tmux-ide 2.6.0 → 2.7.0

package/packages/daemon/src/lib/app-config.ts

@@ -0,0 +1,427 @@
+/**
+ * The one global config — `~/.tmux-ide/config.json` (overridable via
+ * `TMUX_IDE_CONFIG`).
+ *
+ * Everything that used to be hardcoded chrome behaviour lives here: the
+ * root-table key binds (`M-p`/`M-k`/`M-m`), the shared THEME TOKENS consumed by
+ * BOTH the tmux chrome (status bar / pane chips / actions menu / cheat sheet)
+ * AND the OpenTUI widgets, the updater cadence, and the notification/restore/
+ * update-check toggles. One palette, one keymap, one file — the foundation for
+ * the "one cohesive app" milestone.
+ *
+ * The tokens are SEMANTIC (accent/muted/fg + per-status colors + glyphs), not
+ * per-surface: a single `theme` block drives every surface, so re-theming the
+ * whole product is a one-file edit + a re-adopt (no code change).
+ *
+ * {@link parseAppConfig} is PURE — a deep partial merge over the defaults where
+ * any missing or mistyped field falls back to its default and it never throws.
+ * {@link loadAppConfig} is the thin io wrapper (missing/malformed file →
+ * defaults); {@link getAppConfig} caches that read for the process. The old
+ * per-concern readers ({@link ../tui/chrome/notify.ts}, {@link ../restore.ts})
+ * now delegate here.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+import type { AgentStatus } from "../tui/detect/classify.ts";
+
+// ---------------------------------------------------------------------------
+// Shape
+// ---------------------------------------------------------------------------
+
+/**
+ * Root-table key binds (tmux key names) for the per-widget PANEL popups —
+ * every widget is a floating app dialog one keystroke away, esc to close (the
+ * "one-app" milestone). Only widgets that exist AND stand alone are here:
+ * `preview` is a companion that renders the explorer's selection (nothing to
+ * show on its own) and `setup` is the onboarding wizard, so neither gets a key.
+ */
+export interface AppPanelKeys {
+  /** File explorer panel (default `M-e`). */
+  explorer: string;
+  /** Git changes panel (default `M-g`). */
+  changes: string;
+  /** Config editor panel (default `M-,`). */
+  config: string;
+}
+
+/** Root-table key binds (tmux key names) for the chrome popups + widget panels. */
+export interface AppKeys {
+  /** Switcher popup (default `M-p`). */
+  popup: string;
+  /** Home cockpit popup — the full fleet home from any session (default `M-h`). */
+  home: string;
+  /** Cheat-sheet popup (default `M-k`). */
+  cheatsheet: string;
+  /** Actions menu (default `M-m`). */
+  menu: string;
+  /** Sidebar (app nav column) toggle (default `M-b`). */
+  sidebar: string;
+  /** Per-widget panel popups (default `M-e`/`M-g`/`M-,`). */
+  panels: AppPanelKeys;
+}
+
+/** Per-agent-status color token (tmux `colourN` / `#rrggbb`). */
+export type AppThemeStatus = Record<AgentStatus, string>;
+
+/** The two state glyphs — filled (active/present) and hollow (inactive/quiet). */
+export interface AppThemeGlyphs {
+  active: string;
+  inactive: string;
+}
+
+/**
+ * The shared palette — semantic tokens, not per-surface styles. Chrome builders
+ * and widgets both map these into their own render layer, so the whole product
+ * reads as one system.
+ */
+export interface AppTheme {
+  /** Primary/brand accent (default `colour75`). */
+  accent: string;
+  /** Muted/secondary foreground for dim text (default `colour240`). */
+  muted: string;
+  /** Default foreground (default `colour250`). */
+  fg: string;
+  /** Per-status colors (blocked/working/done/idle/unknown). */
+  status: AppThemeStatus;
+  /** The filled/hollow state glyphs. */
+  glyphs: AppThemeGlyphs;
+}
+
+/** Chrome updater cadence. */
+export interface AppUpdater {
+  /** Milliseconds between ticks (default 2000). */
+  tickMs: number;
+  /** Write a disaster-recovery snapshot every N ticks (default 15). */
+  snapshotEvery: number;
+}
+
+/** Notification channel toggles. */
+export interface AppNotifications {
+  toast: boolean;
+  macos: boolean;
+}
+
+/** Restore behaviour toggles. */
+export interface AppRestore {
+  resumeAgents: boolean;
+}
+
+/** Update-check toggles (consumed later by the update-flow card). */
+export interface AppUpdates {
+  check: boolean;
+}
+
+/** First-run welcome toggles. */
+export interface AppWelcome {
+  /**
+   * Whether the first-run welcome card may show (default true). Set false to
+   * suppress it independently of the `~/.tmux-ide/welcomed` marker file (which
+   * records that it has already been shown once).
