moshcode 0.32.0 → 0.33.1

package/src/pty.mjs

@@ -92,9 +92,13 @@ export function ptySpec(cmd, args = [], transcript, flavor) {
  * decoding each slice independently turns them into U+FFFD in the mirror. The
  * decoder holds the incomplete tail back until the rest of it arrives.
  */
-export function followFile(file, onChunk, { intervalMs = 100 } = {}) {
+export function followFile(file, onChunk, { intervalMs = 100, startOffset = 0 } = {}) {
   let fd = null;
-  let offset = 0;
+  // Callers that already have the earlier bytes — the herd's `attach` has just
+  // printed the tail of the transcript for context — pass the offset they got
+  // to, so following a session that has been running for hours costs the new
+  // bytes rather than a full replay of everything it ever printed.
+  let offset = Number(startOffset) || 0;
   let stopped = false;
   let decoder = new StringDecoder("utf8");
 

package/src/trust.mjs

@@ -482,16 +482,53 @@ export function leafPath(name, { platform = process.platform } = {}) {
     : `/usr/local/share/ca-certificates/moshpit-${safe}.crt`;
 }
 
+/**
+ * Is this certificate marked as a certificate authority?
+ *
+ * Read with node's X509 parser rather than by grepping openssl's text, because
+ * the answer decides whether a key gets authority over the whole clearnet and
+ * "CA:FALSE" is a substring of nothing but is adjacent to plenty.
+ *
+ * A certificate carrying no basicConstraints at all answers false: absent is
+ * not the same as asserted, and RFC 5280 §4.2.1.9 treats such a certificate as
+ * an end entity.
+ */
+export async function isCertificateAuthority(pem) {
+  const crypto = await import("node:crypto");
+  return new crypto.X509Certificate(pem).ca === true;
+}
+
 /**
  * What `trust <name>` should do, given what the socket served and what the
  * registry says about it.
  *
  * Pure, so the refusal path is testable without a network or a trust store.
  */
-export function leafTrustPlan({ name, pin, published, platform = process.platform } = {}) {
+export function leafTrustPlan({ name, pin, published, platform = process.platform, ca = false } = {}) {
   const accepted = pinAccepted(pin, published);
   if (!accepted.ok) return { ok: false, refused: true, why: accepted.why };
 
+  // A certificate installed here is installed as a *trust anchor*, and an
+  // anchor marked CA:TRUE may issue for any name in the world. The SAN says
+  // what the certificate speaks for; it says nothing about what a key trusted
+  // as an authority may go on to sign — so `subjectAltName=DNS:seo.rank` on a
+  // CA:TRUE certificate is not the bound it looks like, and trusting one would
+  // hand its holder google.com along with their own name.
+  //
+  // This is the same hole `requireNameConstraints` exists to close on the root
+  // path, arriving by the other door. It went unnoticed because openssl's
+  // `req -x509` defaults to CA:TRUE, so every origin set up before that default
+  // was overridden serves exactly the shape that must be refused — and it looks
+  // identical to a correct one until someone trusts it.
+  if (ca) {
+    return {
+      ok: false,
+      refused: true,
+      kind: "ca",
+      why: `${name} serves a certificate marked CA:TRUE — trusted directly, its key could vouch for any name`,
+    };
+  }
+
   const file = leafPath(name, { platform });
   if (!file) return { ok: false, why: `${name} is not a name that can be written to a file` };
 
@@ -499,10 +536,11 @@ export function leafTrustPlan({ name, pin, published, platform = process.platfor
     ok: true,
     why: accepted.why,
     file,
-    // A self-signed leaf is its own trust anchor, and its SAN limits it to this
-    // one name — so trusting it vouches for `seo.rank` and nothing else. That
-    // is a far smaller grant than a CA, which is why this path needs no
-    // name constraints argument to be defensible.
+    // With CA:FALSE established above, a self-signed leaf is its own trust
+    // anchor and its SAN limits it to this one name — so trusting it vouches
+    // for `seo.rank` and nothing else. That is a far smaller grant than a CA,
+    // which is why this path needs no name-constraints argument to be
+    // defensible. It is only true because of the check above.
     refresh: platform === "darwin"
       ? { command: "security", args: ["add-trusted-cert", "-d", "-r", "trustRoot", "-k", "/Library/Keychains/System.keychain", file] }
       : { command: "update-ca-certificates", args: [] },
@@ -571,10 +609,25 @@ export async function trustName(name, out, deps = {}) {
     return 1;
   }
 
