moshcode 0.73.0 → 0.75.0

package/src/trust.mjs

@@ -189,6 +189,15 @@ export function trustStores({ platform = process.platform, home = os.homedir(),
       needsRoot: true,
       command: "security",
       args: ["add-trusted-cert", "-d", "-r", "trustRoot", "-k", "/Library/Keychains/System.keychain", file],
+      // The one store that can only be told with the certificate in hand:
+      // `remove-trusted-cert` takes a file, not a nickname. `needsFile` is what
+      // lets the undo say so out loud instead of leaving an anchor behind and
+      // reporting success.
+      remove: {
+        needsFile: true,
+        command: "security",
+        args: ["remove-trusted-cert", "-d", file],
+      },
     });
     return stores;
   }
@@ -207,6 +216,13 @@ export function trustStores({ platform = process.platform, home = os.homedir(),
       ownedDir: path.join(home, ".pki", "nssdb"),
       command: "certutil",
       args: ["-d", `sql:${path.join(home, ".pki", "nssdb")}`, "-A", "-t", "C,,", "-n", "Moshpit Local CA", "-i", file],
+      // By nickname, so the anchor can still be withdrawn after the root file
+      // itself is gone — which is the ordinary case, since a person who wants
+      // rid of this deletes the certificate first and asks questions after.
+      remove: {
+        command: "certutil",
+        args: ["-d", `sql:${path.join(home, ".pki", "nssdb")}`, "-D", "-n", "Moshpit Local CA"],
+      },
     });
     stores.push({
       id: "system",
@@ -218,6 +234,14 @@ export function trustStores({ platform = process.platform, home = os.homedir(),
       copyTo: "/usr/local/share/ca-certificates/moshpit-local-ca.crt",
       command: "update-ca-certificates",
       args: [],
+      // Delete the copy, then rebuild. `--fresh` rather than a bare refresh:
+      // the bare form adds what is new, and it is the rebuild that drops the
+      // symlink for a source file that is no longer there.
+      remove: {
+        removeFile: "/usr/local/share/ca-certificates/moshpit-local-ca.crt",
+        command: "update-ca-certificates",
+        args: ["--fresh"],
+      },
     });
     return stores;
   }
@@ -278,6 +302,130 @@ export function trustPlan({
   return { ok: true, steps, skipped, file, why: constrained.why };
 }
 
