vellum 0.0.16 → 0.2.0

package/src/bundler/signature-verifier.ts

@@ -0,0 +1,184 @@
+/**
+ * Signature verification for .vellumapp archives.
+ *
+ * Checks bundle integrity and Ed25519 signature validity.
+ */
+
+import { createHash, verify } from 'node:crypto';
+import { readFile } from 'node:fs/promises';
+import JSZip from 'jszip';
+import type { SignatureJson } from './bundle-signer.js';
+
+export type TrustTier = 'verified' | 'signed' | 'unsigned' | 'tampered';
+
+export interface SignatureVerificationResult {
+  trustTier: TrustTier;
+  signerKeyId?: string;
+  signerDisplayName?: string;
+  signerAccount?: string;
+  message: string;
+}
+
+/**
+ * Recursively sort object keys alphabetically for canonical JSON.
+ */
+function sortKeysDeep(obj: unknown): unknown {
+  if (obj === null || obj === undefined || typeof obj !== 'object') {
+    return obj;
+  }
+  if (Array.isArray(obj)) {
+    return obj.map(sortKeysDeep);
+  }
+  const sorted: Record<string, unknown> = {};
+  for (const key of Object.keys(obj as Record<string, unknown>).sort()) {
+    sorted[key] = sortKeysDeep((obj as Record<string, unknown>)[key]);
+  }
+  return sorted;
+}
+
+/**
+ * Verify the signature and integrity of a .vellumapp bundle.
+ *
+ * @param zipPath - Path to the .vellumapp zip archive.
+ * @param trustedPublicKeys - Optional map of keyId -> base64-encoded public key for verification.
+ *                            If not provided, signature is checked structurally but returns 'signed' at best.
+ * @returns The verification result with trust tier and signer info.
+ */
+export async function verifyBundleSignature(
+  zipPath: string,
+  trustedPublicKeys?: Map<string, string>,
+): Promise<SignatureVerificationResult> {
+  const zipBuffer = await readFile(zipPath);
+  const zip = await JSZip.loadAsync(zipBuffer);
+
+  // 1. Check for signature.json
+  const sigFile = zip.file('signature.json');
+  if (!sigFile) {
+    return {
+      trustTier: 'unsigned',
+      message: 'Bundle is not signed (no signature.json found)',
+    };
+  }
+
+  // 2. Parse signature.json
+  let signatureData: SignatureJson;
+  try {
+    const sigText = await sigFile.async('text');
+    signatureData = JSON.parse(sigText) as SignatureJson;
+  } catch {
+    return {
+      trustTier: 'tampered',
+      message: 'signature.json is malformed',
+    };
+  }
+
+  // 3. Recompute content hashes
+  const computedHashes: Record<string, string> = {};
+  const entries: string[] = [];
+
+  zip.forEach((relativePath, _file) => {
+    if (relativePath !== 'signature.json') {
+      entries.push(relativePath);
+    }
+  });
+  entries.sort();
+
+  for (const entryPath of entries) {
+    const file = zip.file(entryPath);
+    if (!file || file.dir) continue;
+    const content = await file.async('nodebuffer');
+    const hash = createHash('sha256').update(content).digest('hex');
+    computedHashes[entryPath] = hash;
+  }
+
+  // 4. Compare hashes
+  const expectedPaths = Object.keys(signatureData.content_hashes).sort();
+  const actualPaths = Object.keys(computedHashes).sort();
+
+  if (expectedPaths.length !== actualPaths.length ||
+      !expectedPaths.every((p, i) => p === actualPaths[i])) {
+    return {
+      trustTier: 'tampered',
+      signerKeyId: signatureData.signer.key_id,
+      signerDisplayName: signatureData.signer.display_name,
+      message: 'Bundle files do not match signed manifest (files added or removed)',
+    };
+  }
+
+  for (const path of expectedPaths) {
+    if (signatureData.content_hashes[path] !== computedHashes[path]) {
+      return {
+        trustTier: 'tampered',
+        signerKeyId: signatureData.signer.key_id,
+        signerDisplayName: signatureData.signer.display_name,
+        message: `Content hash mismatch for file: ${path}`,
+      };
+    }
+  }
+
+  // 5. Reconstruct canonical signing payload
+  const manifestFile = zip.file('manifest.json');
+  if (!manifestFile) {
+    return {
+      trustTier: 'tampered',
+      message: 'Bundle is missing manifest.json',
+    };
+  }
+  const manifestText = await manifestFile.async('text');
+  const manifest = JSON.parse(manifestText) as Record<string, unknown>;
+
+  const signingPayload = sortKeysDeep({
+    content_hashes: computedHashes,
+    manifest,
+  });
+  const canonicalPayload = JSON.stringify(signingPayload);
+
+  // 6. Verify Ed25519 signature if we have a public key
+  const keyId = signatureData.signer.key_id;
+  const publicKeyBase64 = trustedPublicKeys?.get(keyId);
+
+  if (publicKeyBase64) {
+    try {
+      const rawKey = Buffer.from(publicKeyBase64, 'base64');
+      const signatureBuffer = Buffer.from(signatureData.signature, 'base64');
+
+      // Ed25519 SPKI DER header (12 bytes) for wrapping raw 32-byte public key.
