very-happy-cli 0.2.159 → 0.2.160

package/dist/auth-ba4WMYrN.cjs

@@ -0,0 +1,227 @@
+'use strict';
+
+var authRelay = require('./authRelay-BdYkC1Po.cjs');
+var configuration = require('./configuration-BSYpcPwE.cjs');
+var node_crypto = require('node:crypto');
+var tweetnacl = require('tweetnacl');
+var axios = require('axios');
+var time = require('./time-DCuTyook.cjs');
+var persistence = require('./persistence-yKTH3-5X.cjs');
+var browser = require('./browser-Y6Bl8L_O.cjs');
+var logger = require('./logger-CS0mw3fa.cjs');
+
+function generateWebAuthUrl(publicKey) {
+  const publicKeyBase64 = authRelay.encodeBase64(publicKey, "base64url");
+  return `${configuration.configuration.webappUrl}/terminal/connect#key=${publicKeyBase64}`;
+}
+
+function decideMachineId(input) {
+  const { read, newAuth } = input;
+  if (read.kind === "unreadable") {
+    return {
+      action: "refuse",
+      reason: `settings exist but could not be read (${read.error}); refusing to mint a new machine id \u2014 fix or remove the settings file, or run \`very-happy auth login --force\` to deliberately re-register this machine`
+    };
+  }
+  if (newAuth) return { action: "mint", reason: "new-auth" };
+  if (read.kind === "absent") return { action: "mint", reason: "no-settings-file" };
+  const existing = read.settings.machineId;
+  if (typeof existing === "string" && existing.length > 0) {
+    return { action: "reuse", machineId: existing };
+  }
+  return { action: "mint", reason: "no-machine-id" };
+}
+
+async function doAuth() {
+  console.clear();
+  const secret = new Uint8Array(node_crypto.randomBytes(32));
+  const keypair = tweetnacl.box.keyPair.fromSecretKey(secret);
+  const claimSecret = authRelay.encodeBase64Url(node_crypto.randomBytes(32));
+  try {
+    if (process.env.DEBUG) {
+      console.log(`[AUTH DEBUG] Sending auth request to: ${configuration.configuration.serverUrl}/v1/auth/request`);
+    }
+    const createResponse = await axios.post(`${configuration.configuration.serverUrl}/v1/auth/request`, {
+      publicKey: authRelay.encodeBase64(keypair.publicKey),
+      supportsV2: true,
+      supportsClaimSecret: true,
+      claimSecret,
+      pairingAction: "create"
+    }, {
+      headers: {
+        "X-Happy-Client": `cli/${configuration.configuration.currentCliVersion}`
+      }
+    });
+    if (createResponse.data?.protocolVersion !== 3 || createResponse.data?.claimSecretRequired !== true) {
+      console.log("This server does not support secure CLI pairing. Upgrade the server before signing in.");
+      return null;
+    }
+    if (process.env.DEBUG) {
+      console.log(`[AUTH DEBUG] Auth request sent successfully`);
+    }
+  } catch {
+    if (process.env.DEBUG) {
+      console.log("[AUTH DEBUG] Failed to send secure auth request");
+    }
+    console.log("Failed to create authentication request, please try again later.");
+    return null;
+  }
+  return await doWebAuth(keypair, claimSecret);
+}
+async function doWebAuth(keypair, claimSecret) {
+  console.clear();
+  console.log("\nWeb Authentication\n");
+  const webUrl = generateWebAuthUrl(keypair.publicKey);
+  console.log("Opening your browser...");
+  const browserOpened = await browser.openBrowser(webUrl);
+  if (browserOpened) {
+    console.log("\u2713 Browser opened\n");
+    console.log("Complete authentication in your browser window.");
+  } else {
+    console.log("Could not open browser automatically.");
+  }
+  console.log("\nIf the browser did not open, please copy and paste this URL:");
+  console.log(webUrl);
+  console.log("");
+  return await waitForAuthentication(keypair, claimSecret);
+}
+async function waitForAuthentication(keypair, claimSecret) {
+  process.stdout.write("Waiting for authentication");
+  let dots = 0;
+  let cancelled = false;
+  const handleInterrupt = () => {
+    cancelled = true;
+    console.log("\n\nAuthentication cancelled.");
+    process.exit(0);
+  };
+  process.on("SIGINT", handleInterrupt);
+  try {
+    while (!cancelled) {
+      try {
+        const response = await axios.post(`${configuration.configuration.serverUrl}/v1/auth/request`, {
