skalpel 3.4.19 → 4.0.0

package/postinstall/lib/ca-install.js

@@ -1,268 +0,0 @@
-'use strict';
-
-// Platform trust-store install for the daemon's MITM CA.
-//
-// macOS: login keychain via `security add-trusted-cert`.
-// Linux: /usr/local/share/ca-certificates + `update-ca-certificates`.
-//
-// Contract (installDaemonCA / installMacOSCA):
-//   { ok: true }                                — installed (or already trusted)
-//   { ok: true, skipped: true, reason: '...' } — idempotent skip / unsupported OS
-//   { ok: false, reason: '...' }                — deferred / declined / failed
-//
-// Failure is NEVER fatal to postinstall.
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const childProcess = require('child_process');
-
-const KEYCHAIN_LABEL = 'Skalpel Local Intercept CA';
-const DEFAULT_TIMEOUT_MS = 60_000;
-const SENTINEL_BASENAME = '.ca-install-pending';
-
-const LINUX_CA_DIR = '/usr/local/share/ca-certificates';
-const LINUX_CA_BASENAME = 'skalpel-local-intercept-ca.crt';
-
-function loginKeychainPath(homedir) {
-  return path.join(homedir, 'Library', 'Keychains', 'login.keychain-db');
-}
-
-function linuxTargetPath() {
-  return path.join(LINUX_CA_DIR, LINUX_CA_BASENAME);
-}
-
-function logMsg(stream, msg) {
-  if (stream && typeof stream.write === 'function') {
-    stream.write(`${msg}\n`);
-  }
-}
-
-function caFilesMatch(leftPath, rightPath) {
-  try {
-    const a = fs.readFileSync(leftPath);
-    const b = fs.readFileSync(rightPath);
-    return a.length === b.length && a.equals(b);
-  } catch (_) {
-    return false;
-  }
-}
-
-function writeDeferredSentinel(caPath, opts, stderr) {
-  const sentinelDir = opts.sentinelDir || path.dirname(caPath);
-  const sentinelPath = path.join(sentinelDir, SENTINEL_BASENAME);
-  try {
-    fs.mkdirSync(sentinelDir, { recursive: true });
-    fs.writeFileSync(sentinelPath, '');
-  } catch (err) {
-    logMsg(stderr, `Skalpel: could not write ca-install sentinel at ${sentinelPath}: ${err.message}`);
-  }
-  logMsg(
-    stderr,
-    'Skalpel: daemon CA not yet generated — will install on first `skalpel login` or `codex` invocation.'
-  );
-  return { ok: false, reason: 'deferred-no-ca', sentinelPath };
-}
-
-function isRootUser() {
-  return typeof process.getuid === 'function' && process.getuid() === 0;
-}
-
-function runPrivileged(spawnSync, bin, args) {
-  const fn = spawnSync || childProcess.spawnSync;
-  if (isRootUser()) {
-    return fn(bin, args, { encoding: 'utf8' });
-  }
-  return fn('sudo', ['-n', bin, ...args], { encoding: 'utf8' });
-}
-
-function sudoAvailable(spawnSync) {
-  const fn = spawnSync || childProcess.spawnSync;
-  const probe = fn('sudo', ['-n', 'true'], { encoding: 'utf8' });
-  return probe.status === 0;
-}
-
-// installDaemonCA is the postinstall entrypoint for all platforms.
-async function installDaemonCA(caPath, opts) {
-  const platform = (opts && opts.platform) || process.platform;
-  if (platform === 'darwin') {
-    return installMacOSCA(caPath, { ...opts, platform: 'darwin' });
-  }
-  if (platform === 'linux') {
-    return installLinuxCA(caPath, opts);
-  }
-  const stderr = (opts && opts.stderr) || process.stderr;
-  logMsg(
-    stderr,
-    `Skalpel: Codex MITM CA install skipped on ${platform}; trust-store install ` +
-      'not yet implemented for this OS.'
-  );
-  return { ok: true, skipped: true, reason: 'platform' };
-}
-
-// installLinuxCA copies the daemon CA into the distro trust bundle and
-// refreshes the system store.
