Remove `oa identity`

Diff

10 files changed, +0 -1931

source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"

[[package]]
name = "base16ct"
version = "0.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"

[[package]]
name = "base64"
version = "0.22.1"

 "syn 2.0.117",
]

[[package]]
name = "bip32"
version = "0.5.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "db40d3dfbeab4e031d78c844642fa0caa0b0db11ce1607ac9d2986dff1405c69"
dependencies = [
 "bs58",
 "hmac",
 "k256",
 "once_cell",
 "pbkdf2",
 "rand_core 0.6.4",
 "ripemd",
 "secp256k1",
 "sha2",
 "subtle",
 "zeroize",
]

[[package]]
name = "bip39"
version = "2.2.2"

 "generic-array",
]

[[package]]
name = "bs58"
version = "0.5.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"
dependencies = [
 "sha2",
 "tinyvec",
]

[[package]]
name = "bumpalo"
version = "3.20.3"

 "static_assertions",
]

[[package]]
name = "const-oid"
version = "0.9.6"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"

[[package]]
name = "core-foundation"
version = "0.10.1"

 "winapi",
]

[[package]]
name = "crypto-bigint"
version = "0.5.5"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"
dependencies = [
 "generic-array",
 "rand_core 0.6.4",
 "subtle",
 "zeroize",
]

[[package]]
name = "crypto-common"
version = "0.1.7"

source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"

[[package]]
name = "der"
version = "0.7.10"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"
dependencies = [
 "const-oid",
 "zeroize",
]

[[package]]
name = "deranged"
version = "0.5.8"

checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
dependencies = [
 "block-buffer",
 "const-oid",
 "crypto-common",
 "subtle",
]

[[package]]

source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"

[[package]]
name = "ecdsa"
version = "0.16.9"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"
dependencies = [
 "der",
 "digest",
 "elliptic-curve",
 "rfc6979",
 "signature",
]

[[package]]
name = "either"
version = "1.16.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"

[[package]]
name = "elliptic-curve"
version = "0.13.8"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"
dependencies = [
 "base16ct",
 "crypto-bigint",
 "digest",
 "ff",
 "generic-array",
 "group",
 "rand_core 0.6.4",
 "sec1",
 "subtle",
 "zeroize",
]

[[package]]
name = "embedded-io"
version = "0.4.0"

source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"

[[package]]
name = "ff"
version = "0.13.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"
dependencies = [
 "rand_core 0.6.4",
 "subtle",
]

[[package]]
name = "filedescriptor"
version = "0.8.3"

dependencies = [
 "typenum",
 "version_check",
 "zeroize",
]

[[package]]

source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"

[[package]]
name = "group"
version = "0.13.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"
dependencies = [
 "ff",
 "rand_core 0.6.4",
 "subtle",
]

[[package]]
name = "hashbrown"
version = "0.15.5"

 "arrayvec",
]

[[package]]
name = "hmac"
version = "0.12.1"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"
dependencies = [
 "digest",
]

[[package]]
name = "html-escape"
version = "0.2.15"

 "wasm-bindgen",
]

[[package]]
name = "k256"
version = "0.13.4"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"
dependencies = [
 "cfg-if",
 "ecdsa",
 "elliptic-curve",
 "sha2",
]

[[package]]
name = "lazy_static"
version = "1.5.0"

dependencies = [
 "async-trait",
 "bech32",
 "bip32",
 "bip39",
 "bs58",
 "clap",
 "clap_complete",
 "crossterm",

 "regex",
 "reqwest",
 "ring",
 "ripemd",
 "rustls",
 "serde",
 "serde_json",

source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"

[[package]]
name = "pbkdf2"
version = "0.12.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"
dependencies = [
 "digest",
 "hmac",
]

[[package]]
name = "percent-encoding"
version = "2.3.2"

 "webpki-roots",
]

[[package]]
name = "rfc6979"
version = "0.4.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"
dependencies = [
 "hmac",
 "subtle",
]

[[package]]
name = "ring"
version = "0.17.14"

 "windows-sys 0.52.0",
]

[[package]]
name = "ripemd"
version = "0.1.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"
dependencies = [
 "digest",
]

[[package]]
name = "rustc-hash"
version = "2.1.2"

source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"

[[package]]
name = "sec1"
version = "0.7.3"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"
dependencies = [
 "base16ct",
 "der",
 "generic-array",
 "subtle",
 "zeroize",
]

[[package]]
name = "secp256k1"
version = "0.27.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "25996b82292a7a57ed3508f052cfff8640d38d32018784acd714758b43da9c8f"
dependencies = [
 "secp256k1-sys",
]

[[package]]
name = "secp256k1-sys"
version = "0.8.2"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "4473013577ec77b4ee3668179ef1186df3146e2cf2d927bd200974c6fe60fd99"
dependencies = [
 "cc",
]

[[package]]
name = "security-framework"
version = "3.7.0"

 "libc",
]

[[package]]
name = "signature"
version = "2.2.0"
source = "registry+https://github.com/rust-lang/crates.io-index"
checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"
dependencies = [
 "digest",
 "rand_core 0.6.4",
]

[[package]]
name = "simd-adler32"
version = "0.3.10"

unicode-width = "0.2"
unicode-segmentation = "1"
bip39 = { version = "2", features = ["rand"] }
bip32 = "0.5"
bech32 = "0.11"
ripemd = "0.1"
bs58 = { version = "0.5", features = ["check"] }
regex = "1"
zeroize = "1"
# `oa computer up` speaks the Phoenix controller socket. The same pair the

        // unconditionally.
        #[cfg(unix)]
        {
            use std::os::unix::process::CommandExt;
            command.process_group(0);
        }
        if let Some(environment) = &self.env {

pub enum Commands {
    /// Authentication management
    Auth(AuthArgs),
    /// Agent and human identity operations
    Identity(IdentityArgs),
    /// OpenAgents issue tracker operations
    Issue(IssueArgs),
    /// OpenAgents project management

    },
}

#[derive(Args, Debug)]
pub struct IdentityArgs {
    #[command(subcommand)]
    pub action: IdentityAction,
}

#[derive(Subcommand, Debug)]
pub enum IdentityAction {
    /// Show the public identity derived from the stored seed, and what protects it
    Show,
    /// Generate a new seed phrase and store it encrypted under the OS keychain
    Create {
        #[arg(long, default_value_t = 12, help = "Words in the new seed phrase: 12 for 128 bits, 24 for 256")]
        words: usize,
        #[arg(long, help = "Replace the stored seed. The identity and wallet it derives are lost")]
        force: bool,
    },
    /// Restore an existing seed phrase, read from standard input
    Import {
        #[arg(long, help = "Replace the stored seed. The identity and wallet it derives are lost")]
        force: bool,
    },
    /// Print the stored seed phrase
    Backup,
    /// Delete the stored seed
    Forget {
        #[arg(long, help = "Confirm that the identity and wallet are to be destroyed")]
        force: bool,
    },
}

#[derive(Args, Debug)]
pub struct IssueArgs {
    #[command(subcommand)]


    match command {
        Commands::Auth(auth) => run_auth(auth.action, &endpoint, &cred_store, cli.json).await,
        Commands::Identity(identity) => run_identity(identity.action, cli.json),
        Commands::Issue(issue) => run_issue(issue.action, &api_base, token, cli.json).await,
        Commands::Project(project) => {
            run_project(project.action, &api_base, token, cli.json).await

/// encrypted or is readable text is not something a person can infer from the
/// path, and the plaintext fallback is only honest if the surface that shows an
/// identity says so every time.
fn print_identity(
    identity: &crate::identity::SeedIdentity,
    protection: crate::identity::SeedProtection,
    seed_path: &std::path::Path,
    json: bool,
) {
    if json {
        let value = serde_json::json!({
            "schema": "openagents.cli_identity.v1",
            "profile": identity.profile,
            "npub": identity.npub,
            "nostr_public_key": identity.nostr_public_key_hex,
            "nostr_derivation_path": identity.nostr_derivation_path,
            "wallet_address": identity.wallet_address,
            "wallet_public_key": identity.wallet_public_key_hex,
            "wallet_fingerprint": identity.wallet_fingerprint_hex,
            "wallet_derivation_path": identity.wallet_derivation_path,
            "spending_rail": serde_json::Value::Null,
            "seed_path": seed_path,
            "seed_protection": protection.id(),
            "seed_encrypted_at_rest": protection.encrypted_at_rest(),
        });
        println!("{}", value);
        return;
    }
    println!("Identity: {}", identity.npub);
    println!("  public key   {}", identity.nostr_public_key_hex);
    println!("  path         {}", identity.nostr_derivation_path);
    println!("Wallet:   {}", identity.wallet_address);
    println!("  public key   {}", identity.wallet_public_key_hex);
    println!("  fingerprint  {}", identity.wallet_fingerprint_hex);
    println!("  path         {}", identity.wallet_derivation_path);
    println!("Profile:  {}", identity.profile);
    println!("{}", protection.describe(seed_path));
}

fn run_identity(action: IdentityAction, json: bool) {
    use crate::identity::{
        derive_seed_identity, generate_seed_phrase, is_valid_seed_phrase, SeedStore,
    };
    let store = SeedStore::new(None);
    let seed_path = store.path();

    let refuse_if_seed_exists = |force: bool| {
        if store.present() && !force {
            fail(&format!(
                "A seed is already stored at {}. Back it up with `oa identity backup` first, \
                 then pass --force to replace it.",
                seed_path.display()
            ));
        }
    };

    // Migrate before reading. A seed written before the CLI could encrypt one is
    // plaintext until something moves it, and the move is the same atomic rename
    // either way, so the first `show` after an upgrade protects it rather than
    // waiting for the next `import`. `forget` and the write paths do not call
    // this: sealing a seed that is about to be deleted or replaced would mint a
    // wrapping key for nothing.
    let protection_in_force = || {
        store
            .protect()
            .unwrap_or_else(|e| fail(&e.to_string()))
            .unwrap_or_else(|| {
                store
                    .available_protection()
                    .unwrap_or_else(|e| fail(&e.to_string()))
            })
    };

    match action {
        IdentityAction::Show => {
            let protection = protection_in_force();
            let identity = store.identity().unwrap_or_else(|e| fail(&e.to_string()));
            print_identity(&identity, protection, &seed_path, json);
        }
        IdentityAction::Create { words, force } => {
            if words != 12 && words != 24 {
                fail("--words must be 12 or 24.");
            }
            refuse_if_seed_exists(force);

            let phrase = generate_seed_phrase(words).unwrap_or_else(|e| fail(&e.to_string()));
            // Derive before storing: a phrase that cannot be derived from must not
            // become the identity on this machine.
            let identity = derive_seed_identity(&phrase).unwrap_or_else(|e| fail(&e.to_string()));
            let (_, stored_protection) = store.store_phrase(&phrase).unwrap_or_else(|e| {
                fail(&format!(
                    "The new seed could not be stored at {}: {}",
                    seed_path.display(),
                    e
                ))
            });

            if !json {
                println!(
                    "Wrote a new {}-word seed to {} (mode 0600).",
                    words,
                    seed_path.display()
                );
                println!(
                    "Back it up now with `oa identity backup`. Nothing else on this machine \
                     can recover it."
                );
            }
            print_identity(&identity, stored_protection, &seed_path, json);
        }
        IdentityAction::Import { force } => {
            refuse_if_seed_exists(force);

