local-operator-ui 0.29.4 → 0.29.6

package/out/main/index.js

@@ -9584,6 +9584,428 @@ class BackendInstaller {
     }
   }
 }
+const WEBAUTHN_GROUP_SUFFIX = ".webauthn";
+const WEBAUTHN_PROMPT_REASON = "use a passkey for $1";
+const WEBAUTHN_CHOOSER_TIMEOUT_MS = 6e4;
+const CODESIGN_TIMEOUT_MS = 5e3;
+function webauthnKeychainAccessGroup(teamIdentifier, bundleIdentifier) {
+  return `${teamIdentifier}.${bundleIdentifier}${WEBAUTHN_GROUP_SUFFIX}`;
+}
+function appBundlePathFromExecutable(execPath) {
+  const parts = execPath.split("/");
+  const macOs = parts.lastIndexOf("MacOS");
+  if (macOs < 2 || parts[macOs - 1] !== "Contents") {
+    return execPath;
+  }
+  return parts.slice(0, macOs - 1).join("/") || "/";
+}
+const TEAM_IDENTIFIER_LINE = /^TeamIdentifier=(.*)$/m;
+const IDENTIFIER_LINE = /^Identifier=(.*)$/m;
+function parseTeamIdentifier(codesignVerboseOutput) {
+  const match = TEAM_IDENTIFIER_LINE.exec(codesignVerboseOutput);
+  const value = (match?.[1] ?? "").trim();
+  return value && value !== "not set" ? value : null;
+}
+function parseBundleIdentifier(codesignVerboseOutput) {
+  const match = IDENTIFIER_LINE.exec(codesignVerboseOutput);
+  const value = (match?.[1] ?? "").trim();
+  return value || null;
+}
+function parseKeychainAccessGroups(entitlementsPlist) {
+  const key = entitlementsPlist.indexOf("<key>keychain-access-groups</key>");
+  if (key === -1) return [];
+  const after = entitlementsPlist.slice(key);
+  const arrayStart = after.indexOf("<array>");
+  const arrayEnd = after.indexOf("</array>", arrayStart + 1);
+  if (arrayStart === -1 || arrayEnd === -1) return [];
+  const body = after.slice(arrayStart + "<array>".length, arrayEnd);
+  const groups = [];
+  const pattern = /<string>([^<]*)<\/string>/g;
+  let match = pattern.exec(body);
+  while (match !== null) {
+    const value = match[1].trim();
+    if (value) groups.push(value);
+    match = pattern.exec(body);
+  }
+  return groups;
+}
+function decideWebauthnGate(facts) {
+  if (facts.platform !== "darwin") {
+    return {
+      enabled: false,
+      group: null,
+      reason: "not darwin",
+      detail: `the platform authenticator is macOS only (platform ${facts.platform})`
+    };
+  }
+  if (!facts.packaged) {
+    return {
+      enabled: false,
+      group: null,
+      reason: "unpackaged",
+      detail: "an unpackaged run has no signature to carry the entitlement, so there is no group to configure"
+    };
+  }
+  if (facts.unreadable) {
+    return {
+      enabled: false,
+      group: null,
+      reason: "signature unreadable",
+      detail: facts.unreadable
+    };
+  }
+  if (!facts.bundleIdentifier) {
+    return {
+      enabled: false,
+      group: null,
+      reason: "no bundle id",
+      detail: `codesign reported no Identifier for ${facts.bundlePath}`
+    };
+  }
+  if (!facts.teamIdentifier) {
+    return {
+      enabled: false,
+      group: null,
+      reason: "no team id",
+      detail: `${facts.bundlePath} is not team-signed (an ad-hoc signature has no TeamIdentifier)`
+    };
+  }
+  const group = webauthnKeychainAccessGroup(
+    facts.teamIdentifier,
+    facts.bundleIdentifier
+  );
+  if (facts.keychainAccessGroups.length === 0) {
+    return {
+      enabled: false,
+      group,
+      reason: "entitlement absent",
+      detail: `the signature carries no keychain-access-groups entitlement, so ${group} cannot be used`
+    };
+  }
+  if (!facts.keychainAccessGroups.includes(group)) {
+    return {
+      enabled: false,
+      group,
+      reason: "entitlement mismatch",
+      detail: `the signature's keychain-access-groups are [${facts.keychainAccessGroups.join(", ")}] but the authenticator needs ${group}`
