tmux-ide 1.3.1 → 2.1.0

package/src/lib/auth/auth-service.ts

@@ -0,0 +1,227 @@
+// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
+import * as crypto from "node:crypto";
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { logger } from "../log.ts";
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+interface AuthChallenge {
+  challengeId: string;
+  challenge: Buffer;
+  timestamp: number;
+  userId: string;
+}
+
+export interface AuthResult {
+  success: boolean;
+  userId?: string;
+  token?: string;
+  error?: string;
+}
+
+interface SSHKeyAuth {
+  publicKey: string;
+  signature: string;
+  challengeId: string;
+}
+
+// ---------------------------------------------------------------------------
+// JWT helpers (HMAC-SHA256, no external dependency)
+// ---------------------------------------------------------------------------
+
+function base64url(buf: Buffer | string): string {
+  const b = typeof buf === "string" ? Buffer.from(buf) : buf;
+  return b.toString("base64url");
+}
+
+function decodeBase64url(str: string): Buffer {
+  return Buffer.from(str, "base64url");
+}
+
+function signJwt(payload: Record<string, unknown>, secret: string, expiresInSec: number): string {
+  const header = { alg: "HS256", typ: "JWT" };
+  const now = Math.floor(Date.now() / 1000);
+  const body = { ...payload, iat: now, exp: now + expiresInSec };
+
+  const segments = [base64url(JSON.stringify(header)), base64url(JSON.stringify(body))];
+  const sigInput = segments.join(".");
+  const sig = crypto.createHmac("sha256", secret).update(sigInput).digest();
+  segments.push(base64url(sig));
+  return segments.join(".");
+}
+
+function verifyJwt(
+  token: string,
+  secret: string,
+): { valid: true; payload: Record<string, unknown> } | { valid: false } {
+  const parts = token.split(".");
+  if (parts.length !== 3) return { valid: false };
+
+  const sigInput = parts[0] + "." + parts[1];
+  const expected = crypto.createHmac("sha256", secret).update(sigInput).digest();
+  const actual = decodeBase64url(parts[2]!);
+
+  if (expected.length !== actual.length || !crypto.timingSafeEqual(expected, actual)) {
+    return { valid: false };
+  }
+
+  try {
+    const payload = JSON.parse(decodeBase64url(parts[1]!).toString()) as Record<string, unknown>;
+    if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1000)) {
+      return { valid: false };
+    }
+    return { valid: true, payload };
+  } catch {
+    return { valid: false };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// AuthService
+// ---------------------------------------------------------------------------
+
+const TOKEN_EXPIRY_SEC = 24 * 60 * 60; // 24 hours
+const CHALLENGE_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+
+export class AuthService {
+  private challenges = new Map<string, AuthChallenge>();
+  private jwtSecret: string;
+  private cleanupTimer: ReturnType<typeof setInterval>;
+
+  constructor(secret?: string) {
+    this.jwtSecret = secret ?? process.env.JWT_SECRET ?? crypto.randomBytes(64).toString("hex");
+    this.cleanupTimer = setInterval(() => this.cleanupExpiredChallenges(), 60_000);
+  }
+
+  dispose(): void {
+    clearInterval(this.cleanupTimer);
+  }
+
+  private cleanupExpiredChallenges(): void {
+    const now = Date.now();
+    for (const [id, ch] of this.challenges) {
+      if (now - ch.timestamp > CHALLENGE_TIMEOUT_MS) {
+        this.challenges.delete(id);
+      }
+    }
+  }
+
+  // ---- JWT ----------------------------------------------------------------
+
+  generateToken(userId: string): string {
+    return signJwt({ userId }, this.jwtSecret, TOKEN_EXPIRY_SEC);
+  }
+
+  verifyToken(token: string): { valid: boolean; userId?: string } {
+    const result = verifyJwt(token, this.jwtSecret);
+    if (!result.valid) return { valid: false };
+    return { valid: true, userId: result.payload.userId as string };
