miravo 0.5.0 → 0.6.0

package/src/lib/auth-store.ts

@@ -0,0 +1,87 @@
+/**
+ * Credential storage — persists admin password at ~/.miravo/auth.json.
+ *
+ * Password priority: MIRAVO_ADMIN_PASSWORD env > ~/.miravo/auth.json > default "admin".
+ */
+
+import { mkdir } from "node:fs/promises";
+import { resolveMiravoHome } from "@miravo/core";
+import type { PersistedCredential } from "@miravo/shared";
+import { PersistedCredentialSchema } from "@miravo/shared";
+
+// ---------------------------------------------------------------------------
+// Paths
+// ---------------------------------------------------------------------------
+
+function authFilePath(): string {
+  return `${resolveMiravoHome()}/auth.json`;
+}
+
+// ---------------------------------------------------------------------------
+// Read / Write
+// ---------------------------------------------------------------------------
+
+/** Load persisted credential from ~/.miravo/auth.json. Returns null if missing or invalid. */
+export async function loadCredential(): Promise<PersistedCredential | null> {
+  const file = Bun.file(authFilePath());
+  if (!(await file.exists())) return null;
+  try {
+    const raw: unknown = await file.json();
+    const result = PersistedCredentialSchema.safeParse(raw);
+    return result.success ? result.data : null;
+  } catch {
+    return null;
+  }
+}
+
+/** Persist credential to ~/.miravo/auth.json with restricted permissions. */
+export async function saveCredential(username: string, passwordHash: string): Promise<void> {
+  const filePath = authFilePath();
+  const dir = resolveMiravoHome();
+  await mkdir(dir, { recursive: true });
+  const data: PersistedCredential = { username, passwordHash };
+  await Bun.write(filePath, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+
+// ---------------------------------------------------------------------------
+// Password resolution
+// ---------------------------------------------------------------------------
+
+interface ResolvedPassword {
+  /** Argon2id hash of the effective admin password. */
+  readonly passwordHash: string;
+  /** True when the effective password is the literal default "admin". */
+  readonly isDefault: boolean;
+}
+
+/**
+ * Resolve the admin password with priority:
+ *   1. MIRAVO_ADMIN_PASSWORD env var (plaintext → hashed)
+ *   2. ~/.miravo/auth.json (already hashed)
+ *   3. Default "admin" (plaintext → hashed)
+ */
+export async function resolveAdminPassword(): Promise<ResolvedPassword> {
+  // 1. Environment override
+  const envPassword = Bun.env["MIRAVO_ADMIN_PASSWORD"];
+  if (envPassword && envPassword.trim().length > 0) {
+    return {
+      passwordHash: await Bun.password.hash(envPassword),
+      isDefault: envPassword === "admin",
+    };
+  }
+
+  // 2. Persisted credential file
+  const credential = await loadCredential();
+  if (credential) {
+    return {
+      passwordHash: credential.passwordHash,
+      isDefault: false, // File exists → user changed password at some point
+    };
+  }
+
+  // 3. Default
+  return {
+    passwordHash: await Bun.password.hash("admin"),
+    isDefault: true,
+  };
+}

package/src/lib/daemon-registry.ts

@@ -32,10 +32,10 @@ const DaemonRegistryEntrySchema = z.object({
   runId: z.string().min(1),
 });
 
-export type DaemonAdapterEntry = z.infer<typeof DaemonAdapterEntrySchema>;
+type DaemonAdapterEntry = z.infer<typeof DaemonAdapterEntrySchema>;
 export type DaemonRegistryEntry = z.infer<typeof DaemonRegistryEntrySchema>;
 
-export interface EntryIdentityResult {
+interface EntryIdentityResult {
   readonly status: "dead" | "verified" | "mismatch" | "unreachable";
   readonly ready: boolean;
 }
@@ -45,7 +45,7 @@ export interface EntryIdentityResult {
 // ---------------------------------------------------------------------------
 
 /** Returns the path to the daemon registry directory (`~/.miravo/daemon/`). */
-export function daemonDir(): string {
+function daemonDir(): string {
   return `${resolveMiravoHome()}/daemon`;
 }
 
@@ -193,7 +193,15 @@ export function isPidAlive(pid: number): boolean {
   try {
     process.kill(pid, 0);
     return true;
-  } catch {
+  } catch (err) {
+    if (
+      err &&
+      typeof err === "object" &&
+      "code" in err &&
+      (err.code === "EPERM" || err.code === "EACCES")
+    ) {
+      return true; // process exists but we can't signal it
+    }
     return false;
   }
 }
@@ -239,16 +247,6 @@ export async function probeEntryIdentity(entry: DaemonRegistryEntry): Promise<En
   }
 }
 
-export async function isEntryAlive(entry: DaemonRegistryEntry): Promise<boolean> {
-  const identity = await probeEntryIdentity(entry);
-  return identity.status === "verified" || identity.status === "unreachable";
-}
-
-export async function canSafelySignalEntry(entry: DaemonRegistryEntry): Promise<boolean> {
-  const identity = await probeEntryIdentity(entry);
-  return identity.status === "verified";
-}
-
 /**
  * Remove all registry entries whose processes are no longer alive.
  * Uses full identity verification (PID + runId) to handle PID reuse.