+    };
+  }
+  return {
+    enabled: true,
+    group,
+    reason: "enabled",
+    detail: `the signature carries ${group}`
+  };
+}
+const defaultCodesign = (file, args) => new Promise((resolve, reject) => {
+  node_child_process.execFile(
+    file,
+    args,
+    { timeout: CODESIGN_TIMEOUT_MS },
+    (error, stdout, stderr) => {
+      if (error) {
+        reject(
+          new Error(
+            `${error.message}${stderr ? ` (${String(stderr).trim()})` : ""}`
+          )
+        );
+        return;
+      }
+      resolve({ stdout: String(stdout), stderr: String(stderr) });
+    }
+  );
+});
+async function readAppSignature(options) {
+  const bundlePath = appBundlePathFromExecutable(options.execPath);
+  const base = {
+    platform: options.platform,
+    packaged: options.packaged,
+    bundlePath,
+    bundleIdentifier: null,
+    teamIdentifier: null,
+    keychainAccessGroups: [],
+    unreadable: null
+  };
+  if (options.platform !== "darwin" || !options.packaged) return base;
+  const run = options.run ?? defaultCodesign;
+  try {
+    const verbose = await run("/usr/bin/codesign", [
+      "-dv",
+      "--verbose=4",
+      bundlePath
+    ]);
+    base.bundleIdentifier = parseBundleIdentifier(verbose.stdout);
+    base.teamIdentifier = parseTeamIdentifier(verbose.stdout);
+  } catch (error) {
+    return { ...base, unreadable: `codesign -dv failed: ${messageOf$1(error)}` };
+  }
+  try {
+    const entitlements = await run("/usr/bin/codesign", [
+      "-d",
+      "--entitlements",
+      "-",
+      "--xml",
+      bundlePath
+    ]);
+    base.keychainAccessGroups = parseKeychainAccessGroups(entitlements.stdout);
+  } catch (error) {
+    return {
+      ...base,
+      unreadable: `codesign -d --entitlements failed: ${messageOf$1(error)}`
+    };
+  }
+  return base;
+}
+function messageOf$1(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+let ownSignature = null;
+function ownAppSignature() {
+  ownSignature ??= readAppSignature({
+    platform: process.platform,
+    packaged: electron.app.isPackaged,
+    execPath: process.execPath
+  });
+  return ownSignature;
+}
+async function installWebauthn(options) {
+  const facts = await (options.facts ?? ownAppSignature)();
+  const gate = decideWebauthnGate(facts);
+  if (!gate.enabled || !gate.group) {
+    options.log(
+      `[webauthn] Touch ID passkeys are off: ${gate.reason} — ${gate.detail}`
+    );
+    return { gate, configured: false };
+  }
+  const configure = options.configure ?? ((value) => electron.app.configureWebAuthn(value));
+  try {
+    configure({
+      touchID: {
+        keychainAccessGroup: gate.group,
+        promptReason: WEBAUTHN_PROMPT_REASON
+      }
+    });
+  } catch (error) {
+    options.log(
+      `[webauthn] Touch ID passkeys are off: configureWebAuthn failed — ${messageOf$1(error)}`
+    );
+    return { gate: { ...gate, enabled: false }, configured: false };
+  }
+  options.log(
+    `[webauthn] Touch ID platform authenticator enabled (${gate.group}); credentials are device-bound and never leave this Mac`
+  );
+  return { gate, configured: true };
+}
+class WebauthnChooser {
+  constructor(options) {
+    this.options = options;
+  }
+  pending = /* @__PURE__ */ new Map();
+  counter = 0;
+  /** Handle the Session event. `accounts` is Electron's own array. */
+  handle(details, callback) {
+    const answer = onceAnswer(callback);
+    try {
+      this.prepare(details, answer);
+    } catch (error) {
+      this.options.log(
+        `[webauthn] a passkey request could not be prepared (${String(
+          error
+        )}); cancelling it`
+      );
+      answer(null);
+    }
+  }
