pairling 0.1.0 → 0.2.1

package/payload/mac/install/doctor.sh

@@ -62,7 +62,8 @@ PAIRLING_PORT = int(os.environ.get("PAIRLING_RUNTIME_PORT", "7773"))
 PAIRLING_LABEL = "dev.pairling.companiond"
 PAIRLING_GUARDIAN_LABEL = "dev.pairling.power-guardian"
 PAIRLING_CONNECTD_LABEL = "dev.pairling.connectd"
-LEGACY_LABEL = "com.mghome.notify-webhook"
+PAIRLING_PTYBROKER_LABEL = "dev.pairling.ptybroker"
+TEAM_ID = os.environ.get("PAIRLING_TEAM_ID", os.environ.get("PAIRLING_CONNECTD_TEAM_ID", "965AVD34A3"))
 APP_SUPPORT = Path(os.environ.get("PAIRLING_APP_SUPPORT_ROOT", os.environ.get("COMPANION_APP_SUPPORT_ROOT", str(home / "Library" / "Application Support" / "Pairling"))))
 LOGS_ROOT = Path(os.environ.get("PAIRLING_LOGS_ROOT", os.environ.get("COMPANION_LOGS_ROOT", str(home / "Library" / "Logs" / "Pairling"))))
 CURRENT = APP_SUPPORT / "runtime" / "current"
@@ -75,9 +76,8 @@ USER_PAIRLING = home / ".local" / "bin" / "pairling"
 PAIR_ROOT = APP_SUPPORT / "pair"
 USER_PLIST = home / "Library" / "LaunchAgents" / f"{PAIRLING_LABEL}.plist"
 CONNECTD_USER_PLIST = home / "Library" / "LaunchAgents" / f"{PAIRLING_CONNECTD_LABEL}.plist"
-LEGACY_USER_PLIST = home / "Library" / "LaunchAgents" / f"{LEGACY_LABEL}.plist"
+PTYBROKER_USER_PLIST = home / "Library" / "LaunchAgents" / f"{PAIRLING_PTYBROKER_LABEL}.plist"
 SYSTEM_PLIST = Path("/Library/LaunchDaemons") / f"{PAIRLING_GUARDIAN_LABEL}.plist"
-LEGACY_SYSTEM_PLIST = Path("/Library/LaunchDaemons/com.mghome.companion-power-guardian.plist")
 
 sys.path.insert(0, str(repo_root / "mac" / "companiond"))
 from pairling_connectd_status import fetch_connectd_status, redacted_connectd_summary
@@ -95,6 +95,23 @@ def add(identifier, ok, severity, summary, evidence=None):
     })
 
 
+def codesigning_identity_summary(output: str) -> dict:
+    lines = [line.strip() for line in output.splitlines() if line.strip()]
+    developer_id_lines = [line for line in lines if "Developer ID Application:" in line]
+    expected_team_present = any(f"({TEAM_ID})" in line for line in developer_id_lines)
+    valid_count = None
+    for line in lines:
+        match = re.search(r"(\d+)\s+valid identities found", line)
+        if match:
+            valid_count = int(match.group(1))
+            break
+    return {
+        "valid_identity_count": valid_count,
+        "developer_id_application_count": len(developer_id_lines),
+        "expected_team_present": expected_team_present,
+    }
+
+
 def run(args, timeout=5):
     try:
         proc = subprocess.run(args, capture_output=True, text=True, timeout=timeout)
@@ -202,6 +219,103 @@ def active_pair_records(pair_root: Path) -> list[dict]:
     return records
 
