pairling 0.2.11 → 0.2.12

package/payload/mac/install/render-launchd.py

@@ -8,7 +8,6 @@ import plistlib
 from pathlib import Path
 
 PAIRLING_DAEMON_LABEL = "dev.pairling.companiond"
-PAIRLING_GUARDIAN_LABEL = "dev.pairling.power-guardian"
 PAIRLING_CONNECTD_LABEL = "dev.pairling.connectd"
 PAIRLING_PTYBROKER_LABEL = "dev.pairling.ptybroker"
 PAIRLING_RUNTIME_PORT = "7773"
@@ -24,7 +23,7 @@ def daemon_plist(current: Path, logs: Path, python_bin: str) -> dict:
     env = {
         "PAIRLING_RUNTIME_PORT": PAIRLING_RUNTIME_PORT,
         "COMPANION_DAEMON_PORT": PAIRLING_RUNTIME_PORT,
-        "PAIRLING_BIND_MODE": "all",
+        "PAIRLING_BIND_MODE": "loopback",
         "PAIRLING_APP_SUPPORT_ROOT": str(current.parent.parent),
         "PAIRLING_LOGS_ROOT": str(logs),
         "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
@@ -44,30 +43,6 @@ def daemon_plist(current: Path, logs: Path, python_bin: str) -> dict:
     }
 
 
-def guardian_plist(current: Path, logs: Path, python_bin: str) -> dict:
-    return {
-        "Label": PAIRLING_GUARDIAN_LABEL,
-        "ProgramArguments": [
-            python_bin,
-            str(current / "guardian" / "companion-power-guardian.py"),
-        ],
-        "EnvironmentVariables": {
-            "PAIRLING_RUNTIME_PORT": PAIRLING_RUNTIME_PORT,
-            "COMPANION_DAEMON_PORT": PAIRLING_RUNTIME_PORT,
-            "COMPANION_COORDINATOR_HOST": "pairling-mac",
-            "COMPANION_GUARDIAN_ENFORCE": "0",
-            "COMPANION_LOW_POWER_MODE_POLICY": "preserve",
-            "COMPANION_POWER_INTERVAL_SECONDS": "20",
-            "COMPANION_POWER_STATE_PATH": "/var/run/pairling-power-state.json",
-            "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin",
-        },
-        "RunAtLoad": True,
-        "KeepAlive": True,
-        "StandardOutPath": str(logs / "power-guardian.log"),
-        "StandardErrorPath": str(logs / "power-guardian.err"),
-    }
-
-
 def connectd_plist(current: Path, logs: Path) -> dict:
     app_support = current.parent.parent
     return {
@@ -124,7 +99,6 @@ def main() -> int:
     parser.add_argument("--logs-root", required=True)
     parser.add_argument("--output-dir", required=True)
     parser.add_argument("--daemon-python", default="/usr/local/bin/python3")
-    parser.add_argument("--guardian-python", default="/usr/bin/python3")
     parser.add_argument("--mirror-python", default="/usr/local/bin/python3", help=argparse.SUPPRESS)
     args = parser.parse_args()
 
@@ -134,7 +108,6 @@ def main() -> int:
 
     write_plist(out / f"{PAIRLING_DAEMON_LABEL}.plist", daemon_plist(current, logs, args.daemon_python))
     write_plist(out / f"{PAIRLING_PTYBROKER_LABEL}.plist", ptybroker_plist(current, logs, args.daemon_python))
-    write_plist(out / f"{PAIRLING_GUARDIAN_LABEL}.plist", guardian_plist(current, logs, args.guardian_python))
     write_plist(out / f"{PAIRLING_CONNECTD_LABEL}.plist", connectd_plist(current, logs))
     return 0
 

