mirror of
https://github.com/PR0M3TH3AN/SeedPass.git
synced 2026-11-04 03:42:04 +00:00
thePR0M3TH3ANandClaude Opus 5
8653ee8006
L-7 — `put` is the only way a fingerprint enters `held`, and every later handler joins that string onto a path (the vault it opens, the audit log it writes). The CLI validated the format first, which is exactly why the daemon could not rely on it: agent.ts's own header says the CLI is untrusted, and the browser extension speaks this protocol next. `put` now requires 16 uppercase hex, and additionally that the fingerprint actually belongs to the supplied seed — a mismatch would unlock a vault the caller did not name and file its audit records under the wrong profile. Validation order matters and is now deliberate: cheap format check, then ttl, then the seed match last, because deriving a fingerprint runs the BIP-39 KDF and a malformed ttl should not pay for it. This keeps the existing non-numeric-ttl test exercising the ttl path rather than short-circuiting on the new check. L-5 — `label_regex` is unanchored, so a token issued for `prod` also reaches `not-prod-db`. Left as-is on purpose: Python matches with `re.search`, so anchoring the TypeScript side alone would make one token mean two different things depending on which implementation holds it, and would silently narrow every token already issued. The audit asked for whichever behavior Python has, documented and in the parity matrix — so the semantics are now stated in --label-regex help, reported machine-readably as capabilities().tokens.label_regex_semantics, explained at the enforcement point, recorded in the compatibility matrix, and pinned by tests that assert BOTH labels are visible to an unanchored token. L-6 — the exec allowlist constrains the command word, never its arguments. The token holder writes the argv and the child gets the secret in its environment, so an allowlisted binary with an output-file or network flag hands the secret straight back. Documented in the same three places rather than changed: argument-level containment means allowlisting full argv templates instead of command words, which is a token-format change that has to land in both implementations together. Tests: malformed and mismatched fingerprints refused with nothing held (path traversal, wrong case, wrong length, trailing component); unanchored vs anchored label_regex; capabilities reporting both semantics. Mutation-verified — disabling either put guard turns the matching tests red. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN
95 lines
4.1 KiB
TypeScript
95 lines
4.1 KiB
TypeScript
/**
|
|
* Machine-readable capability map (`seedpass-js capabilities --format json`).
|
|
* Mirrors the intent of the Python `seedpass capabilities` surface: automation
|
|
* discovers what this build can do instead of guessing from the version.
|
|
*/
|
|
|
|
export function capabilities(): Record<string, unknown> {
|
|
return {
|
|
name: "seedpass-js",
|
|
port: "typescript",
|
|
protocol: {
|
|
password_gen_versions: [1, 2],
|
|
vault_payload_formats: ["V3", "V2", "fernet"],
|
|
entry_schema_version: 4,
|
|
portable_backup_format: 1,
|
|
nostr_event_kinds: { manifest: 30070, snapshot_chunk: 30071, delta: 30072 },
|
|
},
|
|
interactive: {
|
|
command: "seedpass-js (no subcommand, on a terminal)",
|
|
model: "numbered menus mirroring Python's legacy (v1) TUI; blank input goes back",
|
|
secrets: "metadata only; 'S' shows and 'C' copies, and Secret Mode routes both to the clipboard",
|
|
non_tty: "prints help",
|
|
},
|
|
agent_surface: {
|
|
reference_scheme: "sp://entry/<id>",
|
|
reference_first_output: true,
|
|
plaintext_egress_commands: [
|
|
"entry reveal",
|
|
"entry totp-codes",
|
|
"util generate-password",
|
|
],
|
|
sinks: ["clipboard", "exec-env", "stdin-to"],
|
|
exec_env_var: "SEEDPASS_SECRET",
|
|
session_agent: {
|
|
transport: "unix-socket",
|
|
commands: ["agent start/status/stop", "vault unlock/lock"],
|
|
seed_resolution_order: ["SEEDPASS_MNEMONIC env", "session agent"],
|
|
},
|
|
},
|
|
profiles: {
|
|
layout: "python-compatible ~/.seedpass",
|
|
commands: [
|
|
"fingerprint list/create/add/switch/remove",
|
|
"config get/set",
|
|
],
|
|
seed_generation: {
|
|
command: "fingerprint create",
|
|
word_counts: [12, 24],
|
|
entropy: "32 bytes from the OS CSPRNG, via BIP-85 app 39 index 0",
|
|
egress:
|
|
"the new phrase goes to --out <0600 file>, --show, or an interactive " +
|
|
"terminal; with none of those the command refuses rather than writing " +
|
|
"the seed into a pipe",
|
|
},
|
|
},
|
|
tokens: {
|
|
commands: ["agent token-issue/token-list/token-revoke"],
|
|
scopes: ["read", "use", "reveal"],
|
|
constraints: ["kinds", "label_regex", "ttl", "uses", "exec_allowlist"],
|
|
// Automation issuing tokens has to know this to scope them correctly:
|
|
// label_regex is a SEARCH, not a full match, in both implementations
|
|
// (Python uses re.search). `prod` therefore also matches `not-prod-db`.
|
|
// Anchor it yourself -- `^prod$` -- to get an exact match.
|
|
label_regex_semantics: "search (substring); anchor with ^...$ for exact match",
|
|
// Automation that issues `use` tokens needs this to pick allowlist
|
|
// entries safely: the check covers the command word, not its arguments.
|
|
exec_allowlist_semantics:
|
|
"command word only; the token holder supplies all arguments, so an " +
|
|
"allowlisted binary that can write a file or open a socket can " +
|
|
"return the secret to its caller",
|
|
token_env_var: "SEEDPASS_TOKEN",
|
|
enforcement: "session agent (secrets materialized agent-side in token mode)",
|
|
escalation:
|
|
"token mode refuses owner operations, but this is a same-uid process " +
|
|
"boundary: a token holder that can read the owner capability file can " +
|
|
"still escalate. See docs/agent_security_model.md.",
|
|
},
|
|
audit: {
|
|
commands: ["agent audit-verify", "agent audit-tail"],
|
|
chain: "HMAC-SHA256(prev_sig + canonical_payload), keyed by KEY_INDEX",
|
|
},
|
|
// Automation branches on this list, so it has to describe this build
|
|
// rather than an earlier one. SSH and ed25519 PGP entries are at
|
|
// byte-for-byte parity with Python and were wrongly listed here.
|
|
not_yet_ported: [
|
|
"pgp RSA keys (ed25519 is supported; RSA generation is not reproducible)",
|
|
"index0/atlas",
|
|
"approval gates and high-risk partitions",
|
|
"semantic (vector search) and api (FastAPI server) command groups",
|
|
"Python's v2/v3 TUIs (interactive mode follows the legacy v1 menus)",
|
|
"QR code display in the TUI (no QR encoder in this build)",
|
|
],
|
|
};
|
|
}
|