+  }
+
+  // ---- SSH challenge-response --------------------------------------------
+
+  createChallenge(userId: string): { challengeId: string; challenge: string } {
+    const challengeId = crypto.randomUUID();
+    const challenge = crypto.randomBytes(32);
+
+    this.challenges.set(challengeId, {
+      challengeId,
+      challenge,
+      timestamp: Date.now(),
+      userId,
+    });
+
+    return { challengeId, challenge: challenge.toString("base64") };
+  }
+
+  async authenticateWithSSHKey(auth: SSHKeyAuth): Promise<AuthResult> {
+    const challenge = this.challenges.get(auth.challengeId);
+    if (!challenge) {
+      return { success: false, error: "Invalid or expired challenge" };
+    }
+
+    const sigBuf = Buffer.from(auth.signature, "base64");
+    if (!this.verifySSHSignature(challenge.challenge, sigBuf, auth.publicKey)) {
+      return { success: false, error: "Invalid SSH key signature" };
+    }
+
+    const authorized = this.checkSSHKeyAuthorization(challenge.userId, auth.publicKey);
+    if (!authorized) {
+      return { success: false, error: "SSH key not authorized for this user" };
+    }
+
+    this.challenges.delete(auth.challengeId);
+    const token = this.generateToken(challenge.userId);
+    return { success: true, userId: challenge.userId, token };
+  }
+
+  // ---- SSH helpers -------------------------------------------------------
+
+  private verifySSHSignature(challenge: Buffer, signature: Buffer, publicKeyStr: string): boolean {
+    try {
+      const parts = publicKeyStr.trim().split(" ");
+      if (parts.length < 2) return false;
+
+      const keyType = parts[0];
+      const keyData = parts[1]!;
+
+      if (keyType !== "ssh-ed25519") {
+        logger.warn("auth", `Unsupported key type: ${keyType}`);
+        return false;
+      }
+
+      if (signature.length !== 64) return false;
+
+      const sshBuf = Buffer.from(keyData, "base64");
+      let offset = 0;
+      const algLen = sshBuf.readUInt32BE(offset);
+      offset += 4 + algLen;
+      const keyLen = sshBuf.readUInt32BE(offset);
+      offset += 4;
+      if (keyLen !== 32) return false;
+
+      const rawPub = sshBuf.subarray(offset, offset + 32);
+      const pubKey = crypto.createPublicKey({
+        key: Buffer.concat([
+          Buffer.from([0x30, 0x2a]),
+          Buffer.from([0x30, 0x05]),
+          Buffer.from([0x06, 0x03, 0x2b, 0x65, 0x70]),
+          Buffer.from([0x03, 0x21, 0x00]),
+          rawPub,
+        ]),
+        format: "der",
+        type: "spki",
+      });
+
+      return crypto.verify(null, challenge, pubKey, signature);
+    } catch (err) {
+      logger.error("auth", "SSH signature verification failed", {
+        error: String(err),
+      });
+      return false;
+    }
+  }
+
+  private checkSSHKeyAuthorization(userId: string, publicKey: string): boolean {
+    try {
+      const home = userId === process.env.USER ? homedir() : `/home/${userId}`;
+      const authKeysPath = join(home, ".ssh", "authorized_keys");
+      if (!existsSync(authKeysPath)) return false;
+
+      const authorizedKeys = readFileSync(authKeysPath, "utf-8");
+      const parts = publicKey.trim().split(" ");
+      const keyData = parts.length > 1 ? parts[1]! : parts[0]!;
+      return authorizedKeys.includes(keyData);
+    } catch {
+      return false;
+    }
+  }
+
+  getCurrentUser(): string {
+    return process.env.USER ?? process.env.USERNAME ?? "unknown";
+  }
+}

package/src/lib/auth/middleware.test.ts

@@ -0,0 +1,119 @@
+// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
+import { describe, it, expect, beforeEach, afterEach } from "bun:test";
+import { Hono } from "hono";
+import { AuthService } from "./auth-service.ts";
+import { authMiddleware, validateWsToken } from "./middleware.ts";
+import type { AuthConfig } from "./types.ts";
+
+describe("authMiddleware", () => {