-async function installLinuxCA(caPath, opts) {
-  const o = opts || {};
-  const stderr = o.stderr || process.stderr;
-  const spawnSync = o.spawnSync || childProcess.spawnSync;
-  const platform = o.platform || process.platform;
-
-  if (platform !== 'linux') {
-    return { ok: true, skipped: true, reason: 'platform' };
-  }
-
-  if (!fs.existsSync(caPath)) {
-    return writeDeferredSentinel(caPath, o, stderr);
-  }
-
-  const dest = o.linuxTargetPath || linuxTargetPath();
-  if (fs.existsSync(dest) && caFilesMatch(caPath, dest)) {
-    return { ok: true, skipped: true, reason: 'already-installed' };
-  }
-
-  if (!isRootUser() && !sudoAvailable(spawnSync)) {
-    logMsg(
-      stderr,
-      'Skalpel: Linux CA trust install needs root or passwordless sudo. Run:\n' +
-        `  sudo install -m 0644 ${caPath} ${dest}\n` +
-        '  sudo update-ca-certificates'
-    );
-    return { ok: false, reason: 'no-sudo' };
-  }
-
-  const installRes = runPrivileged(spawnSync, 'install', ['-m', '0644', caPath, dest]);
-  if (installRes.status !== 0) {
-    const detail = (installRes.stderr || installRes.stdout || '').trim();
-    logMsg(
-      stderr,
-      `Skalpel: failed to copy CA to ${dest}${detail ? `: ${detail}` : ''}. ` +
-        'Codex may bypass skalpel until trust is configured.'
-    );
-    return { ok: false, reason: 'install-failed', exitCode: installRes.status, detail };
-  }
-
-  const updateRes = runPrivileged(spawnSync, 'update-ca-certificates', []);
-  if (updateRes.status !== 0) {
-    const detail = (updateRes.stderr || updateRes.stdout || '').trim();
-    logMsg(
-      stderr,
-      `Skalpel: update-ca-certificates failed${detail ? `: ${detail}` : ''}.`
-    );
-    return { ok: false, reason: 'update-failed', exitCode: updateRes.status, detail };
-  }
-
-  logMsg(stderr, 'Skalpel: daemon CA trusted in Linux system store.');
-  return { ok: true };
-}
-
-// installMacOSCA installs into the login keychain (darwin only).
-async function installMacOSCA(caPath, opts) {
-  const o = opts || {};
-  const spawn = o.spawn || childProcess.spawn;
-  const stderr = o.stderr || process.stderr;
-  const homedir = o.homedir || os.homedir();
-  const timeoutMs = o.timeoutMs || DEFAULT_TIMEOUT_MS;
-  const platform = o.platform || process.platform;
-
-  if (platform !== 'darwin') {
-    return installDaemonCA(caPath, opts);
-  }
-
-  if (!fs.existsSync(caPath)) {
-    return writeDeferredSentinel(caPath, o, stderr);
-  }
-
-  const loginKC = loginKeychainPath(homedir);
-
-  if (await findCertificate(spawn, loginKC, timeoutMs)) {
-    return { ok: true, skipped: true, reason: 'already-installed' };
-  }
-
-  return runAddTrustedCert(spawn, stderr, caPath, loginKC, timeoutMs);
-}
-
-function findCertificate(spawn, loginKC, timeoutMs) {
-  return new Promise((resolve) => {
-    const child = spawn('security', ['find-certificate', '-c', KEYCHAIN_LABEL, loginKC], {
-      stdio: ['ignore', 'ignore', 'ignore'],
-    });
-    let settled = false;
-    const timer = setTimeout(() => {
-      if (settled) return;
-      settled = true;
-      try { child.kill('SIGTERM'); } catch (_) { /* noop */ }
-      resolve(false);
-    }, timeoutMs);
-    child.on('error', () => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve(false);
-    });
-    child.on('exit', (code) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      resolve(code === 0);
-    });
-  });
-}
-
-function runAddTrustedCert(spawn, stderr, caPath, loginKC, timeoutMs) {
-  return new Promise((resolve) => {
-    const child = spawn(
-      'security',