            let mut phrase = String::new();
            if std::io::Read::read_to_string(&mut std::io::stdin(), &mut phrase).is_err() {
                fail("No seed phrase was provided on standard input.");
            }
            let phrase = phrase.trim().to_string();
            if phrase.is_empty() {
                fail("No seed phrase was provided on standard input.");
            }
            // The phrase is never echoed back, not even the part that parsed.
            if !is_valid_seed_phrase(&phrase) {
                fail(
                    "That is not a valid English BIP-39 seed phrase. Check the word count \
                     (12, 15, 18, 21, or 24) and the spelling of each word.",
                );
            }
            let identity = derive_seed_identity(&phrase).unwrap_or_else(|e| fail(&e.to_string()));
            let (_, stored_protection) = store.store_phrase(&phrase).unwrap_or_else(|e| {
                fail(&format!(
                    "The seed could not be stored at {}: {}",
                    seed_path.display(),
                    e
                ))
            });

            if !json {
                println!("Stored the seed at {} (mode 0600).", seed_path.display());
            }
            print_identity(&identity, stored_protection, &seed_path, json);
        }
        IdentityAction::Backup => {
            // The one command that prints the secret, and the one that refuses
            // --json: the phrase must not land in machine-collected output.
            if json {
                fail(
                    "`oa identity backup` does not support --json. The seed phrase must not \
                     land in machine-collected output; run it without --json and copy the \
                     phrase yourself.",
                );
            }
            let protection = protection_in_force();
            let phrase = match store.read_phrase() {
                Ok(Some(phrase)) => phrase,
                Ok(None) => fail(&crate::identity::IdentityError::NoSeed.to_string()),
                Err(e) => fail(&e.to_string()),
            };
            println!(
                "This is the only secret on this machine. Anyone holding it holds the \
                 identity and the wallet."
            );
            // The person about to write the phrase down is the one who most
            // needs to know whether the copy they are leaving behind on disk is
            // encrypted or is the phrase itself.
            println!("{}", protection.describe(&seed_path));
            println!("{}", phrase);
        }
        IdentityAction::Forget { force } => {
            if !force {
                fail(&format!(
                    "Deleting {} destroys the identity and the wallet it derives. Back the \
                     phrase up with `oa identity backup`, then pass --force.",
                    seed_path.display()
                ));
            }
            let removed = store.forget().unwrap_or_else(|e| {
                fail(&format!(
                    "The seed at {} could not be removed: {}",
                    seed_path.display(),
                    e
                ))
            });
            if json {
                println!(
                    "{}",
                    serde_json::json!({
                        "schema": "openagents.cli_identity_forget.v1",
                        "removed": removed,
                        "seed_path": seed_path,
                    })
                );
            } else if removed {
                println!("Removed {}.", seed_path.display());
            } else {
                println!("No seed was stored at {}.", seed_path.display());
            }
        }
    }
}

// ---------------------------------------------------------------------------
// trace

    // started. `process_group` is a Unix extension and is absent on Windows.
    #[cfg(unix)]
    {
        use std::os::unix::process::CommandExt;
        spawn.process_group(0);
    }
    let mut child = match spawn.spawn() {

//! Cryptographic identity: one BIP-39 seed, one Nostr identity, one wallet branch.
//!
//! This is the Rust port of `packages/openagents-cli/src/seed-identity.ts`, and the
//! TypeScript module is the contract. The derivation profile
//! (`openagents.legacy_unified_nostr_spark.v1`), the NIP-06 path, the wallet path,
//! the English word list, and the empty BIP-39 passphrase all come from there. An
//! identity that differs between the two CLIs is a different account, so
//! `tests/identity_test.rs` pins the derivation against shared vectors: change the
//! derivation and the build fails rather than silently reissuing every `npub`.
//!
//! SECRETS. The mnemonic is returned from exactly one function,
//! [`SeedStore::read_phrase`], and derived from in memory. [`SeedIdentity`] carries
//! public identifiers only and is safe to print. No `nsec` and no private key is
//! ever written to disk or returned by `show`.
//!
//! AT REST. The seed file is `0600` inside a `0700` directory, and on a machine
//! with an OS keychain it holds ciphertext rather than the phrase: a 32-byte
//! ChaCha20-Poly1305 wrapping key lives in the keychain under service
//! `openagents-cli-identity`, and the file holds only the sealed envelope. That is
//! what stops the threats permissions never did — a backup tool, a sync client, an
//! agent with read access to `$HOME`, or a stolen unlocked disk image.
//!
//! Where there is no keychain — CI, a container, an unattended agent host — the
//! phrase is written as plaintext at `0600`, exactly as before, and [`SeedStore`]
//! reports [`SeedProtection::PlaintextFile`] so every surface that shows an identity
//! can say so. A silent fall back to plaintext would be worse than no encryption at
//! all, because it would read as protection that is not there. The key never goes in
//! the file, so the phrase exists in exactly one place either way.

use bech32::{Bech32, Hrp};
use bip32::{DerivationPath, XPrv};
use bip39::{Language, Mnemonic};
use ring::aead::{Aad, LessSafeKey, Nonce, UnboundKey, CHACHA20_POLY1305, NONCE_LEN};
use ring::rand::{SecureRandom, SystemRandom};
use ripemd::Ripemd160;
use serde::{Deserialize, Serialize};
use sha2::{Digest, Sha256};
use std::fmt;
use std::fs;
use std::io::Write;
use std::path::{Path, PathBuf};
use std::process::{Command, Stdio};
use std::str::FromStr;
use std::sync::Mutex;
use zeroize::Zeroize;

/// The frozen shared-root profile both the CLI and Pylon derive under.
pub const DERIVATION_PROFILE_ID: &str = "openagents.legacy_unified_nostr_spark.v1";

/// Nostr identity path: NIP-06 account zero.
pub const NOSTR_DERIVATION_PATH: &str = "m/44'/1237'/0'/0/0";

/// Wallet path: BIP-44 Bitcoin account zero, first external key.
pub const WALLET_DERIVATION_PATH: &str = "m/44'/0'/0'/0/0";

/// The frozen BIP-39 passphrase. It is empty, and a non-empty one produces a
/// different identity, so it is a constant here rather than an option.
const BIP39_PASSPHRASE: &str = "";

/// Mainnet pay-to-public-key-hash version byte, the standard BIP-44 pairing.
const P2PKH_VERSION: u8 = 0x00;

/// Every way identity work fails. No variant carries secret material.
#[derive(Debug)]
pub enum IdentityError {
    /// The phrase is not a valid English BIP-39 mnemonic. Never quotes the phrase.
    InvalidPhrase,
    /// No seed is stored, and the command needs one.
    NoSeed,
    /// A seed is already stored and the command would have overwritten it.
    SeedExists(PathBuf),
    /// Key derivation failed underneath us.
    Derivation(String),
    /// This machine has no OS keychain to hold a wrapping key. Not a failure on
    /// its own: it selects the plaintext store, and the caller must say so.
    NoKeychain,
    /// The keychain is here but would not answer, or answered with a record that
    /// is not a wrapping key. Never a reason to mint a second key: that would
    /// orphan the sealed seed the first one opens.
    Keychain(String),
    /// The seed on disk is sealed and the keychain holds no key for it.
    SealedWithoutKey(PathBuf),
    /// The seed on disk is sealed and the key present does not open it.
    Undecryptable(PathBuf),
    Io(std::io::Error),
}

impl fmt::Display for IdentityError {
    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
        match self {
            Self::InvalidPhrase => {
                write!(f, "The seed phrase is not a valid English BIP-39 mnemonic.")
            }
            Self::NoSeed => write!(
                f,
                "No seed is stored. Run `oa identity create` to make one, or \
                 `oa identity import` to restore an existing seed phrase."
            ),
            Self::SeedExists(path) => write!(
                f,
                "A seed is already stored at {}. Run `oa identity forget --force` first \
                 if you mean to replace it.",
                path.display()
            ),
            Self::Derivation(why) => write!(f, "Key derivation failed: {}", why),
            Self::NoKeychain => write!(
                f,
                "This machine has no OS keychain, so there is nowhere to hold a key."
            ),
            Self::Keychain(why) => write!(f, "The OS keychain could not be used: {}", why),
            Self::SealedWithoutKey(path) => write!(
                f,
                "The seed at {} is encrypted, and the OS keychain holds no key that opens it. \
                 The key does not travel with the file and is not in any backup of it. Restore \
                 the seed phrase with `oa identity import`.",
                path.display()
            ),
            Self::Undecryptable(path) => write!(
                f,
                "The seed at {} is encrypted and the key in the OS keychain does not open it. \
                 Restore the seed phrase with `oa identity import`.",
                path.display()
            ),
            Self::Io(err) => write!(f, "{}", err),
        }
    }
}

impl std::error::Error for IdentityError {}

impl From<std::io::Error> for IdentityError {
    fn from(err: std::io::Error) -> Self {
        Self::Io(err)
    }
}

/// The public half of one seed. Nothing here can spend, sign, or reconstruct the
/// seed, so every field is safe to print, store, and export.
#[derive(Debug, Clone, PartialEq, Eq, Serialize, Deserialize)]
pub struct SeedIdentity {
    /// The frozen derivation profile these identifiers were produced under.
    pub profile: String,
    /// The NIP-19 `npub`, and the one cross-surface name for this identity.
    pub npub: String,
    /// The x-only 32-byte Nostr public key as hex.
    pub nostr_public_key_hex: String,
    pub nostr_derivation_path: String,
    /// The compressed 33-byte wallet public key as hex.
    pub wallet_public_key_hex: String,
    /// The BIP-32 key fingerprint, `HASH160(pubkey)[0..4]`, as hex.
    pub wallet_fingerprint_hex: String,
    /// The mainnet P2PKH receive address for the wallet path.
    pub wallet_address: String,
    pub wallet_derivation_path: String,
}

fn to_hex(bytes: &[u8]) -> String {
    bytes.iter().map(|b| format!("{:02x}", b)).collect()
}

fn from_hex(text: &str) -> Option<Vec<u8>> {
    if !text.len().is_multiple_of(2) || text.is_empty() {
        return None;
    }
    (0..text.len())
        .step_by(2)
        .map(|i| u8::from_str_radix(&text[i..i + 2], 16).ok())
        .collect()
}

/// Trim and collapse whitespace without changing the words themselves.
pub fn normalize_phrase(phrase: &str) -> String {
    phrase.split_whitespace().collect::<Vec<_>>().join(" ")
}

/// True when the phrase is a valid English BIP-39 mnemonic with a good checksum.
pub fn is_valid_seed_phrase(phrase: &str) -> bool {
    Mnemonic::parse_in_normalized(Language::English, &normalize_phrase(phrase)).is_ok()
}

/// Generate a fresh mnemonic from OS entropy. 12 words is 128 bits, 24 words is 256.
///
/// The entropy comes from the operating system through `bip39`'s `rand` feature, so
/// two runs — on one machine or two — produce different phrases. There is no seed
/// constant in this file, and a test asserts successive calls differ.
pub fn generate_seed_phrase(words: usize) -> Result<String, IdentityError> {
    let count = if words == 24 { 24 } else { 12 };
    Mnemonic::generate_in(Language::English, count)
        .map(|m| m.to_string())
        .map_err(|e| IdentityError::Derivation(e.to_string()))
}