+  let auth: AuthService;
+  const SECRET = "test-middleware-secret";
+
+  beforeEach(() => {
+    auth = new AuthService(SECRET);
+  });
+
+  afterEach(() => {
+    auth.dispose();
+  });
+
+  function buildApp(config: AuthConfig): Hono {
+    const app = new Hono();
+    app.use("/*", authMiddleware(auth, config));
+    app.get("/health", (c) => c.json({ ok: true }));
+    app.get("/api/auth/challenge", (c) => c.json({ bypassed: true }));
+    app.get("/api/sessions", (c) => c.json({ sessions: [] }));
+    return app;
+  }
+
+  describe("method = none (backward compatible)", () => {
+    it("passes through all requests without auth", async () => {
+      const app = buildApp({ method: "none", token_expiry: 86400 });
+      const res = await app.request("/api/sessions");
+      expect(res.status).toBe(200);
+    });
+  });
+
+  describe("method = ssh", () => {
+    const config: AuthConfig = { method: "ssh", token_expiry: 86400 };
+
+    it("bypasses /health", async () => {
+      const app = buildApp(config);
+      const res = await app.request("/health");
+      expect(res.status).toBe(200);
+    });
+
+    it("bypasses /api/auth/* routes", async () => {
+      const app = buildApp(config);
+      const res = await app.request("/api/auth/challenge");
+      expect(res.status).toBe(200);
+      const body = await res.json();
+      expect(body.bypassed).toBe(true);
+    });
+
+    it("rejects requests without Authorization header", async () => {
+      const app = buildApp(config);
+      const res = await app.request("/api/sessions");
+      expect(res.status).toBe(401);
+    });
+
+    it("rejects requests with invalid token", async () => {
+      const app = buildApp(config);
+      const res = await app.request("/api/sessions", {
+        headers: { Authorization: "Bearer invalid-token" },
+      });
+      expect(res.status).toBe(401);
+    });
+
+    it("allows requests with valid token", async () => {
+      const app = buildApp(config);
+      const token = auth.generateToken("alice");
+      const res = await app.request("/api/sessions", {
+        headers: { Authorization: `Bearer ${token}` },
+      });
+      expect(res.status).toBe(200);
+    });
+
+    it("rejects requests with non-Bearer auth", async () => {
+      const app = buildApp(config);
+      const res = await app.request("/api/sessions", {
+        headers: { Authorization: "Basic dXNlcjpwYXNz" },
+      });
+      expect(res.status).toBe(401);
+    });
+  });
+});
+
+describe("validateWsToken", () => {
+  let auth: AuthService;
+  const SECRET = "test-ws-secret";
+
+  beforeEach(() => {
+    auth = new AuthService(SECRET);
+  });
+
+  afterEach(() => {
+    auth.dispose();
+  });
+
+  it("returns 'anonymous' when method is none", () => {
+    const result = validateWsToken(auth, { method: "none", token_expiry: 86400 }, null);
+    expect(result).toBe("anonymous");
+  });
+
+  it("returns null when method is ssh and no token provided", () => {
+    const result = validateWsToken(auth, { method: "ssh", token_expiry: 86400 }, null);
+    expect(result).toBeNull();
+  });
+
+  it("returns userId for valid token", () => {
+    const token = auth.generateToken("bob");
+    const result = validateWsToken(auth, { method: "ssh", token_expiry: 86400 }, token);
+    expect(result).toBe("bob");
+  });
+
+  it("returns null for invalid token", () => {
+    const result = validateWsToken(auth, { method: "ssh", token_expiry: 86400 }, "bad-token");
+    expect(result).toBeNull();
+  });
+});

package/src/lib/auth/middleware.ts

@@ -0,0 +1,56 @@
+// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
+import type { Context, Next, MiddlewareHandler } from "hono";
+import { AuthService } from "./auth-service.ts";
+import type { AuthConfig } from "./types.ts";
+
+/**
+ * Hono middleware that checks Authorization Bearer header.