-      ['add-trusted-cert', '-r', 'trustRoot', '-k', loginKC, caPath],
-      { stdio: ['ignore', 'pipe', 'pipe'] }
-    );
-    let settled = false;
-    const timer = setTimeout(() => {
-      if (settled) return;
-      settled = true;
-      try { child.kill('SIGTERM'); } catch (_) { /* noop */ }
-      logMsg(stderr, 'Skalpel: user did not respond to keychain prompt within 60s — skipped.');
-      resolve({ ok: false, reason: 'timeout' });
-    }, timeoutMs);
-
-    child.on('error', (err) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      logMsg(stderr, `Skalpel: keychain install failed to start: ${err.message}`);
-      resolve({ ok: false, reason: 'spawn-error', error: err.message });
-    });
-
-    child.on('exit', (code) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      if (code === 0) {
-        logMsg(stderr, 'Skalpel: daemon CA trusted in login keychain.');
-        resolve({ ok: true });
-        return;
-      }
-      logMsg(
-        stderr,
-        'Skalpel: Codex MITM CA not trusted. Codex traffic will bypass skalpel until ' +
-          'you re-run the prompt (next `skalpel login` or `codex` invocation) or ' +
-          'manually trust ~/.skalpel/mitm-ca.pem.'
-      );
-      resolve({ ok: false, reason: 'declined-or-failed', exitCode: code });
-    });
-  });
-}
-
-module.exports = {
-  installDaemonCA,
-  installMacOSCA,
-  installLinuxCA,
-  KEYCHAIN_LABEL,
-  SENTINEL_BASENAME,
-  LINUX_CA_DIR,
-  LINUX_CA_BASENAME,
-  linuxTargetPath,
-  loginKeychainPath,
-  caFilesMatch,
-  runPrivileged,
-};

package/postinstall/lib/ca-install.test.js

@@ -1,327 +0,0 @@
-#!/usr/bin/env node
-// ca-install tests.
-//
-// Stdlib only: assert + fs + os + path + events. No mocha / no jest.
-// Matches the testing style of rc-edit.test.js. spawn is injected so
-// the tests never touch the real `security` binary or the user's
-// login keychain.
-//
-// Test cases (the promise.txt names each one explicitly):
-//   - non-darwin                — platform != 'darwin' short-circuits
-//   - already-installed         — find-certificate returns 0 → skip
-//   - success                   — add-trusted-cert exits 0
-//   - declined                  — add-trusted-cert exits non-zero
-//   - timeout                   — add-trusted-cert never exits; killed
-//   - deferred                  — CA file missing → sentinel written
-
-'use strict';
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-const { EventEmitter } = require('events');
-const assert = require('assert');
-
-const ca = require('./ca-install');
-
-let pass = 0;
-let fail = 0;
-
-function test(name, fn) {
-  return Promise.resolve()
-    .then(fn)
-    .then(() => {
-      process.stdout.write(`  PASS ${name}\n`);
-      pass += 1;
-    })
-    .catch((err) => {
-      process.stderr.write(`  FAIL ${name}\n    ${err && err.stack ? err.stack : err}\n`);
-      fail += 1;
-    });
-}
-
-// fakeChild implements the subset of ChildProcess that installMacOSCA
-// consumes: an event emitter with `kill()`. Plug into makeSpawn().
-function fakeChild() {
-  const ee = new EventEmitter();
-  ee.killed = false;
-  ee.kill = function () { ee.killed = true; };
-  return ee;
-}
-
-// makeSpawn returns a fake spawn that scripts each successive
-// invocation. Each script entry is either:
-//   { cmd: 'find-certificate', exit: 0|N }
-//   { cmd: 'add-trusted-cert', exit: 0|N, async?: true (delay exit), error?: Error }
-// If `async` is set, the child does NOT emit `exit` — the caller is
-// responsible for triggering the timeout path.