-  const plan = leafTrustPlan({ name, pin, published, platform });
+  // Read off the certificate rather than assumed: an origin set up before
+  // `setup-origin.sh` overrode openssl's default serves CA:TRUE, and that is
+  // the one shape this must not install.
+  const ca = await isCertificateAuthority(served.stdout).catch(() => true);
+
+  const plan = leafTrustPlan({ name, pin, published, platform, ca });
   if (!plan.ok) {
     out(`REFUSED — ${plan.why}`);
-    if (plan.refused) {
+    if (plan.kind === "ca") {
+      // A refusal with no way forward is a refusal people route around, and
+      // this one has a cheap way forward that costs nothing anywhere else: the
+      // pin is over the key, so re-issuing the certificate from the same key
+      // leaves the published pin untouched. Nothing has to be republished and
+      // no client holding the old pin breaks.
+      out("  its SAN says what it speaks for, not what it may sign — an anchor");
+      out("  marked CA:TRUE is not limited to the name printed on it.");
+      out("  re-issue it as CA:FALSE; the key is reused, so the pin does not move:");
+      out(`    sudo sh scripts/setup-origin.sh ${name}    # from moshpit-proxy`);
+    } else if (plan.refused) {
       out(`  served  ${pin}`);
       out(published.length ? `  pinned  ${published.join("\n          ")}` : "  pinned  (none)");
       out("  moshcode will not trust a certificate the registry does not vouch for.");

package/src/tui.mjs

@@ -27,6 +27,8 @@ import { banner, hr, acid, ash, bone, dim, ok, err, warn, info, moshcodeVersion
 import { CORE_CLI_COMMAND_NAMES } from "./cli-schema.mjs";
 import { RENAMED_COMMANDS, findPitCommand, pitHelpModel, renderPitCommand, suggest, wantsHelp } from "./help.mjs";
 import { openNewTab } from "./tabs.mjs";
+import { herdCommand, herdStart, renderRoster, roster, splitDetachArgs } from "./herd-cli.mjs";
+import { detectSubstrate, substrateNote } from "./herd.mjs";
 
 const PROMPT = () => acid("mosh ") + dim("▸ ");
 
@@ -148,6 +150,44 @@ function printEngines(json = false) {
   }
 }
 
+/**
+ * The herd, on the pit's front door.
+ *
+ * Printed before the prompt because "what is already running, and does any of
+ * it want me?" is the first question on opening the pit, and until now the only
+ * way to answer it was to remember. Silent when the herd is empty — a heading
+ * over nothing is noise on every cold start.
+ */
+function printHerd() {
+  const rows = roster();
+  if (!rows.length) return;
+  const blocked = rows.filter((r) => r.state === "blocked").length;
+  console.log(bone("  herd") + ash(`     — ${rows.length} session${rows.length === 1 ? "" : "s"} · attach with `) + acid("/attach <name>"));
+  console.log(renderRoster(rows, { indent: "   " }));
+  if (blocked) console.log("   " + warn(`${blocked} waiting on you`));
+}
+
+/**
+ * `-d` / `--name` on `/agents` and `/start`: run it in the herd instead of
+ * handing over the terminal.
+ *
+ * Returns { taken, args }. `taken` means the herd has it and the caller should
+ * skip its passthrough path; `args` is always the engine's own arguments with
+ * the herd flags removed, so a box with no substrate falls back to a normal
+ * foreground launch instead of passing `-d` on to an engine that has never
+ * heard of it.
+ */
+function detachedLaunch(key, args, { agentMode = false } = {}) {
+  const { detach, name, rest } = splitDetachArgs(args);
+  if (!detach) return { taken: false, args: rest };
+  if (!detectSubstrate()) {
+    console.log(warn(substrateNote(null)));
+    return { taken: false, args: rest };
+  }
+  herdStart([key, ...(name ? ["--name", name] : []), ...(agentMode ? ["--agent"] : []), ...rest]);
+  return { taken: true, args: rest };
+}
+
 function printTools() {
   // Named generically rather than listing every tool: the roster grows, and a
   // hardcoded list here silently goes stale the moment TOOLS gains an entry.
@@ -476,7 +516,9 @@ export async function tui() {
   printEngines();
   console.log();
   printTools();
-  console.log("\n" + ash("  /help for commands · /new for a tab · /quit to leave") + "\n");
+  console.log();
+  printHerd();
+  console.log("\n" + ash("  /help for commands · /ps for the herd · /new for a tab · /quit to leave") + "\n");
 