+      // The Swift client sends the key as rawRepresentation (32 bytes), but
+      // Node.js crypto.verify expects DER-encoded SPKI format (44 bytes).
+      const ed25519SpkiPrefix = Buffer.from('302a300506032b6570032100', 'hex');
+      const derKey = Buffer.concat([ed25519SpkiPrefix, rawKey]);
+
+      const isValid = verify(
+        null, // Ed25519 doesn't use a separate hash algorithm
+        Buffer.from(canonicalPayload),
+        { key: derKey, format: 'der', type: 'spki' },
+        signatureBuffer,
+      );
+
+      if (!isValid) {
+        return {
+          trustTier: 'tampered',
+          signerKeyId: keyId,
+          signerDisplayName: signatureData.signer.display_name,
+          message: 'Ed25519 signature verification failed',
+        };
+      }
+    } catch {
+      return {
+        trustTier: 'tampered',
+        signerKeyId: keyId,
+        signerDisplayName: signatureData.signer.display_name,
+        message: 'Ed25519 signature verification failed (crypto error)',
+      };
+    }
+  }
+
+  // For MVP, we don't have Vellum account lookup, so best we can do is 'signed'
+  return {
+    trustTier: 'signed',
+    signerKeyId: keyId,
+    signerDisplayName: signatureData.signer.display_name,
+    signerAccount: signatureData.signer.account,
+    message: `Bundle signed by ${signatureData.signer.display_name}`,
+  };
+}

package/src/cli/autonomy.ts

@@ -0,0 +1,188 @@
+/**
+ * CLI command group: `vellum autonomy`
+ *
+ * View and configure autonomy tiers that govern what runs unsupervised
+ * per channel, category, or contact.
+ */
+
+import { Command } from 'commander';
+import {
+  getAutonomyConfig,
+  setAutonomyConfig,
+  AUTONOMY_TIERS,
+} from '../autonomy/index.js';
+import type { AutonomyTier } from '../autonomy/index.js';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function output(data: unknown, json: boolean): void {
+  process.stdout.write(
+    json ? JSON.stringify(data) + '\n' : JSON.stringify(data, null, 2) + '\n',
+  );
+}
+
+function exitError(message: string): void {
+  output({ ok: false, error: message }, true);
+  process.exitCode = 1;
+}
+
+function getJson(cmd: Command): boolean {
+  let c: Command | null = cmd;
+  while (c) {
+    if ((c.opts() as { json?: boolean }).json) return true;
+    c = c.parent;
+  }
+  return false;
+}
+
+function isValidTier(value: string): value is AutonomyTier {
+  return AUTONOMY_TIERS.includes(value as AutonomyTier);
+}
+
+function formatConfigForHuman(): string {
+  const config = getAutonomyConfig();
+  const lines: string[] = [
+    `  Default tier: ${config.defaultTier}`,
+  ];
+
+  const channelEntries = Object.entries(config.channelDefaults);
+  if (channelEntries.length > 0) {
+    lines.push('  Channel defaults:');
+    for (const [channel, tier] of channelEntries) {
+      lines.push(`    ${channel}: ${tier}`);
+    }
+  } else {
+    lines.push('  Channel defaults: (none)');
+  }
+
+  const categoryEntries = Object.entries(config.categoryOverrides);
+  if (categoryEntries.length > 0) {
+    lines.push('  Category overrides:');
+    for (const [category, tier] of categoryEntries) {
+      lines.push(`    ${category}: ${tier}`);
+    }
+  } else {
+    lines.push('  Category overrides: (none)');
+  }
+
+  const contactEntries = Object.entries(config.contactOverrides);
+  if (contactEntries.length > 0) {
+    lines.push('  Contact overrides:');
+    for (const [contactId, tier] of contactEntries) {
+      lines.push(`    ${contactId}: ${tier}`);
+    }
+  } else {
+    lines.push('  Contact overrides: (none)');
+  }
+
+  return lines.join('\n');
+}
+
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+