-function makeSpawn(script) {
-  const calls = [];
-  let i = 0;
-  function spawn(bin, args) {
-    const verb = args[0];
-    const step = script[i] || {};
-    i += 1;
-    calls.push({ bin, args, verb });
-    const child = fakeChild();
-    if (step.error) {
-      process.nextTick(() => child.emit('error', step.error));
-      return child;
-    }
-    if (step.async) {
-      // never emits exit — caller's setTimeout drives the timeout
-      return child;
-    }
-    const exitCode = typeof step.exit === 'number' ? step.exit : 0;
-    process.nextTick(() => child.emit('exit', exitCode));
-    return child;
-  }
-  spawn.calls = calls;
-  return spawn;
-}
-
-function captureStderr() {
-  const buf = [];
-  return {
-    write(s) { buf.push(s); },
-    text() { return buf.join(''); },
-  };
-}
-
-function tmpdir() {
-  return fs.mkdtempSync(path.join(os.tmpdir(), 'ca-install-test-'));
-}
-
-async function run() {
-  process.stdout.write('ca-install tests:\n');
-
-  await test('win32 platform skip via installDaemonCA', async () => {
-    const stderr = captureStderr();
-    const result = await ca.installDaemonCA('/anything', {
-      stderr,
-      platform: 'win32',
-    });
-    assert.strictEqual(result.ok, true);
-    assert.strictEqual(result.skipped, true);
-    assert.strictEqual(result.reason, 'platform');
-    assert.ok(/win32/.test(stderr.text()), 'should mention current platform');
-  });
-
-  await test('linux deferred writes sentinel', async () => {
-    const stderr = captureStderr();
-    const dir = tmpdir();
-    const caPath = path.join(dir, 'mitm-ca.pem');
-    const result = await ca.installLinuxCA(caPath, {
-      stderr,
-      platform: 'linux',
-      sentinelDir: dir,
-      spawnSync: () => ({ status: 0 }),
-    });
-    assert.strictEqual(result.ok, false);
-    assert.strictEqual(result.reason, 'deferred-no-ca');
-    const sentinel = path.join(dir, ca.SENTINEL_BASENAME);
-    assert.ok(fs.existsSync(sentinel));
-  });
-
-  await test('linux already-installed idempotency', async () => {
-    const stderr = captureStderr();
-    const dir = tmpdir();
-    const caPath = path.join(dir, 'mitm-ca.pem');
-    const dest = path.join(dir, 'skalpel-local-intercept-ca.crt');
-    const body = 'test-pem';
-    fs.writeFileSync(caPath, body);
-    fs.writeFileSync(dest, body);
-    const spawnSync = () => {
-      throw new Error('spawnSync should not run when already installed');
-    };
-    const result = await ca.installLinuxCA(caPath, {
-      stderr,
-      platform: 'linux',
-      linuxTargetPath: dest,
-      spawnSync,
-    });
-    assert.strictEqual(result.ok, true);
-    assert.strictEqual(result.skipped, true);
-    assert.strictEqual(result.reason, 'already-installed');
-  });
-
-  await test('linux success path', async () => {
-    const stderr = captureStderr();
-    const dir = tmpdir();
-    const caPath = path.join(dir, 'mitm-ca.pem');
-    const dest = path.join(dir, 'skalpel-local-intercept-ca.crt');
-    fs.writeFileSync(caPath, 'pem');
-    const calls = [];
-    const spawnSync = (bin, args) => {
-      if (bin === 'sudo') {
-        calls.push({ bin: args[1], args: args.slice(2) });
-      } else {
-        calls.push({ bin, args });
-      }
-      if (calls[calls.length - 1].bin === 'install') {
-        fs.copyFileSync(caPath, dest);
-      }
-      return { status: 0, stdout: '', stderr: '' };
-    };
-    const origGetuid = process.getuid;
-    process.getuid = () => 1000;
-    try {
-      const result = await ca.installLinuxCA(caPath, {
-        stderr,
-        platform: 'linux',
-        linuxTargetPath: dest,
-        spawnSync,
-      });
-      assert.strictEqual(result.ok, true);
-      assert.ok(fs.existsSync(dest));
-      const bins = calls.map((c) => c.bin);
-      assert.ok(bins.includes('install'), `expected install in ${bins}`);
-      assert.ok(bins.includes('update-ca-certificates'), `expected update-ca-certificates in ${bins}`);
-    } finally {
-      process.getuid = origGetuid;
-    }
-  });
-
-  await test('linux no-sudo soft failure', async () => {
-    const stderr = captureStderr();