+ *
+ * - Bypasses /health and /api/auth/* routes.
+ * - When method is "none" (default), passes through everything (backward compatible).
+ * - Otherwise validates the JWT and sets c.set("userId", ...).
+ */
+export function authMiddleware(authService: AuthService, config: AuthConfig): MiddlewareHandler {
+  return async (c: Context, next: Next) => {
+    // Backward compatible: no auth required when method is "none"
+    if (config.method === "none") {
+      return next();
+    }
+
+    const path = new URL(c.req.url).pathname;
+
+    // Bypass health and auth endpoints
+    if (path === "/health" || path.startsWith("/api/auth/")) {
+      return next();
+    }
+
+    const authHeader = c.req.header("Authorization");
+    if (!authHeader?.startsWith("Bearer ")) {
+      return c.json({ error: "Missing or invalid Authorization header" }, 401);
+    }
+
+    const token = authHeader.slice(7);
+    const result = authService.verifyToken(token);
+    if (!result.valid) {
+      return c.json({ error: "Invalid or expired token" }, 401);
+    }
+
+    c.set("userId", result.userId);
+    return next();
+  };
+}
+
+/**
+ * Validate a JWT token from a query parameter (for WebSocket upgrade).
+ * Returns the userId if valid, null otherwise.
+ */
+export function validateWsToken(
+  authService: AuthService,
+  config: AuthConfig,
+  token: string | null,
+): string | null {
+  if (config.method === "none") return "anonymous";
+  if (!token) return null;
+  const result = authService.verifyToken(token);
+  return result.valid ? (result.userId ?? null) : null;
+}

package/src/lib/auth/types.ts

@@ -0,0 +1,13 @@
+// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
+import { z } from "zod";
+
+export const AuthConfigSchema = z.object({
+  /** Auth method: "none" disables auth (default), "ssh" enables SSH key challenge-response. */
+  method: z.enum(["none", "ssh"]).default("none"),
+  /** JWT secret — auto-generated if omitted. */
+  secret: z.string().optional(),
+  /** Token expiry in seconds (default 86400 = 24h). */
+  token_expiry: z.number().min(60).default(86400),
+});
+
+export type AuthConfig = z.infer<typeof AuthConfigSchema>;

package/src/lib/authorship.test.ts

@@ -0,0 +1,242 @@
+import { describe, it, expect } from "bun:test";
+import {
+  extractMarks,
+  embedMarks,
+  calculateStats,
+  createAuthored,
+  normalizeQuote,
+  reanchorMarks,
+  tagContent,
+  generateMarkId,
+  type Mark,
+  type MarksDocument,
+} from "./authorship.ts";
+
+describe("normalizeQuote", () => {
+  it("collapses whitespace", () => {
+    expect(normalizeQuote("  hello   world  ")).toBe("hello world");
+  });
+
+  it("handles newlines", () => {
+    expect(normalizeQuote("line1\n  line2\n")).toBe("line1 line2");
+  });
+});
+
+describe("generateMarkId", () => {
+  it("returns unique IDs", () => {
+    const a = generateMarkId();
+    const b = generateMarkId();
+    expect(a).not.toBe(b);
+    expect(a.startsWith("m")).toBeTruthy();
+  });
+});
+
+describe("createAuthored", () => {
+  it("creates a mark with correct fields", () => {
+    const mark = createAuthored("ai:François", { from: 0, to: 50 }, "some text");
+    expect(mark.kind).toBe("authored");
+    expect(mark.by).toBe("ai:François");
+    expect(mark.range.from).toBe(0);
+    expect(mark.range.to).toBe(50);
+    expect(mark.quote).toBe("some text");
+    expect(mark.id.startsWith("m")).toBeTruthy();
+    expect(mark.at.includes("T")).toBeTruthy(); // ISO timestamp
+  });
+});
+
+describe("extractMarks", () => {