/// Derive the public identity and wallet from one mnemonic.
///
/// Deterministic and side-effect free: the same phrase always yields the same `npub`
/// and the same wallet address, on every machine and every version. Refuses a phrase
/// that is not valid BIP-39 English, because deriving from a mistyped phrase would
/// hand back a plausible identity nobody can recover.
pub fn derive_seed_identity(phrase: &str) -> Result<SeedIdentity, IdentityError> {
    let normalized = normalize_phrase(phrase);
    let mnemonic = Mnemonic::parse_in_normalized(Language::English, &normalized)
        .map_err(|_| IdentityError::InvalidPhrase)?;
    let seed = mnemonic.to_seed_normalized(BIP39_PASSPHRASE);

    let nostr_public_key = derive_public_key(&seed, NOSTR_DERIVATION_PATH)?;
    // NIP-06 keys are x-only: drop the compressed-form parity byte.
    let nostr_x_only = &nostr_public_key[1..];

    let wallet_public_key = derive_public_key(&seed, WALLET_DERIVATION_PATH)?;
    let wallet_hash160 = hash160(&wallet_public_key);

    let mut address_payload = [0u8; 21];
    address_payload[0] = P2PKH_VERSION;
    address_payload[1..].copy_from_slice(&wallet_hash160);

    let hrp = Hrp::parse("npub").map_err(|e| IdentityError::Derivation(e.to_string()))?;
    let npub = bech32::encode::<Bech32>(hrp, nostr_x_only)
        .map_err(|e| IdentityError::Derivation(e.to_string()))?;

    Ok(SeedIdentity {
        profile: DERIVATION_PROFILE_ID.to_string(),
        npub,
        nostr_public_key_hex: to_hex(nostr_x_only),
        nostr_derivation_path: NOSTR_DERIVATION_PATH.to_string(),
        wallet_public_key_hex: to_hex(&wallet_public_key),
        wallet_fingerprint_hex: to_hex(&wallet_hash160[..4]),
        wallet_address: bs58::encode(address_payload).with_check().into_string(),
        wallet_derivation_path: WALLET_DERIVATION_PATH.to_string(),
    })
}

/// Derive one compressed 33-byte secp256k1 public key at `path` from a BIP-32 seed.
fn derive_public_key(seed: &[u8; 64], path: &str) -> Result<[u8; 33], IdentityError> {
    let parsed =
        DerivationPath::from_str(path).map_err(|e| IdentityError::Derivation(e.to_string()))?;
    let xprv = XPrv::derive_from_path(seed, &parsed)
        .map_err(|e| IdentityError::Derivation(e.to_string()))?;
    Ok(xprv.public_key().to_bytes())
}

/// `RIPEMD160(SHA256(bytes))`, the standard Bitcoin HASH160.
fn hash160(bytes: &[u8]) -> [u8; 20] {
    let sha = Sha256::digest(bytes);
    let mut out = [0u8; 20];
    out.copy_from_slice(&Ripemd160::digest(sha));
    out
}

// ---------------------------------------------------------------------------
// protection at rest
// ---------------------------------------------------------------------------

/// What is actually protecting the stored seed. Every surface that shows an
/// identity reports this, because the difference between the two is the whole
/// security posture of the machine and a person cannot infer it from the path.
#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum SeedProtection {
    /// The file holds a sealed envelope. The key that opens it is in the OS
    /// keychain and never touches the identity directory.
    OsKeychain,
    /// The file holds the phrase itself at `0600`. Filesystem permissions are
    /// the entire protection.
    PlaintextFile,
}

impl SeedProtection {
    /// The stable machine name. `oa identity show --json` carries this.
    pub fn id(self) -> &'static str {
        match self {
            Self::OsKeychain => "os_keychain",
            Self::PlaintextFile => "plaintext_file",
        }
    }

    pub fn encrypted_at_rest(self) -> bool {
        matches!(self, Self::OsKeychain)
    }

    /// The sentence a person reads. It says what is protecting the seed and, for
    /// the plaintext store, what that protection does not cover — a fallback
    /// nobody is told about is the same defect as a redaction that reports
    /// success and leaves the secret in place.
    pub fn describe(self, path: &Path) -> String {
        match self {
            Self::OsKeychain => format!(
                "Protection: OS keychain. The seed at {} is encrypted \
                 ({}); the key that opens it is held by the OS keychain under service {}, \
                 never in the file and never in a backup of it.",
                path.display(),
                SEED_ENVELOPE_ALG,
                IDENTITY_KEYCHAIN_SERVICE
            ),
            Self::PlaintextFile => format!(
                "Protection: NONE. The seed phrase is stored as readable text at {} (mode 0600). \
                 No OS keychain is available here, so file permissions are the whole protection: \
                 they stop another local user, and they stop nothing that already runs as you — \
                 a backup tool, a sync client, or an agent that can read your home directory. \
                 Treat this file the way you would treat the phrase written on paper.",
                path.display()
            ),
        }
    }
}

// ---------------------------------------------------------------------------
// the sealed envelope
// ---------------------------------------------------------------------------

/// The on-disk format both CLIs read and write. Changing any of these three
/// constants makes one CLI unable to open the other's seed.
const SEED_ENVELOPE_SCHEMA: &str = "openagents.cli_identity_seed.v1";
const SEED_ENVELOPE_ALG: &str = "chacha20-poly1305";
/// Bound into the AEAD as additional data, so an envelope cannot be replayed
/// under a different schema.
const SEED_ENVELOPE_AAD: &[u8] = SEED_ENVELOPE_SCHEMA.as_bytes();

#[derive(Serialize, Deserialize)]
struct SeedEnvelope {
    schema: String,
    alg: String,
    /// The 12-byte AEAD nonce, hex. Fresh on every write.
    nonce: String,
    /// Ciphertext with the 16-byte Poly1305 tag appended, hex.
    ciphertext: String,
}

/// True when the file at hand is a sealed envelope rather than a bare mnemonic.
/// A BIP-39 phrase can never start with `{`, so the two formats cannot be
/// confused and an old plaintext seed is still recognised for migration.
fn looks_sealed(text: &str) -> bool {
    text.trim_start().starts_with('{')
}

fn seal_phrase(phrase: &str, key: &[u8; 32]) -> Result<String, IdentityError> {
    let unbound = UnboundKey::new(&CHACHA20_POLY1305, key)
        .map_err(|_| IdentityError::Keychain("the wrapping key is not usable".to_string()))?;
    let sealing = LessSafeKey::new(unbound);

    let mut nonce_bytes = [0u8; NONCE_LEN];
    SystemRandom::new()
        .fill(&mut nonce_bytes)
        .map_err(|_| IdentityError::Derivation("the system random source failed".to_string()))?;

    let mut in_out = phrase.as_bytes().to_vec();
    sealing
        .seal_in_place_append_tag(
            Nonce::assume_unique_for_key(nonce_bytes),
            Aad::from(SEED_ENVELOPE_AAD),
            &mut in_out,
        )
        .map_err(|_| IdentityError::Derivation("the seed could not be encrypted".to_string()))?;

    let envelope = SeedEnvelope {
        schema: SEED_ENVELOPE_SCHEMA.to_string(),
        alg: SEED_ENVELOPE_ALG.to_string(),
        nonce: to_hex(&nonce_bytes),
        ciphertext: to_hex(&in_out),
    };
    in_out.zeroize();
    serde_json::to_string(&envelope)
        .map_err(|e| IdentityError::Derivation(format!("the envelope could not be encoded: {e}")))
}

fn open_envelope(text: &str, key: &[u8; 32], path: &Path) -> Result<String, IdentityError> {
    let envelope: SeedEnvelope = serde_json::from_str(text.trim())
        .map_err(|_| IdentityError::Undecryptable(path.to_path_buf()))?;
    if envelope.schema != SEED_ENVELOPE_SCHEMA || envelope.alg != SEED_ENVELOPE_ALG {
        return Err(IdentityError::Undecryptable(path.to_path_buf()));
    }
    let nonce_bytes: [u8; NONCE_LEN] = from_hex(&envelope.nonce)
        .and_then(|bytes| <[u8; NONCE_LEN]>::try_from(bytes.as_slice()).ok())
        .ok_or_else(|| IdentityError::Undecryptable(path.to_path_buf()))?;
    let mut in_out = from_hex(&envelope.ciphertext)
        .ok_or_else(|| IdentityError::Undecryptable(path.to_path_buf()))?;

    let unbound = UnboundKey::new(&CHACHA20_POLY1305, key)
        .map_err(|_| IdentityError::Keychain("the wrapping key is not usable".to_string()))?;
    let opening = LessSafeKey::new(unbound);
    let opened = opening
        .open_in_place(
            Nonce::assume_unique_for_key(nonce_bytes),
            Aad::from(SEED_ENVELOPE_AAD),
            &mut in_out,
        )
        .map_err(|_| IdentityError::Undecryptable(path.to_path_buf()))?;
    let phrase = String::from_utf8(opened.to_vec())
        .map_err(|_| IdentityError::Undecryptable(path.to_path_buf()))?;
    in_out.zeroize();
    Ok(normalize_phrase(&phrase))
}

// ---------------------------------------------------------------------------
// where the wrapping key lives
// ---------------------------------------------------------------------------

/// The service name the OS keychain files the identity wrapping key under. It is
/// deliberately not `openagents-cli` (account tokens) or `openagents-cli-computer`
/// (machine tokens), so no two of the three can overwrite each other. The
/// TypeScript CLI uses the same one.
pub const IDENTITY_KEYCHAIN_SERVICE: &str = "openagents-cli-identity";

/// Set this to opt out of the keychain and store the phrase as plaintext at
/// `0600`. It exists because a keychain that prompts is worse than no keychain
/// on an unattended host, and because the choice should be stateable rather than
/// discovered. It is never selected implicitly.
pub const PLAINTEXT_ENV: &str = "OPENAGENTS_IDENTITY_PLAINTEXT";

/// Where the 32-byte wrapping key lives. One implementation talks to the OS
/// keychain; the others exist so a test exercises the real seal, open, and
/// migration paths without touching the developer's own keychain.
pub trait SeedKeyStore: Send + Sync {
    /// `Ok(None)` means the store answered and holds no key for this identity
    /// directory. `Err(NoKeychain)` means there is no store on this machine,
    /// which selects the plaintext file. Any other error must not be read as
    /// "no key": minting a second key would orphan the sealed seed.
    fn get(&self) -> Result<Option<[u8; 32]>, IdentityError>;
    /// Store the key and prove it by reading it back. A store that reports
    /// success without keeping the value would seal a seed nobody can open.
    fn put(&self, key: &[u8; 32]) -> Result<(), IdentityError>;
    /// Best-effort removal. Used by `forget`, so a deleted identity does not
    /// leave its key behind.
    fn delete(&self);
}