-    const dir = tmpdir();
-    const caPath = path.join(dir, 'mitm-ca.pem');
-    const dest = path.join(dir, 'skalpel-local-intercept-ca.crt');
-    fs.writeFileSync(caPath, 'pem');
-    const spawnSync = (bin) => {
-      if (bin === 'sudo') return { status: 1, stdout: '', stderr: 'sorry' };
-      return { status: 0, stdout: '', stderr: '' };
-    };
-    const origGetuid = process.getuid;
-    process.getuid = () => 1000;
-    try {
-      const result = await ca.installLinuxCA(caPath, {
-        stderr,
-        platform: 'linux',
-        linuxTargetPath: dest,
-        spawnSync,
-      });
-      assert.strictEqual(result.ok, false);
-      assert.strictEqual(result.reason, 'no-sudo');
-      assert.ok(/passwordless sudo|sudo install/.test(stderr.text()));
-    } finally {
-      process.getuid = origGetuid;
-    }
-  });
-
-  await test('already-installed idempotency', async () => {
-    const stderr = captureStderr();
-    const dir = tmpdir();
-    const caPath = path.join(dir, 'mitm-ca.pem');
-    fs.writeFileSync(caPath, 'dummy');
-    // find-certificate exits 0 → already trusted; no add-trusted-cert call.
-    const spawn = makeSpawn([{ cmd: 'find-certificate', exit: 0 }]);
-    const result = await ca.installMacOSCA(caPath, {
-      spawn,
-      stderr,
-      platform: 'darwin',
-      homedir: dir,
-    });
-    assert.strictEqual(result.ok, true);
-    assert.strictEqual(result.skipped, true);
-    assert.strictEqual(result.reason, 'already-installed');
-    assert.strictEqual(spawn.calls.length, 1);
-    assert.strictEqual(spawn.calls[0].verb, 'find-certificate');
-  });
-
-  await test('success path', async () => {
-    const stderr = captureStderr();
-    const dir = tmpdir();
-    const caPath = path.join(dir, 'mitm-ca.pem');
-    fs.writeFileSync(caPath, 'dummy');
-    const spawn = makeSpawn([
-      { cmd: 'find-certificate', exit: 1 },
-      { cmd: 'add-trusted-cert', exit: 0 },
-    ]);
-    const result = await ca.installMacOSCA(caPath, {
-      spawn,
-      stderr,
-      platform: 'darwin',
-      homedir: dir,
-    });
-    assert.strictEqual(result.ok, true);
-    assert.strictEqual(result.skipped, undefined);
-    assert.strictEqual(spawn.calls.length, 2);
-    assert.strictEqual(spawn.calls[1].verb, 'add-trusted-cert');
-    assert.deepStrictEqual(
-      spawn.calls[1].args.slice(0, 4),
-      ['add-trusted-cert', '-r', 'trustRoot', '-k']
-    );
-  });
-
-  await test('declined path', async () => {
-    const stderr = captureStderr();
-    const dir = tmpdir();
-    const caPath = path.join(dir, 'mitm-ca.pem');
-    fs.writeFileSync(caPath, 'dummy');
-    const spawn = makeSpawn([
-      { cmd: 'find-certificate', exit: 1 },
-      { cmd: 'add-trusted-cert', exit: 128 },
-    ]);
-    const result = await ca.installMacOSCA(caPath, {
-      spawn,
-      stderr,
-      platform: 'darwin',
-      homedir: dir,
-    });
-    assert.strictEqual(result.ok, false);
-    assert.strictEqual(result.reason, 'declined-or-failed');
-    assert.strictEqual(result.exitCode, 128);
-    assert.ok(/CA not trusted|bypass skalpel/.test(stderr.text()), 'should warn user');
-  });
-
-  await test('timeout path', async () => {
-    const stderr = captureStderr();
-    const dir = tmpdir();
-    const caPath = path.join(dir, 'mitm-ca.pem');
-    fs.writeFileSync(caPath, 'dummy');
-    const spawn = makeSpawn([
-      { cmd: 'find-certificate', exit: 1 },
-      { cmd: 'add-trusted-cert', async: true }, // never exits
-    ]);
-    const result = await ca.installMacOSCA(caPath, {
-      spawn,
-      stderr,
-      platform: 'darwin',
-      homedir: dir,
-      timeoutMs: 30, // small so test is fast
-    });
-    assert.strictEqual(result.ok, false);
-    assert.strictEqual(result.reason, 'timeout');
-    assert.ok(/did not respond|skipped/.test(stderr.text()), 'should explain skip');
-  });
-
-  await test('deferred (no CA file yet) writes sentinel', async () => {
-    const stderr = captureStderr();
-    const dir = tmpdir();
-    const caPath = path.join(dir, 'mitm-ca.pem');
-    // Do NOT create caPath — simulate daemon hasn't booted yet.