+  /** The pre-timer half of `handle`: everything that can still throw. */
+  prepare(details, answer) {
+    const relyingPartyId = typeof details.relyingPartyId === "string" ? details.relyingPartyId : "";
+    const accounts = Array.isArray(details.accounts) ? details.accounts.filter(
+      (account) => typeof account === "object" && account !== null
+    ).map((account) => toAccountView(account)) : [];
+    if (accounts.length === 0) {
+      this.options.log(
+        `[webauthn] ${relyingPartyId || "a site"} asked for a passkey with no account to choose; cancelling the request`
+      );
+      answer(null);
+      return;
+    }
+    const requestId2 = this.options.nextRequestId ? this.options.nextRequestId() : `webauthn-${++this.counter}-${Date.now().toString(36)}`;
+    const source = this.options.describeSource?.(details.frame) ?? {
+      tabId: null,
+      pageTitle: null
+    };
+    const timer = setTimeout(
+      () => this.expire(requestId2),
+      this.options.timeoutMs ?? WEBAUTHN_CHOOSER_TIMEOUT_MS
+    );
+    timer.unref?.();
+    const request = {
+      requestId: requestId2,
+      relyingPartyId,
+      accounts,
+      tabId: source.tabId,
+      pageTitle: source.pageTitle
+    };
+    this.options.log(
+      `[webauthn] ${relyingPartyId || "a site"} matched ${accounts.length} passkeys; asking the user which one to use (${requestId2})`
+    );
+    this.options.notify(request);
+    this.pending.set(requestId2, {
+      requestId: requestId2,
+      relyingPartyId,
+      accounts,
+      tabId: source.tabId,
+      pageTitle: source.pageTitle,
+      answer,
+      timer
+    });
+  }
+  /**
+   * Answer a surfaced chooser. Returns whether a pending request was settled.
+   *
+   * A `credentialId` that is not one of the offered accounts is treated as a
+   * dismissal rather than passed through: Electron would cancel the request
+   * anyway, and doing it here keeps the log honest about what happened.
+   */
+  respond(requestId2, credentialId) {
+    const entry = this.pending.get(requestId2);
+    if (!entry) {
+      this.options.log(
+        `[webauthn] ignored a choice for an unknown or already-answered request (${requestId2})`
+      );
+      return false;
+    }
+    if (credentialId !== null && !entry.accounts.some((a) => a.credentialId === credentialId)) {
+      this.options.log(
+        `[webauthn] a choice for ${entry.relyingPartyId} named a credential that was not offered; cancelling the request`
+      );
+      this.settle(entry, null, "credential-not-offered");
+      return true;
+    }
+    if (credentialId === null) {
+      this.options.log(
+        `[webauthn] the passkey choice for ${entry.relyingPartyId} was dismissed; cancelling the request`
+      );
+      this.settle(entry, null, "dismissed");
+      return true;
+    }
+    const chosen = entry.accounts.find((a) => a.credentialId === credentialId);
+    this.options.log(
+      `[webauthn] the user chose ${labelOf(chosen)} for ${entry.relyingPartyId}`
+    );
+    this.settle(entry, credentialId, "chosen");
+    return true;
+  }
+  /** Ids still waiting for an answer. Read by tests and by nothing else. */
+  pendingRequestIds() {
+    return [...this.pending.keys()];
+  }
+  /**
+   * Every request still waiting, OLDEST FIRST.
+   *
+   * This is what a surface that mounts late reads instead of a request it never
+   * received (UX round 1, U2: the request was raised while the browser route was
+   * not mounted, so the push had nowhere to go). Order is the map's own insertion
+   * order, which is why it is stated: the renderer offers the oldest request and
+   * names the rest rather than silently replacing one with the next.