/// The OS keychain: `security` on macOS, `secret-tool` on Linux.
///
/// The record is keyed by the identity directory, exactly as the credential
/// store keys tokens by origin, so a second identity directory gets a second key
/// and a test with a temporary directory can never reach the developer's own.
pub struct OsKeychainKeyStore {
    account: String,
}

impl OsKeychainKeyStore {
    pub fn for_directory(directory: &Path) -> Self {
        Self {
            account: directory.display().to_string(),
        }
    }

    fn get_command(&self) -> Option<Command> {
        if cfg!(target_os = "macos") {
            let mut command = Command::new("security");
            command.args([
                "find-generic-password",
                "-a",
                &self.account,
                "-s",
                IDENTITY_KEYCHAIN_SERVICE,
                "-w",
            ]);
            command.stderr(Stdio::null());
            Some(command)
        } else if cfg!(target_os = "linux") {
            let mut command = Command::new("secret-tool");
            command.args([
                "lookup",
                "service",
                IDENTITY_KEYCHAIN_SERVICE,
                "account",
                &self.account,
            ]);
            command.stderr(Stdio::null());
            Some(command)
        } else {
            None
        }
    }
}

impl SeedKeyStore for OsKeychainKeyStore {
    fn get(&self) -> Result<Option<[u8; 32]>, IdentityError> {
        let Some(mut command) = self.get_command() else {
            return Err(IdentityError::NoKeychain);
        };
        // A `security` or `secret-tool` that will not start is not an empty
        // store: this platform has no keychain, and that is a different answer.
        let output = command.output().map_err(|_| IdentityError::NoKeychain)?;
        if !output.status.success() {
            return Ok(None);
        }
        let value = String::from_utf8_lossy(&output.stdout).trim().to_string();
        if value.is_empty() {
            return Ok(None);
        }
        match from_hex(&value).and_then(|bytes| <[u8; 32]>::try_from(bytes.as_slice()).ok()) {
            Some(key) => Ok(Some(key)),
            // Never regenerate here. A record that is not a wrapping key means
            // something else wrote it, and overwriting it would make the sealed
            // seed permanently unopenable.
            None => Err(IdentityError::Keychain(format!(
                "the record under service {} is not an identity wrapping key",
                IDENTITY_KEYCHAIN_SERVICE
            ))),
        }
    }

    fn put(&self, key: &[u8; 32]) -> Result<(), IdentityError> {
        let encoded = to_hex(key);
        let stored = if cfg!(target_os = "macos") {
            // `security` reads the value from argv, so the wrapping key is
            // briefly visible to `ps`. The seed phrase never is: it goes to the
            // file sealed, and the key alone opens nothing without that file.
            Command::new("security")
                .args([
                    "add-generic-password",
                    "-U",
                    "-a",
                    &self.account,
                    "-s",
                    IDENTITY_KEYCHAIN_SERVICE,
                    "-w",
                    &encoded,
                ])
                .stdout(Stdio::null())
                .stderr(Stdio::null())
                .status()
                .map(|status| status.success())
                .map_err(|_| IdentityError::NoKeychain)?
        } else if cfg!(target_os = "linux") {
            let child = Command::new("secret-tool")
                .args([
                    "store",
                    "--label=OpenAgents identity",
                    "service",
                    IDENTITY_KEYCHAIN_SERVICE,
                    "account",
                    &self.account,
                ])
                .stdin(Stdio::piped())
                .stdout(Stdio::null())
                .stderr(Stdio::null())
                .spawn();
            match child {
                Ok(mut child) => {
                    if let Some(mut pipe) = child.stdin.take() {
                        let _ = pipe.write_all(encoded.as_bytes());
                    }
                    matches!(child.wait(), Ok(status) if status.success())
                }
                Err(_) => return Err(IdentityError::NoKeychain),
            }
        } else {
            return Err(IdentityError::NoKeychain);
        };
        if !stored {
            return Err(IdentityError::Keychain(
                "the OS keychain refused to store the identity wrapping key".to_string(),
            ));
        }
        match self.get()? {
            Some(read_back) if read_back == *key => Ok(()),
            _ => Err(IdentityError::Keychain(
                "the OS keychain did not return the key that was just written".to_string(),
            )),
        }
    }

    fn delete(&self) {
        if cfg!(target_os = "macos") {
            let _ = Command::new("security")
                .args([
                    "delete-generic-password",
                    "-a",
                    &self.account,
                    "-s",
                    IDENTITY_KEYCHAIN_SERVICE,
                ])
                .stdout(Stdio::null())
                .stderr(Stdio::null())
                .status();
        } else if cfg!(target_os = "linux") {
            let _ = Command::new("secret-tool")
                .args([
                    "clear",
                    "service",
                    IDENTITY_KEYCHAIN_SERVICE,
                    "account",
                    &self.account,
                ])
                .stdout(Stdio::null())
                .stderr(Stdio::null())
                .status();
        }
    }
}

/// A machine with no keychain: CI, a container, an unattended agent host. Every
/// call says so, which is what selects the plaintext store and the warning that
/// goes with it.
pub struct NoKeyStore;

impl SeedKeyStore for NoKeyStore {
    fn get(&self) -> Result<Option<[u8; 32]>, IdentityError> {
        Err(IdentityError::NoKeychain)
    }
    fn put(&self, _key: &[u8; 32]) -> Result<(), IdentityError> {
        Err(IdentityError::NoKeychain)
    }
    fn delete(&self) {}
}

/// A keychain that lives for the length of one test, so the seal, open, and
/// migration paths are exercised for real without writing to the developer's own
/// keychain or depending on one existing.
#[derive(Default)]
pub struct InMemoryKeyStore {
    key: Mutex<Option<[u8; 32]>>,
}

impl InMemoryKeyStore {
    pub fn new() -> Self {
        Self::default()
    }
}

impl SeedKeyStore for InMemoryKeyStore {
    fn get(&self) -> Result<Option<[u8; 32]>, IdentityError> {
        Ok(*self.key.lock().unwrap())
    }
    fn put(&self, key: &[u8; 32]) -> Result<(), IdentityError> {
        *self.key.lock().unwrap() = Some(*key);
        Ok(())
    }
    fn delete(&self) {
        *self.key.lock().unwrap() = None;
    }
}

/// A seed read back off disk, and what was protecting it there.
pub struct StoredSeed {
    /// The mnemonic. Secret; there is deliberately no `Debug`.
    pub phrase: String,
    pub protection: SeedProtection,
}

/// Where the seed lives on disk, and the only thing that touches it.
pub struct SeedStore {
    directory: PathBuf,
    keys: Box<dyn SeedKeyStore>,
}

impl SeedStore {
    /// `OPENAGENTS_IDENTITY_DIR` moves the store, which is how tests get an isolated
    /// identity without touching the developer's own. Matches the TypeScript CLI so
    /// both read the same seed.
    pub fn default_directory() -> PathBuf {
        match std::env::var("OPENAGENTS_IDENTITY_DIR") {
            Ok(dir) if !dir.trim().is_empty() => PathBuf::from(dir),
            _ => {
                let home = std::env::var("HOME").unwrap_or_else(|_| ".".to_string());
                PathBuf::from(home).join(".openagents").join("identity")
            }
        }
    }

    /// The production store: the OS keychain holds the wrapping key, unless
    /// [`PLAINTEXT_ENV`] says otherwise.
    pub fn new(directory: Option<PathBuf>) -> Self {
        let directory = directory.unwrap_or_else(Self::default_directory);
        let keys: Box<dyn SeedKeyStore> = if plaintext_requested() {
            Box::new(NoKeyStore)
        } else {
            Box::new(OsKeychainKeyStore::for_directory(&directory))
        };
        Self { directory, keys }
    }

    /// A store with the wrapping key held somewhere a test controls, so the seal,
    /// open, and migration paths run for real without touching the developer's
    /// own keychain. Mirrors `CredentialStore::isolated`.
    pub fn with_key_store(directory: PathBuf, keys: Box<dyn SeedKeyStore>) -> Self {
        Self { directory, keys }
    }

    /// The seed file: a sealed envelope under the OS keychain, or the mnemonic
    /// itself where there is no keychain. Mode `0600` either way.
    pub fn path(&self) -> PathBuf {
        self.directory.join(Self::SEED_FILE_NAME)
    }

    const SEED_FILE_NAME: &'static str = "seed";

    /// A staging path for one rewrite, unique to this call.
    ///
    /// It used to be the fixed `seed.tmp`. Two processes writing a seed under
    /// one `$HOME` then shared it: each truncated the other's staged bytes and
    /// removed the file out from under it, so one rewrite could rename a
    /// half-written envelope over the seed, or fail after the other had already
    /// replaced it. A seed is the one file where either outcome loses an
    /// identity outright. See [`crate::auth::unique_temp_path`].
    fn temp_path(&self) -> PathBuf {
        crate::auth::unique_temp_path(&self.path())
    }

    /// Remove staging files this directory still holds from crashed rewrites.
    ///
    /// With one fixed staging name `forget` could just delete it. Unique names
    /// mean a sweep instead: anything beside the seed that this store's writes
    /// would have named.
    fn sweep_temp_files(&self) {
        let Ok(entries) = fs::read_dir(&self.directory) else {
            return;
        };
        let prefix = format!(".{}.", Self::SEED_FILE_NAME);
        for entry in entries.flatten() {
            let name = entry.file_name();
            let name = name.to_string_lossy();
            if name.starts_with(&prefix) && name.ends_with(crate::auth::TEMP_SUFFIX) {
                let _ = fs::remove_file(entry.path());
            }
            // The name a crashed pre-sweep `oa` left behind.
            if name == "seed.tmp" {
                let _ = fs::remove_file(entry.path());
            }
        }
    }

    /// True when a seed is already stored. Presence only; the bytes stay on disk.
    pub fn present(&self) -> bool {
        self.path().is_file()
    }

    /// What a write would use on this machine right now. `Err` only when the
    /// keychain is present but unusable, which must not be silently downgraded
    /// to plaintext.
    pub fn available_protection(&self) -> Result<SeedProtection, IdentityError> {
        match self.keys.get() {
            Ok(_) => Ok(SeedProtection::OsKeychain),
            Err(IdentityError::NoKeychain) => Ok(SeedProtection::PlaintextFile),
            Err(other) => Err(other),
        }
    }

    /// What is protecting the seed that is on disk now, without opening it.
    /// `Ok(None)` when nothing is stored.
    pub fn protection_on_disk(&self) -> Result<Option<SeedProtection>, IdentityError> {
        let path = self.path();
        if !path.is_file() {
            return Ok(None);
        }
        let text = fs::read_to_string(&path)?;
        if text.trim().is_empty() {
            return Ok(None);
        }
        Ok(Some(if looks_sealed(&text) {
            SeedProtection::OsKeychain
        } else {
            SeedProtection::PlaintextFile
        }))
    }

    /// Read the stored seed and report what was protecting it. This and
    /// [`SeedStore::read_phrase`] are the only functions that return secret
    /// material.
    pub fn load(&self) -> Result<Option<StoredSeed>, IdentityError> {
        let path = self.path();
        if !path.is_file() {
            return Ok(None);
        }
        let text = fs::read_to_string(&path)?;
        if text.trim().is_empty() {
            return Ok(None);
        }
        if !looks_sealed(&text) {
            let phrase = normalize_phrase(&text);
            return Ok(Some(StoredSeed {
                phrase,
                protection: SeedProtection::PlaintextFile,
            }));
        }
        // Sealed. A keychain that cannot be read is never reported as "no seed":
        // that reads as an identity that vanished, and the next command would
        // offer to make a new one.
        let key = self
            .keys
            .get()?
            .ok_or_else(|| IdentityError::SealedWithoutKey(path.clone()))?;
        let phrase = open_envelope(&text, &key, &path)?;
        Ok(Some(StoredSeed {
            phrase,
            protection: SeedProtection::OsKeychain,
        }))
    }

    /// Read the stored mnemonic. Every caller either derives from it or hands it
    /// to the reader who asked for a backup.
    pub fn read_phrase(&self) -> Result<Option<String>, IdentityError> {
        Ok(self.load()?.map(|stored| stored.phrase))
    }