+   */
+  show: boolean;
+}
+
+/** Agent-integration auto-discovery config. */
+export interface AppIntegrations {
+  /**
+   * Whether the first-adopt integration OFFER may show (default true). Set false
+   * to suppress the one-time "claude detected — install the integration?" popup
+   * independently of the `<home>/integration-offered` marker (which records that
+   * it has already been shown once).
+   */
+  offer: boolean;
+}
+
+/** The unified-app front-door decision (M22.6). */
+export interface AppApp {
+  /**
+   * Whether bare `tmux-ide` (no ide.yml here, no `--team`) launches the unified
+   * app (`tmux-ide app`) instead of the classic team cockpit. Default false —
+   * the flip is opt-in until the default-entry decision is made. `tmux-ide team`
+   * (the explicit cockpit) and a project's `ide.yml` auto-launch are unaffected.
+   */
+  frontDoor: boolean;
+}
+
+/** Worktree flow config (`tmux-ide worktree`). */
+export interface AppWorktrees {
+  /**
+   * Base directory for worktree checkouts. Empty (default) → a sibling
+   * `<repo>-worktrees` dir next to each repo. A non-empty value overrides that
+   * base; a relative path is resolved against the repo.
+   */
+  dir: string;
+}
+
+/** The whole config. */
+export interface AppConfig {
+  keys: AppKeys;
+  theme: AppTheme;
+  updater: AppUpdater;
+  notifications: AppNotifications;
+  restore: AppRestore;
+  updates: AppUpdates;
+  welcome: AppWelcome;
+  integrations: AppIntegrations;
+  worktrees: AppWorktrees;
+  app: AppApp;
+}
+
+// ---------------------------------------------------------------------------
+// Defaults
+// ---------------------------------------------------------------------------
+
+/** The built-in config — every field's fallback. */
+export const DEFAULT_APP_CONFIG: AppConfig = {
+  keys: {
+    popup: "M-p",
+    home: "M-h",
+    cheatsheet: "M-k",
+    menu: "M-m",
+    sidebar: "M-b",
+    panels: { explorer: "M-e", changes: "M-g", config: "M-," },
+  },
+  theme: {
+    accent: "colour75",
+    muted: "colour240",
+    fg: "colour250",
+    status: {
+      blocked: "colour203",
+      working: "colour221",
+      done: "colour111",
+      idle: "colour114",
+      unknown: "colour244",
+    },
+    glyphs: { active: "●", inactive: "○" },
+  },
+  updater: { tickMs: 2000, snapshotEvery: 15 },
+  notifications: { toast: true, macos: false },
+  restore: { resumeAgents: false },
+  updates: { check: true },
+  welcome: { show: true },
+  integrations: { offer: true },
+  worktrees: { dir: "" },
+  app: { frontDoor: false },
+};
+
+/** The default theme tokens — the fallback threaded into the pure builders. */
+export const DEFAULT_THEME: AppTheme = DEFAULT_APP_CONFIG.theme;
+
+/** The default key binds — the fallback for the bind command builders. */
+export const DEFAULT_KEYS: AppKeys = DEFAULT_APP_CONFIG.keys;
+
+// ---------------------------------------------------------------------------
+// Pure parse (deep partial merge over defaults)
+// ---------------------------------------------------------------------------
+
+/** A plain object, or `{}` for anything that isn't one (arrays included). */
+function asObject(value: unknown): Record<string, unknown> {
+  return value && typeof value === "object" && !Array.isArray(value)
+    ? (value as Record<string, unknown>)
+    : {};
+}
+
+/** A non-empty string, else the default. */
+function pickString(value: unknown, fallback: string): string {
+  return typeof value === "string" && value.length > 0 ? value : fallback;
+}
+
+/** A boolean, else the default. */
+function pickBool(value: unknown, fallback: boolean): boolean {
+  return typeof value === "boolean" ? value : fallback;
+}
+
+/** A positive integer, else the default. */
+function pickPosInt(value: unknown, fallback: number): number {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : fallback;
+}
+
+/**
+ * PURE — merge an unknown (typically parsed JSON) over {@link DEFAULT_APP_CONFIG}.