+   */
+  pendingRequests() {
+    return [...this.pending.keys()].map((requestId2) => this.view(requestId2));
+  }
+  /** Cancel everything still pending. Called when the host stops, because a
+   * callback left behind would keep the page's promise pending in a window
+   * that is going away. */
+  dispose() {
+    for (const entry of [...this.pending.values()]) {
+      this.options.log(
+        `[webauthn] the passkey request from ${entry.relyingPartyId} was cancelled: the browser host stopped`
+      );
+      this.settle(entry, null, "host-stopped");
+    }
+  }
+  expire(requestId2) {
+    const entry = this.pending.get(requestId2);
+    if (!entry) return;
+    this.options.log(
+      `[webauthn] nobody chose a passkey for ${entry.relyingPartyId} within ${Math.round((this.options.timeoutMs ?? WEBAUTHN_CHOOSER_TIMEOUT_MS) / 1e3)}s; cancelling the request`
+    );
+    this.settle(entry, null, "expired");
+  }
+  /** The wire view of one pending request. Never a credential id in the token
+   * position: `requestId` is this module's own. */
+  view(requestId2) {
+    const entry = this.pending.get(requestId2);
+    if (!entry) {
+      throw new Error(`no pending passkey request ${requestId2}`);
+    }
+    return {
+      requestId: entry.requestId,
+      relyingPartyId: entry.relyingPartyId,
+      accounts: entry.accounts,
+      tabId: entry.tabId,
+      pageTitle: entry.pageTitle
+    };
+  }
+  /** Answer exactly once, then tell the renderer the request is gone.
+   *
+   * Both halves matter. The map entry and the guarded callback are the
+   * exactly-once half; `onSettled` is what stops the renderer offering a choice
+   * for a request main has already answered — the dead-end dialog of design
+   * round 1, D2 — and it fires for EVERY path, including the host's own stop.
+   */
+  settle(entry, credentialId, outcome) {
+    if (!this.pending.has(entry.requestId)) return;
+    this.pending.delete(entry.requestId);
+    clearTimeout(entry.timer);
+    entry.answer(credentialId);
+    this.options.onSettled?.(entry.requestId, outcome);
+  }
+}
+const answerableCallbacks = /* @__PURE__ */ new WeakMap();
+function onceAnswer(callback) {
+  const existing = answerableCallbacks.get(callback);
+  if (existing) return existing;
+  let answered = false;
+  const guarded = (credentialId) => {
+    if (answered) return;
+    answered = true;
+    callback(credentialId ?? void 0);
+  };
+  answerableCallbacks.set(callback, guarded);
+  return guarded;
+}
+const chooserListeners = /* @__PURE__ */ new WeakMap();
+function attachWebauthnChooser(session, chooser, log) {
+  const previous = chooserListeners.get(session);
+  if (previous) {
+    session.removeListener("select-webauthn-account", previous);
+    log(
+      "[webauthn] replaced the previous passkey chooser listener (a second browser host started in this process)"
+    );
+  }
+  const listener = (_event, details, callback) => {
+    chooser.handle(details, callback);
+  };
+  session.on("select-webauthn-account", listener);
+  chooserListeners.set(session, listener);
+  return () => {
+    if (chooserListeners.get(session) !== listener) return;
+    session.removeListener("select-webauthn-account", listener);
+    chooserListeners.delete(session);
+  };
+}
+function toAccountView(account) {
+  return {
+    credentialId: typeof account.credentialId === "string" ? account.credentialId : "",
+    name: typeof account.name === "string" ? account.name : null,
+    displayName: typeof account.displayName === "string" ? account.displayName : null,
+    userHandle: typeof account.userHandle === "string" ? account.userHandle : null
+  };
+}
+function labelOf(account) {
+  if (!account) return "an unnamed passkey";
+  return account.displayName || account.name || "an unnamed passkey";
+}
 const PRIVATE_FILE_MODE = 384;
 const PRIVATE_DIR_MODE = 448;
 function writeJsonAtomic(path2, value) {
@@ -11000,14 +11422,48 @@ function settle(contents, timeoutMs = 3e4) {
 function permittedScheme(url) {
   return url.protocol === "http:" || url.protocol === "https:";
 }
+async function resolveMainFrameId(ctx, contents) {
+  let pageEnabled = false;
+  try {
+    await ctx.cdp.send(contents, "Page.enable", {});
+    pageEnabled = true;
+    const tree = await ctx.cdp.send(contents, "Page.getFrameTree", {});
+    const id2 = tree?.frameTree?.frame?.id;
+    return {
+      mainFrameId: typeof id2 === "string" && id2 ? id2 : null,
+      pageEnabled
+    };
+  } catch {
+    return { mainFrameId: null, pageEnabled };
+  }
+}
 async function withOriginGate(ctx, view, requester, approved, operation) {
   const contents = view.webContents;
   const blocked = [];
   const seen = /* @__PURE__ */ new Set();
+  const frameTree = await resolveMainFrameId(ctx, contents);
+  const mainFrameId = frameTree.mainFrameId;
+  if (mainFrameId === null) {
+    ctx.log(
+      `[browser] could not read the frame tree for ${requester}; this navigation is gated on every Document request, which may refuse cross-origin frames the page needs${// The domain's state travels with the fallback because it is not
+      // inferable from the failure: an enable that resolved and a read that
+      // did not left `Page` armed, an enable that never resolved did not
+      // (agent review round 2, R3).