+          publicKey: authRelay.encodeBase64(keypair.publicKey),
+          supportsV2: true,
+          supportsClaimSecret: true,
+          claimSecret,
+          pairingAction: "poll"
+        }, {
+          headers: {
+            "X-Happy-Client": `cli/${configuration.configuration.currentCliVersion}`
+          }
+        });
+        if (response.data?.protocolVersion !== 3 || response.data?.claimSecretRequired !== true) {
+          console.log("\n\nThis server does not support secure CLI pairing. Upgrade the server before signing in.");
+          return null;
+        }
+        if (response.data.state === "authorized") {
+          let token = response.data.token;
+          let r = authRelay.decodeBase64(response.data.response);
+          let decrypted = decryptWithEphemeralKey(r, keypair.secretKey);
+          if (decrypted) {
+            if (decrypted.length === 32) {
+              const credentials = {
+                secret: decrypted,
+                token
+              };
+              await persistence.writeCredentialsLegacy(credentials);
+              console.log("\n\n\u2713 Authentication successful\n");
+              return {
+                encryption: {
+                  type: "legacy",
+                  secret: decrypted
+                },
+                token
+              };
+            } else {
+              if (decrypted[0] === 0) {
+                const credentials = {
+                  publicKey: decrypted.slice(1, 33),
+                  machineKey: node_crypto.randomBytes(32),
+                  token
+                };
+                await persistence.writeCredentialsDataKey(credentials);
+                console.log("\n\n\u2713 Authentication successful\n");
+                return {
+                  encryption: {
+                    type: "dataKey",
+                    publicKey: credentials.publicKey,
+                    machineKey: credentials.machineKey
+                  },
+                  token
+                };
+              } else {
+                console.log("\n\nFailed to decrypt response. Please try again.");
+                return null;
+              }
+            }
+          } else {
+            console.log("\n\nFailed to decrypt response. Please try again.");
+            return null;
+          }
+        }
+      } catch (error) {
+        console.log("\n\nFailed to check authentication status. Please try again.");
+        return null;
+      }
+      process.stdout.write("\rWaiting for authentication" + ".".repeat(dots % 3 + 1) + "   ");
+      dots++;
+      await time.delay(1e3);
+    }
+  } finally {
+    process.off("SIGINT", handleInterrupt);
+  }
+  return null;
+}
+function decryptWithEphemeralKey(encryptedBundle, recipientSecretKey) {
+  const ephemeralPublicKey = encryptedBundle.slice(0, 32);
+  const nonce = encryptedBundle.slice(32, 32 + tweetnacl.box.nonceLength);
+  const encrypted = encryptedBundle.slice(32 + tweetnacl.box.nonceLength);
+  const decrypted = tweetnacl.box.open(encrypted, nonce, ephemeralPublicKey, recipientSecretKey);
+  if (!decrypted) {
+    return null;
+  }
+  return decrypted;
+}
+async function authAndSetupMachineIfNeeded() {
+  logger.logger.debug("[AUTH] Starting auth and machine setup...");
+  let credentials = await persistence.readCredentials();
+  let newAuth = false;
+  if (credentials) {
+    const relayProblem = authRelay.credentialRelayProblem(credentials.authServerUrl, configuration.configuration.serverUrl);
+    if (relayProblem) {
+      throw new Error(
+        `${relayProblem} Use a separate HAPPY_HOME_DIR for this relay, or run \`very-happy auth login --force\` before starting an agent or daemon.`
+      );
+    }
+  }
+  if (!credentials) {
+    logger.logger.debug("[AUTH] No credentials found, starting authentication flow...");
+    const authResult = await doAuth();
+    if (!authResult) {
+      throw new Error("Authentication failed or was cancelled");
+    }
+    credentials = authResult;
+    newAuth = true;
+  } else {
+    logger.logger.debug("[AUTH] Using existing credentials");