+ * Every block/leaf is validated independently: a missing or mistyped field falls
+ * back to its default, so partial and garbage configs both resolve to a complete,
+ * well-typed {@link AppConfig}. Never throws.
+ */
+export function parseAppConfig(input: unknown): AppConfig {
+  const D = DEFAULT_APP_CONFIG;
+  const root = asObject(input);
+  const keys = asObject(root.keys);
+  const panels = asObject(keys.panels);
+  const theme = asObject(root.theme);
+  const status = asObject(theme.status);
+  const glyphs = asObject(theme.glyphs);
+  const updater = asObject(root.updater);
+  const notifications = asObject(root.notifications);
+  const restore = asObject(root.restore);
+  const updates = asObject(root.updates);
+  const welcome = asObject(root.welcome);
+  const integrations = asObject(root.integrations);
+  const worktrees = asObject(root.worktrees);
+  const app = asObject(root.app);
+  return {
+    keys: {
+      popup: pickString(keys.popup, D.keys.popup),
+      home: pickString(keys.home, D.keys.home),
+      cheatsheet: pickString(keys.cheatsheet, D.keys.cheatsheet),
+      menu: pickString(keys.menu, D.keys.menu),
+      sidebar: pickString(keys.sidebar, D.keys.sidebar),
+      panels: {
+        explorer: pickString(panels.explorer, D.keys.panels.explorer),
+        changes: pickString(panels.changes, D.keys.panels.changes),
+        config: pickString(panels.config, D.keys.panels.config),
+      },
+    },
+    theme: {
+      accent: pickString(theme.accent, D.theme.accent),
+      muted: pickString(theme.muted, D.theme.muted),
+      fg: pickString(theme.fg, D.theme.fg),
+      status: {
+        blocked: pickString(status.blocked, D.theme.status.blocked),
+        working: pickString(status.working, D.theme.status.working),
+        done: pickString(status.done, D.theme.status.done),
+        idle: pickString(status.idle, D.theme.status.idle),
+        unknown: pickString(status.unknown, D.theme.status.unknown),
+      },
+      glyphs: {
+        active: pickString(glyphs.active, D.theme.glyphs.active),
+        inactive: pickString(glyphs.inactive, D.theme.glyphs.inactive),
+      },
+    },
+    updater: {
+      tickMs: pickPosInt(updater.tickMs, D.updater.tickMs),
+      snapshotEvery: pickPosInt(updater.snapshotEvery, D.updater.snapshotEvery),
+    },
+    notifications: {
+      toast: pickBool(notifications.toast, D.notifications.toast),
+      macos: pickBool(notifications.macos, D.notifications.macos),
+    },
+    restore: { resumeAgents: pickBool(restore.resumeAgents, D.restore.resumeAgents) },
+    updates: { check: pickBool(updates.check, D.updates.check) },
+    welcome: { show: pickBool(welcome.show, D.welcome.show) },
+    integrations: { offer: pickBool(integrations.offer, D.integrations.offer) },
+    worktrees: { dir: pickString(worktrees.dir, D.worktrees.dir) },
+    app: { frontDoor: pickBool(app.frontDoor, D.app.frontDoor) },
+  };
+}
+
+// ---------------------------------------------------------------------------
+// io
+// ---------------------------------------------------------------------------
+
+/**
+ * Absolute path to the config file: `TMUX_IDE_CONFIG` when set (tests / per-run
+ * overrides), else `~/.tmux-ide/config.json`.
+ */
+export function appConfigPath(): string {
+  return process.env.TMUX_IDE_CONFIG ?? join(homedir(), ".tmux-ide", "config.json");
+}
+
+/**
+ * io — read + parse the config. A missing or malformed file resolves to the full
+ * defaults ({@link parseAppConfig} never throws). Reads fresh each call; use
+ * {@link getAppConfig} for the cached per-process read.
+ */
+export function loadAppConfig(): AppConfig {
+  const path = appConfigPath();
+  if (!existsSync(path)) return parseAppConfig(undefined);
+  try {
+    return parseAppConfig(JSON.parse(readFileSync(path, "utf-8")));
+  } catch {
+    // malformed file — full defaults
+    return parseAppConfig(undefined);
+  }
+}
+
+let cached: AppConfig | null = null;
+
+/**
+ * The process-cached config. Resolved once on first use — config changes take
+ * effect on the next process (e.g. a re-adopt spawns fresh CLI invocations), so
+ * caching is safe and keeps the hot updater tick from re-reading the file.
