tryharness 0.7.22 → 0.7.25

package/lib/phones.mjs

@@ -1,6 +1,15 @@
 import os from "node:os";
 import { randomBytes } from "node:crypto";
-import { b64u, channelKey, constantTimeEqual, loadOrCreateIdentity, MAX_SKEW_MS, open, pairProof, seal } from "./sealed.mjs";
+import {
+  b64u,
+  channelKey,
+  constantTimeEqual,
+  loadOrCreateIdentity,
+  MAX_SKEW_MS,
+  open,
+  pairProof,
+  seal,
+} from "./sealed.mjs";
 
 // The daemon's side of the person's own devices: pairing offers made on this machine (a QR code
 // for a phone, a link opened in a browser), and sealed calls from paired devices, opened here and
@@ -13,34 +22,134 @@ const OFFER_TTL_MS = 10 * 60_000;
 const MAX_OFFERS = 5;
 // A message queued at Harness while this computer slept may arrive up to 7 days late; only decisions and posts may.
 const QUEUED_MAX_AGE_MS = 7 * 24 * 60 * 60 * 1000;
-const QUEUEABLE = new Set(["board.post", "board.run", "board.release", "board.answer", "board.remove", "board.thread.post", "board.thread.send", "board.thread.discard", "board.thread.end", "board.goal.stop",
-  "board.swarm.start", "board.swarm.post", "board.swarm.stop", "board.swarm.stop_all", "board.swarm.resume", "board.swarm.start_run"]);
+const QUEUEABLE = new Set([
+  "board.post",
+  "board.run",
+  "board.release",
+  "board.answer",
+  "board.remove",
+  "board.thread.post",
+  "board.thread.send",
+  "board.thread.discard",
+  "board.thread.end",
+  "board.goal.stop",
+  "board.swarm.start",
+  "board.swarm.post",
+  "board.swarm.stop",
+  "board.swarm.stop_all",
+  "board.swarm.resume",
+  "board.swarm.start_run",
+]);
 const ID = /^[A-Za-z0-9_-]{8,64}$/;
 const KEY = /^[A-Za-z0-9_-]{80,100}$/;
 const KINDS = new Set(["phone", "browser"]);
 const PHONE_COMMANDS = new Set([
-  "board.list", "board.get", "board.children", "board.agents", "board.post", "board.run", "board.release", "board.answer", "board.remove",
-  "board.thread.read", "board.thread.post", "board.thread.send", "board.thread.discard", "board.thread.auto", "board.thread.end",
-  "board.goal.list", "board.goal.get", "board.goal.stop", "board.room.read",
-  "board.swarm.list", "board.swarm.read", "board.swarm.start", "board.swarm.post", "board.swarm.stop", "board.swarm.stop_all", "board.swarm.resume", "board.swarm.folder", "board.swarm.coordinator",
-  "board.swarm.diff", "board.swarm.merge", "board.swarm.discard", "board.swarm.start_run", "board.swarm.agents", "board.swarm.note",
+  "board.list",
+  "board.get",
+  "board.children",
+  "board.agents",
+  "board.post",
+  "board.run",
+  "board.release",
+  "board.answer",
+  "board.remove",
+  "board.thread.read",
+  "board.thread.post",
+  "board.thread.send",
+  "board.thread.discard",
+  "board.thread.auto",
+  "board.thread.end",
+  "board.goal.list",
+  "board.goal.get",
+  "board.goal.stop",
+  "board.room.read",
+  // A thread's files: shown, opened and downloaded, and shared or kept on this computer, by the person.
+  "board.file.get",
+  "board.file.share",
+  "board.swarm.list",
+  "board.swarm.read",
+  "board.swarm.start",
+  "board.swarm.post",
+  "board.swarm.stop",
+  "board.swarm.stop_all",
+  "board.swarm.resume",
+  "board.swarm.folder",
+  "board.swarm.coordinator",
+  "board.swarm.diff",
+  "board.swarm.merge",
+  "board.swarm.discard",
+  "board.swarm.start_run",
+  "board.swarm.agents",
+  "board.swarm.note",
   // Where a thread works: the folders offered, any folder browsed to, and where a message would work (folders.mjs).
-  "board.swarm.places", "board.swarm.browse", "board.swarm.place",
+  "board.swarm.places",
+  "board.swarm.browse",
+  "board.swarm.place",
   // The person's own running sessions, read and messaged as from the desktop app; never queued (a session may be gone).
-  "board.live", "board.live.read", "board.live.say",
+  "board.live",
+  "board.live.read",
+  "board.live.say",
 ]);
 // What the chat owner does on the board, in Harness's name (was src/server/mcp/board.ts HARNESS_COMMANDS).
 const HARNESS_COMMANDS = new Set([
-  "board.list", "board.get", "board.post", "board.claim", "board.report", "board.answer", "board.thread.read", "board.thread.post", "board.standing.check",
-  "board.goal.create", "board.goal.get", "board.goal.list", "board.goal.finish", "board.room.read", "board.room.post", "board.room.search", "board.children", "board.agents",
-  "board.swarm.list", "board.swarm.read", "board.swarm.diff",
+  "board.list",
+  "board.get",
+  "board.post",
+  "board.claim",
+  "board.report",
+  "board.answer",
+  "board.thread.read",
+  "board.thread.post",
+  "board.standing.check",
+  "board.goal.create",
+  "board.goal.get",
+  "board.goal.list",
+  "board.goal.finish",
+  "board.room.read",
+  "board.room.post",
+  "board.room.search",
+  "board.children",
+  "board.agents",
+  "board.swarm.list",
+  "board.swarm.read",
+  "board.swarm.diff",
 ]);
 // Swarms talking to swarms (network.mjs), from the Harness window: the person's own, never Harness's.
-const RELAY_PERSON_COMMANDS = ["board.relay.list", "board.relay.network", "board.relay.decide", "board.relay.request", "board.relay.seen", "board.relay.defaults", "board.relay.peers"];
-const BROWSER_PERSON_COMMANDS = new Set([...PHONE_COMMANDS, "board.goal.resume", "board.standing", "board.standing.check", "board.standing.off", ...RELAY_PERSON_COMMANDS]);
-const BROWSER_READS = new Set(["sessions.search", "sessions.read", "sessions.raw", "tasks.status", "relay.request", "relay.open"]);
+const RELAY_PERSON_COMMANDS = [
+  "board.relay.list",
+  "board.relay.network",
+  "board.relay.decide",
+  "board.relay.request",
+  "board.relay.seen",
+  "board.relay.defaults",
+  "board.relay.peers",
+];
+const BROWSER_PERSON_COMMANDS = new Set([
+  ...PHONE_COMMANDS,
+  "board.goal.resume",
+  "board.standing",
+  "board.standing.check",
+  "board.standing.off",
+  ...RELAY_PERSON_COMMANDS,
+]);
+const BROWSER_READS = new Set([
+  "sessions.search",
+  "sessions.read",
+  "sessions.raw",
+  "tasks.status",
+  "relay.request",
+  "relay.open",
+]);
 