+  }
+  const decision = decideMachineId({
+    read: await persistence.readSettingsOutcome(),
+    newAuth
+  });
+  if (decision.action === "refuse") {
+    throw new Error(`Cannot establish this machine's identity: ${decision.reason}`);
+  }
+  let machineId;
+  if (decision.action === "reuse") {
+    machineId = decision.machineId;
+  } else {
+    machineId = node_crypto.randomUUID();
+    logger.logger.warn(`[AUTH] Registering a NEW machine id (${decision.reason})`);
+    await persistence.updateSettings(async (s) => ({ ...s, machineId }));
+  }
+  logger.logger.debug(`[AUTH] Machine ID: ${machineId}`);
+  return { credentials, machineId };
+}
+
+exports.authAndSetupMachineIfNeeded = authAndSetupMachineIfNeeded;

package/dist/authRelay-BdYkC1Po.cjs

@@ -0,0 +1,156 @@
+'use strict';
+
+var node_crypto = require('node:crypto');
+var tweetnacl = require('tweetnacl');
+
+function encodeBase64(buffer, variant = "base64") {
+  if (variant === "base64url") {
+    return encodeBase64Url(buffer);
+  }
+  return Buffer.from(buffer).toString("base64");
+}
+function encodeBase64Url(buffer) {
+  return Buffer.from(buffer).toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function decodeBase64(base64, variant = "base64") {
+  if (variant === "base64url") {
+    const base64Standard = base64.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - base64.length % 4) % 4);
+    return new Uint8Array(Buffer.from(base64Standard, "base64"));
+  }
+  return new Uint8Array(Buffer.from(base64, "base64"));
+}
+function getRandomBytes(size) {
+  return new Uint8Array(node_crypto.randomBytes(size));
+}
+function libsodiumPublicKeyFromSecretKey(seed) {
+  const hashedSeed = new Uint8Array(node_crypto.createHash("sha512").update(seed).digest());
+  const secretKey = hashedSeed.slice(0, 32);
+  return new Uint8Array(tweetnacl.box.keyPair.fromSecretKey(secretKey).publicKey);
+}
+function libsodiumEncryptForPublicKey(data, recipientPublicKey) {
+  const ephemeralKeyPair = tweetnacl.box.keyPair();
+  const nonce = getRandomBytes(tweetnacl.box.nonceLength);
+  const encrypted = tweetnacl.box(data, nonce, recipientPublicKey, ephemeralKeyPair.secretKey);
+  const result = new Uint8Array(ephemeralKeyPair.publicKey.length + nonce.length + encrypted.length);
+  result.set(ephemeralKeyPair.publicKey, 0);
+  result.set(nonce, ephemeralKeyPair.publicKey.length);
+  result.set(encrypted, ephemeralKeyPair.publicKey.length + nonce.length);
+  return result;
+}
+function encryptLegacy(data, secret) {
+  const nonce = getRandomBytes(tweetnacl.secretbox.nonceLength);
+  const encrypted = tweetnacl.secretbox(new TextEncoder().encode(JSON.stringify(data)), nonce, secret);
+  const result = new Uint8Array(nonce.length + encrypted.length);
+  result.set(nonce);
+  result.set(encrypted, nonce.length);
+  return result;
+}
+function decryptLegacy(data, secret) {
+  const nonce = data.slice(0, tweetnacl.secretbox.nonceLength);
+  const encrypted = data.slice(tweetnacl.secretbox.nonceLength);
+  const decrypted = tweetnacl.secretbox.open(encrypted, nonce, secret);
+  if (!decrypted) {
+    return null;
+  }
+  return JSON.parse(new TextDecoder().decode(decrypted));
+}
+function decryptBlob(bundle, key) {
+  if (bundle.length < tweetnacl.secretbox.nonceLength + 16) {
+    return null;
+  }
+  const nonce = bundle.slice(0, tweetnacl.secretbox.nonceLength);
+  const ciphertext = bundle.slice(tweetnacl.secretbox.nonceLength);
+  const decrypted = tweetnacl.secretbox.open(ciphertext, nonce, key);
+  if (!decrypted) {
+    return null;
+  }
+  return new Uint8Array(decrypted);
+}
+function encryptWithDataKey(data, dataKey) {
+  const nonce = getRandomBytes(12);
+  const cipher = node_crypto.createCipheriv("aes-256-gcm", dataKey, nonce);
+  const plaintext = new TextEncoder().encode(JSON.stringify(data));
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext),
+    cipher.final()
+  ]);
+  const authTag = cipher.getAuthTag();
+  const bundle = new Uint8Array(12 + encrypted.length + 16 + 1);
+  bundle.set([0], 0);
+  bundle.set(nonce, 1);
+  bundle.set(new Uint8Array(encrypted), 13);