+/**
+ * What `dns disable` should do about trust.
+ *
+ * Deliberately not `trustPlan(...).steps.reverse()`. Installing is gated on the
+ * root being safe to install — name constraints, a certificate that parses —
+ * and none of that has any bearing on taking it back out: a root that should
+ * never have been trusted is the *most* important one to be able to withdraw.
+ * So this plan asks two questions only, whether the store can be reached and
+ * whether the undo needs the certificate file, and never refuses.
+ *
+ * Pure, like trustPlan, so `dns disable` can be tested without a trust store.
+ */
+export function untrustPlan({
+  platform = process.platform,
+  home = os.homedir(),
+  caFile = null,
+  isRoot = false,
+  haveCertutil = true,
+  haveFile = true,
+} = {}) {
+  const file = caFile || caPath({ home });
+  const steps = [];
+  const skipped = [];
+
+  for (const store of trustStores({ platform, home, caFile: file })) {
+    if (!store.remove) {
+      skipped.push({ ...store, why: "this build knows how to install it but not how to remove it" });
+      continue;
+    }
+    if (store.id === "nss" && !haveCertutil) {
+      skipped.push({ ...store, why: "certutil is not installed (Debian/Ubuntu: libnss3-tools)" });
+      continue;
+    }
+    if (store.needsRoot && !isRoot) {
+      skipped.push({ ...store, why: "needs root" });
+      continue;
+    }
+    // The macOS case. Saying "the root is gone, so the anchor cannot be named"
+    // is worth a line, because the alternative is a machine that keeps trusting
+    // a certificate nobody can produce any more.
+    if (store.remove.needsFile && !haveFile) {
+      skipped.push({ ...store, why: `the root at ${file} is gone, and this store can only be told with it` });
+      continue;
+    }
+    steps.push(store);
+  }
+
+  return { ok: true, steps, skipped, file };
+}
+
+/**
+ * The trust half of `dns disable` — take back what `applyTrust` installed.
+ *
+ * Non-fatal throughout, for the same reason its counterpart is: resolution has
+ * already been put back by the time this runs, and failing the whole command
+ * over a trust store would undo working DNS to fix a certificate. What it must
+ * not do is report a removal it did not achieve, since a trust anchor believed
+ * gone is worse than one known to be present.
+ */
+export async function applyUntrust(out, deps = {}) {
+  const {
+    readFile = async (f) => (await import("node:fs/promises")).readFile(f, "utf8"),
+    runner = run,
+    env = process.env,
+    home = operatorHome({ env }),
+    platform = process.platform,
+    uid = typeof process.getuid === "function" ? process.getuid() : 0,
+  } = deps;
+  const owner = env.SUDO_USER || env.DOAS_USER || null;
+
+  const file = caPath({ home });
+  const haveFile = await readFile(file).then(() => true, () => false);
+  const plan = untrustPlan({
+    platform, home, caFile: file, isRoot: uid === 0,
+    haveCertutil: (await runner("which", ["certutil"])).ok,
+    haveFile,
+  });
+
+  if (!plan.steps.length && !plan.skipped.length) return { ok: true, removed: 0, skipped: 0 };
+
+  out("");
+  out("trust  (taking the local root back out)");
+
+  let removed = 0;
+  for (const step of plan.steps) {
+    const undo = step.remove;
+    if (undo.removeFile) {
+      // `rm -f`: the copy not being there is the state we are trying to reach,
+      // so its absence is success rather than something to report.
+      const gone = await runner("rm", ["-f", undo.removeFile]);
+      if (!gone.ok) {
+        out(`  FAIL ${step.label} — ${gone.stderr.split("\n")[0] || `could not remove ${undo.removeFile}`}`);
+        continue;
+      }
+    }
+    const done = await runner(undo.command, undo.args);
+    if (!done.ok) {
+      const first = done.stderr.split("\n")[0] || "";
+      // certutil says this when the nickname is not in the database, which is
+      // the same end state as a successful removal and must not read as a
+      // failure — most often it means `dns disable` is being run twice.
+      if (/SEC_ERROR_BAD_DATA|not found|PR_FILE_NOT_FOUND/i.test(first)) {
+        out(`  ok   ${step.label} — was not there`);
+        continue;
+      }
+      out(`  FAIL ${step.label} — ${first || `${undo.command} failed`}`);
+      continue;
+    }
+    if (step.ownedDir && owner && uid === 0) {
+      const owned = await runner("chown", ["-R", `${owner}:`, step.ownedDir]);
+      if (!owned.ok) out(`  --   ${step.ownedDir} is left owned by root — chown -R ${owner}: ${step.ownedDir}`);
+    }
+    removed++;
+    out(`  ok   removed from ${step.label}`);
+  }
+
+  for (const step of plan.skipped) {
+    out(`  --   ${step.label} — ${step.why}`);
+    if (step.needsRoot && uid !== 0) out("       re-run with root to cover it: sudo moshcode dns disable");
+  }
+
+  return { ok: true, removed, skipped: plan.skipped.length };
+}
+
 /**
  * What to do about a refusal, which depends entirely on which one it is.
  *

package/src/tui.mjs

@@ -16,8 +16,9 @@ import { runUpgrade } from "./upgrade.mjs";
 import { locate, tilde } from "./pwd.mjs";
 import { createPrd, listPrds, authoringPrompt } from "./prd.mjs";
 import { loginAuto, whoami, logout } from "./auth.mjs";
+import { startAutoSync } from "./autosync.mjs";
 import { loadCommand, saveCommand } from "./settings-sync.mjs";
-import { createMirror, pressKey, teeOutput } from "./mirror.mjs";
+import { createMirror, pressKey, setActiveSink, teeOutput } from "./mirror.mjs";
 import { fetchMotdAd } from "./ads.mjs";
 import { runScript } from "./runtime.mjs";
 import { moshVocabulary } from "./commands.mjs";
@@ -27,6 +28,7 @@ import { cryptoCommand } from "./crypto.mjs";
 import { gamesCommand } from "./games.mjs";
 import { canOpenBrowser, openBrowser } from "./open-url.mjs";
 import { shellInvocation } from "./shell.mjs";
+import { captureSpec } from "./pty.mjs";
 import { needsRootHere, primeEscalation } from "./escalate.mjs";
 import { banner, hr, acid, ash, bone, dim, ok, err, warn, info, moshcodeVersion } from "./ui.mjs";
 import { CORE_CLI_COMMAND_NAMES } from "./cli-schema.mjs";
@@ -677,14 +679,23 @@ async function openWorkflowTool(key, tool, args) {
 // command string → `$SHELL +m -ic "<cmd>"` (one-off). Interactive so the command
 // can see the aliases and functions in ~/.zshrc — see src/shell.mjs for why
 // that is not optional. Resolves { ok, code, signal }.
-function runShell(rawCmd) {
+//
+// Captured through a pty when the mirror is watching, for the same reason an
+// engine is: a shell command is where most of what a pit does actually happens
+// — `!cmd`, /shell, and every shell-valued /alias land here — and with plain
+// `inherit` none of its bytes, on stdout or stderr, ever pass through this
+// process. The session page was showing the echoed command line and the exit
+// note with nothing in between.
+export function runShell(rawCmd, { onOutput } = {}) {
   return new Promise((resolve) => {
     const { shell, args } = shellInvocation(rawCmd);
+    const launch = captureSpec({ cmd: shell, args }, onOutput);
+    const done = (result) => { try { launch.stop(); } catch { /* already drained */ } resolve(result); };
     let child;
-    try { child = spawn(shell, args, { stdio: "inherit" }); }
-    catch (e) { resolve({ ok: false, error: e }); return; }
-    child.on("error", (e) => resolve({ ok: false, error: e }));
-    child.on("exit", (code, signal) => resolve({ ok: true, code, signal }));
+    try { child = spawn(launch.cmd, launch.args, { stdio: "inherit" }); }
+    catch (e) { done({ ok: false, error: e }); return; }
+    child.on("error", (e) => done({ ok: false, error: e }));
+    child.on("exit", (code, signal) => done({ ok: true, code, signal }));
   });
 }
 