    /// Write the mnemonic under the best protection this machine has, `0600`
    /// inside a `0700` directory, after validating it. The validation is not
    /// politeness: a phrase stored here that does not validate would be an
    /// identity nobody can recover from its own backup.
    ///
    /// The write is atomic — staged in a sibling file and renamed over the
    /// target — so the phrase is never in two files at once and a crash mid-write
    /// leaves the previous seed intact rather than half of the new one.
    pub fn write_phrase(&self, phrase: &str) -> Result<PathBuf, IdentityError> {
        Ok(self.store_phrase(phrase)?.0)
    }

    /// The same write, and the protection it landed under.
    pub fn store_phrase(&self, phrase: &str) -> Result<(PathBuf, SeedProtection), IdentityError> {
        let normalized = normalize_phrase(phrase);
        if !is_valid_seed_phrase(&normalized) {
            return Err(IdentityError::InvalidPhrase);
        }
        let protection = self.available_protection()?;
        let body = match protection {
            SeedProtection::OsKeychain => {
                let key = match self.keys.get()? {
                    Some(key) => key,
                    None => {
                        let mut fresh = [0u8; 32];
                        SystemRandom::new().fill(&mut fresh).map_err(|_| {
                            IdentityError::Derivation("the system random source failed".to_string())
                        })?;
                        // Prove the keychain kept it before anything is sealed
                        // under it. Sealing first would produce a file no key
                        // opens.
                        self.keys.put(&fresh)?;
                        fresh
                    }
                };
                let sealed = seal_phrase(&normalized, &key)?;
                format!("{}\n", sealed)
            }
            SeedProtection::PlaintextFile => format!("{}\n", normalized),
        };
        let path = self.write_atomic(body.as_bytes())?;
        Ok((path, protection))
    }

    fn write_atomic(&self, bytes: &[u8]) -> Result<PathBuf, IdentityError> {
        fs::create_dir_all(&self.directory)?;
        Self::set_mode(&self.directory, 0o700)?;
        let path = self.path();
        let temp = self.temp_path();
        // No `remove_file` first: the name belongs to this call alone, so
        // anything already at it would be a surprise rather than our own
        // leftovers, and `create_new` inside `write_sealed` says so.
        if let Err(error) = Self::write_sealed(&temp, bytes) {
            let _ = fs::remove_file(&temp);
            return Err(error);
        }
        if let Err(error) = fs::rename(&temp, &path) {
            let _ = fs::remove_file(&temp);
            return Err(IdentityError::Io(error));
        }
        Self::set_mode(&path, 0o600)?;
        Ok(path)
    }

    /// Put `bytes` in a new file that is `0600` from the moment it exists.
    ///
    /// Created `0600` rather than created and then restricted: the seed must
    /// never be readable to the rest of the machine, not even for the instant
    /// between the two calls.
    fn write_sealed(temp: &std::path::Path, bytes: &[u8]) -> Result<(), IdentityError> {
        let mut options = fs::OpenOptions::new();
        options.write(true).create_new(true);
        #[cfg(unix)]
        {
            use std::os::unix::fs::OpenOptionsExt;
            options.mode(0o600);
        }
        let mut file = options.open(temp)?;
        file.write_all(bytes)?;
        Self::set_mode(temp, 0o600)?;
        Ok(())
    }

    /// Move a plaintext seed under the OS keychain, and report what is protecting
    /// it afterwards. `Ok(None)` when nothing is stored.
    ///
    /// The rewrite lands on the same path by rename, so there is never a moment
    /// with the phrase in two files, and the plaintext is gone the instant the
    /// sealed envelope arrives. On a machine with no keychain this changes
    /// nothing and reports [`SeedProtection::PlaintextFile`], which is what the
    /// caller then has to say out loud.
    pub fn protect(&self) -> Result<Option<SeedProtection>, IdentityError> {
        let Some(on_disk) = self.protection_on_disk()? else {
            return Ok(None);
        };
        if on_disk == SeedProtection::OsKeychain {
            return Ok(Some(SeedProtection::OsKeychain));
        }
        if self.available_protection()? != SeedProtection::OsKeychain {
            return Ok(Some(SeedProtection::PlaintextFile));
        }
        let Some(stored) = self.load()? else {
            return Ok(None);
        };
        let (_, protection) = self.store_phrase(&stored.phrase)?;
        Ok(Some(protection))
    }

    /// Remove the stored seed, and the wrapping key with it. Idempotent, and it
    /// deletes nothing else. Leaving the key behind would leave a keychain record
    /// for an identity that no longer exists.
    pub fn forget(&self) -> Result<bool, IdentityError> {
        let path = self.path();
        self.sweep_temp_files();
        if !path.exists() {
            self.keys.delete();
            return Ok(false);
        }
        fs::remove_file(&path)?;
        self.keys.delete();
        Ok(true)
    }

    /// Derive the public identity from the stored seed, or say there is none.
    pub fn identity(&self) -> Result<SeedIdentity, IdentityError> {
        match self.read_phrase()? {
            Some(phrase) => derive_seed_identity(&phrase),
            None => Err(IdentityError::NoSeed),
        }
    }

    #[cfg(unix)]
    fn set_mode(path: &std::path::Path, mode: u32) -> Result<(), IdentityError> {
        use std::os::unix::fs::PermissionsExt;
        fs::set_permissions(path, fs::Permissions::from_mode(mode))?;
        Ok(())
    }

    #[cfg(not(unix))]
    fn set_mode(_path: &std::path::Path, _mode: u32) -> Result<(), IdentityError> {
        Ok(())
    }
}

/// True when the environment asks for the plaintext store. Anything but an
/// explicit off value counts, so `=1`, `=true`, and `=yes` all work and a typo
/// does not silently leave the keychain on when the operator meant it off.
fn plaintext_requested() -> bool {
    match std::env::var(PLAINTEXT_ENV) {
        Ok(value) => {
            let value = value.trim().to_ascii_lowercase();
            !(value.is_empty() || value == "0" || value == "false" || value == "no")
        }
        Err(_) => false,
    }
}

pub mod fleet;
pub mod foreign_resume;
pub mod forum;
pub mod identity;
pub mod interactive;
pub mod markdown;
pub mod memory_client;

    use openagents_cli::workspace::Isolation;
    use openagents_cli::tools::{HarnessToolRegistry, ToolCall};
    use openagents_cli::auth::CredentialStore;
    use openagents_cli::identity::{derive_seed_identity, SeedStore};
    use openagents_cli::tracker::{slug_from_remote_url, IssueListOptions, RepoTarget, TrackerClient};
    use openagents_cli::repo::{admitted_credential_request, parse_git_credential_request};
    use openagents_cli::box_client::BoxClient;

        assert!(store.find_token().unwrap().is_none());
    }

    /// The old assertion checked only that the strings began `npub1`/`nsec1`, which
    /// a `format!` over a SHA-256 digest satisfied. These assert the derivation.
    /// The full contract, including parity with the TypeScript CLI, is in
    /// `tests/identity_test.rs`.
    #[test]
    fn test_identity_generation_issue_75() {
        let phrase = "abandon abandon abandon abandon abandon abandon \
                      abandon abandon abandon abandon abandon about";
        let identity = derive_seed_identity(phrase).unwrap();
        assert_eq!(
            identity.npub,
            "npub1az708q3kd9zy6z6f44zav5ygvdwelkzspf6mtusttx47lft2z38sghk0w7"
        );
        assert!(derive_seed_identity("not a mnemonic").is_err());

        // Nothing is persisted until something asks for it to be.
        let directory = tempfile::tempdir().unwrap();
        let store = SeedStore::new(Some(directory.path().join("identity")));
        assert!(!store.present());
        assert!(store.identity().is_err());
    }

    /// The old assertion was `issues.is_empty() || !issues.is_empty()`, which is
    /// true of every value of every list and so held while the client asked for
    /// a route that does not exist and answered the refusal with `Ok(vec![])`.

//! Derivation parity with the TypeScript CLI, and the storage contract.
//!
//! The vectors below are the ones `packages/openagents-cli/test/seed-identity.test.ts`
//! freezes, which in turn are `packages/sovereign-identity/src/contract/vectors.ts`.
//! An `npub` that differs between the two CLIs is a different account, so a change
//! to the Rust derivation fails here rather than silently reissuing every identity.

use openagents_cli::identity::{
    derive_seed_identity, generate_seed_phrase, is_valid_seed_phrase, InMemoryKeyStore, NoKeyStore,
    SeedKeyStore, SeedProtection, SeedStore, DERIVATION_PROFILE_ID, NOSTR_DERIVATION_PATH,
    WALLET_DERIVATION_PATH,
};
use std::path::{Path, PathBuf};

/// A store whose wrapping key lives for the length of one test. Nothing here
/// reaches the developer's own OS keychain, and nothing depends on the machine
/// running the tests having one.
fn sealed_store(directory: &Path) -> SeedStore {
    SeedStore::with_key_store(
        directory.join("identity"),
        Box::new(InMemoryKeyStore::new()),
    )
}

/// A store on a machine with no keychain: CI, a container, an agent host.
fn headless_store(directory: &Path) -> SeedStore {
    SeedStore::with_key_store(directory.join("identity"), Box::new(NoKeyStore))
}

fn seed_bytes(path: &PathBuf) -> String {
    std::fs::read_to_string(path).expect("the seed file is on disk")
}

/// The canonical published BIP-39 test phrase. It is not a secret and never was;
/// it exists so a deterministic answer can be committed.
const TEST_PHRASE: &str =
    "abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";

const FROZEN_NPUB: &str = "npub1az708q3kd9zy6z6f44zav5ygvdwelkzspf6mtusttx47lft2z38sghk0w7";
const FROZEN_NOSTR_PUBKEY_HEX: &str =
    "e8bcf3823669444d0b49ad45d65088635d9fd8500a75b5f20b59abefa56a144f";
const FROZEN_WALLET_PUBKEY_HEX: &str =
    "03aaeb52dd7494c361049de67cc680e83ebcbbbdbeb13637d92cd845f70308af5e";
const FROZEN_WALLET_FINGERPRINT_HEX: &str = "d986ed01";
const FROZEN_WALLET_ADDRESS: &str = "1LqBGSKuX5yYUonjxT5qGfpUsXKYYWeabA";

#[test]
fn derives_the_frozen_identity_from_the_published_test_phrase() {
    let identity = derive_seed_identity(TEST_PHRASE).expect("the test phrase is valid BIP-39");

    assert_eq!(identity.profile, DERIVATION_PROFILE_ID);
    assert_eq!(identity.npub, FROZEN_NPUB);
    assert_eq!(identity.nostr_public_key_hex, FROZEN_NOSTR_PUBKEY_HEX);
    assert_eq!(identity.nostr_derivation_path, NOSTR_DERIVATION_PATH);
    assert_eq!(identity.wallet_public_key_hex, FROZEN_WALLET_PUBKEY_HEX);
    assert_eq!(
        identity.wallet_fingerprint_hex,
        FROZEN_WALLET_FINGERPRINT_HEX
    );
    assert_eq!(identity.wallet_address, FROZEN_WALLET_ADDRESS);
    assert_eq!(identity.wallet_derivation_path, WALLET_DERIVATION_PATH);
}

#[test]
fn the_npub_is_real_bech32_not_a_prefixed_hex_string() {
    let identity = derive_seed_identity(TEST_PHRASE).unwrap();

    // A NIP-19 npub is 63 characters. The fabricated implementation produced 37.
    assert_eq!(identity.npub.len(), 63, "npub: {}", identity.npub);