package/payload/mac/install/uninstall-runtime.sh

@@ -2,7 +2,6 @@
 set -euo pipefail
 
 PAIRLING_DAEMON_LABEL="dev.pairling.companiond"
-PAIRLING_GUARDIAN_LABEL="dev.pairling.power-guardian"
 PAIRLING_CONNECTD_LABEL="dev.pairling.connectd"
 PAIRLING_PTYBROKER_LABEL="dev.pairling.ptybroker"
 APP_SUPPORT="${PAIRLING_APP_SUPPORT_ROOT:-${COMPANION_APP_SUPPORT_ROOT:-$HOME/Library/Application Support/Pairling}}"
@@ -10,7 +9,6 @@ LOGS_ROOT="${PAIRLING_LOGS_ROOT:-${COMPANION_LOGS_ROOT:-$HOME/Library/Logs/Pairl
 USER_PLIST="$HOME/Library/LaunchAgents/$PAIRLING_DAEMON_LABEL.plist"
 CONNECTD_USER_PLIST="$HOME/Library/LaunchAgents/$PAIRLING_CONNECTD_LABEL.plist"
 PTYBROKER_USER_PLIST="$HOME/Library/LaunchAgents/$PAIRLING_PTYBROKER_LABEL.plist"
-SYSTEM_PLIST="/Library/LaunchDaemons/$PAIRLING_GUARDIAN_LABEL.plist"
 # Legacy: the silent-join mint broker, removed from the product. Torn down below.
 MINTD_SYSTEM_LABEL="dev.pairling.mintd"
 MINTD_SYSTEM_PLIST="/Library/LaunchDaemons/$MINTD_SYSTEM_LABEL.plist"
@@ -137,7 +135,6 @@ bootout_user "$PAIRLING_PTYBROKER_LABEL" "$PTYBROKER_USER_PLIST"
 rm -f "$USER_PLIST"
 rm -f "$CONNECTD_USER_PLIST"
 rm -f "$PTYBROKER_USER_PLIST"
-bootout_system "$PAIRLING_GUARDIAN_LABEL" "$SYSTEM_PLIST"
 teardown_legacy_mintd
 
 rm -rf "$APP_SUPPORT/pair" 2>/dev/null || true

package/payload/mac/install/verify-payload-manifest.py

@@ -0,0 +1,71 @@
+#!/usr/bin/env python3
+from __future__ import annotations
+
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+
+def fail(message: str) -> int:
+    print(f"payload manifest verification failed: {message}", file=sys.stderr)
+    return 1
+
+
+def sha256(path: Path) -> str:
+    digest = hashlib.sha256()
+    with path.open("rb") as fh:
+        for chunk in iter(lambda: fh.read(1024 * 1024), b""):
+            digest.update(chunk)
+    return digest.hexdigest()
+
+
+def payload_file(payload_root: Path, rel: str) -> Path | None:
+    path = Path(rel)
+    if path.is_absolute() or ".." in path.parts:
+        return None
+    parts = path.parts
+    if not parts or parts[0] != "payload":
+        return None
+    return payload_root.joinpath(*parts[1:])
+
+
+def main() -> int:
+    if len(sys.argv) != 3:
+        return fail("usage: verify-payload-manifest.py <payload-root> <payload-manifest.json>")
+    payload_root = Path(sys.argv[1]).resolve()
+    manifest_path = Path(sys.argv[2]).resolve()
+    try:
+        manifest = json.loads(manifest_path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError) as exc:
+        return fail(f"cannot read manifest: {exc}")
+    if not isinstance(manifest, dict) or manifest.get("schema_version") != 1:
+        return fail("unsupported manifest schema")
+    files = manifest.get("files")
+    if not isinstance(files, list) or not files:
+        return fail("manifest has no files")
+    for item in files:
+        if not isinstance(item, dict):
+            return fail("manifest file entry is not an object")
+        rel = str(item.get("path") or "")
+        expected = str(item.get("sha256") or "")
+        if len(expected) != 64 or any(c not in "0123456789abcdef" for c in expected.lower()):
+            return fail(f"bad sha256 for {rel or '<missing path>'}")
+        target = payload_file(payload_root, rel)
+        if target is None:
+            return fail(f"bad payload path {rel!r}")
+        try:
+            resolved = target.resolve(strict=True)
+        except OSError:
+            return fail(f"missing payload file {rel}")
+        if payload_root not in (resolved, *resolved.parents):
+            return fail(f"payload path escapes root {rel!r}")
+        actual = sha256(resolved)
+        if actual.lower() != expected.lower():
+            return fail(f"sha256 mismatch for {rel}")
+    print(f"payload manifest verified: {len(files)} files")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