+ */
+export function getAppConfig(): AppConfig {
+  if (!cached) cached = loadAppConfig();
+  return cached;
+}
+
+/** Drop the cache so the next {@link getAppConfig} re-reads. Test-only. */
+export function _resetForTests(): void {
+  cached = null;
+}
+
+// ---------------------------------------------------------------------------
+// Writes (M22.4 — the settings surface persists through here)
+// ---------------------------------------------------------------------------
+
+/**
+ * io — the RAW parsed config file as the user wrote it (`{}` when missing or
+ * malformed). Writers merge over THIS, not over {@link parseAppConfig}'s output:
+ * round-tripping through the parser would materialize every default into the
+ * hand-editable file and silently DROP fields the typed shape doesn't model yet
+ * (e.g. the notification polish fields `notifications.enabled` /
+ * `notifications.quietHours` that {@link ../tui/chrome/notify.ts} reads raw).
+ */
+export function loadRawAppConfig(): Record<string, unknown> {
+  const path = appConfigPath();
+  if (!existsSync(path)) return {};
+  try {
+    const parsed: unknown = JSON.parse(readFileSync(path, "utf-8"));
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : {};
+  } catch {
+    return {};
+  }
+}
+
+/** A partial config write: plain objects merge recursively, scalars/arrays
+ *  replace, and an explicit `undefined` DELETES the key (how "reset to
+ *  defaults" removes a block so the parser's defaults take over). */
+export type AppConfigPatch = { [key: string]: unknown };
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+/**
+ * PURE — merge `patch` into `raw` without touching either input. Objects merge
+ * key-by-key (recursively), anything else replaces, and a key whose patch value
+ * is `undefined` is REMOVED from the result. Unknown user fields survive — the
+ * merge only visits keys the patch names.
+ */
+export function mergeConfigPatch(
+  raw: Record<string, unknown>,
+  patch: AppConfigPatch,
+): Record<string, unknown> {
+  const out: Record<string, unknown> = { ...raw };
+  for (const [key, value] of Object.entries(patch)) {
+    if (value === undefined) {
+      delete out[key];
+    } else if (isPlainObject(value) && isPlainObject(out[key])) {
+      out[key] = mergeConfigPatch(out[key] as Record<string, unknown>, value as AppConfigPatch);
+    } else if (isPlainObject(value)) {
+      out[key] = mergeConfigPatch({}, value as AppConfigPatch);
+    } else {
+      out[key] = value;
+    }
+  }
+  return out;
+}
+
+/**
+ * io — apply a patch to the config file ATOMICALLY (temp + rename, the same
+ * discipline as the editor save): read raw → {@link mergeConfigPatch} → write.
+ * Busts the {@link getAppConfig} process cache and returns the new parsed
+ * config. Honors `TMUX_IDE_CONFIG`, so tests never touch the real file.
+ */
+export function updateAppConfig(patch: AppConfigPatch): AppConfig {
+  const path = appConfigPath();
+  const merged = mergeConfigPatch(loadRawAppConfig(), patch);
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(merged, null, 2)}\n`, "utf-8");
+  renameSync(tmp, path);
+  cached = null;
+  return parseAppConfig(merged);
+}

package/packages/daemon/src/lib/app-settings.ts

@@ -0,0 +1,53 @@
+import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { homedir } from "node:os";
+
+export interface AppSettings {
+  remoteAccess: {
+    enabled: boolean;
+    token: string | null;
+  };
+}
+
+const DEFAULT_SETTINGS: AppSettings = {
+  remoteAccess: {
+    enabled: false,
+    token: null,
+  },
+};
+
+function settingsDir(): string {
+  return process.env.TMUX_IDE_SETTINGS_DIR ?? join(homedir(), ".tmux-ide");
+}
+
+export function appSettingsPath(): string {
+  return join(settingsDir(), "app-settings.json");
+}
+
+function normalizeSettings(value: unknown): AppSettings {
+  if (!value || typeof value !== "object") return structuredClone(DEFAULT_SETTINGS);
+  const remote = (value as { remoteAccess?: unknown }).remoteAccess;
+  if (!remote || typeof remote !== "object") return structuredClone(DEFAULT_SETTINGS);
+  const enabled = (remote as { enabled?: unknown }).enabled === true;