   const ad = await motd;
   if (ad) console.log(dim(ad) + "\n");
@@ -610,6 +652,23 @@ export async function tui() {
       rl = mkrl();
       continue;
     }
+    // The herd (PRD 0009). These never close the readline interface, because
+    // that is the entire point of them: the pit keeps its prompt while the
+    // sessions run somewhere that outlives it.
+    if (cmd === "herd") { await herdCommand(rest); continue; }
+    if (cmd === "ps") { await herdCommand(["ps", ...rest]); continue; }
+    if (cmd === "kill") { await herdCommand(["kill", ...rest]); continue; }
+    if (cmd === "wait") { await herdCommand(["wait", ...rest]); continue; }
+    if (cmd === "restore") { await herdCommand(["restore", ...rest]); continue; }
+    // `/attach` is the exception — it hands over the terminal like an engine
+    // session does, so readline has to let go of stdin first or the two fight
+    // over every keystroke.
+    if (cmd === "attach") {
+      rl.close();
+      await herdCommand(["attach", ...rest]);
+      rl = mkrl();
+      continue;
+    }
     if (cmd === "agents" || cmd === "agent" || cmd === "engines") {
       if (!rest[0] || (rest.length === 1 && rest[0] === "--json")) {
         printEngines(rest[0] === "--json");
@@ -618,23 +677,27 @@ export async function tui() {
       const resolved = resolveEngine(rest[0]);
       if (!resolved) { console.log(err(`unknown engine "${rest[0]}". try: ${Object.keys(ENGINES).join(", ")}`)); continue; }
       const [key, engine] = resolved;
+      const detached = detachedLaunch(key, rest.slice(1), { agentMode: true });
+      if (detached.taken) continue;
       rl.close();
       await openEngine(
         key,
         { ...engine, installed: engineStatus().find((e) => e.key === key)?.installed },
-        rest.slice(1),
+        detached.args,
         { agentMode: true },
       );
       rl = mkrl();
       continue;
     }
     if (cmd === "start") {
-      if (!rest[0]) { console.log(err("usage: /start <engine> [args…]")); continue; }
+      if (!rest[0]) { console.log(err("usage: /start <engine> [args…] [-d]")); continue; }
       const resolved = resolveEngine(rest[0]);
       if (!resolved) { console.log(err(`unknown engine "${rest[0]}". try: ${Object.keys(ENGINES).join(", ")}`)); continue; }
       const [key, engine] = resolved;
+      const detached = detachedLaunch(key, rest.slice(1));
+      if (detached.taken) continue;
       rl.close();
-      await openEngine(key, { ...engine, installed: engineStatus().find((e) => e.key === key)?.installed }, rest.slice(1));
+      await openEngine(key, { ...engine, installed: engineStatus().find((e) => e.key === key)?.installed }, detached.args);
       rl = mkrl();
       continue;
     }