+export function registerAutonomyCommand(program: Command): void {
+  const autonomy = program
+    .command('autonomy')
+    .description('View and configure autonomy tiers')
+    .option('--json', 'Machine-readable JSON output');
+
+  autonomy
+    .command('get')
+    .description('Show current autonomy configuration')
+    .action((_opts: unknown, cmd: Command) => {
+      const config = getAutonomyConfig();
+      const json = getJson(cmd);
+
+      if (json) {
+        output({ ok: true, config }, true);
+      } else {
+        process.stdout.write('Autonomy configuration:\n\n');
+        process.stdout.write(formatConfigForHuman() + '\n');
+      }
+    });
+
+  autonomy
+    .command('set')
+    .description('Set autonomy tier for a channel, category, contact, or the global default')
+    .option('--default <tier>', 'Set the global default tier')
+    .option('--channel <channel>', 'Channel to configure (use with --tier)')
+    .option('--category <category>', 'Category to configure (use with --tier)')
+    .option('--contact <contactId>', 'Contact ID to configure (use with --tier)')
+    .option('--tier <tier>', 'Autonomy tier to set (auto, draft, notify)')
+    .action((opts: {
+      default?: string;
+      channel?: string;
+      category?: string;
+      contact?: string;
+      tier?: string;
+    }, cmd: Command) => {
+      const json = getJson(cmd);
+
+      // Set global default
+      if (opts.default) {
+        if (!isValidTier(opts.default)) {
+          exitError(`Invalid tier "${opts.default}". Must be one of: ${AUTONOMY_TIERS.join(', ')}`);
+          return;
+        }
+        const config = setAutonomyConfig({ defaultTier: opts.default });
+        if (json) {
+          output({ ok: true, config }, true);
+        } else {
+          process.stdout.write(`Set global default tier to "${opts.default}".\n`);
+        }
+        return;
+      }
+
+      // All other options require --tier
+      if (!opts.tier) {
+        exitError('Missing --tier. Use --tier <auto|draft|notify>.');
+        return;
+      }
+      if (!isValidTier(opts.tier)) {
+        exitError(`Invalid tier "${opts.tier}". Must be one of: ${AUTONOMY_TIERS.join(', ')}`);
+        return;
+      }
+
+      if (opts.channel) {
+        const config = setAutonomyConfig({
+          channelDefaults: { [opts.channel]: opts.tier },
+        });
+        if (json) {
+          output({ ok: true, config }, true);
+        } else {
+          process.stdout.write(`Set channel "${opts.channel}" default to "${opts.tier}".\n`);
+        }
+        return;
+      }
+
+      if (opts.category) {
+        const config = setAutonomyConfig({
+          categoryOverrides: { [opts.category]: opts.tier },
+        });
+        if (json) {
+          output({ ok: true, config }, true);
+        } else {
+          process.stdout.write(`Set category "${opts.category}" override to "${opts.tier}".\n`);
+        }
+        return;
+      }
+
+      if (opts.contact) {
+        const config = setAutonomyConfig({
+          contactOverrides: { [opts.contact]: opts.tier },
+        });
+        if (json) {
+          output({ ok: true, config }, true);
+        } else {
+          process.stdout.write(`Set contact "${opts.contact}" override to "${opts.tier}".\n`);
+        }
+        return;
+      }
+
+      exitError('Specify one of: --default <tier>, --channel <channel> --tier <tier>, --category <category> --tier <tier>, or --contact <contactId> --tier <tier>.');
+    });
+}

package/src/cli/contacts.ts

@@ -0,0 +1,149 @@
+/**
+ * CLI command group: `vellum contacts`
+ *
+ * Manage the contact graph — list, inspect, and merge contacts.
