffer.from(serialize(Object.fromEntries(this.cache.entries())), 'utf8');
+      const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+      const authTag = cipher.getAuthTag();
+      const payload: PersistedPayload = {
+        version: 1,
+        salt: salt.toString('base64'),
+        nonce: nonce.toString('base64'),
+        authTag: authTag.toString('base64'),
+        data: encrypted.toString('base64')
+      };
+      await fs.writeFile(this.filePath, JSON.stringify(payload), { mode: FILE_MODE });
+    } catch (error) {
+      throw maskFilesystemError(error);
+    }
+  }
+
+  async initialize(): Promise<void> {
+    await this.loadFromDisk();
+    this.initialized = true;
+  }
+
+  private async ensureReady() {
+    if (!this.initialized) {
+      await this.initialize();
+    }
+  }
+
+  async get(key: string): Promise<string | null> {
+    await this.ensureReady();
+    return this.cache.get(key) ?? null;
+  }
+
+  async set(key: string, value: string): Promise<void> {
+    await this.ensureReady();
+    this.cache.set(key, value);
+    await this.persist();
+  }
+
+  async delete(key: string): Promise<void> {
+    await this.ensureReady();
+    this.cache.delete(key);
+    await this.persist();
+  }
+
+  async list(): Promise<Record<string, string>> {
+    await this.ensureReady();
+    return Object.fromEntries(this.cache.entries());
+  }
+}
+
+export default FileBackend;