package/payload-manifest.json

@@ -1,11 +1,11 @@
 {
   "connectd": {
     "darwin-arm64": {
-      "sha256": "2bd3903963b0395cc2af25c0ca88450873b8f878fa8b0fcf5b70283fde21602f",
+      "sha256": "29af8f7c4d4291e487804bf84e918ae58d35e258ee542c70884ab107e94b63fa",
       "team_id": "965AVD34A3"
     },
     "darwin-x64": {
-      "sha256": "301fe95148dbc5a5144165802319d817a4a5c8f1492d0b5a11ef101f4fffbc9e",
+      "sha256": "6df440f47c58dc520396ed4bf8b437545b27c87d6e3787c20ce212b6a3a58f6d",
       "team_id": "965AVD34A3"
     }
   },
@@ -20,11 +20,11 @@
     },
     {
       "path": "payload/mac/SOURCE_REVISION",
-      "sha256": "48e3c96b6c22c6c3424b1fbcebbbee0e23f0e61535ac6b487dec510a496cb6ef"
+      "sha256": "2828a4f7792a6e97ac014e5205bdcf361ced85eff86009de975b92da14959e2b"
     },
     {
       "path": "payload/mac/VERSION",
-      "sha256": "bbab81dca58f2b892db293acbba7fe5731667b67876f6812e3e7b9e2253a5c51"
+      "sha256": "b1d246bf58dfe9d621c372fbca4fdda71a56ddd79c641b9e3b7dde08ca4d7512"
     },
     {
       "path": "payload/mac/companiond/app_attest_lan.py",
@@ -80,7 +80,7 @@
     },
     {
       "path": "payload/mac/companiond/pairling_pairing.py",
-      "sha256": "6d6aab5cfa12daff6b83f25c6844253432dfec3f20bec30a072875a19dba23cb"
+      "sha256": "9b1046d54b7b1c026186e9d1f1dae4ff33de3c66f36f37b8842b2be7fcaeb36c"
     },
     {
       "path": "payload/mac/companiond/pairling_psk.py",
@@ -96,7 +96,7 @@
     },
     {
       "path": "payload/mac/companiond/pairlingd.py",
-      "sha256": "ad3d9929966d41778de40be0ae908ea22ec49f811f9a6aceabd606aa41b6a2db"
+      "sha256": "0377e193d6ac49bfb55979bb4c17635caa1f2cbcb8c85c0d51447cf07939f908"
     },
     {
       "path": "payload/mac/companiond/providers/__init__.py",
@@ -148,19 +148,19 @@
     },
     {
       "path": "payload/mac/companiond/runtime_contract.py",
-      "sha256": "70fa5b830d94bbae44b4d000d55f334c54f4be4008c9da560e34af4c0a709846"
+      "sha256": "903c4bef29b17454c8dde50ebaa9b7107e8d5a113f25b2a0861b18e544b7b9ee"
     },
     {
       "path": "payload/mac/companiond/runtime_manifest.py",
-      "sha256": "72d61833a74e8171157784bee252f3e0f0bb15d77b740c2ffb2d82214d3b4933"
+      "sha256": "c38f2bca253b9364263593ad8443bdf4ebbb80f823a11f8a66cc0a142e944f3d"
     },
     {
       "path": "payload/mac/companiond/runtime_paths.py",
-      "sha256": "5d6be15c373c89f1d12d142dd25bc175b688af703398d8cf4cc71f06b98ec4cc"
+      "sha256": "d5f0c2546e50c1fa30e9e2c043c0ef97e924cb0c92626c2885c577b9b4e613ad"
     },
     {
       "path": "payload/mac/companiond/safety_monitor.py",
-      "sha256": "54122cd85220f5e698de36cbab0eace74bfcf3b4ed4ab3777f709378e631540a"
+      "sha256": "eb2aebe73214d8cafa810295f0b1a63933b5f850d3e45533108b55d2b9c4b08e"
     },
     {
       "path": "payload/mac/companiond/sentinel_notifications.py",
@@ -232,11 +232,11 @@
