secure-agents 0.0.0-stage → 0.7.2

package/dist/relay.js

@@ -0,0 +1,222 @@
+// The relay: a middle server so two computers never connect to each other directly and never learn each other's IP. It only joins two encrypted pipes; it can't read them.
+import { EventEmitter } from 'node:events';
+import HyperDHT from 'hyperdht';
+import NoiseSecretStream from '@hyperswarm/secret-stream';
+import { newId } from './store.js';
+const MAX_HEADER = 4096;
+const PENDING_MS = 20_000;
+const MAX_BUFFER = 1_000_000;
+const isKey = (v) => typeof v === 'string' && /^[0-9a-f]{64}$/.test(v);
+/** Reads the first line of a stream, then hands over the rest untouched. */
+function firstLine(s, onLine) {
+    let buf = Buffer.alloc(0);
+    const onData = (c) => {
+        buf = Buffer.concat([buf, c]);
+        const nl = buf.indexOf(10);
+        if (nl < 0) {
+            if (buf.length > MAX_HEADER) {
+                s.off('data', onData);
+                onLine(null, Buffer.alloc(0));
+            }
+            return;
+        }
+        s.off('data', onData);
+        s.pause();
+        let line = null;
+        try {
+            line = JSON.parse(buf.subarray(0, nl).toString('utf8'));
+        }
+        catch { /* bad header */ }
+        onLine(line, buf.subarray(nl + 1));
+    };
+    s.on('data', onData);
+}
+function lines(s, onLine, rest = Buffer.alloc(0)) {
+    let buf = rest.toString('utf8');
+    const eat = () => {
+        let nl;
+        while ((nl = buf.indexOf('\n')) >= 0) {
+            const l = buf.slice(0, nl);
+            buf = buf.slice(nl + 1);
+            try {
+                onLine(JSON.parse(l));
+            }
+            catch { /* ignore */ }
+        }
+        if (buf.length > MAX_HEADER)
+            s.destroy();
+    };
+    s.on('data', (c) => { buf += c.toString('utf8'); eat(); });
+    s.resume();
+    eat();
+}
+const send = (s, l) => s.write(JSON.stringify(l) + '\n');
+// ── the relay server (runs on a machine you trust, e.g. a small VPS) ──────────
+export async function runRelay(keys, allowed, log) {
+    const dht = new HyperDHT();
+    const controls = new Map();
+    const pending = new Map();
+    const tellWatchers = (pk, t) => { for (const c of controls.values())
+        if (c.watch.has(pk))
+            send(c.s, { t, pk }); };
+    const server = dht.createServer((conn) => {
+        const me = conn.remotePublicKey.toString('hex');
+        conn.on('error', () => { });
+        if (!allowed().has(me)) {
+            log(`refused ${me.slice(0, 12)}… (not allowed on this relay)`);
+            conn.destroy();
+            return;
+        }
+        firstLine(conn, (line, rest) => {
+            if (!line)
+                return conn.destroy();
+            if (line.t === 'watch') {
+                controls.get(me)?.s.destroy();
+                const c = { s: conn, watch: new Set((Array.isArray(line.peers) ? line.peers : []).filter(isKey).slice(0, 1000)) };
+                controls.set(me, c);
+                for (const pk of c.watch)
+                    if (controls.has(pk))
+                        send(conn, { t: 'online', pk });
+                tellWatchers(me, 'online');
+                lines(conn, (l) => {
+                    if (l.t !== 'watch' || !Array.isArray(l.peers))
+                        return;
+                    c.watch = new Set(l.peers.filter(isKey).slice(0, 1000));
+                    for (const pk of c.watch)
+                        if (controls.has(pk))
+                            send(conn, { t: 'online', pk });
+                }, rest);
+                conn.on('close', () => { if (controls.get(me)?.s === conn) {
+                    controls.delete(me);
+                    tellWatchers(me, 'offline');
+                } });
+                return;
+            }
+            if (line.t === 'dial' && isKey(line.to)) {
+                const target = controls.get(line.to);
+                if (!target)
+                    return conn.destroy();
+                const id = newId();
+                const p = { from: me, to: line.to, s: conn, buffered: (rest.length ? [rest] : []), size: rest.length, timer: setTimeout(() => { pending.delete(id); conn.destroy(); }, PENDING_MS) };
+                conn.on('data', (c) => { p.buffered.push(c); p.size += c.length; if (p.size > MAX_BUFFER)
+                    conn.destroy(); });
+                conn.resume();
+                conn.on('close', () => { clearTimeout(p.timer); pending.delete(id); });
+                pending.set(id, p);
+                send(target.s, { t: 'incoming', from: me, id });
+                return;
+            }