+ */
+
+import { Command } from 'commander';
+import { initializeDb } from '../memory/db.js';
+import {
+  listContacts,
+  getContact,
+  mergeContacts,
+} from '../contacts/contact-store.js';
+import type { ContactWithChannels } from '../contacts/types.js';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function output(data: unknown, json: boolean): void {
+  process.stdout.write(
+    json ? JSON.stringify(data) + '\n' : JSON.stringify(data, null, 2) + '\n',
+  );
+}
+
+function exitError(message: string): void {
+  output({ ok: false, error: message }, true);
+  process.exitCode = 1;
+}
+
+function getJson(cmd: Command): boolean {
+  let c: Command | null = cmd;
+  while (c) {
+    if ((c.opts() as { json?: boolean }).json) return true;
+    c = c.parent;
+  }
+  return false;
+}
+
+function formatContactForHuman(c: ContactWithChannels): string {
+  const lines = [
+    `  ID:           ${c.id}`,
+    `  Name:         ${c.displayName}`,
+    `  Relationship: ${c.relationship ?? '(none)'}`,
+    `  Importance:   ${c.importance.toFixed(2)}`,
+    `  Response:     ${c.responseExpectation ?? '(none)'}`,
+    `  Tone:         ${c.preferredTone ?? '(none)'}`,
+    `  Interactions: ${c.interactionCount}`,
+  ];
+  if (c.lastInteraction) {
+    lines.push(`  Last seen:    ${new Date(c.lastInteraction).toISOString()}`);
+  }
+  if (c.channels.length > 0) {
+    lines.push('  Channels:');
+    for (const ch of c.channels) {
+      const primary = ch.isPrimary ? ' (primary)' : '';
+      lines.push(`    - ${ch.type}: ${ch.address}${primary}`);
+    }
+  }
+  return lines.join('\n');
+}
+
+// ---------------------------------------------------------------------------
+// Command registration
+// ---------------------------------------------------------------------------
+
+export function registerContactsCommand(program: Command): void {
+  const contacts = program
+    .command('contacts')
+    .description('Manage the contact graph')
+    .option('--json', 'Machine-readable JSON output');
+
+  contacts
+    .command('list')
+    .description('List all contacts')
+    .option('--limit <n>', 'Max contacts to show', '50')
+    .action((opts: { limit: string }, cmd: Command) => {
+      initializeDb();
+      const limit = parseInt(opts.limit, 10) || 50;
+      const results = listContacts(limit);
+      const json = getJson(cmd);
+
+      if (json) {
+        output({ ok: true, contacts: results }, true);
+        return;
+      }
+
+      if (results.length === 0) {
+        process.stdout.write('No contacts found.\n');
+        return;
+      }
+
+      process.stdout.write(`Contacts (${results.length}):\n\n`);
+      for (const c of results) {
+        process.stdout.write(formatContactForHuman(c) + '\n\n');
+      }
+    });
+
+  contacts
+    .command('get <id>')
+    .description('Get a contact by ID')
+    .action((id: string, _opts: unknown, cmd: Command) => {
+      initializeDb();
+      const contact = getContact(id);
+      const json = getJson(cmd);
+
+      if (!contact) {
+        if (json) {
+          exitError(`Contact "${id}" not found`);
+        } else {
+          process.stdout.write(`Contact "${id}" not found.\n`);
+          process.exitCode = 1;
+        }
+        return;
+      }
+
+      if (json) {
+        output({ ok: true, contact }, true);
+      } else {
+        process.stdout.write(formatContactForHuman(contact) + '\n');
+      }
+    });
+
+  contacts
+    .command('merge <keepId> <mergeId>')
+    .description('Merge two contacts (merge second into first, delete second)')
+    .action((keepId: string, mergeId: string, _opts: unknown, cmd: Command) => {
+      initializeDb();
+      const json = getJson(cmd);
+
+      try {
+        const merged = mergeContacts(keepId, mergeId);
+        if (json) {
+          output({ ok: true, contact: merged }, true);
+        } else {
+          process.stdout.write(`Merged contact "${mergeId}" into "${keepId}".\n\n`);
+          process.stdout.write(formatContactForHuman(merged) + '\n');
+        }
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        if (json) {
+          exitError(msg);
+        } else {
+          process.stdout.write(`Error: ${msg}\n`);
+          process.exitCode = 1;
+        }
+      }
+    });
+}