+      frameTree.pageEnabled ? " (the Page domain may still be enabled)" : ""}`
+    );
+  }
+  let unattributed = 0;
   const unsubscribe = ctx.cdp.subscribe(contents.id, (method, params) => {
     if (method !== "Fetch.requestPaused") return;
     const requestId2 = typeof params.requestId === "string" ? params.requestId : "";
     if (!requestId2) return;
+    const frameId = typeof params.frameId === "string" ? params.frameId : "";
+    if (mainFrameId !== null && frameId && frameId !== mainFrameId) {
+      void ctx.cdp.send(contents, "Fetch.continueRequest", { requestId: requestId2 }).catch(() => {
+      });
+      return;
+    }
+    if (mainFrameId !== null && !frameId) unattributed += 1;
     const rawUrl = typeof params.request === "object" && params.request !== null ? params.request.url : void 0;
     let url = null;
     try {
@@ -11056,10 +11512,21 @@ async function withOriginGate(ctx, view, requester, approved, operation) {
     throw error;
   } finally {
     unsubscribe();
+    if (unattributed > 0) {
+      ctx.log(
+        `[browser] ${unattributed} paused document request(s) during ${requester}'s navigation carried no frame id; they were gated as navigation hops`
+      );
+    }
     try {
       await ctx.cdp.send(contents, "Fetch.disable", {});
     } catch {
     }
+    if (frameTree.pageEnabled) {
+      try {
+        await ctx.cdp.send(contents, "Page.disable", {});
+      } catch {
+      }
+    }
   }
 }
 async function navigateView(ctx, view, url, requester, approved, timeoutMs = 3e4) {
@@ -11681,6 +12148,20 @@ class TabRegistry {
   list() {
     return [...this.tabs.values()].sort((a, b) => a.tabId - b.tabId);
   }
+  /**
+   * The tab whose view owns this webContents id, if any.
+   *
+   * The passkey chooser needs it to name the page a request came from: Electron
+   * hands the initiating frame, `webContents.fromFrame` turns that into a
+   * webContents, and this is the mapping from there to a tab of THIS host — the
+   * frame may belong to no tab here at all, which is why the answer is optional
+   * rather than an error.
