Merge pull request 'rofi: node-launcher's hidden prompt, answered sealed to the asker (hq ADR 0259 §10)' (#135) from feat/a-secret-given-at-the-desk into main

modules/rofi/README.md

@@ -4,6 +4,15 @@ The launcher as a module (novox/hq ADR 0208, research 026/04 and 05).
 
 - Installs `rofi`, claims the mesh's `node-launcher` seat and serves its verb `menu`. Requires
   `x11-display` on its own machine.
+- **A value nobody sees** (`node-launcher.secret`, novox/hq ADR 0259 §10): a prompt that shows nothing of
+  what is typed (`rofi -dmenu -password`), whose answer is sealed to the key the asker gives before it
+  leaves this process — never in the clear on the bus, in the runtime's log or in a call's record. The
+  controller's `give` asks it to take a module's own secret, such as a bot token, at the desk. It waits at
+  most 25 seconds. **The prompt is written here** from the module, the secret and the machine — names, checked
+  as names — and says the mesh's controller asks: the bus denies the verb to every principal but the
+  controller, however wide its grant. A caller's own words (`prompt`, `message`) are refused. On X11 any
+  program of the operator's account can still read the keys as they are typed (ADR 0234's accepted residual
+  risk), so the operator types only into a prompt they started with `give`.
 - **The seat's dmenu-compatible command.** It places `~/.local/bin/dmenu`: choices on standard input,
   the chosen one on standard output, exit 1 when nothing was chosen. It runs `rofi -dmenu`, passing
   on dmenu's `-p`, `-l` and `-i` and dropping its look options. A script, a notifier or a clipboard

modules/rofi/cmd/rofi-tools/main.go

@@ -43,6 +43,32 @@ func tools() []stdio.Tool {
 				return Menu(q)
 			},
 		},
+		{
+			Name: "node-launcher.secret",
+			Description: fmt.Sprintf("Ask the operator for a value in a prompt that shows nothing of what is typed, "+
+				"and answer it sealed to the key seal_to names — never in the clear (novox/hq ADR 0259 §10): how the "+
+				"mesh takes a module's own secret at the desk. The prompt is written here from the names, and says the "+
+				"mesh's controller asks: the bus lets nobody else ask it. Answers sealed, or cancelled when the prompt was "+
+				"dismissed, answered empty or not answered within timeout_seconds (default and at most %d).", menuMost),
+			Input: map[string]any{
+				"type": "object",
+				"properties": map[string]any{
+					"module":          map[string]any{"type": "string", "description": "the module whose own secret is asked for"},
+					"secret":          map[string]any{"type": "string", "description": "the own secret's name"},
+					"node":            map[string]any{"type": "string", "description": "the machine the module runs on"},
+					"seal_to":         map[string]any{"type": "string", "description": "the asker's public sealing key, base64: the answer is sealed to it"},
+					"timeout_seconds": map[string]any{"type": "integer", "description": fmt.Sprintf("give up after this long (at most %d)", menuMost)},
+				},
+				"required": []string{"module", "secret", "node", "seal_to"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				q, err := secretQuestion(args)
+				if err != nil {
+					return nil, err
+				}
+				return Secret(q)
+			},
+		},
 		{
 			Name: "rofi_applications",
 			Description: "The desktop applications the launcher offers on this machine, from every desktop entry " +

modules/rofi/cmd/rofi-tools/manifest_test.go

@@ -16,7 +16,7 @@ func TestItClaimsTheLauncherSeatServingMenuAndRequiresTheXDisplay(t *testing.T)
 	if m.Module != "rofi" || m.Seats != nil {
 		t.Fatalf("module %q declares seats %v", m.Module, m.Seats)
 	}
-	if !reflect.DeepEqual(m.Claims, []claim{{Name: "node-launcher", Scope: "node", Serves: []string{"menu"}}}) {
+	if !reflect.DeepEqual(m.Claims, []claim{{Name: "node-launcher", Scope: "node", Serves: []string{"menu", "secret"}}}) {
 		t.Fatalf("claims: %+v", m.Claims)
 	}
 	if !reflect.DeepEqual(m.Requires, []string{"x11-display"}) {