 
+def desired_ptybroker_identity() -> dict:
+    revision = None
+    if manifest and manifest.get("source_revision"):
+        revision = str(manifest.get("source_revision"))
+    elif (CURRENT / "mac" / "SOURCE_REVISION").is_file():
+        try:
+            revision = (CURRENT / "mac" / "SOURCE_REVISION").read_text().strip() or None
+        except Exception:
+            revision = None
+    desired_root = CURRENT.resolve() if CURRENT.exists() else CURRENT
+    return {
+        "runtime_root": str(desired_root),
+        "script_path": str(desired_root / "companiond" / "pty_broker_service.py"),
+        "source_revision": revision,
+        "protocol_version": 1,
+    }
+
+
+def ptybroker_status_rpc() -> tuple[dict | None, str | None]:
+    try:
+        sys.path.insert(0, str(CURRENT / "companiond"))
+        from pty_broker_client import PTYBrokerClient, ensure_pty_broker_token
+
+        companion = home / ".claude" / "companion"
+        client = PTYBrokerClient(companion / "pty-broker.sock", ensure_pty_broker_token(companion), timeout=1.0)
+        status = client.status()
+        return status if isinstance(status, dict) else {}, None
+    except Exception as exc:
+        return None, f"{type(exc).__name__}: {exc}"
+
+
+def ptybroker_deployment_status(*, launchd_loaded: bool) -> dict:
+    desired = desired_ptybroker_identity()
+    base = {
+        "label": PAIRLING_PTYBROKER_LABEL,
+        "state": "unknown",
+        "restart_deferred": False,
+        "pid": None,
+        "live_session_count": None,
+        "live_source_revision": None,
+        "desired_source_revision": desired.get("source_revision"),
+        "desired_runtime_root": desired.get("runtime_root"),
+        "desired_script_path": desired.get("script_path"),
+        "evidence": None,
+    }
+    if not MANIFEST_PATH.is_file() and not CURRENT.exists():
+        return {**base, "state": "not_installed", "evidence": "runtime/current is missing"}
+    if not launchd_loaded:
+        return {**base, "state": "not_running", "evidence": "launchd label is not running"}
+    live, error = ptybroker_status_rpc()
+    if live is None:
+        return {**base, "state": "unreachable_socket", "evidence": error}
+    reasons = []
+    live_root = live.get("runtime_root")
+    if live_root:
+        if os.path.realpath(str(live_root)) != str(desired.get("runtime_root")):
+            reasons.append("runtime_root_mismatch")
+    else:
+        reasons.append("runtime_root_missing")
+    live_script = live.get("script_path")
+    if live_script:
+        if os.path.realpath(str(live_script)) != str(desired.get("script_path")):
+            reasons.append("script_path_mismatch")
+    else:
+        reasons.append("script_path_missing")
+    live_revision = live.get("source_revision")
+    if desired.get("source_revision") and not live_revision:
+        reasons.append("source_revision_missing")
+    elif live_revision and desired.get("source_revision") and str(live_revision) != str(desired.get("source_revision")):
+        reasons.append("source_revision_mismatch")
+    try:
+        live_protocol = int(live.get("protocol_version") or 0)
+    except (TypeError, ValueError):
+        live_protocol = 0
+    if live_protocol != int(desired.get("protocol_version") or 0):
+        if not live.get("protocol_version"):
+            reasons.append("protocol_version_missing")
+        else:
+            reasons.append("protocol_version_mismatch")
+    state = "current" if not reasons else "stale_deferred"
+    return {
+        **base,
+        "state": state,
+        "restart_deferred": state == "stale_deferred",
+        "pid": live.get("pid"),
+        "live_session_count": live.get("live_session_count"),
+        "live_source_revision": live_revision,
+        "live_runtime_root": live_root,
+        "live_script_path": live_script,
+        "protocol_version": live.get("protocol_version"),
+        "code_version": live.get("code_version"),
+        "started_at": live.get("started_at"),
+        "reasons": reasons,
+        "evidence": live,
+    }
+
+
 def first_run_stage(*, installed: bool, running: bool, pair_window_open: bool, remote_ready: bool) -> str:
     if not installed:
         return "helper_missing"
@@ -239,18 +353,18 @@ def next_action_for_stage(stage: str, *, remote_status: str, pair_window_open: b
         return {
             "id": "open_pairing_invitation",
             "label": "Open pairing invitation",
-            "message": "Open a pairing invitation from Pairling Helper, then pair from the iPhone.",
+            "message": "Run pairling pair to open a pairing invitation, then pair from the iPhone.",
         }
     if stage == "runtime_not_ready":
         return {
-            "id": "start_helper",
-            "label": "Start Pairling Helper",
-            "message": "Run Pairling Helper setup and review the failing runtime checks.",
+            "id": "start_runtime",
+            "label": "Start the Pairling runtime",
+            "message": "Run pairling setup and review the failing runtime checks.",
         }
     return {
-        "id": "install_helper",
-        "label": "Install Pairling Helper",
-        "message": "Install Pairling Helper on this Mac before pairing.",
+        "id": "install_cli",
+        "label": "Install the Pairling CLI",
+        "message": "Run npm install -g pairling then pairling setup on this Mac before pairing.",
     }
 