    // It decodes, the checksum holds, and the payload is the x-only public key.
    let (hrp, payload) = bech32::decode(&identity.npub).expect("npub is valid bech32");
    assert_eq!(hrp.as_str(), "npub");
    assert_eq!(payload.len(), 32);
    assert_eq!(
        payload
            .iter()
            .map(|b| format!("{:02x}", b))
            .collect::<String>(),
        FROZEN_NOSTR_PUBKEY_HEX
    );

    // Bech32 has no uppercase and excludes `1`, `b`, `i`, and `o` from its alphabet.
    let data = &identity.npub["npub1".len()..];
    assert!(
        data.chars()
            .all(|c| "qpzry9x8gf2tvdw0s3jn54khce6mua7l".contains(c)),
        "npub payload is outside the bech32 alphabet: {}",
        data
    );
}

#[test]
fn is_insensitive_to_surrounding_whitespace_but_not_to_the_words() {
    let spaced = format!("  {}\n", TEST_PHRASE.replace(' ', "  "));
    assert_eq!(derive_seed_identity(&spaced).unwrap().npub, FROZEN_NPUB);
}

#[test]
fn refuses_a_phrase_whose_checksum_does_not_hold() {
    let wrong_checksum = TEST_PHRASE.replace("about", "abandon");
    assert!(!is_valid_seed_phrase(&wrong_checksum));
    assert!(derive_seed_identity(&wrong_checksum).is_err());
}

#[test]
fn generated_phrases_come_from_os_entropy_not_a_constant() {
    // The defect this replaces derived every key from a string literal, so two
    // empty HOMEs on two machines minted the same npub. Distinct phrases and
    // distinct identities are the property that proves the literal is gone.
    let first = generate_seed_phrase(12).unwrap();
    let second = generate_seed_phrase(12).unwrap();
    assert_ne!(first, second);
    assert_eq!(first.split_whitespace().count(), 12);
    assert_eq!(
        generate_seed_phrase(24).unwrap().split_whitespace().count(),
        24
    );

    let first_identity = derive_seed_identity(&first).unwrap();
    let second_identity = derive_seed_identity(&second).unwrap();
    assert_ne!(first_identity.npub, second_identity.npub);
    assert_ne!(
        first_identity.wallet_address,
        second_identity.wallet_address
    );

    // Every generated phrase must validate, or it could not be written back.
    assert!(is_valid_seed_phrase(&first));
}

#[test]
fn writes_the_phrase_0600_and_reads_it_back_unchanged() {
    let directory = tempfile::tempdir().unwrap();
    let store = sealed_store(directory.path());

    assert!(!store.present());
    assert!(store.read_phrase().unwrap().is_none());
    assert!(store.identity().is_err(), "no seed means no identity");

    let path = store.write_phrase(TEST_PHRASE).unwrap();
    assert!(store.present());
    assert_eq!(store.read_phrase().unwrap().as_deref(), Some(TEST_PHRASE));

    // Create, then show: the identity shown is the one just created.
    assert_eq!(store.identity().unwrap().npub, FROZEN_NPUB);

    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        let file_mode = std::fs::metadata(&path).unwrap().permissions().mode() & 0o777;
        assert_eq!(
            file_mode, 0o600,
            "seed file must not be readable by anyone else"
        );
        let dir_mode = std::fs::metadata(path.parent().unwrap())
            .unwrap()
            .permissions()
            .mode()
            & 0o777;
        assert_eq!(dir_mode, 0o700);
    }
}

/// The claim under test is not "encryption was called". It is that the bytes a
/// backup tool, a sync client, or an agent reading `$HOME` would carry away are
/// not the phrase, and not any word of it.
#[test]
fn the_sealed_seed_file_holds_no_word_of_the_phrase() {
    let directory = tempfile::tempdir().unwrap();
    let store = sealed_store(directory.path());
    let path = store.write_phrase(TEST_PHRASE).unwrap();

    let on_disk = seed_bytes(&path);
    assert!(
        !on_disk.contains(TEST_PHRASE),
        "the phrase is in the seed file"
    );
    assert!(
        !on_disk.contains("abandon"),
        "a phrase word is in the seed file"
    );
    assert!(
        !on_disk.contains("about"),
        "a phrase word is in the seed file"
    );

    // And it is the sealed envelope, not some other encoding of the same words:
    // a base64 or hex of the phrase would pass the checks above.
    assert!(on_disk.contains("chacha20-poly1305"));
    assert!(on_disk.contains("openagents.cli_identity_seed.v1"));
    assert_eq!(
        store.protection_on_disk().unwrap(),
        Some(SeedProtection::OsKeychain)
    );
    assert!(SeedProtection::OsKeychain.encrypted_at_rest());

    // The wrapping key is not in the identity directory. If it were, the file
    // and the key would travel together and the encryption would be theatre.
    for entry in std::fs::read_dir(path.parent().unwrap()).unwrap() {
        let entry = entry.unwrap();
        assert_eq!(
            entry.file_name(),
            "seed",
            "the identity directory holds a second file: {:?}",
            entry.file_name()
        );
    }
}

/// Two writes of the same phrase produce different bytes, which is what a fresh
/// nonce per write buys and what a fixed-nonce or ECB-shaped mistake would fail.
#[test]
fn every_seal_uses_a_fresh_nonce() {
    let directory = tempfile::tempdir().unwrap();
    let store = sealed_store(directory.path());

    let path = store.write_phrase(TEST_PHRASE).unwrap();
    let first = seed_bytes(&path);
    store.write_phrase(TEST_PHRASE).unwrap();
    let second = seed_bytes(&path);

    assert_ne!(
        first, second,
        "two seals of one phrase produced one ciphertext"
    );
    assert_eq!(store.read_phrase().unwrap().as_deref(), Some(TEST_PHRASE));
}

/// A sealed seed whose key is gone must say so. Reporting "no seed" would read
/// as an identity that vanished, and the next command would offer a new one.
#[test]
fn a_sealed_seed_without_its_key_is_an_error_not_an_absence() {
    let directory = tempfile::tempdir().unwrap();
    let keys = std::sync::Arc::new(InMemoryKeyStore::new());
    let store = SeedStore::with_key_store(
        directory.path().join("identity"),
        Box::new(SharedKeys(keys.clone())),
    );
    store.write_phrase(TEST_PHRASE).unwrap();
    keys.delete();

    assert!(store.present(), "the file is still there");
    let message = store.read_phrase().unwrap_err().to_string();
    assert!(message.contains("encrypted"), "message: {message}");
    assert!(!message.contains("abandon"), "the error quoted the phrase");
}

/// A wrapping key that does not open the envelope is not a reason to mint a new
/// one, which would silently orphan the seed.
#[test]
fn a_wrong_key_refuses_rather_than_returning_rubbish() {
    let directory = tempfile::tempdir().unwrap();
    let keys = std::sync::Arc::new(InMemoryKeyStore::new());
    let store = SeedStore::with_key_store(
        directory.path().join("identity"),
        Box::new(SharedKeys(keys.clone())),
    );
    store.write_phrase(TEST_PHRASE).unwrap();
    keys.put(&[7u8; 32]).unwrap();

    assert!(store.read_phrase().is_err());
    assert!(store.identity().is_err());
}

/// The headless case, stated rather than assumed: with no keychain the phrase is
/// on disk as text, and the store says exactly that so the CLI can print it.
#[test]
fn without_a_keychain_the_store_says_the_seed_is_plaintext() {
    let directory = tempfile::tempdir().unwrap();
    let store = headless_store(directory.path());

    let (path, protection) = store.store_phrase(TEST_PHRASE).unwrap();
    assert_eq!(protection, SeedProtection::PlaintextFile);
    assert!(!protection.encrypted_at_rest());
    assert_eq!(protection.id(), "plaintext_file");
    assert!(seed_bytes(&path).contains(TEST_PHRASE));
    assert_eq!(store.read_phrase().unwrap().as_deref(), Some(TEST_PHRASE));

    // The sentence a person sees must name the file and say what is not covered.
    let described = protection.describe(&path);
    assert!(
        described.contains(&path.display().to_string()),
        "{described}"
    );
    assert!(described.contains("readable text"), "{described}");
    assert!(described.contains("backup tool"), "{described}");
    assert!(!described.contains(TEST_PHRASE));
}

/// The migration. Start from a seed file written by the CLI that could not
/// encrypt one, and prove both halves: the identity is unchanged, and the
/// plaintext is gone.
#[test]
fn migrates_an_existing_plaintext_seed_and_leaves_no_plaintext_behind() {
    let directory = tempfile::tempdir().unwrap();
    let identity_directory = directory.path().join("identity");
    std::fs::create_dir_all(&identity_directory).unwrap();
    let path = identity_directory.join("seed");

    // Exactly what the previous CLI wrote: the phrase, one line, mode 0600.
    std::fs::write(&path, format!("{}\n", TEST_PHRASE)).unwrap();
    #[cfg(unix)]
    {
        use std::os::unix::fs::PermissionsExt;
        std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();
    }
    let before = derive_seed_identity(TEST_PHRASE).unwrap();

    let store = sealed_store(directory.path());
    assert_eq!(
        store.protection_on_disk().unwrap(),
        Some(SeedProtection::PlaintextFile),
        "the fixture must start as plaintext or this test proves nothing"
    );

    assert_eq!(store.protect().unwrap(), Some(SeedProtection::OsKeychain));

    // The identity did not move.
    let after = store.identity().unwrap();
    assert_eq!(after, before);
    assert_eq!(after.npub, FROZEN_NPUB);

    // The plaintext is gone, from that file and from every other file the
    // migration could have left in the directory.
    let on_disk = seed_bytes(&path);
    assert!(!on_disk.contains(TEST_PHRASE));
    assert!(!on_disk.contains("abandon"));
    for entry in std::fs::read_dir(&identity_directory).unwrap() {
        let entry = entry.unwrap();
        let text = std::fs::read_to_string(entry.path()).unwrap_or_default();
        assert!(
            !text.contains("abandon"),
            "{:?} still holds the phrase",
            entry.file_name()
        );
    }

    // Migrating twice is not a second identity, and not a second file.
    assert_eq!(store.protect().unwrap(), Some(SeedProtection::OsKeychain));
    assert_eq!(store.identity().unwrap(), before);
}

/// On a machine with no keychain the migration must not pretend. It reports the
/// plaintext store and leaves the file exactly as it found it.
#[test]
fn migration_on_a_headless_machine_reports_plaintext_rather_than_faking_it() {
    let directory = tempfile::tempdir().unwrap();
    let identity_directory = directory.path().join("identity");
    std::fs::create_dir_all(&identity_directory).unwrap();
    let path = identity_directory.join("seed");
    std::fs::write(&path, format!("{}\n", TEST_PHRASE)).unwrap();

    let store = headless_store(directory.path());
    assert_eq!(
        store.protect().unwrap(),
        Some(SeedProtection::PlaintextFile)
    );
    assert!(seed_bytes(&path).contains(TEST_PHRASE));
    assert_eq!(store.identity().unwrap().npub, FROZEN_NPUB);
}