+  const rawToken = (remote as { token?: unknown }).token;
+  const token = typeof rawToken === "string" && rawToken.length > 0 ? rawToken : null;
+  return { remoteAccess: { enabled, token } };
+}
+
+export function readAppSettings(): AppSettings {
+  const path = appSettingsPath();
+  if (!existsSync(path)) return structuredClone(DEFAULT_SETTINGS);
+  try {
+    return normalizeSettings(JSON.parse(readFileSync(path, "utf-8")));
+  } catch {
+    return structuredClone(DEFAULT_SETTINGS);
+  }
+}
+
+export function writeAppSettings(next: AppSettings): void {
+  const path = appSettingsPath();
+  mkdirSync(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${Date.now()}.tmp`;
+  writeFileSync(tmp, `${JSON.stringify(normalizeSettings(next), null, 2)}\n`, "utf-8");
+  renameSync(tmp, path);
+}

package/packages/daemon/src/lib/auth/auth-service.ts

@@ -0,0 +1,227 @@
+// Based on VibeTunnel (MIT) — github.com/amantus-ai/vibetunnel
+import * as crypto from "node:crypto";
+import { readFileSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { logger } from "../log.ts";
+
+// ---------------------------------------------------------------------------
+// Types
+// ---------------------------------------------------------------------------
+
+interface AuthChallenge {
+  challengeId: string;
+  challenge: Buffer;
+  timestamp: number;
+  userId: string;
+}
+
+export interface AuthResult {
+  success: boolean;
+  userId?: string;
+  token?: string;
+  error?: string;
+}
+
+interface SSHKeyAuth {
+  publicKey: string;
+  signature: string;
+  challengeId: string;
+}
+
+// ---------------------------------------------------------------------------
+// JWT helpers (HMAC-SHA256, no external dependency)
+// ---------------------------------------------------------------------------
+
+function base64url(buf: Buffer | string): string {
+  const b = typeof buf === "string" ? Buffer.from(buf) : buf;
+  return b.toString("base64url");
+}
+
+function decodeBase64url(str: string): Buffer {
+  return Buffer.from(str, "base64url");
+}
+
+function signJwt(payload: Record<string, unknown>, secret: string, expiresInSec: number): string {
+  const header = { alg: "HS256", typ: "JWT" };
+  const now = Math.floor(Date.now() / 1000);
+  const body = { ...payload, iat: now, exp: now + expiresInSec };
+
+  const segments = [base64url(JSON.stringify(header)), base64url(JSON.stringify(body))];
+  const sigInput = segments.join(".");
+  const sig = crypto.createHmac("sha256", secret).update(sigInput).digest();
+  segments.push(base64url(sig));
+  return segments.join(".");
+}
+
+function verifyJwt(
+  token: string,
+  secret: string,
+): { valid: true; payload: Record<string, unknown> } | { valid: false } {
+  const parts = token.split(".");
+  if (parts.length !== 3) return { valid: false };
+
+  const sigInput = parts[0] + "." + parts[1];
+  const expected = crypto.createHmac("sha256", secret).update(sigInput).digest();
+  const actual = decodeBase64url(parts[2]!);
+
+  if (expected.length !== actual.length || !crypto.timingSafeEqual(expected, actual)) {
+    return { valid: false };
+  }
+
+  try {
+    const payload = JSON.parse(decodeBase64url(parts[1]!).toString()) as Record<string, unknown>;
+    if (typeof payload.exp === "number" && payload.exp < Math.floor(Date.now() / 1000)) {
+      return { valid: false };
+    }
+    return { valid: true, payload };
+  } catch {
+    return { valid: false };
+  }
+}
+
+// ---------------------------------------------------------------------------
+// AuthService
+// ---------------------------------------------------------------------------
+
+const TOKEN_EXPIRY_SEC = 24 * 60 * 60; // 24 hours
+const CHALLENGE_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes
+
+export class AuthService {
+  private challenges = new Map<string, AuthChallenge>();
+  private jwtSecret: string;
+  private cleanupTimer: ReturnType<typeof setInterval>;
+
+  constructor(secret?: string) {
+    this.jwtSecret = secret ?? process.env.JWT_SECRET ?? crypto.randomBytes(64).toString("hex");
+    this.cleanupTimer = setInterval(() => this.cleanupExpiredChallenges(), 60_000);
+  }
+
+  dispose(): void {