 
@@ -269,7 +383,13 @@ if manifest:
     runtime = manifest.get("runtime") if isinstance(manifest.get("runtime"), dict) else {}
     add("runtime_port", runtime.get("port") == PAIRLING_PORT, "error", "Runtime port is locked to 7773.", runtime.get("port"))
     launchd = manifest.get("launchd") if isinstance(manifest.get("launchd"), dict) else {}
-    add("launchd_labels", launchd.get("daemon_label") == PAIRLING_LABEL and launchd.get("connectd_label") == PAIRLING_CONNECTD_LABEL and launchd.get("guardian_label") == PAIRLING_GUARDIAN_LABEL, "error", "Manifest launchd labels are Pairling labels.", launchd)
+    launchd_evidence = {
+        "daemon_label": launchd.get("daemon_label"),
+        "ptybroker_label": launchd.get("ptybroker_label"),
+        "connectd_label": launchd.get("connectd_label"),
+        "guardian_label": launchd.get("guardian_label"),
+    }
+    add("launchd_labels", launchd.get("daemon_label") == PAIRLING_LABEL and launchd.get("ptybroker_label") == PAIRLING_PTYBROKER_LABEL and launchd.get("connectd_label") == PAIRLING_CONNECTD_LABEL and launchd.get("guardian_label") == PAIRLING_GUARDIAN_LABEL, "error", "Manifest launchd labels are Pairling labels.", launchd_evidence)
     mismatches = []
     for item in manifest.get("files") or []:
         rel = item.get("path")
@@ -365,7 +485,7 @@ try:
     add(
         "shell_pairling_wrapper",
         "runtime/current/bin/pairling" in pairling_text
-        and "/Users/mergimg0/projects/Pairling" not in pairling_text,
+        and re.search(r"/Users/[^\\s'\"]+/projects/Pairling", pairling_text) is None,
         "error",
         "User pairling command resolves through runtime/current unless PAIRLING_REPO_ROOT is explicitly set.",
         str(USER_PAIRLING),
@@ -411,6 +531,19 @@ except Exception as exc:
     add("connectd_launchagent_plist", False, "error", f"Pairling Connect LaunchAgent plist unreadable: {type(exc).__name__}: {exc}", str(CONNECTD_USER_PLIST))
     add("connectd_launchagent_env", False, "error", "Cannot validate Pairling Connect LaunchAgent environment.", str(CONNECTD_USER_PLIST))
 
+try:
+    payload = load_plist(PTYBROKER_USER_PLIST)
+    args = payload.get("ProgramArguments") or []
+    add(
+        "ptybroker_launchagent_plist",
+        payload.get("Label") == PAIRLING_PTYBROKER_LABEL and any(str(CURRENT / "companiond" / "pty_broker_service.py") == value for value in args),
+        "error",
+        "Pairling PTY broker LaunchAgent points at runtime/current.",
+        {"label": payload.get("Label"), "args": args},
+    )
+except Exception as exc:
+    add("ptybroker_launchagent_plist", False, "error", f"Pairling PTY broker LaunchAgent plist unreadable: {type(exc).__name__}: {exc}", str(PTYBROKER_USER_PLIST))
+
 try:
     payload = load_plist(SYSTEM_PLIST)
     add("guardian_plist", payload.get("Label") == PAIRLING_GUARDIAN_LABEL, "warning", "Pairling guardian LaunchDaemon is rendered/installed.", {"label": payload.get("Label")})
@@ -425,16 +558,23 @@ code, out, err = run(["launchctl", "print", f"gui/{os.getuid()}/{PAIRLING_CONNEC
 add("connectd_launchagent_loaded", code == 0 and "state = running" in out, "error", "Pairling Connect LaunchAgent is running." if code == 0 else "Pairling Connect LaunchAgent is not loaded.", (out or err)[:2000])
 add("connectd_loaded_from_current", str(CURRENT / "connectd" / "pairling-connectd") in out, "error", "Loaded Pairling Connect LaunchAgent uses runtime/current.", out[:2000])
 
-code, out, err = run(["launchctl", "print", f"gui/{os.getuid()}/{LEGACY_LABEL}"])
-legacy_loaded = code == 0 and "state = running" in out
-add("legacy_daemon_unloaded", not legacy_loaded, "error", "Old Pairling predecessor launchd label is not loaded.", (out or err)[:2000])
-add("legacy_launchagent_removed", not LEGACY_USER_PLIST.exists(), "warning", "Legacy user LaunchAgent plist is absent.", str(LEGACY_USER_PLIST))
-add("legacy_guardian_removed", not LEGACY_SYSTEM_PLIST.exists(), "warning", "Legacy guardian LaunchDaemon plist is absent.", str(LEGACY_SYSTEM_PLIST))
+code, out, err = run(["launchctl", "print", f"gui/{os.getuid()}/{PAIRLING_PTYBROKER_LABEL}"])
+ptybroker_launchd_loaded = code == 0 and "state = running" in out
+add("ptybroker_launchagent_loaded", ptybroker_launchd_loaded, "error", "Pairling PTY broker LaunchAgent is running." if code == 0 else "Pairling PTY broker LaunchAgent is not loaded.", (out or err)[:2000])
+add("ptybroker_loaded_from_current", str(CURRENT / "companiond" / "pty_broker_service.py") in out, "error", "Loaded Pairling PTY broker uses runtime/current.", out[:2000])
+ptybroker_deployment = ptybroker_deployment_status(launchd_loaded=ptybroker_launchd_loaded)
+add(
+    "ptybroker_deployment_state",
+    ptybroker_deployment["state"] == "current",
+    "warning",
+    f"Pairling PTY broker deployment state is {ptybroker_deployment['state']}.",
+    ptybroker_deployment,
+)
 
