pairling 0.2.7 → 0.2.9

package/payload/mac/install/uninstall-runtime.sh

@@ -11,6 +11,11 @@ USER_PLIST="$HOME/Library/LaunchAgents/$PAIRLING_DAEMON_LABEL.plist"
 CONNECTD_USER_PLIST="$HOME/Library/LaunchAgents/$PAIRLING_CONNECTD_LABEL.plist"
 PTYBROKER_USER_PLIST="$HOME/Library/LaunchAgents/$PAIRLING_PTYBROKER_LABEL.plist"
 SYSTEM_PLIST="/Library/LaunchDaemons/$PAIRLING_GUARDIAN_LABEL.plist"
+# Legacy: the silent-join mint broker, removed from the product. Torn down below.
+MINTD_SYSTEM_LABEL="dev.pairling.mintd"
+MINTD_SYSTEM_PLIST="/Library/LaunchDaemons/$MINTD_SYSTEM_LABEL.plist"
+MINTD_SYSTEM_DIR="/Library/Application Support/Pairling/mint"
+MINTD_SERVICE_ACCOUNT="_pairling_mint"
 YES="false"
 DELETE_STATE="false"
 DELETE_LOGS="false"
@@ -98,6 +103,32 @@ bootout_system() {
   fi
 }
 
+# Legacy teardown: the silent-join mint broker (dev.pairling.mintd) was removed
+# from the product. Machines that ran the old `enable-silent-join` still carry a
+# root LaunchDaemon, a stored Tailscale OAuth secret under the system mint dir,
+# and the _pairling_mint role account. Remove all three. Best-effort, sudo-gated.
+teardown_legacy_mintd() {
+  if [[ ! -f "$MINTD_SYSTEM_PLIST" && ! -d "$MINTD_SYSTEM_DIR" ]] \
+     && ! id -u "$MINTD_SERVICE_ACCOUNT" >/dev/null 2>&1; then
+    return
+  fi
+  if is_dry_run; then
+    printf 'dry-run: would remove the legacy silent-join mint broker (%s, %s, user %s)\n' \
+      "$MINTD_SYSTEM_PLIST" "$MINTD_SYSTEM_DIR" "$MINTD_SERVICE_ACCOUNT"
+    return
+  fi
+  if sudo -n true >/dev/null 2>&1; then
+    sudo launchctl bootout "system/$MINTD_SYSTEM_LABEL" >/dev/null 2>&1 || true
+    sudo launchctl bootout system "$MINTD_SYSTEM_PLIST" >/dev/null 2>&1 || true
+    sudo rm -f "$MINTD_SYSTEM_PLIST"
+    sudo rm -rf "$MINTD_SYSTEM_DIR"
+    sudo /usr/sbin/sysadminctl -deleteUser "$MINTD_SERVICE_ACCOUNT" >/dev/null 2>&1 || true
+    printf 'Removed the legacy silent-join mint broker.\n'
+  else
+    printf 'Skipping legacy mint-broker removal: passwordless sudo is unavailable.\n' >&2
+  fi
+}
+
 confirm
 
 bootout_user "$PAIRLING_DAEMON_LABEL" "$USER_PLIST"
@@ -107,6 +138,7 @@ rm -f "$USER_PLIST"
 rm -f "$CONNECTD_USER_PLIST"
 rm -f "$PTYBROKER_USER_PLIST"
 bootout_system "$PAIRLING_GUARDIAN_LABEL" "$SYSTEM_PLIST"
+teardown_legacy_mintd
 