+            if (line.t === 'accept' && typeof line.id === 'string') {
+                const p = pending.get(line.id);
+                if (!p || p.to !== me)
+                    return conn.destroy();
+                pending.delete(line.id);
+                clearTimeout(p.timer);
+                p.s.removeAllListeners('data');
+                for (const b of p.buffered)
+                    conn.write(b);
+                if (rest.length)
+                    p.s.write(rest);
+                p.s.pipe(conn).pipe(p.s);
+                const end = () => { p.s.destroy(); conn.destroy(); };
+                p.s.on('close', end);
+                conn.on('close', end);
+                conn.resume();
+                p.s.resume();
+                log(`joined ${p.from.slice(0, 12)}… ↔ ${me.slice(0, 12)}…`);
+                return;
+            }
+            conn.destroy();
+        });
+    });
+    await server.listen(keys);
+    return async () => { await server.close(); await dht.destroy(); };
+}
+/** Connects to peers only through the relay. Never opens a direct connection, so peers never see this computer's IP. */
+export class RelayClient extends EventEmitter {
+    keys;
+    relay;
+    me;
+    allow;
+    connected;
+    mustDial;
+    dht = new HyperDHT();
+    control = null;
+    watch = new Set();
+    online = new Set();
+    dialing = new Set();
+    stopped = false;
+    constructor(keys, relay, me, allow, connected, mustDial) {
+        super();
+        this.keys = keys;
+        this.relay = relay;
+        this.me = me;
+        this.allow = allow;
+        this.connected = connected;
+        this.mustDial = mustDial;
+    }
+    start() { this.connectControl(); }
+    dial(pk) {
+        this.watch.add(pk);
+        if (this.control)
+            send(this.control, { t: 'watch', peers: [...this.watch] });
+        if (this.online.has(pk))
+            this.maybeDial(pk);
+    }
+    forget(pk) { this.watch.delete(pk); if (this.control)
+        send(this.control, { t: 'watch', peers: [...this.watch] }); }
+    /** Called when a peer connection closes, to reconnect while both are still online. */
+    lost(pk) { if (!this.stopped)
+        setTimeout(() => this.maybeDial(pk), 2000); }
+    async stop() { this.stopped = true; this.control?.destroy(); await this.dht.destroy(); }
+    connectControl() {
+        if (this.stopped)
+            return;
+        const c = this.dht.connect(Buffer.from(this.relay, 'hex'), { keyPair: this.keys });
+        this.control = c;
+        send(c, { t: 'watch', peers: [...this.watch] });
+        c.on('error', () => { });
+        c.on('close', () => { if (this.control === c) {
+            this.control = null;
+            this.online.clear();
+            setTimeout(() => this.connectControl(), 3000);
+        } });
+        lines(c, (l) => {
+            if (l.t === 'online' && isKey(l.pk)) {
+                this.online.add(l.pk);
+                this.maybeDial(l.pk);
+            }
+            if (l.t === 'offline' && isKey(l.pk))
+                this.online.delete(l.pk);
+            if (l.t === 'incoming' && isKey(l.from) && typeof l.id === 'string' && this.allow(l.from))
+                this.pipe({ t: 'accept', id: l.id }, false, l.from);
+        });
+    }
+    /** The smaller key dials, so the two sides don't both dial at once; a joiner always dials the inviter. */
+    maybeDial(pk) {
+        if (this.stopped || !this.online.has(pk) || this.connected(pk) || this.dialing.has(pk))
+            return;
+        if (!(this.me < pk || this.mustDial(pk)))
+            return;
+        this.pipe({ t: 'dial', to: pk }, true, pk);
+    }
+    pipe(header, initiator, pk) {
+        if (initiator)
+            this.dialing.add(pk);
+        const raw = this.dht.connect(Buffer.from(this.relay, 'hex'), { keyPair: this.keys });
+        raw.on('error', () => { });
+        send(raw, header);
+        const s = new NoiseSecretStream(initiator, raw, { keyPair: this.keys, remotePublicKey: initiator ? Buffer.from(pk, 'hex') : undefined });
+        s.on('error', () => { });
+        const done = () => this.dialing.delete(pk);
+        s.opened.then((ok) => {
+            done();
+            if (!ok || s.remotePublicKey?.toString('hex') !== pk) {
+                s.destroy();
+                return;
+            }
+            this.emit('connection', s, pk);
+        }, () => { done(); s.destroy(); });
+        raw.on('close', done);
+    }
+}

package/dist/scan.js

@@ -0,0 +1,41 @@
+// Content checks: secrets must never leave in text, and text from another agent that tries to steer this agent is held for the person.