 listeners_7773 = port_listeners(PAIRLING_PORT)
 listeners_7723 = port_listeners(7723)
 add("port_7773_listener", bool(listeners_7773) or tcp_accepts("127.0.0.1", PAIRLING_PORT), "error", "Runtime is listening on 7773.", listeners_7773)
-legacy_conflict = any("notify-webhook" in line or "Python" in line or "python" in line for line in listeners_7723)
+legacy_conflict = any("Python" in line or "python" in line for line in listeners_7723)
 add("legacy_port_7723_clear", not legacy_conflict, "error", "Legacy 7723 daemon is not conflicting.", listeners_7723)
 
 health = None
@@ -475,17 +615,20 @@ for name in ["claude", "codex"]:
 add("provider_clis_detected", True, "warning", "Provider CLI detection completed.", provider_evidence)
 
 release_blockers = []
-developer_id_identity = os.environ.get("PAIRLING_DEVELOPER_ID_IDENTITY", "Developer ID Application: Mergim Gashi (965AVD34A3)")
+developer_id_identity = os.environ.get("PAIRLING_DEVELOPER_ID_IDENTITY")
 code, out, err = run(["/usr/bin/security", "find-identity", "-v", "-p", "codesigning"], timeout=5)
-has_developer_id = code == 0 and developer_id_identity in out
+identity_evidence = codesigning_identity_summary(out)
+has_developer_id = code == 0 and (
+    (developer_id_identity in out) if developer_id_identity else identity_evidence["expected_team_present"]
+)
 if not has_developer_id:
-    release_blockers.append(f"Developer ID identity is missing from the login keychain: {developer_id_identity}")
+    release_blockers.append("Developer ID Application identity is missing from the login keychain for the expected team.")
 add(
     "developer_id_identity",
     has_developer_id,
     "warning",
     "Developer ID Application identity is available for public helper signing.",
-    (out or err)[:2000],
+    identity_evidence if code == 0 else {"error": (err or "security find-identity failed")[:200]},
 )
 
 notary_profile = os.environ.get("PAIRLING_NOTARY_PROFILE", "pairling-notary")
@@ -498,42 +641,76 @@ add(
     has_notary_profile,
     "warning",
     "Notary credentials are stored and can authenticate.",
-    (out or err)[:2000],
+    {"profile": notary_profile, "authenticated": has_notary_profile, "error": None if has_notary_profile else (err or out)[:200]},
 )
 