 rm -rf "$APP_SUPPORT/pair" 2>/dev/null || true
 

package/payload-manifest.json

@@ -1,11 +1,11 @@
 {
   "connectd": {
     "darwin-arm64": {
-      "sha256": "9941dbf0462cd6140c24d3c37f3351aa6dbe093183740fd042ddaa6f44cb1c65",
+      "sha256": "3ee070f12619390609a8c76e0ae4803ab1bc48c9f77361b8f27a4125846f38e3",
       "team_id": "965AVD34A3"
     },
     "darwin-x64": {
-      "sha256": "66f6f18d836e43389d6efd70b0bd59200daaf668220907a6f1bfde17983ae7fe",
+      "sha256": "c1ee211c3da71200d7855c9246ea04cd25fda702f7fb33a366b4d51bdaf9e230",
       "team_id": "965AVD34A3"
     }
   },
@@ -20,11 +20,11 @@
     },
     {
       "path": "payload/mac/SOURCE_REVISION",
-      "sha256": "15d265ea54cc0e8147c8f5e60a9f83297966a1f7c059888a09d97d3e5b7a6d0c"
+      "sha256": "29c2c816c529155cc86f26d44a8e8d79fc170fc26ade74fac3780554b5c864ff"
     },
     {
       "path": "payload/mac/VERSION",
-      "sha256": "5b57e3b8c153d1d33b0c0f1ee29d3de1bf93232ed95aa78b80fe885e99faa915"
+      "sha256": "2f2b333be8858cb384114251b668bb1c9e45a0bb8393600b7ad4093d0e8e72f6"
     },
     {
       "path": "payload/mac/companiond/app_attest_lan.py",
@@ -96,7 +96,7 @@
     },
     {
       "path": "payload/mac/companiond/pairlingd.py",
-      "sha256": "ee2a9115531a15f9cc3aff0680be3bb7ab7b42c7cf001eac05b33cbf36755842"
+      "sha256": "ca1c5551dd235990d4ff8d8b9c3c3f25e912ca9c22c7003f50c9fe1ccb6bf02e"
     },
     {
       "path": "payload/mac/companiond/providers/__init__.py",
@@ -200,28 +200,16 @@
     },
     {
       "path": "payload/mac/connectd/cmd/pairling-connectd/main.go",
-      "sha256": "4582664c189db3c13fef81328172d69fa0bcd6b064396c0a811a154da98f7f21"
+      "sha256": "019288bd16c6e900c60206ee4739f9ae5ed640ea73cd57db6a1f0d618c9bf00c"
     },
     {
       "path": "payload/mac/connectd/cmd/pairling-connectd/peer_identity_test.go",
-      "sha256": "044c1260387b990de073d4f09fa516c3ce15ded7c255b5e1ac3d57f3f5810c27"
+      "sha256": "eb1f44e588c2d70e2660f805ee6b7fe09aa793365c0ae442164785a8241c35d8"
     },
     {
       "path": "payload/mac/connectd/cmd/pairling-connectd/upstream_health_test.go",
       "sha256": "dc5b6d3a8d11f38bcc198287bdbc95f058d35792ca6cf34bc49ca0bed22bfacf"
     },
-    {
-      "path": "payload/mac/connectd/cmd/pairling-tailnet-mintd/main.go",
-      "sha256": "64fd4527c97397fce10793001af8d59ac3154c75c7ed9e1b532f8f2e4bf88bd4"
-    },
-    {
-      "path": "payload/mac/connectd/cmd/pairling-tailnet-mintd/mintd.go",
-      "sha256": "ca49b8ab8216eeec770ad6e9e8111aca819a9a88b050d7eefbdf69c0fad20376"
-    },
-    {
-      "path": "payload/mac/connectd/cmd/pairling-tailnet-mintd/mintd_test.go",
-      "sha256": "14a9af6b9575ba89314ce05f2fe465844fea3bb40b3eba5e0d33d059608bfb1f"
-    },
     {
       "path": "payload/mac/connectd/go.mod",
       "sha256": "c96748d396598b0952b4c0d43f7f85ca3a56f4019761088267421b22518d5905"
@@ -244,11 +232,11 @@
     },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy.go",
-      "sha256": "ad7de08a59819fcbdd81f62d707738af128064cc24cea576674aee2f0960c267"
+      "sha256": "b852408a35b71a0b62554cc93f413c3352034432f14529ab3ddbe85fa5ee49c8"
     },
     {
       "path": "payload/mac/connectd/internal/gateway/proxy_test.go",
-      "sha256": "b02cd354dcd3292079f35ee86a1ce75e3ed8286550f064fdae7914e661464910"
+      "sha256": "f3a6b1974c1ccba8e5e380d18c31a5aca61458b6d4a1075865b8978e86e54209"
     },
     {
       "path": "payload/mac/connectd/internal/runtime/config.go",
@@ -284,7 +272,7 @@
     },
     {
       "path": "payload/mac/install/install-runtime.sh",
-      "sha256": "152eed164fd4edfd42874f20e8476d8e42415d5e93e090b716fef2ea7ed6424e"
+      "sha256": "40ffa67a3833ce4342c241ca4f1e7dec471a86b0c80359746cd75a8df2e33f60"
     },
     {
       "path": "payload/mac/install/psk_dependency_check.py",
@@ -292,11 +280,11 @@
     },
     {
       "path": "payload/mac/install/render-launchd.py",
-      "sha256": "5c4c06b578e24726731650ff39d688248ba1bd412b9e21fc368b13d07e8ee0df"
+      "sha256": "29db1aa46d62cd23ba27ab283bb990d168bfc08fb82cfc681046dc7b887d85fe"
     },
     {
       "path": "payload/mac/install/uninstall-runtime.sh",
-      "sha256": "8af7b3bb4de4b053888fe44a9fdb576144d6cb154bafc9b3d02edac90a7055ec"
+      "sha256": "0edeb5336a71c235d8796a8e59072c6d8983d196de5aae0cfcb4b0c3560fa33f"
     },
     {
       "path": "payload/mac/mcp/phone_tools.py",
@@ -307,19 +295,9 @@
       "sha256": "5ebcd63fc53114ace518807c2221e562e65237e57945a76c457f5931a5791cc1"
     }
   ],
-  "mintd": {
-    "darwin-arm64": {
-      "sha256": "326d1d42a0b40bdb60687f7b7d190c12c520106e47542054b1b807d397e41fe9",
-      "team_id": "965AVD34A3"
-    },
-    "darwin-x64": {
-      "sha256": "477cf4d9b88f1e8303e5545eb3c03460e0c75b284f9d628641cb80e2be14af38",
-      "team_id": "965AVD34A3"
-    }
-  },
   "package": "pairling",
-  "package_version": "0.2.7",
+  "package_version": "0.2.9",
   "schema_version": 1,
   "source_dirty": false,
-  "source_revision": "102b7cf"
+  "source_revision": "c97bbab"
 }