     },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy.go",
-      "sha256": "9d57225667f5ab025286c6714864762cbd31a8bdaf176f2b5679a26ca7144f74"
+      "sha256": "39d736dc16ccd2e7118605d36014d63f0bedf0b6c08fbb64ee5cf7b795869119"
     },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy_test.go",
-      "sha256": "f3a6b1974c1ccba8e5e380d18c31a5aca61458b6d4a1075865b8978e86e54209"
+      "sha256": "678025830386e2175fcf84adc18537bb673a97db1d29cbd7c79ef5cc1721d6f2"
     },
     {
       "path": "payload/mac/connectd/internal/runtime/config.go",
@@ -254,25 +254,17 @@
       "path": "payload/mac/connectd/internal/status/status_test.go",
       "sha256": "5d2c9601c5edf6afc0abc7d4737cc06fd4e3a53cb83c0fce4b51750c1e194366"
     },
-    {
-      "path": "payload/mac/guardian/companion-power-guardian.py",
-      "sha256": "b613f57b886a88a047b9f226ae0d9c160932b114f6957b1721988363f80eeca9"
-    },
-    {
-      "path": "payload/mac/guardian/guardian_contract.py",
-      "sha256": "18f08827a61b165b21f47616bfc7a6aacf1d309672ddd83dee411415d9af10dd"
-    },
     {
       "path": "payload/mac/install/bootstrap-first-run.sh",
-      "sha256": "ae15dc2cbe4862fe9ec70165d8876757063d2e70aa883638967f858b53ecc18d"
+      "sha256": "294c74c9cd07af6d738dfbad5f125f9a142c358d659506466a4e8c3df62243c5"
     },
     {
       "path": "payload/mac/install/doctor.sh",
-      "sha256": "1ba291c2c7def20af4ab4c850df0aaf54c41065da7e77255d8a6ff3bdfbeb2cc"
+      "sha256": "87f817965611e59cb84b1547dd59352f0f637d66084e3d4d7a84cea299ad82e2"
     },
     {
       "path": "payload/mac/install/install-runtime.sh",
-      "sha256": "2575f5ae2aeb03d6bce5ae1194498ac34d14d09c993c4a1a4474e187cae10618"
+      "sha256": "2cba0b8bc3731c5725aae2229fe4b2069f71c4f269e1cc212c03197152561daf"
     },
     {
       "path": "payload/mac/install/psk_dependency_check.py",
@@ -280,11 +272,15 @@
     },
     {
       "path": "payload/mac/install/render-launchd.py",
-      "sha256": "29db1aa46d62cd23ba27ab283bb990d168bfc08fb82cfc681046dc7b887d85fe"
+      "sha256": "454b8ed22c801fce9c557cfcd09928cd01caf9c37a517ece0ec424a5532b95c4"
     },
     {
       "path": "payload/mac/install/uninstall-runtime.sh",
-      "sha256": "0edeb5336a71c235d8796a8e59072c6d8983d196de5aae0cfcb4b0c3560fa33f"
+      "sha256": "10cd5eb9ea5424a7a71b6c92a0eba97d2d524807d49e7e0035c51ad4f1fce546"
+    },
+    {
+      "path": "payload/mac/install/verify-payload-manifest.py",
+      "sha256": "131788b553d88077ba7f0592579b3c702fb91a328b7cd81d596358051df1ba48"
     },
     {
       "path": "payload/mac/mcp/phone_tools.py",
@@ -296,8 +292,8 @@
     }
   ],
   "package": "pairling",
-  "package_version": "0.2.11",
+  "package_version": "0.2.12",
   "schema_version": 1,
   "source_dirty": false,
-  "source_revision": "83c69e1"
+  "source_revision": "71ea638dd7f9fe82a505448f437113380eec83aa"
 }