+const SECRETS = [
+    ['private key', /-----BEGIN [A-Z ]*PRIVATE KEY-----/],
+    ['AWS access key', /\bAKIA[0-9A-Z]{16}\b/],
+    ['GitHub token', /\bgh[pousr]_[A-Za-z0-9]{36,}\b/],
+    ['OpenAI or Anthropic key', /\bsk-(ant-)?[A-Za-z0-9_-]{20,}\b/],
+    ['Slack token', /\bxox[abprs]-[A-Za-z0-9-]{10,}\b/],
+    ['Google API key', /\bAIza[0-9A-Za-z_-]{35}\b/],
+    ['Stripe key', /\b[rs]k_live_[0-9A-Za-z]{16,}\b/],
+    ['JSON web token', /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/],
+    ['password or token assignment', /\b(password|passwd|pwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token)\s*[:=]\s*['"]?[^\s'"]{8,}/i],
+    ['database URL with password', /\b(postgres|postgresql|mysql|mongodb(\+srv)?|redis):\/\/[^:\s/]+:[^@\s]+@/i],
+];
+const STEERING = [
+    ['tells the agent to ignore its instructions', /\b(ignore|disregard|forget|override)\b.{0,40}\b(previous|prior|above|earlier|all|your|system)\b.{0,30}\b(instructions?|rules?|prompt|guidelines?)/i],
+    ['claims to be the system or the user', /\b(you are now|act as|new instructions|system prompt|developer mode|i am your (user|owner|admin))\b/i],
+    ['asks to keep it from the user', /\b(don'?t|do not|never|without)\b.{0,20}\b(tell|inform|ask|asking|telling|notify|show)\w*\b.{0,15}\b(the |your )?(user|human|owner|person)\b/i],
+    ['pipes a download into a shell', /\b(curl|wget|iwr|invoke-webrequest)\b[^\n]{0,200}\|\s*(sh|bash|zsh|iex|powershell|python)/i],
+    ['destructive or privileged command', /\b(rm\s+-rf|sudo\s|chmod\s+\+x|mkfs|dd\s+if=|format\s+c:|del\s+\/[sq])/i],
+    ['encoded or evaluated code', /\b(base64\s+(-d|--decode)|eval\s*\(|exec\s*\(|powershell\s+-e(nc)?\b|fromcharcode)/i],
+    ['asks to send secrets or keys', /\b(send|upload|post|share|paste|exfiltrat\w*|copy)\b.{0,60}(\.env|id_rsa|\.ssh|api[_ -]?key|password|token|secret|credential|\.aws|keychain)/i],
+    ['asks to change permissions or settings', /\b(approve|disable|turn off|bypass|skip)\b.{0,30}\b(permission|approval|sandbox|safety|secure|confirmation)s?\b/i],
+];
+// Requests that are fine to make but must always reach the person, even on Automatic: asking for secrets, or asking for a change.
+const SENSITIVE = [
+    ['asks for secrets or credentials', /(\.env\b|\benv(ironment)?[ _-]?var\w*|\bcredential\w*|\bpassw(or)?d\w*|\bapi[_ -]?keys?\b|\bsecret\w*|\b(access|auth|bearer|refresh)[_ -]?tokens?\b|\bprivate[_ -]?keys?\b|\bssh[_ -]?keys?\b|\bid_(rsa|ed25519)\b|\.pem\b|\bkeychain\b|\bconnection[_ -]?string\b)/i],
+    ['asks to change or delete something', /\b(delete|remove|drop|truncate|wipe|erase|purge|update|change|modify|edit|rename|overwrite|replace|deploy|push|commit|merge|rotate|reset|revoke|install|uninstall|restart|shut ?down|kill|disable|enable|create|insert|write|fix|patch|migrate)\b.{0,60}\b(files?|folders?|repo|repository|branch|code|database|db|tables?|rows?|records?|logs?|credentials?|passwords?|config\w*|settings?|variables?|env|servers?|services?|alerts?|dashboards?|users?|accounts?|keys?|tokens?|data)\b/i],
+    ['asks to change or delete something (Hindi/Hinglish)', /\b(kar ?do|karo|kar ?dena|hata ?do|hatao|mita ?do|mitao|badal ?do|badlo|daal ?do|bhej ?do|chala ?do|band ?kar|delete kar|update kar|change kar|push kar|deploy kar)\b/i],
+];
+const hits = (text, rules) => rules.filter(([, r]) => r.test(text)).map(([n]) => n);
+export const secretsIn = (text) => hits(text, SECRETS);
+export const steeringIn = (text) => hits(text, STEERING);
+export const sensitiveIn = (text) => hits(text, SENSITIVE);
+/** Everything that makes a request stop for the person: takeover attempts first, then secret or change requests. */
+export const warningsIn = (text) => [...steeringIn(text), ...sensitiveIn(text)];
+export function blockSecrets(text, what) {
+    const found = secretsIn(text);
+    if (found.length)
+        throw new Error(`Secure blocked this ${what}: it contains what looks like a secret (${found.join(', ')}). Remove it and try again.`);
+}
+export { SECRETS };

package/dist/setup.js

@@ -0,0 +1,35 @@
+// One-command setup helpers: connect Secure to the agents installed on this computer, and open the approval page.