-export async function createPhoneDesk({ store, identityFile, boardCommand, reads = {}, version, onMessage = () => {}, machine = () => null }) {
+export async function createPhoneDesk({
+  store,
+  identityFile,
+  boardCommand,
+  reads = {},
+  version,
+  onMessage = () => {},
+  machine = () => null,
+}) {
   const identity = await loadOrCreateIdentity(identityFile);
   const offers = new Map();
   const keys = new Map();
@@ -48,10 +157,15 @@ export async function createPhoneDesk({ store, identityFile, boardCommand, reads
 
   const sweep = () => {
     const now = Date.now();
-    for (const [id, offer] of offers) if (offer.expiresAt < now) offers.delete(id);
+    for (const [id, offer] of offers)
+      if (offer.expiresAt < now) offers.delete(id);
   };
   const keyFor = async (device) => {
-    if (!keys.has(device.id)) keys.set(device.id, await channelKey(identity.privateKey, device.public_key, device.id));
+    if (!keys.has(device.id))
+      keys.set(
+        device.id,
+        await channelKey(identity.privateKey, device.public_key, device.id)
+      );
     return keys.get(device.id);
   };
 
@@ -64,52 +178,152 @@ export async function createPhoneDesk({ store, identityFile, boardCommand, reads
     const offerId = b64u(randomBytes(16));
     const secret = b64u(randomBytes(32));
     offers.set(offerId, { secret, kind, expiresAt: Date.now() + OFFER_TTL_MS });
-    const fragment = new URLSearchParams({ v: "1", o: offerId, s: secret, k: identity.publicKey, h: hostname });
+    const fragment = new URLSearchParams({
+      v: "1",
+      o: offerId,
+      s: secret,
+      k: identity.publicKey,
+      h: hostname,
+    });
     const page = kind === "browser" ? "/link" : "/m/pair";
-    return { offerId, kind, expiresInSeconds: OFFER_TTL_MS / 1000, url: `${String(origin).replace(/\/$/, "")}${page}#${fragment}` };
+    return {
+      offerId,
+      kind,
+      expiresInSeconds: OFFER_TTL_MS / 1000,
+      url: `${String(origin).replace(/\/$/, "")}${page}#${fragment}`,
+    };
   };
 