+  bundle.set(new Uint8Array(authTag), 13 + encrypted.length);
+  return bundle;
+}
+function decryptWithDataKey(bundle, dataKey) {
+  if (bundle.length < 1) {
+    return null;
+  }
+  if (bundle[0] !== 0) {
+    return null;
+  }
+  if (bundle.length < 12 + 16 + 1) {
+    return null;
+  }
+  const nonce = bundle.slice(1, 13);
+  const authTag = bundle.slice(bundle.length - 16);
+  const ciphertext = bundle.slice(13, bundle.length - 16);
+  try {
+    const decipher = node_crypto.createDecipheriv("aes-256-gcm", dataKey, nonce);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final()
+    ]);
+    return JSON.parse(new TextDecoder().decode(decrypted));
+  } catch (error) {
+    return null;
+  }
+}
+function encrypt(key, variant, data) {
+  if (variant === "legacy") {
+    return encryptLegacy(data, key);
+  } else {
+    return encryptWithDataKey(data, key);
+  }
+}
+function decrypt(key, variant, data) {
+  if (variant === "legacy") {
+    return decryptLegacy(data, key);
+  } else {
+    return decryptWithDataKey(data, key);
+  }
+}
+
+const DEFAULT_SERVER_URL = "https://veryhappy.dev";
+const LEGACY_CLOUD_SERVER_URL = "https://happy.mereith.com";
+const CLOUD_SERVER_URLS = [DEFAULT_SERVER_URL, LEGACY_CLOUD_SERVER_URL];
+function sameRelay(left, right) {
+  try {
+    return new URL(left).origin === new URL(right).origin;
+  } catch {
+    return left.replace(/\/+$/, "") === right.replace(/\/+$/, "");
+  }
+}
+function credentialRelayProblem(credentialServerUrl, configuredServerUrl) {
+  if (credentialServerUrl) {
+    return sameRelay(credentialServerUrl, configuredServerUrl) ? void 0 : `Credentials belong to ${credentialServerUrl}, but the active relay is ${configuredServerUrl}.`;
+  }
+  if (CLOUD_SERVER_URLS.some((cloudUrl) => sameRelay(configuredServerUrl, cloudUrl))) {
+    return void 0;
+  }
+  return `These credentials predate relay tracking, so they cannot be safely reused with ${configuredServerUrl}.`;
+}
+
+exports.credentialRelayProblem = credentialRelayProblem;
+exports.decodeBase64 = decodeBase64;
+exports.decrypt = decrypt;
+exports.decryptBlob = decryptBlob;
+exports.decryptLegacy = decryptLegacy;
+exports.decryptWithDataKey = decryptWithDataKey;
+exports.encodeBase64 = encodeBase64;
+exports.encodeBase64Url = encodeBase64Url;
+exports.encrypt = encrypt;
+exports.getRandomBytes = getRandomBytes;
+exports.libsodiumEncryptForPublicKey = libsodiumEncryptForPublicKey;
+exports.libsodiumPublicKeyFromSecretKey = libsodiumPublicKeyFromSecretKey;

package/dist/authRelay-DSAvg1uv.mjs

@@ -0,0 +1,143 @@
+import { randomBytes, createCipheriv, createDecipheriv, createHash } from 'node:crypto';
+import tweetnacl from 'tweetnacl';
+
+function encodeBase64(buffer, variant = "base64") {
+  if (variant === "base64url") {
+    return encodeBase64Url(buffer);
+  }
+  return Buffer.from(buffer).toString("base64");
+}
+function encodeBase64Url(buffer) {
+  return Buffer.from(buffer).toString("base64").replaceAll("+", "-").replaceAll("/", "_").replaceAll("=", "");
+}
+function decodeBase64(base64, variant = "base64") {
+  if (variant === "base64url") {
+    const base64Standard = base64.replaceAll("-", "+").replaceAll("_", "/") + "=".repeat((4 - base64.length % 4) % 4);
+    return new Uint8Array(Buffer.from(base64Standard, "base64"));
+  }
+  return new Uint8Array(Buffer.from(base64, "base64"));
+}
+function getRandomBytes(size) {
+  return new Uint8Array(randomBytes(size));
+}
+function libsodiumPublicKeyFromSecretKey(seed) {
+  const hashedSeed = new Uint8Array(createHash("sha512").update(seed).digest());
+  const secretKey = hashedSeed.slice(0, 32);
+  return new Uint8Array(tweetnacl.box.keyPair.fromSecretKey(secretKey).publicKey);
+}
+function libsodiumEncryptForPublicKey(data, recipientPublicKey) {
+  const ephemeralKeyPair = tweetnacl.box.keyPair();
+  const nonce = getRandomBytes(tweetnacl.box.nonceLength);
+  const encrypted = tweetnacl.box(data, nonce, recipientPublicKey, ephemeralKeyPair.secretKey);
+  const result = new Uint8Array(ephemeralKeyPair.publicKey.length + nonce.length + encrypted.length);
+  result.set(ephemeralKeyPair.publicKey, 0);