+import { spawn, spawnSync } from 'node:child_process';
+import { findAgent } from './agents.js';
+const isWin = process.platform === 'win32';
+const quote = (s) => (isWin ? `"${s}"` : s);
+function run(cmd, args) {
+    // On Windows, agent CLIs are .cmd files, which only start through the shell; quote paths for it.
+    const r = spawnSync(cmd, isWin ? args.map((a) => (/\s/.test(a) ? quote(a) : a)) : args, { shell: isWin, encoding: 'utf8', timeout: 30_000 });
+    return { ok: r.status === 0, out: `${r.stdout ?? ''}${r.stderr ?? ''}`.trim() };
+}
+/** Adds (or refreshes) the secure MCP server, removing the old "securee" one, in every agent CLI found. Uses this node and this file's full path, so desktop apps without node on PATH work too. */
+export function connectAgents(cliPath) {
+    const server = [process.execPath, cliPath, 'mcp'];
+    const report = [];
+    const agents = [
+        ['Claude Code', 'claude', ['mcp', 'remove', '--scope', 'user', 'secure'], ['mcp', 'add', '--scope', 'user', 'secure', '--', ...server]],
+        ['Codex', 'codex', ['mcp', 'remove', 'secure'], ['mcp', 'add', 'secure', '--', ...server]],
+    ];
+    for (const [name, agent, remove, add] of agents) {
+        const cmd = findAgent(agent);
+        if (!cmd)
+            continue;
+        run(cmd, remove);
+        run(cmd, remove.map((x) => x === 'secure' ? 'securee' : x));
+        const r = run(cmd, add);
+        report.push(r.ok ? `${name}: connected` : `${name}: could not connect (${r.out.split('\n')[0]})`);
+    }
+    if (!report.length)
+        report.push(`No Claude Code or Codex found. For another agent, add an MCP server: command "${process.execPath}", arguments "${cliPath}" "mcp".`);
+    return report;
+}
+export function openPage(url) {
+    const [cmd, args] = isWin ? ['cmd', ['/c', 'start', '""', url]] : process.platform === 'darwin' ? ['open', [url]] : ['xdg-open', [url]];
+    spawn(cmd, args, { stdio: 'ignore', detached: true }).on('error', () => { }).unref();
+}

package/dist/store.js

@@ -0,0 +1,125 @@
+// Everything this computer remembers: paired peers, invites, messages and the audit log. Locked by the passphrase, local only.