   const pair = async (input) => {
     sweep();
     const { offerId, deviceId, devicePublicKey, proof, requestId } = input;
-    if (![offerId, deviceId, requestId].every((value) => ID.test(String(value))) || !KEY.test(String(devicePublicKey))) return { ok: false, error: "invalid pairing request" };
+    if (
+      ![offerId, deviceId, requestId].every((value) =>
+        ID.test(String(value))
+      ) ||
+      !KEY.test(String(devicePublicKey))
+    )
+      return { ok: false, error: "invalid pairing request" };
     const pending = offers.get(String(offerId));
     // One attempt per code, right or wrong: a guessed proof burns the code.
     offers.delete(String(offerId));
-    if (!pending) return { ok: false, error: "this pairing code expired or was already used; make a new one on the computer" };
-    if (!constantTimeEqual(proof, await pairProof(pending.secret, offerId, devicePublicKey, identity.publicKey))) return { ok: false, error: "the pairing proof did not match" };
-    if (store.getPhone(String(deviceId))) return { ok: false, error: "this device is already paired" };
+    if (!pending)
+      return {
+        ok: false,
+        error:
+          "this pairing code expired or was already used; make a new one on the computer",
+      };
+    if (
+      !constantTimeEqual(
+        proof,
+        await pairProof(
+          pending.secret,
+          offerId,
+          devicePublicKey,
+          identity.publicKey
+        )
+      )
+    )
+      return { ok: false, error: "the pairing proof did not match" };
+    if (store.getPhone(String(deviceId)))
+      return { ok: false, error: "this device is already paired" };
     const fallback = pending.kind === "browser" ? "Browser" : "Phone";
-    const label = String(input.label || fallback).replace(/[^\p{L}\p{N} ._'-]/gu, "").slice(0, 40) || fallback;
-    const device = store.addPhone({ id: String(deviceId), label, publicKey: String(devicePublicKey), kind: pending.kind });
-    return { ok: true, envelope: await seal(await keyFor(device), "d2p", device.id, String(requestId), { paired: true, hostname, label, kind: device.kind, version }) };
+    const label =
+      String(input.label || fallback)
+        .replace(/[^\p{L}\p{N} ._'-]/gu, "")
+        .slice(0, 40) || fallback;
+    const device = store.addPhone({
+      id: String(deviceId),
+      label,
+      publicKey: String(devicePublicKey),
+      kind: pending.kind,
+    });
+    return {
+      ok: true,
+      envelope: await seal(
+        await keyFor(device),
+        "d2p",
+        device.id,
+        String(requestId),
+        { paired: true, hostname, label, kind: device.kind, version }
+      ),
+    };
   };
 