+  result.set(nonce, ephemeralKeyPair.publicKey.length);
+  result.set(encrypted, ephemeralKeyPair.publicKey.length + nonce.length);
+  return result;
+}
+function encryptLegacy(data, secret) {
+  const nonce = getRandomBytes(tweetnacl.secretbox.nonceLength);
+  const encrypted = tweetnacl.secretbox(new TextEncoder().encode(JSON.stringify(data)), nonce, secret);
+  const result = new Uint8Array(nonce.length + encrypted.length);
+  result.set(nonce);
+  result.set(encrypted, nonce.length);
+  return result;
+}
+function decryptLegacy(data, secret) {
+  const nonce = data.slice(0, tweetnacl.secretbox.nonceLength);
+  const encrypted = data.slice(tweetnacl.secretbox.nonceLength);
+  const decrypted = tweetnacl.secretbox.open(encrypted, nonce, secret);
+  if (!decrypted) {
+    return null;
+  }
+  return JSON.parse(new TextDecoder().decode(decrypted));
+}
+function decryptBlob(bundle, key) {
+  if (bundle.length < tweetnacl.secretbox.nonceLength + 16) {
+    return null;
+  }
+  const nonce = bundle.slice(0, tweetnacl.secretbox.nonceLength);
+  const ciphertext = bundle.slice(tweetnacl.secretbox.nonceLength);
+  const decrypted = tweetnacl.secretbox.open(ciphertext, nonce, key);
+  if (!decrypted) {
+    return null;
+  }
+  return new Uint8Array(decrypted);
+}
+function encryptWithDataKey(data, dataKey) {
+  const nonce = getRandomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", dataKey, nonce);
+  const plaintext = new TextEncoder().encode(JSON.stringify(data));
+  const encrypted = Buffer.concat([
+    cipher.update(plaintext),
+    cipher.final()
+  ]);
+  const authTag = cipher.getAuthTag();
+  const bundle = new Uint8Array(12 + encrypted.length + 16 + 1);
+  bundle.set([0], 0);
+  bundle.set(nonce, 1);
+  bundle.set(new Uint8Array(encrypted), 13);
+  bundle.set(new Uint8Array(authTag), 13 + encrypted.length);
+  return bundle;
+}
+function decryptWithDataKey(bundle, dataKey) {
+  if (bundle.length < 1) {
+    return null;
+  }
+  if (bundle[0] !== 0) {
+    return null;
+  }
+  if (bundle.length < 12 + 16 + 1) {
+    return null;
+  }
+  const nonce = bundle.slice(1, 13);
+  const authTag = bundle.slice(bundle.length - 16);
+  const ciphertext = bundle.slice(13, bundle.length - 16);
+  try {
+    const decipher = createDecipheriv("aes-256-gcm", dataKey, nonce);
+    decipher.setAuthTag(authTag);
+    const decrypted = Buffer.concat([
+      decipher.update(ciphertext),
+      decipher.final()
+    ]);
+    return JSON.parse(new TextDecoder().decode(decrypted));
+  } catch (error) {
+    return null;
+  }
+}
+function encrypt(key, variant, data) {
+  if (variant === "legacy") {
+    return encryptLegacy(data, key);
+  } else {
+    return encryptWithDataKey(data, key);
+  }
+}
+function decrypt(key, variant, data) {
+  if (variant === "legacy") {
+    return decryptLegacy(data, key);
+  } else {
+    return decryptWithDataKey(data, key);
+  }
+}
+
+const DEFAULT_SERVER_URL = "https://veryhappy.dev";
+const LEGACY_CLOUD_SERVER_URL = "https://happy.mereith.com";
+const CLOUD_SERVER_URLS = [DEFAULT_SERVER_URL, LEGACY_CLOUD_SERVER_URL];
+function sameRelay(left, right) {
+  try {
+    return new URL(left).origin === new URL(right).origin;
+  } catch {
+    return left.replace(/\/+$/, "") === right.replace(/\/+$/, "");
+  }
+}
+function credentialRelayProblem(credentialServerUrl, configuredServerUrl) {
+  if (credentialServerUrl) {
+    return sameRelay(credentialServerUrl, configuredServerUrl) ? void 0 : `Credentials belong to ${credentialServerUrl}, but the active relay is ${configuredServerUrl}.`;
+  }
+  if (CLOUD_SERVER_URLS.some((cloudUrl) => sameRelay(configuredServerUrl, cloudUrl))) {
+    return void 0;
+  }
+  return `These credentials predate relay tracking, so they cannot be safely reused with ${configuredServerUrl}.`;
+}
+
+export { decryptWithDataKey as a, decryptLegacy as b, credentialRelayProblem as c, decodeBase64 as d, encodeBase64 as e, encodeBase64Url as f, encrypt as g, decrypt as h, decryptBlob as i, libsodiumPublicKeyFromSecretKey as j, getRandomBytes as k, libsodiumEncryptForPublicKey as l };