+  it("extracts marks from markdown with comment block", () => {
+    const doc: MarksDocument = {
+      version: 2,
+      marks: {
+        m1: {
+          id: "m1",
+          kind: "authored",
+          by: "ai:François",
+          at: "2026-01-01T00:00:00Z",
+          range: { from: 0, to: 13 },
+          quote: "Hello world!",
+        },
+      },
+    };
+    const md = `Hello world!\n\n<!-- TMUX-IDE:MARKS\n${JSON.stringify(doc, null, 2)}\n-->\n`;
+
+    const result = extractMarks(md);
+    expect(result.marks).toBeTruthy();
+    expect(result.marks!.version).toBe(2);
+    expect(Object.keys(result.marks!.marks).length).toBe(1);
+    expect(result.marks!.marks["m1"]!.by).toBe("ai:François");
+    expect(result.content.includes("Hello world!")).toBeTruthy();
+    expect(!result.content.includes("TMUX-IDE:MARKS")).toBeTruthy();
+  });
+
+  it("returns null marks when no comment block", () => {
+    const md = "Just content.";
+    const result = extractMarks(md);
+    expect(result.marks).toBe(null);
+    expect(result.content).toBe(md);
+  });
+
+  it("handles malformed JSON gracefully", () => {
+    const md = "Content.\n\n<!-- TMUX-IDE:MARKS\nnot json\n-->\n";
+    const result = extractMarks(md);
+    expect(result.marks).toBe(null);
+  });
+});
+
+describe("embedMarks", () => {
+  it("appends marks comment to markdown", () => {
+    const md = "Hello world!";
+    const doc: MarksDocument = {
+      version: 2,
+      marks: {
+        m1: createAuthored("ai:François", { from: 0, to: 12 }, "Hello world!"),
+      },
+    };
+
+    const result = embedMarks(md, doc);
+    expect(result.includes("Hello world!")).toBeTruthy();
+    expect(result.includes("TMUX-IDE:MARKS")).toBeTruthy();
+    expect(result.includes("ai:François")).toBeTruthy();
+  });
+
+  it("replaces existing marks comment", () => {
+    const oldDoc: MarksDocument = { version: 2, marks: {} };
+    const md = `Content.\n\n<!-- TMUX-IDE:MARKS\n${JSON.stringify(oldDoc)}\n-->\n`;
+
+    const newDoc: MarksDocument = {
+      version: 2,
+      marks: {
+        m1: createAuthored("human:thijs", { from: 0, to: 8 }, "Content."),
+      },
+    };
+
+    const result = embedMarks(md, newDoc);
+    const count = (result.match(/TMUX-IDE:MARKS/g) || []).length;
+    expect(count).toBe(1);
+    expect(result.includes("human:thijs")).toBeTruthy();
+  });
+});
+
+describe("calculateStats", () => {
+  it("calculates AI vs human percentages from marks", () => {
+    const marks: Record<string, Mark> = {
+      m1: createAuthored("ai:François", { from: 0, to: 300 }, "ai text"),
+      m2: createAuthored("human:thijs", { from: 300, to: 500 }, "human text"),
+    };
+    const stats = calculateStats(marks);
+    expect(stats.totalChars).toBe(500);
+    expect(stats.aiPercent).toBe(60);
+    expect(stats.humanPercent).toBe(40);
+  });
+
+  it("returns 100% AI when all marks are AI", () => {
+    const marks: Record<string, Mark> = {
+      m1: createAuthored("ai:Amélie", { from: 0, to: 100 }, "text"),
+      m2: createAuthored("ai:Louis", { from: 100, to: 200 }, "more text"),
+    };
+    const stats = calculateStats(marks);
+    expect(stats.aiPercent).toBe(100);
+    expect(stats.humanPercent).toBe(0);
+  });
+
+  it("returns zeros for empty marks", () => {
+    const stats = calculateStats({});
+    expect(stats.totalChars).toBe(0);
+    expect(stats.aiPercent).toBe(0);
+  });
+
+  it("skips orphaned marks", () => {
+    const marks: Record<string, Mark> = {
+      m1: { ...createAuthored("ai:X", { from: 0, to: 100 }, "text"), orphaned: true },