/// A seed sealed by one CLI opens in the other. Both write the same envelope
/// under the same key, so this asserts the format, not the language.
#[test]
fn a_sealed_envelope_opens_from_a_second_store_holding_the_same_key() {
    let directory = tempfile::tempdir().unwrap();
    let key = [42u8; 32];

    let writer = SeedStore::with_key_store(directory.path().join("identity"), {
        let store = InMemoryKeyStore::new();
        store.put(&key).unwrap();
        Box::new(store)
    });
    writer.write_phrase(TEST_PHRASE).unwrap();

    let reader = SeedStore::with_key_store(directory.path().join("identity"), {
        let store = InMemoryKeyStore::new();
        store.put(&key).unwrap();
        Box::new(store)
    });
    assert_eq!(reader.read_phrase().unwrap().as_deref(), Some(TEST_PHRASE));
    assert_eq!(reader.identity().unwrap().npub, FROZEN_NPUB);
}

#[test]
fn refuses_to_store_a_phrase_that_could_not_be_recovered() {
    let directory = tempfile::tempdir().unwrap();
    let store = sealed_store(directory.path());

    assert!(store.write_phrase("not a real mnemonic at all").is_err());
    assert!(
        !store.present(),
        "an invalid phrase must leave no file behind"
    );
}

#[test]
fn forget_deletes_the_seed_the_key_and_is_idempotent() {
    let directory = tempfile::tempdir().unwrap();
    let keys = std::sync::Arc::new(InMemoryKeyStore::new());
    let store = SeedStore::with_key_store(
        directory.path().join("identity"),
        Box::new(SharedKeys(keys.clone())),
    );

    store.write_phrase(TEST_PHRASE).unwrap();
    assert!(
        keys.get().unwrap().is_some(),
        "a key was minted for the seal"
    );
    assert!(store.forget().unwrap(), "the first forget removes the seed");
    assert!(!store.present());
    assert!(!store.path().exists());
    assert!(
        keys.get().unwrap().is_none(),
        "forget left the wrapping key behind for an identity that is gone"
    );
    assert!(
        !store.forget().unwrap(),
        "a second forget reports nothing to remove"
    );
}

/// Lets a test hold on to the key store the `SeedStore` owns, so it can take the
/// key away or replace it mid-test.
struct SharedKeys(std::sync::Arc<InMemoryKeyStore>);

impl SeedKeyStore for SharedKeys {
    fn get(&self) -> Result<Option<[u8; 32]>, openagents_cli::identity::IdentityError> {
        self.0.get()
    }
    fn put(&self, key: &[u8; 32]) -> Result<(), openagents_cli::identity::IdentityError> {
        self.0.put(key)
    }
    fn delete(&self) {
        self.0.delete()
    }
}


use openagents_cli::auth::{CredentialStore, PendingDeviceAuthorization, PendingStore, Secret};
use openagents_cli::computer::{ComputerPaths, PolicyConfig};
use openagents_cli::identity::{generate_seed_phrase, NoKeyStore, SeedStore};
use std::io::{BufRead, BufReader, Read, Write};
use std::net::TcpListener;
use std::path::Path;

    assert_no_staging_files_left(directory.path());
}

/// Concurrent seed writes all succeed and the seed that remains is one somebody
/// actually wrote.
///
/// The seed store staged through a fixed `seed.tmp` and removed it before each
/// write, so two writers could put half of one phrase and half of another in
/// the file that then got renamed over the seed. A seed is the one file where
/// that costs an identity outright: nothing recovers a mnemonic that is six
/// words from one wallet and six from another.
#[test]
fn concurrent_seed_writes_all_succeed_and_the_seed_still_opens() {
    let directory = tempfile::tempdir().expect("an identity directory");
    let at = directory.path().join("identity");
    let phrases: Vec<String> = (0..WRITERS)
        .map(|_| generate_seed_phrase(12).expect("a phrase"))
        .collect();

    let written = phrases.clone();
    let target = at.clone();
    let results = race(move |index| {
        SeedStore::with_key_store(target.clone(), Box::new(NoKeyStore))
            .write_phrase(&written[index])
    });
    for (index, result) in results.iter().enumerate() {
        assert!(
            result.is_ok(),
            "writer {index} was told the seed was not written: {}",
            result.as_ref().unwrap_err()
        );
    }

    let store = SeedStore::with_key_store(at.clone(), Box::new(NoKeyStore));
    let recovered = store
        .read_phrase()
        .expect("the seed opens")
        .expect("a seed is stored");
    assert!(
        phrases.contains(&recovered),
        "the stored seed is not any phrase that was written, so two writes were spliced"
    );
    #[cfg(unix)]
    {
        assert_eq!(
            mode_of(&store.path()),
            0o600,
            "the seed is readable to the machine"
        );
        assert_eq!(
            mode_of(&at),
            0o700,
            "the identity directory is open to the machine"
        );
    }
    assert_no_staging_files_left(&at);
}

/// A reader of `computer.json` never sees a policy it cannot decode, however
/// many writers are working on it.
///
/// `computer.json` wrote in place — truncate the target, then write it — so
/// between those two calls the file on disk is empty, and any `oa` that read
/// the policy in that window was told its own configuration is not valid JSON.
/// It is the policy file: the answer decides which commands the Computer will
/// run at all, and `load_config` is right to refuse a file it cannot read
/// rather than fall back to a default the owner never chose. So the refusal
/// lands on a reader that did nothing wrong.
///
/// Writers alone would not settle this. Two small `write` calls usually land
/// whole, so a test that only writes passes against the broken version. Readers
/// are what make the truncate window visible, and staging elsewhere and
/// renaming is what closes it: the target is only ever the old file or the new
/// one.
#[test]
fn a_reader_never_sees_a_half_written_computer_policy() {
    /// Enough passes for the truncate window to be observed if it is open.

166	166		`source = "registry+https://github.com/rust-lang/crates.io-index"`
167	167		`checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"`
168	168
169		-	`[[package]]`
170		-	`name = "base16ct"`
171		-	`version = "0.2.0"`
172		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
173		-	`checksum = "4c7f02d4ea65f2c1853089ffd8d2787bdbc63de2f0d29dedbcf8ccdfa0ccd4cf"`
174		-
175	169		`[[package]]`
176	170		`name = "base64"`
177	171		`version = "0.22.1"`

211	205		`"syn 2.0.117",`
212	206		`]`
213	207
214		-	`[[package]]`
215		-	`name = "bip32"`
216		-	`version = "0.5.3"`
217		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
218		-	`checksum = "db40d3dfbeab4e031d78c844642fa0caa0b0db11ce1607ac9d2986dff1405c69"`
219		-	`dependencies = [`
220		-	`"bs58",`
221		-	`"hmac",`
222		-	`"k256",`
223		-	`"once_cell",`
224		-	`"pbkdf2",`
225		-	`"rand_core 0.6.4",`
226		-	`"ripemd",`
227		-	`"secp256k1",`
228		-	`"sha2",`
229		-	`"subtle",`
230		-	`"zeroize",`
231		-	`]`
232		-
233	208		`[[package]]`
234	209		`name = "bip39"`
235	210		`version = "2.2.2"`

288	263		`"generic-array",`
289	264		`]`
290	265
291		-	`[[package]]`
292		-	`name = "bs58"`
293		-	`version = "0.5.1"`
294		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
295		-	`checksum = "bf88ba1141d185c399bee5288d850d63b8369520c1eafc32a0430b5b6c287bf4"`
296		-	`dependencies = [`
297		-	`"sha2",`
298		-	`"tinyvec",`
299		-	`]`
300		-
301	266		`[[package]]`
302	267		`name = "bumpalo"`
303	268		`version = "3.20.3"`

500	465		`"static_assertions",`
501	466		`]`
502	467
503		-	`[[package]]`
504		-	`name = "const-oid"`
505		-	`version = "0.9.6"`
506		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
507		-	`checksum = "c2459377285ad874054d797f3ccebf984978aa39129f6eafde5cdc8315b612f8"`
508		-
509	468		`[[package]]`
510	469		`name = "core-foundation"`
511	470		`version = "0.10.1"`

781	740		`"winapi",`
782	741		`]`
783	742
784		-	`[[package]]`
785		-	`name = "crypto-bigint"`
786		-	`version = "0.5.5"`
787		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
788		-	`checksum = "0dc92fb57ca44df6db8059111ab3af99a63d5d0f8375d9972e319a379c6bab76"`
789		-	`dependencies = [`
790		-	`"generic-array",`
791		-	`"rand_core 0.6.4",`
792		-	`"subtle",`
793		-	`"zeroize",`
794		-	`]`
795		-
796	743		`[[package]]`
797	744		`name = "crypto-common"`
798	745		`version = "0.1.7"`

Commit

Remove `oa identity`

Deploy story

Not deployed through the forge lane

Changed files

Diff

849	796		`source = "registry+https://github.com/rust-lang/crates.io-index"`
850	797		`checksum = "a4ae5f15dda3c708c0ade84bfee31ccab44a3da4f88015ed22f63732abe300c8"`
851	798
852		-	`[[package]]`
853		-	`name = "der"`
854		-	`version = "0.7.10"`
855		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
856		-	`checksum = "e7c1832837b905bbfb5101e07cc24c8deddf52f93225eee6ead5f4d63d53ddcb"`
857		-	`dependencies = [`
858		-	`"const-oid",`
859		-	`"zeroize",`
860		-	`]`
861		-
862	799		`[[package]]`
863	800		`name = "deranged"`
864	801		`version = "0.5.8"`

878	815		`checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"`
879	816		`dependencies = [`
880	817		`"block-buffer",`
881		-	`"const-oid",`
882	818		`"crypto-common",`
883		-	`"subtle",`
884	819		`]`
885	820
886	821		`[[package]]`

900	835		`source = "registry+https://github.com/rust-lang/crates.io-index"`
901	836		`checksum = "75b325c5dbd37f80359721ad39aca5a29fb04c89279657cffdda8736d0c0b9d2"`
902	837
903		-	`[[package]]`
904		-	`name = "ecdsa"`
905		-	`version = "0.16.9"`
906		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
907		-	`checksum = "ee27f32b5c5292967d2d4a9d7f1e0b0aed2c15daded5a60300e4abb9d8020bca"`
908		-	`dependencies = [`
909		-	`"der",`
910		-	`"digest",`
911		-	`"elliptic-curve",`
912		-	`"rfc6979",`
913		-	`"signature",`
914		-	`]`
915		-
916	838		`[[package]]`
917	839		`name = "either"`
918	840		`version = "1.16.0"`
919	841		`source = "registry+https://github.com/rust-lang/crates.io-index"`
920	842		`checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"`
921	843
922		-	`[[package]]`
923		-	`name = "elliptic-curve"`
924		-	`version = "0.13.8"`
925		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
926		-	`checksum = "b5e6043086bf7973472e0c7dff2142ea0b680d30e18d9cc40f267efbf222bd47"`
927		-	`dependencies = [`
928		-	`"base16ct",`
929		-	`"crypto-bigint",`
930		-	`"digest",`
931		-	`"ff",`
932		-	`"generic-array",`
933		-	`"group",`
934		-	`"rand_core 0.6.4",`
935		-	`"sec1",`
936		-	`"subtle",`
937		-	`"zeroize",`
938		-	`]`
939		-
940	844		`[[package]]`
941	845		`name = "embedded-io"`
942	846		`version = "0.4.0"`

999	903		`source = "registry+https://github.com/rust-lang/crates.io-index"`
1000	904		`checksum = "da7c62ceae207dd37ea5b845da6a0696c799f85e97da1ab5b7910be3c1c80223"`
1001	905
1002		-	`[[package]]`
1003		-	`name = "ff"`
1004		-	`version = "0.13.1"`
1005		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
1006		-	`checksum = "c0b50bfb653653f9ca9095b427bed08ab8d75a137839d9ad64eb11810d5b6393"`
1007		-	`dependencies = [`
1008		-	`"rand_core 0.6.4",`
1009		-	`"subtle",`
1010		-	`]`
1011		-
1012	906		`[[package]]`
1013	907		`name = "filedescriptor"`
1014	908		`version = "0.8.3"`