   const call = async (envelope) => {
     sweep();
-    if (!envelope || envelope.v !== 1 || !ID.test(String(envelope.deviceId)) || !ID.test(String(envelope.requestId)) || typeof envelope.iv !== "string" || typeof envelope.ct !== "string") {
+    if (
+      !envelope ||
+      envelope.v !== 1 ||
+      !ID.test(String(envelope.deviceId)) ||
+      !ID.test(String(envelope.requestId)) ||
+      typeof envelope.iv !== "string" ||
+      typeof envelope.ct !== "string"
+    ) {
       return { ok: false, error: "invalid envelope" };
     }
     const device = store.getPhone(envelope.deviceId);
-    if (!device) return { ok: false, error: "unknown device", code: "unpaired" };
-    if (device.revoked_at) return { ok: false, error: "this device was disconnected from the computer", code: "revoked" };
+    if (!device)
+      return { ok: false, error: "unknown device", code: "unpaired" };
+    if (device.revoked_at)
+      return {
+        ok: false,
+        error: "this device was disconnected from the computer",
+        code: "revoked",
+      };
     const key = await keyFor(device);
     let request;
-    try { request = await open(key, "p2d", envelope); } catch { return { ok: false, error: "the message could not be opened", code: "unreadable" }; }
+    try {
+      request = await open(key, "p2d", envelope);
+    } catch {
+      return {
+        ok: false,
+        error: "the message could not be opened",
+        code: "unreadable",
+      };
+    }
     const queued = request?.queued === true;
-    if (queued && !QUEUEABLE.has(String(request?.call?.command || ""))) return { ok: false, error: "only posts and decisions wait for the computer", code: "refused" };
-    const age = typeof request?.ts === "number" ? Date.now() - request.ts : Infinity;
-    if (queued ? age > QUEUED_MAX_AGE_MS || age < -MAX_SKEW_MS : Math.abs(age) > MAX_SKEW_MS) return { ok: false, error: "the message is too old or the device's clock is off", code: "stale" };
-    if (!store.firstPhoneRequest(device.id, String(envelope.requestId))) return { ok: false, error: "this message was already received", code: "replayed" };
+    if (queued && !QUEUEABLE.has(String(request?.call?.command || "")))
+      return {
+        ok: false,
+        error: "only posts and decisions wait for the computer",
+        code: "refused",
+      };
+    const age =
+      typeof request?.ts === "number" ? Date.now() - request.ts : Infinity;
+    if (
+      queued
+        ? age > QUEUED_MAX_AGE_MS || age < -MAX_SKEW_MS
+        : Math.abs(age) > MAX_SKEW_MS
+    )
+      return {
+        ok: false,
+        error: "the message is too old or the device's clock is off",
+        code: "stale",
+      };
+    if (!store.firstPhoneRequest(device.id, String(envelope.requestId)))
+      return {
+        ok: false,
+        error: "this message was already received",
+        code: "replayed",
+      };
     store.touchPhone(device.id);
     // Any message from a paired device keeps a Mac in Standby awake for the next hour (Lid-Closed Mode).
     onMessage();
     if (request.call?.command === "phone.forget") {
       const forgotten = revoke(device.id);
-      return { ok: true, envelope: await seal(key, "d2p", device.id, envelope.requestId, { ok: forgotten.ok }) };
+      return {
+        ok: true,
+        envelope: await seal(key, "d2p", device.id, envelope.requestId, {
+          ok: forgotten.ok,
+        }),
+      };
     }
     const result = await answer(request.call, device);
-    return { ok: true, envelope: await seal(key, "d2p", device.id, envelope.requestId, result) };
+    return {
+      ok: true,
+      envelope: await seal(key, "d2p", device.id, envelope.requestId, result),
+    };
   };
 
   const settled = async (run) => {
@@ -117,42 +331,175 @@ export async function createPhoneDesk({ store, identityFile, boardCommand, reads
       const result = run();
       return result?.pending ? { ok: true, ...(await result.pending) } : result;
     } catch (error) {
-      return { ok: false, error: `the board could not answer: ${error.message}` };
+      return {
+        ok: false,
+        error: `the board could not answer: ${error.message}`,
+      };
     }
   };
 
   const answer = async (callInput, device) => {
     const command = String(callInput?.command || "");
-    if (command === "phone.hello") return { ok: true, hostname, version, kind: device.kind };
+    if (command === "phone.hello")
+      return { ok: true, hostname, version, kind: device.kind };
     if (device.kind === "browser") {
       if (BROWSER_READS.has(command)) {
         const read = reads[command];
-        if (!read) return { ok: false, error: `this computer cannot answer ${command}` };
-        try { return { ok: true, result: await read(callInput) }; } catch (error) { return { ok: false, error: error.message }; }
+        if (!read)
+          return { ok: false, error: `this computer cannot answer ${command}` };
+        try {
+          return { ok: true, result: await read(callInput) };
+        } catch (error) {
+          return { ok: false, error: error.message };
+        }
       }
       // The browser says whose call it is: the person's own action, or the chat owner's tool call.
       const as = callInput.as === "harness" ? "harness" : "user";
-      if (!(as === "harness" ? HARNESS_COMMANDS : BROWSER_PERSON_COMMANDS).has(command)) return { ok: false, error: `a browser cannot call ${command || "that"} as ${as}` };
+      if (
+        !(as === "harness" ? HARNESS_COMMANDS : BROWSER_PERSON_COMMANDS).has(
+          command
+        )
+      )
+        return {
+          ok: false,
+          error: `a browser cannot call ${command || "that"} as ${as}`,
+        };
       // Words another agent wrote that drove Harness's call ride as a taint the board keeps.
-      const writtenBy = Array.isArray(callInput.writtenBy) ? callInput.writtenBy.map(String).slice(0, 16) : [];
-      if (as === "harness" && command === "board.goal.create" && writtenBy.length) return { ok: false, error: "a goal is set only in a turn the owner started" };
-      const { as: _as, writtenBy: _written, provenance: _provenance, ...rest } = callInput;
-      return settled(() => boardCommand({ ...rest, command, agent: as, ...(writtenBy.length ? { provenance: { trust: "agent", chain: writtenBy } } : {}) }));
+      const writtenBy = Array.isArray(callInput.writtenBy)
+        ? callInput.writtenBy.map(String).slice(0, 16)
+        : [];
+      if (
+        as === "harness" &&
+        command === "board.goal.create" &&
+        writtenBy.length
+      )
+        return {
+          ok: false,
+          error: "a goal is set only in a turn the owner started",
+        };
+      const {
+        as: _as,
+        writtenBy: _written,
+        provenance: _provenance,
+        ...rest
+      } = callInput;
+      return settled(() =>
+        boardCommand({
+          ...rest,
+          command,
+          agent: as,
+          ...(writtenBy.length
+            ? { provenance: { trust: "agent", chain: writtenBy } }
+            : {}),
+        })
+      );
     }
     // Lid-Closed Mode's wake: no arguments, never queued, and it can only keep the Mac awake and say how it is.
     if (command === "machine.wake") return { ok: true, machine: machine() };
-    if (!PHONE_COMMANDS.has(command)) return { ok: false, error: `a phone cannot call ${command || "that"}` };
+    if (!PHONE_COMMANDS.has(command))
+      return { ok: false, error: `a phone cannot call ${command || "that"}` };
     // The phone is the person; whatever it names itself, it acts as "user".
-    return settled(() => boardCommand({ ...callInput, command, agent: "user", ...(command === "board.list" && callInput.all === undefined ? { all: true } : {}) }));
+    return settled(() =>
+      boardCommand({
+        ...callInput,
+        command,
+        agent: "user",
+        ...(command === "board.list" && callInput.all === undefined
+          ? { all: true }
+          : {}),
+      })
+    );
   };
 