-    const spawn = makeSpawn([]);
-    const result = await ca.installMacOSCA(caPath, {
-      spawn,
-      stderr,
-      platform: 'darwin',
-      homedir: dir,
-      sentinelDir: dir,
-    });
-    assert.strictEqual(result.ok, false);
-    assert.strictEqual(result.reason, 'deferred-no-ca');
-    assert.strictEqual(spawn.calls.length, 0, 'no security spawn on deferred path');
-    const sentinel = path.join(dir, ca.SENTINEL_BASENAME);
-    assert.ok(fs.existsSync(sentinel), `sentinel should exist at ${sentinel}`);
-  });
-
-  process.stdout.write(`\n  pass=${pass} fail=${fail}\n`);
-  return fail === 0 ? 0 : 1;
-}
-
-if (require.main === module) {
-  run().then((code) => process.exit(code));
-}
-
-module.exports = { run };

package/postinstall/lib/detect-prior.js

@@ -1,62 +0,0 @@
-// Step 1: detect prior install.
-//
-// v3.0.1 fix: `prior` now means specifically "user has auth state" —
-// i.e. auth.json exists. v3.0.0 treated any of {auth.json, config.toml,
-// lock file, service registration} as "prior" and skipped sign-in.
-// That meant once a machine had ever installed skalpel, the systemd /
-// launchd unit file persists outside configDir; every subsequent
-// `npm install skalpel` would skip sign-in forever, and the user
-// could never get logged in via the install flow on re-install.
-//
-// The other probes (config.toml / lock file / service registration)
-// are informational only — they get reported in the log but no longer
-// gate sign-in. SPEC.md §9.6: a fresh user with no auth.json must
-// always be offered the sign-in step, regardless of mechanical
-// install state (service units, rc snippets) that survived a prior
-// install.
-
-'use strict';
-
-const fs = require('fs');
-const log = require('./log');
-const paths = require('./paths');
-
-function fileExists(p) {
-  try {
-    fs.accessSync(p, fs.constants.F_OK);
-    return true;
-  } catch (_e) {
-    return false;
-  }
-}
-
-function run({ dryRun }) {
-  const probes = [
-    { label: 'auth.json', path: paths.authFile(), gatesPrior: true },
-    { label: 'config.toml', path: paths.configToml(), gatesPrior: false },
-    { label: 'lock file', path: paths.lockFile(), gatesPrior: false },
-    { label: 'service registration', path: paths.servicePath(), gatesPrior: false },
-  ];
-
-  const findings = probes.map((p) => ({ ...p, exists: fileExists(p.path) }));
-  // `prior` reflects only auth.json existence — see header comment.
-  const prior = findings.some((f) => f.gatesPrior && f.exists);
-
-  if (dryRun) {
-    log.dryRun(`step 1 detect-prior: would probe ${findings.length} paths`);
-  }
-  for (const f of findings) {
-    log.info(
-      `  ${f.exists ? 'present' : 'absent '} — ${f.label}: ${f.path}`
-    );
-  }
-
-  log.info(
-    prior
-      ? 'detected prior auth (auth.json present) — sign-in will skip'
-      : 'no prior auth detected — sign-in will run'
-  );
-  return { prior, findings };
-}
-
-module.exports = { run };