+      m2: createAuthored("human:Y", { from: 0, to: 50 }, "text"),
+    };
+    const stats = calculateStats(marks);
+    expect(stats.totalChars).toBe(50);
+    expect(stats.humanPercent).toBe(100);
+  });
+
+  it("skips non-authored marks", () => {
+    const marks: Record<string, Mark> = {
+      m1: createAuthored("ai:X", { from: 0, to: 100 }, "text"),
+      m2: { ...createAuthored("human:Y", { from: 0, to: 50 }, "text"), kind: "comment" },
+    };
+    const stats = calculateStats(marks);
+    expect(stats.totalChars).toBe(100);
+    expect(stats.aiPercent).toBe(100);
+  });
+});
+
+describe("reanchorMarks", () => {
+  it("keeps marks with matching quotes at correct positions", () => {
+    const content = "Hello world!";
+    const marks: Record<string, Mark> = {
+      m1: createAuthored("ai:X", { from: 0, to: 12 }, "Hello world!"),
+    };
+    const result = reanchorMarks(content, marks);
+    expect(result["m1"]!.range.from).toBe(0);
+    expect(result["m1"]!.range.to).toBe(12);
+    expect(result["m1"]!.orphaned).toBe(undefined);
+  });
+
+  it("re-anchors marks when content shifts", () => {
+    // Content was "XHello" but now prefix was removed
+    const content = "Hello world!";
+    const marks: Record<string, Mark> = {
+      m1: createAuthored("ai:X", { from: 1, to: 13 }, "Hello world!"),
+    };
+    const result = reanchorMarks(content, marks);
+    expect(result["m1"]!.range.from).toBe(0);
+    expect(result["m1"]!.range.to).toBe(12);
+  });
+
+  it("orphans marks when quote not found", () => {
+    const content = "Completely different text.";
+    const marks: Record<string, Mark> = {
+      m1: createAuthored("ai:X", { from: 0, to: 12 }, "Hello world!"),
+    };
+    const result = reanchorMarks(content, marks);
+    expect(result["m1"]!.orphaned).toBe(true);
+  });
+});
+
+describe("tagContent", () => {
+  it("tags entire content as authored", () => {
+    const md = "Hello world!";
+    const result = tagContent(md, "ai:François");
+
+    const { marks } = extractMarks(result);
+    expect(marks).toBeTruthy();
+    const authored = Object.values(marks!.marks).filter((m) => m.kind === "authored");
+    expect(authored.length > 0).toBeTruthy();
+    expect(authored[0]!.by).toBe("ai:François");
+    expect(authored[0]!.range.from).toBe(0);
+    expect(authored[0]!.range.to).toBe(12);
+  });
+
+  it("preserves existing marks and only tags uncovered ranges", () => {
+    const existingMark = createAuthored("human:thijs", { from: 0, to: 5 }, "Hello");
+    const doc: MarksDocument = { version: 2, marks: { [existingMark.id]: existingMark } };
+    const md = embedMarks("Hello world!", doc);
+
+    const result = tagContent(md, "ai:Amélie");
+    const { marks } = extractMarks(result);
+    expect(marks).toBeTruthy();
+
+    const marksList = Object.values(marks!.marks).filter(
+      (m) => m.kind === "authored" && !m.orphaned,
+    );
+    // Should have human mark for "Hello" and AI mark for the rest
+    const humanMarks = marksList.filter((m) => m.by === "human:thijs");
+    const aiMarks = marksList.filter((m) => m.by === "ai:Amélie");
+    expect(humanMarks.length > 0).toBeTruthy();
+    expect(aiMarks.length > 0).toBeTruthy();
+  });
+
+  it("round-trips: extract after tag returns same content", () => {
+    const original = "Some plan content here.\n\n## Section Two\n\nMore content.";
+    const tagged = tagContent(original, "ai:Louis");
+    const { content } = extractMarks(tagged);
+    expect(content).toBe(original);
+  });
+});