package/payload/mac/connectd/cmd/pairling-tailnet-mintd/main.go

@@ -1,121 +0,0 @@
-package main
-
-import (
-	"context"
-	"encoding/json"
-	"errors"
-	"flag"
-	"fmt"
-	"log"
-	"net/http"
-	"os"
-	"os/exec"
-	"os/signal"
-	"strconv"
-	"strings"
-	"syscall"
-	"time"
-)
-
-func main() {
-	var (
-		secretPath    = flag.String("secret-path", "/Library/Application Support/Pairling/mint/client_secret.json", "OAuth client credential JSON")
-		socketPath    = flag.String("socket-path", "/Library/Application Support/Pairling/run/mintd/mintd.sock", "Unix socket path")
-		statePath     = flag.String("state-path", "/Library/Application Support/Pairling/mint/state.json", "persistent rate-limit state JSON")
-		auditPath     = flag.String("audit-path", "/Library/Application Support/Pairling/mint/audit.jsonl", "audit JSONL path")
-		alertPath     = flag.String("alert-path", "/Library/Application Support/Pairling/run/mintd/alerts.jsonl", "health-readable alert JSONL path")
-		apiBaseURL    = flag.String("api-base-url", "https://api.tailscale.com/api/v2", "Tailscale API base URL")
-		oauthURL      = flag.String("oauth-url", "https://api.tailscale.com/api/v2/oauth/token", "Tailscale OAuth token URL")
-		authorizedUID = flag.Int("authorized-uid", -1, "only this peer uid may request mints")
-	)
-	flag.Parse()
-
-	b, err := NewBroker(BrokerConfig{
-		SecretPath: *secretPath,
-		StatePath:  *statePath,
-		AuditPath:  *auditPath,
-		AlertPath:  *alertPath,
-		OAuthURL:   *oauthURL,
-		APIBaseURL: *apiBaseURL,
-		LockStatus: defaultLockStatus,
-	})
-	if err != nil {
-		log.Fatal(err)
-	}
-	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
-	defer stop()
-	if err := b.ServeUnix(ctx, *socketPath, *authorizedUID); err != nil {
-		log.Fatal(err)
-	}
-}
-
-func defaultLockStatus(ctx context.Context) (bool, error) {
-	if locked, err := lockStatusFromConnectdStatus(ctx, "http://127.0.0.1:7774/status"); err == nil {
-		return locked, nil
-	}
-	return lockStatusFromCandidates(ctx, []string{
-		"/opt/homebrew/bin/tailscale",
-		"/Applications/Tailscale.app/Contents/MacOS/Tailscale",
-		"tailscale",
-	})
-}
-
-func lockStatusFromConnectdStatus(ctx context.Context, statusURL string) (bool, error) {
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, statusURL, nil)
-	if err != nil {
-		return false, err
-	}
-	resp, err := (&http.Client{Timeout: 2 * time.Second}).Do(req)
-	if err != nil {
-		return false, err
-	}
-	defer resp.Body.Close()
-	if resp.StatusCode != http.StatusOK {
-		return false, fmt.Errorf("connectd status returned %s", resp.Status)
-	}
-	var body struct {
-		TailnetLockEnabled *bool `json:"tailnet_lock_enabled"`
-	}
-	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
-		return false, err
-	}
-	if body.TailnetLockEnabled == nil {
-		return false, errors.New("connectd status omitted tailnet_lock_enabled")
-	}
-	return *body.TailnetLockEnabled, nil
-}
-
-func lockStatusFromCandidates(ctx context.Context, candidates []string) (bool, error) {
-	var errs []error
-	for _, bin := range candidates {
-		out, err := exec.CommandContext(ctx, bin, "lock", "status").CombinedOutput()
-		if err != nil {
-			errs = append(errs, fmt.Errorf("%s: %w", bin, err))
-			continue
-		}
-		text := strings.ToLower(string(out))
-		if strings.Contains(text, "tailscale gui failed to start") {
-			errs = append(errs, fmt.Errorf("%s: gui unavailable", bin))
-			continue
-		}
-		if strings.Contains(text, "not enabled") || strings.Contains(text, "disabled") {
-			return false, nil
-		}
-		if strings.Contains(text, "enabled") {
-			return true, nil
-		}
-		return false, fmt.Errorf("unrecognized tailscale lock status: %q", strings.TrimSpace(string(out)))
-	}
-	return false, errors.New("tailscale lock status unavailable: " + joinErrors(errs))
-}
-
-func joinErrors(errs []error) string {
-	parts := make([]string, 0, len(errs))
-	for _, err := range errs {
-		parts = append(parts, err.Error())
-	}
-	if len(parts) == 0 {
-		return "no candidates"
-	}
-	return strconv.Quote(strings.Join(parts, "; "))
-}