modules/rofi/cmd/rofi-tools/secret.go

@@ -0,0 +1,121 @@
+package main
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+	"time"
+
+	"golang.org/x/crypto/nacl/box"
+)
+
+// node-launcher's verb `secret` (novox/hq ADR 0259 §10): a prompt that does not show what is typed, whose
+// answer is sealed to the key the asker gives before it leaves this process — never in the clear on the
+// bus, in the runtime's log or in any call's record. The controller asks it to take a module's own secret,
+// such as a bot token, from the operator at their desk.
+//
+// **What it does not do**: on an X11 desk any program of the operator's account can read the keys as they
+// are typed, and a program that asks this verb with a key of its own is answered with what the operator
+// typed into a prompt they did not ask for. The bus lets only the controller ask this verb, and the prompt,
+// written here from names, says so and for what, so the operator types only into one they started with give
+// (ADR 0234's accepted residual risk is what remains: a program drawing a window of its own).
+
+// SecretQuestion is what node-launcher.secret asks.
+type SecretQuestion struct {
+	Prompt  string
+	Message string
+	SealTo  [32]byte
+	Timeout time.Duration
+}
+
+// SecretAnswer is what node-launcher.secret answers: the value sealed, or why there is none. Never the value.
+type SecretAnswer struct {
+	Sealed    string `json:"sealed,omitempty"`
+	Cancelled bool   `json:"cancelled"`
+	TimedOut  bool   `json:"timed_out,omitempty"`
+}
+
+// aName is a module's, a secret's or a machine's name as the mesh writes them: nothing else reaches the prompt.
+var aName = regexp.MustCompile(`^[a-z0-9][a-z0-9-]{0,62}$`)
+
+// secretQuestion reads the call. The prompt is this holder's words, written from the module, the secret and the
+// machine (the review of 2026-10-09, M4): it says the mesh's controller asks, which the bus makes true — it
+// denies these subjects to every principal but the controller — and a caller's own words are refused, so
+// nobody puts a prompt of its choosing before the operator.
+func secretQuestion(args map[string]any) (SecretQuestion, error) {
+	var q SecretQuestion
+	for _, free := range []string{"prompt", "message"} {
+		if _, there := args[free]; there {
+			return q, fmt.Errorf("%s is not taken: the prompt is written here from module, secret and node", free)
+		}
+	}
+	names := map[string]string{}
+	for _, key := range []string{"module", "secret", "node"} {
+		v, err := text(args, key, true)
+		if err != nil {
+			return q, err
+		}
+		if !aName.MatchString(v) {
+			return q, fmt.Errorf("%s %q is not a name the mesh writes", key, v)
+		}
+		names[key] = v
+	}
+	q.Prompt = names["secret"] + " for " + names["module"]
+	q.Message = fmt.Sprintf("The mesh's controller asks for %s, the own secret of %s on %s. What you type is not "+
+		"shown, and is sealed before it leaves this machine. Type it only if you started this with give.",
+		names["secret"], names["module"], names["node"])
+	key, err := text(args, "seal_to", true)
+	if err != nil {
+		return q, err
+	}
+	raw, err := base64.StdEncoding.DecodeString(strings.TrimSpace(key))
+	if err != nil || len(raw) != 32 {
+		return q, errors.New("seal_to is not a sealing key: 32 bytes, base64")
+	}
+	copy(q.SealTo[:], raw)
+	q.Timeout, err = seconds(args, "timeout_seconds", menuMost, menuMost)
+	return q, err
+}
+
+// Secret asks the operator in a prompt that shows nothing of what is typed, and seals the answer.
+func Secret(q SecretQuestion) (SecretAnswer, error) {
+	s, err := findSession()
+	if err != nil {
+		return SecretAnswer{}, err
+	}
+	args := []string{"-dmenu", "-password", "-p", q.Prompt, "-theme-str", "listview { enabled: false; }"}
+	if q.Message != "" {
+		args = append(args, "-mesg", q.Message)
+	}
+	r, err := s.run(q.Timeout, "", "rofi", args...)
+	if errors.Is(err, ErrTimedOut) {
+		return SecretAnswer{Cancelled: true, TimedOut: true}, nil
+	}
+	if err != nil {
+		return SecretAnswer{}, err
+	}
+	switch r.Code {
+	case 0:
+	case 1:
+		return SecretAnswer{Cancelled: true}, nil
+	default:
+		// rofi's own words, never what was typed: that is on standard output, which is not said.
+		return SecretAnswer{}, fmt.Errorf("rofi exited %d: %s", r.Code, strings.TrimSpace(r.Stderr))
+	}
+	value := []byte(strings.TrimRight(r.Stdout, "\r\n"))
+	r.Stdout = ""
+	if len(value) == 0 {
+		return SecretAnswer{Cancelled: true}, nil
+	}
+	sealed, err := box.SealAnonymous(nil, value, &q.SealTo, rand.Reader)
+	for i := range value {
+		value[i] = 0
+	}
+	if err != nil {
+		return SecretAnswer{}, errors.New("what was typed could not be sealed; nothing is answered")
+	}
+	return SecretAnswer{Sealed: base64.StdEncoding.EncodeToString(sealed)}, nil
+}