   // Harness's bridge message: a pairing or a sealed call. Everything returned is safe to pass through Harness.
-  const handle = async (input) => (input?.kind === "pair" ? pair(input) : input?.kind === "call" ? call(input.envelope) : { ok: false, error: "unknown sealed request" });
+  const handle = async (input) =>
+    input?.kind === "pair"
+      ? pair(input)
+      : input?.kind === "call"
+        ? call(input.envelope)
+        : { ok: false, error: "unknown sealed request" };
+
+  // The other way round: this computer asking the person's own Harness window for what only the window holds (its
+  // screen history). The question is sealed to every browser linked here ("d2b") under one fresh request id; Harness
+  // hands the envelopes to the window that is open (`carry`, the bridge's leg), only a browser holding one of these
+  // links can open its envelope, and its answer comes back sealed ("b2d") for this request id alone. Harness sees which
+  // devices, sizes and timing, never the question or the answer.
+  const ask = async (call, carry) => {
+    const browsers = store
+      .phones()
+      .filter((device) => device.kind === "browser" && !device.revoked_at)
+      .slice(0, 8)
+      .map((device) => store.getPhone(device.id));
+    if (!browsers.length)
+      return {
+        ok: false,
+        code: "unpaired",
+        error:
+          "no Harness window is linked to this computer: the person links one with npx tryharness link",
+      };
+    const requestId = b64u(randomBytes(16));
+    const ts = Date.now();
+    const envelopes = await Promise.all(
+      browsers.map(async (device) =>
+        seal(await keyFor(device), "d2b", device.id, requestId, { ts, call })
+      )
+    );
+    const reply = await carry(envelopes);
+    if (reply?.window === "closed")
+      return {
+        ok: false,
+        code: "closed",
+        error:
+          "the person's Harness window isn't open: ask them to open Harness, then try again",
+      };
+    if (reply?.window !== "open")
+      return {
+        ok: false,
+        error: reply?.error || "Harness could not carry the question",
+      };
+    if (!reply.ok || !reply.envelope)
+      return {
+        ok: false,
+        code: reply.code,
+        error:
+          reply.code === "window"
+            ? `the open Harness window could not answer: ${reply.error}`
+            : reply.error,
+      };
+    const device = browsers.find((item) => item.id === reply.envelope.deviceId);
+    if (!device || reply.envelope.requestId !== requestId)
+      return {
+        ok: false,
+        code: "unreadable",
+        error: "the answer was for another question",
+      };
+    let answer;
+    try {
+      answer = await open(await keyFor(device), "b2d", reply.envelope);
+    } catch {
+      return {
+        ok: false,
+        code: "unreadable",
+        error:
+          "the answer could not be opened: it did not come from a window linked to this computer",
+      };
+    }
+    store.touchPhone(device.id);
+    return answer;
+  };
 
   const revoke = (id) => {
     keys.delete(String(id));
     return store.revokePhone(String(id));
   };
 
-  return { offer, handle, revoke, list: () => store.phones(), publicKey: identity.publicKey, identity };
+  return {
+    offer,
+    handle,
+    ask,
+    revoke,
+    list: () => store.phones(),
+    publicKey: identity.publicKey,
+    identity,
+  };
 }