+   */
+  byWebContentsId(webContentsId) {
+    return this.list().find(
+      (record) => !record.view.webContents.isDestroyed() && record.view.webContents.id === webContentsId
+    );
+  }
   get activeTab() {
     return this.activeTabId === null ? null : this.tabs.get(this.activeTabId) ?? null;
   }
@@ -13027,7 +13508,9 @@ const BROWSER_IPC_CHANNELS = [
   "browser-revoke-approval",
   "browser-revoke-all-approvals",
   "browser-forget-site",
-  "browser-clear-data"
+  "browser-clear-data",
+  "browser-webauthn-respond",
+  "browser-webauthn-pending"
 ];
 function registerBrowserIpc(options) {
   function authorize(event) {
@@ -13097,6 +13580,25 @@ function registerBrowserIpc(options) {
     const host = authorize(event);
     return host.revokeHandOver(numberOrThrow(tabId, "tabId"));
   });
+  electron.ipcMain.handle(
+    "browser-webauthn-respond",
+    (event, requestId2, credentialId) => {
+      authorize(event);
+      const chooser = options.webauthn();
+      if (!chooser) throw new Error("The browser host is not running.");
+      if (typeof requestId2 !== "string" || !requestId2) {
+        throw new Error("A pending passkey request id is required.");
+      }
+      if (credentialId !== null && typeof credentialId !== "string") {
+        throw new Error("A passkey choice must name a credential or nothing.");
+      }
+      return chooser.respond(requestId2, credentialId);
+    }
+  );
+  electron.ipcMain.handle("browser-webauthn-pending", (event) => {
+    authorize(event);
+    return options.webauthn()?.pendingRequests() ?? [];
+  });
   electron.ipcMain.handle(
     "browser-consent-respond",
     (event, entryId, decision) => {
@@ -13488,8 +13990,9 @@ class OwnershipLedger {
 const BROWSER_PARTITION = "persist:local-operator-browser";
 function browserUserAgent() {
   const chrome = process.versions.chrome ?? "0";
+  const major = chrome.split(".")[0] || "0";
   const platform = process.platform === "darwin" ? "Macintosh; Intel Mac OS X 10_15_7" : process.platform === "win32" ? "Windows NT 10.0; Win64; x64" : "X11; Linux x86_64";
-  return `Mozilla/5.0 (${platform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${chrome} Safari/537.36 LocalOperator/${electron.app.getVersion()}`;
+  return `Mozilla/5.0 (${platform}) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/${major}.0.0.0 Safari/537.36`;
 }
 function resolveBrowserSession() {
   return electron.session.fromPartition(BROWSER_PARTITION);
@@ -14930,6 +15433,43 @@ async function startBrowserHost(options) {
     log
   });
   configurePslRules(PSL_RULES);
+  await installWebauthn({ log });
+  const describeSource = (frame) => {
+    if (!frame || typeof frame !== "object") {
+      return { tabId: null, pageTitle: null };
+    }
+    const contents = electron.webContents.fromFrame(frame);
+    const record = contents === void 0 ? void 0 : registry.byWebContentsId(contents.id);
+    if (!record) return { tabId: null, pageTitle: null };
+    const title = record.view.webContents.isDestroyed() ? "" : record.view.webContents.getTitle();
+    return { tabId: record.tabId, pageTitle: title || null };
+  };
+  const webauthn = new WebauthnChooser({
+    notify: (request) => {
+      if (options.window.isDestroyed()) return;
+      options.window.webContents.send("browser-webauthn-request", request);
+    },
+    /*
+     * AND THE OTHER DIRECTION: every settle is pushed, not only every arrival.
+     *
+     * Without this the renderer cannot tell a live request from one main has
+     * already cancelled, so a chooser whose request expired while the user was
+     * away stays on screen offering rows that can no longer do anything (design
+     * round 1, D2) — and the click is then discarded silently. The outcome travels
+     * with the push because the two cases differ for the user: their own answer is
+     * already off the screen, an expiry has to be explained.
+     */
+    onSettled: (requestId2, outcome) => {
+      if (options.window.isDestroyed()) return;
+      options.window.webContents.send("browser-webauthn-settled", {
+        requestId: requestId2,
+        outcome
+      });
+    },
+    describeSource,
+    log
+  });
+  const detachWebauthn = attachWebauthnChooser(browserSession, webauthn, log);
   const cookieJar = createHiddenCookieJarTarget(
     new electron.WebContentsView({
       webPreferences: { ...HIDDEN_COOKIE_JAR_WEB_PREFERENCES }
@@ -15074,6 +15614,7 @@ async function startBrowserHost(options) {
     window: () => options.window,
     expectedUrl: options.expectedUrl,
     host: () => host,
+    webauthn: () => webauthn,
     clearData: (what) => sessionCookies.clearBrowsingData(what),
     log
   });
@@ -15102,6 +15643,8 @@ async function startBrowserHost(options) {
       await cdp.close();
       await server.close();
       unregisterBrowserIpc();
+      detachWebauthn();
+      webauthn.dispose();
       stateWriter?.clear();
       approvals.resetPending();
       ownership.clear();