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import { file } from './config.js';
+import { mac, readSealed, writeSealed } from './vault.js';
+export const DEFAULT_PERMISSIONS = { ask: 'ask', send: 'ask', files: 'ask', tasks: 'ask', brain: 'auto' };
+export const RULE_KEYS = ['ask', 'send', 'files', 'tasks', 'brain'];
+const now = () => new Date().toISOString();
+export const newId = () => crypto.randomBytes(8).toString('hex');
+const FINISHED = ['sent', 'answered', 'denied', 'failed', 'delivered'];
+export class Store {
+    maxItems;
+    peers = readSealed('peers.sealed', []).map((p) => {
+        const permissions = { ...DEFAULT_PERMISSIONS, ...p.permissions };
+        if (permissions.tasks === 'auto')
+            permissions.tasks = 'ask';
+        return { ...p, permissions, shared: p.shared ?? [], reach: p.reach ?? 'folders', tools: p.tools ?? 'files' };
+    });
+    invites = readSealed('invites.sealed', []);
+    joins = readSealed('joins.sealed', []);
+    items = readSealed('items.sealed', []);
+    constructor(maxItems) {
+        this.maxItems = maxItems;
+    }
+    peer(publicKey) { return this.peers.find((p) => p.publicKey === publicKey); }
+    peerByName(name) {
+        const n = name.toLowerCase();
+        return this.peers.find((p) => p.name.toLowerCase() === n || p.publicKey === name);
+    }
+    addPeer(publicKey, name) {
+        const existing = this.peer(publicKey);
+        if (existing) {
+            existing.name = name;
+            this.save();
+            return existing;
+        }
+        const p = { publicKey, name, pairedAt: now(), permissions: { ...DEFAULT_PERMISSIONS }, shared: [], reach: 'folders', tools: 'files' };
+        this.peers.push(p);
+        this.save();
+        return p;
+    }
+    removePeer(publicKey) { this.peers = this.peers.filter((p) => p.publicKey !== publicKey); this.save(); }
+    item(id) { return this.items.find((i) => i.id === id); }
+    addItem(i) {
+        const it = { ...i, createdAt: now(), updatedAt: now() };
+        this.items.push(it);
+        this.prune();
+        this.save();
+        return it;
+    }
+    setStatus(id, status, note, data) {
+        const it = this.item(id);
+        if (!it)
+            return undefined;
+        it.status = status;
+        if (note !== undefined)
+            it.note = note;
+        if (data)
+            it.data = { ...it.data, ...data };
+        it.updatedAt = now();
+        this.save();
+        return it;
+    }
+    /** Items from this peer still waiting for the person. */
+    pendingFrom(peer) { return this.items.filter((i) => i.peer === peer && i.direction === 'in' && i.status === 'awaiting_human').length; }
+    /** Keeps the newest items; never drops one that still waits for the person or the network. */
+    prune() {
+        let extra = this.items.length - this.maxItems;
+        if (extra <= 0)
+            return;
+        this.items = this.items.filter((i) => !(extra > 0 && FINISHED.includes(i.status) && extra-- > 0));
+    }
+    pruneInvites() {
+        const t = Date.now();
+        this.invites = this.invites.filter((i) => Date.parse(i.expiresAt) > t);
+    }
+    save() {
+        writeSealed('peers.sealed', this.peers);
+        writeSealed('invites.sealed', this.invites);
+        writeSealed('joins.sealed', this.joins);
+        writeSealed('items.sealed', this.items);
+    }
+}
+let lastMac = null;
+const GENESIS = '0'.repeat(64);
+function tailMac() {
+    try {
+        const lines = fs.readFileSync(file('audit.jsonl'), 'utf8').trimEnd().split('\n');
+        return JSON.parse(lines.at(-1) ?? '').mac ?? GENESIS;
+    }
+    catch {
+        return GENESIS;
+    }
+}
+/** Append-only record of every decision and every byte that left or arrived. Each line is chained to the one before with a passphrase-keyed MAC, so edits or deletions show up in "secure audit". */
+export function audit(event, detail) {
+    const prev = lastMac ?? tailMac();
+    const body = JSON.stringify({ at: now(), event, ...detail, prev });
+    const m = mac(body);
+    fs.appendFileSync(file('audit.jsonl'), `${body.slice(0, -1)},"mac":"${m}"}\n`, { mode: 0o600 });
+    lastMac = m;
+}
+export function verifyAudit() {
+    let raw = '';
+    try {
+        raw = fs.readFileSync(file('audit.jsonl'), 'utf8');
+    }
+    catch {
+        return { lines: 0, brokenAt: null };
+    }
+    const lines = raw.split('\n').filter(Boolean);
+    let prev = GENESIS;
+    for (let n = 0; n < lines.length; n++) {
+        const line = lines[n];
+        const cut = line.lastIndexOf(',"mac":"');
+        const body = `${line.slice(0, cut)}}`;
+        const m = line.slice(cut + 8, -2);
+        if (cut < 0 || JSON.parse(body).prev !== prev)
+            return { lines: lines.length, brokenAt: n + 1, reason: 'a line before it was removed or reordered' };
+        if (mac(body) !== m)
+            return { lines: lines.length, brokenAt: n + 1, reason: 'this line was changed' };
+        prev = m;
+    }
+    return { lines: lines.length, brokenAt: null };
+}