@@ -699,7 +710,7 @@ async function openShell(rawCmd) {
     ? `${bone(shellName)} ${ash(flags)} ${ash(rawCmd)}`
     : `dropping to ${bone(shellName)} — ${ash("`exit` or Ctrl-D brings you back to the pit")}`));
   console.log(hr());
-  const r = await runShell(rawCmd);
+  const r = await runShell(rawCmd, { onOutput: childSink() });
   console.log(hr());
   if (!r.ok) {
     console.log(err(`couldn't start shell: ${r.error?.message || r.error}`));
@@ -719,14 +730,22 @@ function installTarget(key) {
     // something the installer's output scrolled into view.
     if (needsRootHere(target)) primeEscalation({ what: key, out: (s) => console.log(info(s.replace(/^· /, ""))) });
     console.log(hr());
-    const child = spawn(target.install.cmd, target.install.args, { stdio: "inherit" });
+    // Installers are long, chatty, and the thing you most want to read from a
+    // phone — so they go through the mirror's pty like everything else.
+    const launch = captureSpec(
+      { cmd: target.install.cmd, args: target.install.args },
+      childSink(),
+    );
+    const child = spawn(launch.cmd, launch.args, { stdio: "inherit" });
     child.on("error", (e) => {
+      launch.stop();
       console.log(hr());
       console.log(err(`install failed: ${e.message}`));
       if (e.code === "ENOENT" && target.installHelp) console.log(info(target.installHelp));
       resolve();
     });
     child.on("exit", (code) => {
+      launch.stop();
       console.log(hr());
       if (code !== 0) { console.log(err(`install exited ${code}`)); return resolve(); }
       console.log(ok(`${key} installed. 🤘`));
@@ -822,6 +841,14 @@ export async function tui() {
 
   const { restoreTee, drainRemote, atPrompt } = await startMirror();
 
+  // Settings sync, unattended. Started per `tui()` call and stopped in the
+  // teardown below, because the pit is re-entered after an engine session
+  // (`backToPit`) and a timer left behind would be joined by another one.
+  // Deliberately holds no reference to `rl`: the loop closes and rebuilds it
+  // around a dozen commands, so a tick that captured it would be writing to a
+  // readline that no longer exists.
+  const stopAutoSync = startAutoSync();
+
   let rl = mkrl();
   // An alias expands into a line that is dispatched exactly as if it had been
   // typed, so it goes back through the top of this loop instead of through a
@@ -1252,6 +1279,7 @@ export async function tui() {
       : `unknown command "${line}". /help for the list.`));
   }
 
+  stopAutoSync();
   try { rl.close(); } catch { /* noop */ }
   saveHistory();
   console.log("\n" + ash("code hard, mosh harder. 🤘"));
@@ -1282,6 +1310,10 @@ async function startMirror() {
   if (!started) return noop;
 
   activeMirror = mirror;
+  // Every launcher that spawns a child reads this rather than being handed a
+  // sink, so a command run from the pit is captured whether or not whoever
+  // wrote that launcher knew the mirror existed.
+  setActiveSink((chunk) => activeMirror?.write(chunk));
   const restoreTee = teeOutput((chunk) => mirror.write(chunk));
 
   // Commands arrive whenever; the prompt is only ready between engine
@@ -1316,6 +1348,7 @@ async function startMirror() {
 async function stopMirror(restoreTee) {
   const mirror = activeMirror;
   activeMirror = null;
+  setActiveSink(null);
   try { restoreTee?.(); } catch { /* noop */ }
   try { await mirror?.stop(); } catch { /* best effort */ }
 }