-helper_artifact = Path(os.environ.get("PAIRLING_HELPER_ARTIFACT", str(repo_root / "dist" / "PairlingHelper.dmg")))
-helper_bundle = APP_SUPPORT / "Pairling Helper.app"
-if helper_artifact.exists():
-    code, out, err = run([
-        "/usr/sbin/spctl",
-        "-a",
-        "-vv",
-        "--type",
-        "open",
-        "--context",
-        "context:primary-signature",
-        str(helper_artifact),
-    ], timeout=8)
-    if code != 0:
-        release_blockers.append("Developer ID signed/notarized helper DMG is not Gatekeeper-accepted yet.")
+# npm distribution: the staged pairling-connectd binary must be a valid
+# Developer ID build from the pinned team. This replaces the retired dmg
+# Gatekeeper check; the npm install path never sets com.apple.quarantine, so
+# Gatekeeper assessment is not in the launch path, but signature + Team ID
+# verification is the integrity equivalent and matches the fail-closed staging
+# gate in install-runtime.sh.
+expected_team = os.environ.get("PAIRLING_CONNECTD_TEAM_ID", "965AVD34A3")
+staged_connectd = CURRENT / "connectd" / "pairling-connectd"
+if staged_connectd.exists():
+    vcode, vout, verr = run(["/usr/bin/codesign", "--verify", "--strict", str(staged_connectd)], timeout=8)
+    icode, iout, ierr = run(["/usr/bin/codesign", "-dvv", str(staged_connectd)], timeout=8)
+    team_line = next((l for l in ((iout or "") + (ierr or "")).splitlines() if l.startswith("TeamIdentifier=")), "")
+    team_id = team_line.split("=", 1)[1] if "=" in team_line else ""
+    signed_ok = vcode == 0 and (expected_team == "-" or team_id == expected_team)
+    if not signed_ok:
+        release_blockers.append("Staged pairling-connectd is not a valid Developer ID build from the expected team.")
     add(
-        "helper_signing_notarization",
-        code == 0,
+        "connectd_signature",
+        signed_ok,
         "warning",
-        "Helper DMG Gatekeeper assessment.",
-        {"artifact": str(helper_artifact), "assessment": (out or err)[:2000]},
+        "Staged pairling-connectd passes codesign --verify --strict with the expected Team ID.",
+        {"binary": str(staged_connectd), "team_id": team_id or None, "expected_team": expected_team, "verify": (vout or verr)[:1000]},
     )
-elif helper_bundle.exists():
-    code, out, err = run(["/usr/sbin/spctl", "-a", "-vv", str(helper_bundle)], timeout=8)
-    add("helper_signing_notarization", code == 0, "warning", "Helper bundle Gatekeeper assessment.", (out or err)[:2000])
 else:
-    release_blockers.append("Developer ID signed/notarized helper artifact is not present yet.")
+    release_blockers.append("Staged pairling-connectd is not present; run pairling setup.")
     add(
-        "helper_signing_notarization",
+        "connectd_signature",
         False,
         "warning",
-        "Helper artifact not present; signing/notarization remains a release blocker.",
-        {"artifact": str(helper_artifact), "bundle": str(helper_bundle)},
+        "Staged pairling-connectd not present; signature verification unavailable until pairling setup runs.",
+        {"binary": str(staged_connectd)},
+    )
+
+# P3 Python custody: when a vendored interpreter is staged, it must be a valid
+# Developer ID build from the expected team with the dev.pairling.python
+# identity — that scoping is the whole point (TCC grants attach to Pairling, not
+# a generic python3). When no vendored python is staged (the daemon runs under a
+# system python3), this check is informational, not a blocker.
+expected_python_identifier = os.environ.get("PAIRLING_PYTHON_IDENTIFIER", "dev.pairling.python")
+staged_python = CURRENT / "python" / "bin" / "python3"
+if staged_python.exists():
+    pvcode, pvout, pverr = run(["/usr/bin/codesign", "--verify", "--strict", str(staged_python)], timeout=10)
+    picode, piout, pierr = run(["/usr/bin/codesign", "-dvv", str(staged_python)], timeout=10)
+    pinfo = (piout or "") + (pierr or "")
+    p_team = next((l.split("=", 1)[1] for l in pinfo.splitlines() if l.startswith("TeamIdentifier=")), "")
+    p_id = next((l.split("=", 1)[1] for l in pinfo.splitlines() if l.startswith("Identifier=")), "")
+    python_signed_ok = (
+        pvcode == 0
+        and (expected_team == "-" or p_team == expected_team)
+        and p_id == expected_python_identifier
+    )
+    if not python_signed_ok:
+        release_blockers.append("Staged vendored python is not a valid dev.pairling.python Developer ID build.")
+    add(
+        "python_runtime",
+        python_signed_ok,
+        "warning",
+        "Staged vendored CPython is signed dev.pairling.python by the expected Team ID.",
+        {"python": str(staged_python), "team_id": p_team or None, "identifier": p_id or None, "expected_identifier": expected_python_identifier},
+    )
+else:
+    add(
+        "python_runtime",
+        True,
+        "warning",
+        "No vendored CPython staged; daemon runs under a system python3 (acceptable pre-P3-rollout).",
+        {"python": str(staged_python), "vendored": False},
     )
 
 errors = [c for c in checks if c["status"] != "ok" and c["severity"] == "error"]
@@ -620,6 +797,7 @@ result = {
         "launchd_label": PAIRLING_LABEL,
         "guardian_label": PAIRLING_GUARDIAN_LABEL,
     },
+    "ptybroker": ptybroker_deployment,
     "paths": {
         "app_support": str(APP_SUPPORT),
         "logs": str(LOGS_ROOT),
@@ -628,9 +806,7 @@ result = {
         "pair_records": str(PAIR_ROOT),
     },
     "legacy": {
-        "daemon_label": LEGACY_LABEL,
         "port": 7723,
-        "loaded": legacy_loaded,
         "listeners": listeners_7723,
     },
     "release_blockers": release_blockers,