+    clearInterval(this.cleanupTimer);
+  }
+
+  private cleanupExpiredChallenges(): void {
+    const now = Date.now();
+    for (const [id, ch] of this.challenges) {
+      if (now - ch.timestamp > CHALLENGE_TIMEOUT_MS) {
+        this.challenges.delete(id);
+      }
+    }
+  }
+
+  // ---- JWT ----------------------------------------------------------------
+
+  generateToken(userId: string): string {
+    return signJwt({ userId }, this.jwtSecret, TOKEN_EXPIRY_SEC);
+  }
+
+  verifyToken(token: string): { valid: boolean; userId?: string } {
+    const result = verifyJwt(token, this.jwtSecret);
+    if (!result.valid) return { valid: false };
+    return { valid: true, userId: result.payload.userId as string };
+  }
+
+  // ---- SSH challenge-response --------------------------------------------
+
+  createChallenge(userId: string): { challengeId: string; challenge: string } {
+    const challengeId = crypto.randomUUID();
+    const challenge = crypto.randomBytes(32);
+
+    this.challenges.set(challengeId, {
+      challengeId,
+      challenge,
+      timestamp: Date.now(),
+      userId,
+    });
+
+    return { challengeId, challenge: challenge.toString("base64") };
+  }
+
+  async authenticateWithSSHKey(auth: SSHKeyAuth): Promise<AuthResult> {
+    const challenge = this.challenges.get(auth.challengeId);
+    if (!challenge) {
+      return { success: false, error: "Invalid or expired challenge" };
+    }
+
+    const sigBuf = Buffer.from(auth.signature, "base64");
+    if (!this.verifySSHSignature(challenge.challenge, sigBuf, auth.publicKey)) {
+      return { success: false, error: "Invalid SSH key signature" };
+    }
+
+    const authorized = this.checkSSHKeyAuthorization(challenge.userId, auth.publicKey);
+    if (!authorized) {
+      return { success: false, error: "SSH key not authorized for this user" };
+    }
+
+    this.challenges.delete(auth.challengeId);
+    const token = this.generateToken(challenge.userId);
+    return { success: true, userId: challenge.userId, token };
+  }
+
+  // ---- SSH helpers -------------------------------------------------------
+
+  private verifySSHSignature(challenge: Buffer, signature: Buffer, publicKeyStr: string): boolean {
+    try {
+      const parts = publicKeyStr.trim().split(" ");
+      if (parts.length < 2) return false;
+
+      const keyType = parts[0];
+      const keyData = parts[1]!;
+
+      if (keyType !== "ssh-ed25519") {
+        logger.warn("auth", `Unsupported key type: ${keyType}`);
+        return false;
+      }
+
+      if (signature.length !== 64) return false;
+
+      const sshBuf = Buffer.from(keyData, "base64");
+      let offset = 0;
+      const algLen = sshBuf.readUInt32BE(offset);
+      offset += 4 + algLen;
+      const keyLen = sshBuf.readUInt32BE(offset);
+      offset += 4;
+      if (keyLen !== 32) return false;
+
+      const rawPub = sshBuf.subarray(offset, offset + 32);
+      const pubKey = crypto.createPublicKey({
+        key: Buffer.concat([
+          Buffer.from([0x30, 0x2a]),
+          Buffer.from([0x30, 0x05]),
+          Buffer.from([0x06, 0x03, 0x2b, 0x65, 0x70]),
+          Buffer.from([0x03, 0x21, 0x00]),
+          rawPub,
+        ]),
+        format: "der",
+        type: "spki",
+      });
+
+      return crypto.verify(null, challenge, pubKey, signature);
+    } catch (err) {
+      logger.error("auth", "SSH signature verification failed", {
+        error: String(err),
+      });
+      return false;
+    }
+  }
+
+  private checkSSHKeyAuthorization(userId: string, publicKey: string): boolean {
+    try {
+      const home = userId === process.env.USER ? homedir() : `/home/${userId}`;
+      const authKeysPath = join(home, ".ssh", "authorized_keys");
+      if (!existsSync(authKeysPath)) return false;
+
+      const authorizedKeys = readFileSync(authKeysPath, "utf-8");
+      const parts = publicKey.trim().split(" ");
+      const keyData = parts.length > 1 ? parts[1]! : parts[0]!;
+      return authorizedKeys.includes(keyData);
+    } catch {
+      return false;
+    }
+  }
+
+  getCurrentUser(): string {
+    return process.env.USER ?? process.env.USERNAME ?? "unknown";
+  }
+}