modules/rofi/cmd/rofi-tools/secret_test.go

@@ -0,0 +1,130 @@
+package main
+
+import (
+	"crypto/rand"
+	"encoding/base64"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"golang.org/x/crypto/nacl/box"
+)
+
+const typedValue = "123456789:AAEhBP0av28P4XFQnIuR-o-7Xnz1kkUzW3g"
+
+func aKey(t *testing.T) (string, *[32]byte, *[32]byte) {
+	t.Helper()
+	pub, priv, err := box.GenerateKey(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	return base64.StdEncoding.EncodeToString(pub[:]), pub, priv
+}
+
+// novox/hq ADR 0259 §10: what the operator types in the hidden prompt is answered sealed to the asker's
+// key, and never in the clear — not in the answer, not in an error.
+func TestWhatIsTypedIsAnsweredSealedToTheAskersKeyAndNeverInTheClear(t *testing.T) {
+	withSession(t)
+	bin := fakeBinaries(t, map[string]string{"rofi": `echo "$*" > "$LOG"; echo "` + typedValue + `"`})
+	t.Setenv("LOG", filepath.Join(bin, "log"))
+	key, pub, priv := aKey(t)
+	q, err := secretQuestion(map[string]any{"module": "telegram", "secret": "telegram-token", "node": "anchor", "seal_to": key})
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, err := Secret(q)
+	if err != nil || got.Cancelled || got.Sealed == "" {
+		t.Fatalf("%+v %v", got, err)
+	}
+	raw, _ := json.Marshal(got)
+	if strings.Contains(string(raw), typedValue) || strings.Contains(string(raw), "AAEhBP0") {
+		t.Fatal("the answer carries what was typed in the clear")
+	}
+	blob, _ := base64.StdEncoding.DecodeString(got.Sealed)
+	opened, ok := box.OpenAnonymous(nil, blob, pub, priv)
+	if !ok || string(opened) != typedValue {
+		t.Fatalf("the answer does not open to what was typed, its line ending taken off")
+	}
+	asked, _ := os.ReadFile(filepath.Join(bin, "log"))
+	for _, want := range []string{"-dmenu", "-password", "-p telegram-token for telegram",
+		"-mesg The mesh's controller asks for telegram-token, the own secret of telegram on anchor"} {
+		if !strings.Contains(string(asked), want) {
+			t.Errorf("rofi was not asked %q: %s", want, asked)
+		}
+	}
+	if strings.Contains(string(asked), "-no-custom") {
+		t.Error("the prompt takes no typed answer")
+	}
+}
+
+func TestADismissedEmptyOrLatePromptIsACancelAndAFailureNeverSaysTheValue(t *testing.T) {
+	withSession(t)
+	key, _, _ := aKey(t)
+	q, _ := secretQuestion(map[string]any{"module": "telegram", "secret": "telegram-token", "node": "anchor", "seal_to": key, "timeout_seconds": 1})
+	for script, timedOut := range map[string]bool{`exit 1`: false, `echo ""`: false, `sleep 30`: true} {
+		fakeBinaries(t, map[string]string{"rofi": script})
+		got, err := Secret(q)
+		if err != nil || !got.Cancelled || got.TimedOut != timedOut || got.Sealed != "" {
+			t.Errorf("%s: %+v %v", script, got, err)
+		}
+	}
+	fakeBinaries(t, map[string]string{"rofi": `echo "` + typedValue + `"; echo "rofi broke" >&2; exit 3`})
+	if _, err := Secret(q); err == nil || strings.Contains(err.Error(), typedValue) || !strings.Contains(err.Error(), "rofi broke") {
+		t.Errorf("a failure said %v", err)
+	}
+}
+
+func TestASecretIsAskedOnlyWithAKeyToSealItTo(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString(make([]byte, 32))
+	named := func(extra map[string]any) map[string]any {
+		a := map[string]any{"module": "telegram", "secret": "telegram-token", "node": "anchor"}
+		for k, v := range extra {
+			a[k] = v
+		}
+		return a
+	}
+	for _, args := range []map[string]any{
+		named(nil),
+		named(map[string]any{"seal_to": "not a key"}),
+		named(map[string]any{"seal_to": base64.StdEncoding.EncodeToString([]byte("short"))}),
+		named(map[string]any{"seal_to": key, "timeout_seconds": 60}),
+		{"seal_to": key},
+	} {
+		if _, err := secretQuestion(args); err == nil {
+			t.Errorf("%v was taken", args)
+		}
+	}
+}
+
+// The prompt is this holder's words from names, never the caller's (the review of 2026-10-09, M4): it says the
+// mesh's controller asks — the bus lets nobody else ask it — and for which secret of which module on which
+// machine; words of the caller's, and a name that is not one, are refused.
+func TestThePromptIsWrittenHereFromNamesAndSaysTheControllerAsks(t *testing.T) {
+	key := base64.StdEncoding.EncodeToString(make([]byte, 32))
+	base := map[string]any{"module": "telegram", "secret": "telegram-token", "node": "anchor", "seal_to": key}
+	q, err := secretQuestion(base)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if q.Prompt != "telegram-token for telegram" || !strings.HasPrefix(q.Message, "The mesh's controller asks for telegram-token") {
+		t.Errorf("prompt %q, message %q", q.Prompt, q.Message)
+	}
+	for key, value := range map[string]any{
+		"prompt":  "Your bank's PIN",
+		"message": "Your bank asks",
+		"module":  "telegram\nYour bank asks",
+		"secret":  "a token",
+		"node":    "<b>anchor</b>",
+	} {
+		args := map[string]any{}
+		for k, v := range base {
+			args[k] = v
+		}
+		args[key] = value
+		if _, err := secretQuestion(args); err == nil {
+			t.Errorf("%s=%q was taken", key, value)
+		}
+	}
+}

modules/rofi/go.mod

@@ -3,3 +3,8 @@ module rofi
 go 1.22
 
 require git.novox.be/novox/mesh-sdk/go v0.1.7
+
+require (
+	golang.org/x/crypto v0.31.0
+	golang.org/x/sys v0.28.0 // indirect
+)

modules/rofi/go.sum

@@ -1,2 +1,6 @@
 git.novox.be/novox/mesh-sdk/go v0.1.7 h1:C0sTQmtTiyYH7bnqZb7PusXnqA37gKuT7Nqjn9gG47w=
 git.novox.be/novox/mesh-sdk/go v0.1.7/go.mod h1:GFuZUElBZ9A++mxgIKo97aXXo+kV0uJ/UkbhQPPIbrY=
+golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
+golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
+golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
+golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=

modules/rofi/module.json

@@ -12,7 +12,8 @@
       "name": "node-launcher",
       "scope": "node",
       "serves": [
-        "menu"
+        "menu",
+        "secret"
       ]
     }
   ],