1153	1047		`dependencies = [`
1154	1048		`"typenum",`
1155	1049		`"version_check",`
1156		-	`"zeroize",`
1157	1050		`]`
1158	1051
1159	1052		`[[package]]`

1211	1104		`source = "registry+https://github.com/rust-lang/crates.io-index"`
1212	1105		`checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"`
1213	1106
1214		-	`[[package]]`
1215		-	`name = "group"`
1216		-	`version = "0.13.0"`
1217		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
1218		-	`checksum = "f0f9ef7462f7c099f518d754361858f86d8a07af53ba9af0fe635bbccb151a63"`
1219		-	`dependencies = [`
1220		-	`"ff",`
1221		-	`"rand_core 0.6.4",`
1222		-	`"subtle",`
1223		-	`]`
1224		-
1225	1107		`[[package]]`
1226	1108		`name = "hashbrown"`
1227	1109		`version = "0.15.5"`

1255	1137		`"arrayvec",`
1256	1138		`]`
1257	1139
1258		-	`[[package]]`
1259		-	`name = "hmac"`
1260		-	`version = "0.12.1"`
1261		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
1262		-	`checksum = "6c49c37c09c17a53d937dfbb742eb3a961d65a994e6bcdcf37e7399d0cc8ab5e"`
1263		-	`dependencies = [`
1264		-	`"digest",`
1265		-	`]`
1266		-
1267	1140		`[[package]]`
1268	1141		`name = "html-escape"`
1269	1142		`version = "0.2.15"`

1619	1492		`"wasm-bindgen",`
1620	1493		`]`
1621	1494
1622		-	`[[package]]`
1623		-	`name = "k256"`
1624		-	`version = "0.13.4"`
1625		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
1626		-	`checksum = "f6e3919bbaa2945715f0bb6d3934a173d1e9a59ac23767fbaaef277265a7411b"`
1627		-	`dependencies = [`
1628		-	`"cfg-if",`
1629		-	`"ecdsa",`
1630		-	`"elliptic-curve",`
1631		-	`"sha2",`
1632		-	`]`
1633		-
1634	1495		`[[package]]`
1635	1496		`name = "lazy_static"`
1636	1497		`version = "1.5.0"`

2066	1927		`dependencies = [`
2067	1928		`"async-trait",`
2068	1929		`"bech32",`
2069		-	`"bip32",`
2070	1930		`"bip39",`
2071		-	`"bs58",`
2072	1931		`"clap",`
2073	1932		`"clap_complete",`
2074	1933		`"crossterm",`

2082	1941		`"regex",`
2083	1942		`"reqwest",`
2084	1943		`"ring",`
2085		-	`"ripemd",`
2086	1944		`"rustls",`
2087	1945		`"serde",`
2088	1946		`"serde_json",`

2144	2002		`source = "registry+https://github.com/rust-lang/crates.io-index"`
2145	2003		`checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a"`
2146	2004
2147		-	`[[package]]`
2148		-	`name = "pbkdf2"`
2149		-	`version = "0.12.2"`
2150		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
2151		-	`checksum = "f8ed6a7761f76e3b9f92dfb0a60a6a6477c61024b775147ff0973a02653abaf2"`
2152		-	`dependencies = [`
2153		-	`"digest",`
2154		-	`"hmac",`
2155		-	`]`
2156		-
2157	2005		`[[package]]`
2158	2006		`name = "percent-encoding"`
2159	2007		`version = "2.3.2"`

2590	2438		`"webpki-roots",`
2591	2439		`]`
2592	2440
2593		-	`[[package]]`
2594		-	`name = "rfc6979"`
2595		-	`version = "0.4.0"`
2596		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
2597		-	`checksum = "f8dd2a808d456c4a54e300a23e9f5a67e122c3024119acbfd73e3bf664491cb2"`
2598		-	`dependencies = [`
2599		-	`"hmac",`
2600		-	`"subtle",`
2601		-	`]`
2602		-
2603	2441		`[[package]]`
2604	2442		`name = "ring"`
2605	2443		`version = "0.17.14"`

2614	2452		`"windows-sys 0.52.0",`
2615	2453		`]`
2616	2454
2617		-	`[[package]]`
2618		-	`name = "ripemd"`
2619		-	`version = "0.1.3"`
2620		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
2621		-	`checksum = "bd124222d17ad93a644ed9d011a40f4fb64aa54275c08cc216524a9ea82fb09f"`
2622		-	`dependencies = [`
2623		-	`"digest",`
2624		-	`]`
2625		-
2626	2455		`[[package]]`
2627	2456		`name = "rustc-hash"`
2628	2457		`version = "2.1.2"`

2738	2567		`source = "registry+https://github.com/rust-lang/crates.io-index"`
2739	2568		`checksum = "94143f37725109f92c262ed2cf5e59bce7498c01bcc1502d7b9afe439a4e9f49"`
2740	2569
2741		-	`[[package]]`
2742		-	`name = "sec1"`
2743		-	`version = "0.7.3"`
2744		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
2745		-	`checksum = "d3e97a565f76233a6003f9f5c54be1d9c5bdfa3eccfb189469f11ec4901c47dc"`
2746		-	`dependencies = [`
2747		-	`"base16ct",`
2748		-	`"der",`
2749		-	`"generic-array",`
2750		-	`"subtle",`
2751		-	`"zeroize",`
2752		-	`]`
2753		-
2754		-	`[[package]]`
2755		-	`name = "secp256k1"`
2756		-	`version = "0.27.0"`
2757		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
2758		-	`checksum = "25996b82292a7a57ed3508f052cfff8640d38d32018784acd714758b43da9c8f"`
2759		-	`dependencies = [`
2760		-	`"secp256k1-sys",`
2761		-	`]`
2762		-
2763		-	`[[package]]`
2764		-	`name = "secp256k1-sys"`
2765		-	`version = "0.8.2"`
2766		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
2767		-	`checksum = "4473013577ec77b4ee3668179ef1186df3146e2cf2d927bd200974c6fe60fd99"`
2768		-	`dependencies = [`
2769		-	`"cc",`
2770		-	`]`
2771		-
2772	2570		`[[package]]`
2773	2571		`name = "security-framework"`
2774	2572		`version = "3.7.0"`

2948	2746		`"libc",`
2949	2747		`]`
2950	2748
2951		-	`[[package]]`
2952		-	`name = "signature"`
2953		-	`version = "2.2.0"`
2954		-	`source = "registry+https://github.com/rust-lang/crates.io-index"`
2955		-	`checksum = "77549399552de45a898a580c1b41d445bf730df867cc44e6c0233bbc4b8329de"`
2956		-	`dependencies = [`
2957		-	`"digest",`
2958		-	`"rand_core 0.6.4",`
2959		-	`]`
2960		-
2961	2749		`[[package]]`
2962	2750		`name = "simd-adler32"`
2963	2751		`version = "0.3.10"`

31	31		`unicode-width = "0.2"`
32	32		`unicode-segmentation = "1"`
33	33		`bip39 = { version = "2", features = ["rand"] }`
34		-	`bip32 = "0.5"`
35		-	`bech32 = "0.11"`
36		-	`ripemd = "0.1"`
37		-	`bs58 = { version = "0.5", features = ["check"] }`
38	34		`regex = "1"`
39	35		`zeroize = "1"`
40	36		# `oa computer up` speaks the Phoenix controller socket. The same pair the

286	286		`// unconditionally.`
287	287		`#[cfg(unix)]`
288	288		`{`
289		-	`use std::os::unix::process::CommandExt;`
290	289		`command.process_group(0);`
291	290		`}`
292	291		`if let Some(environment) = &self.env {`

52	52		`pub enum Commands {`
53	53		`/// Authentication management`
54	54		`Auth(AuthArgs),`
55		-	`/// Agent and human identity operations`
56		-	`Identity(IdentityArgs),`
57	55		`/// OpenAgents issue tracker operations`
58	56		`Issue(IssueArgs),`
59	57		`/// OpenAgents project management`

154	152		`},`
155	153		`}`
156	154
157		-	`#[derive(Args, Debug)]`
158		-	`pub struct IdentityArgs {`
159		-	`#[command(subcommand)]`
160		-	`pub action: IdentityAction,`
161		-	`}`
162		-
163		-	`#[derive(Subcommand, Debug)]`
164		-	`pub enum IdentityAction {`
165		-	`/// Show the public identity derived from the stored seed, and what protects it`
166		-	`Show,`
167		-	`/// Generate a new seed phrase and store it encrypted under the OS keychain`
168		-	`Create {`
169		-	`#[arg(long, default_value_t = 12, help = "Words in the new seed phrase: 12 for 128 bits, 24 for 256")]`
170		-	`words: usize,`
171		-	`#[arg(long, help = "Replace the stored seed. The identity and wallet it derives are lost")]`
172		-	`force: bool,`
173		-	`},`
174		-	`/// Restore an existing seed phrase, read from standard input`
175		-	`Import {`
176		-	`#[arg(long, help = "Replace the stored seed. The identity and wallet it derives are lost")]`
177		-	`force: bool,`
178		-	`},`
179		-	`/// Print the stored seed phrase`
180		-	`Backup,`
181		-	`/// Delete the stored seed`
182		-	`Forget {`
183		-	`#[arg(long, help = "Confirm that the identity and wallet are to be destroyed")]`
184		-	`force: bool,`
185		-	`},`
186		-	`}`
187		-
188	155		`#[derive(Args, Debug)]`
189	156		`pub struct IssueArgs {`
190	157		`#[command(subcommand)]`

1376	1343
1377	1344		`match command {`
1378	1345		`Commands::Auth(auth) => run_auth(auth.action, &endpoint, &cred_store, cli.json).await,`
1379		-	`Commands::Identity(identity) => run_identity(identity.action, cli.json),`
1380	1346		`Commands::Issue(issue) => run_issue(issue.action, &api_base, token, cli.json).await,`
1381	1347		`Commands::Project(project) => {`
1382	1348		`run_project(project.action, &api_base, token, cli.json).await`

3709	3675		`/// encrypted or is readable text is not something a person can infer from the`
3710	3676		`/// path, and the plaintext fallback is only honest if the surface that shows an`
3711	3677		`/// identity says so every time.`
3712		-	`fn print_identity(`
3713		-	`identity: &crate::identity::SeedIdentity,`
3714		-	`protection: crate::identity::SeedProtection,`
3715		-	`seed_path: &std::path::Path,`
3716		-	`json: bool,`
3717		-	`) {`
3718		-	`if json {`
3719		-	`let value = serde_json::json!({`
3720		-	`"schema": "openagents.cli_identity.v1",`
3721		-	`"profile": identity.profile,`
3722		-	`"npub": identity.npub,`
3723		-	`"nostr_public_key": identity.nostr_public_key_hex,`
3724		-	`"nostr_derivation_path": identity.nostr_derivation_path,`
3725		-	`"wallet_address": identity.wallet_address,`
3726		-	`"wallet_public_key": identity.wallet_public_key_hex,`
3727		-	`"wallet_fingerprint": identity.wallet_fingerprint_hex,`
3728		-	`"wallet_derivation_path": identity.wallet_derivation_path,`
3729		-	`"spending_rail": serde_json::Value::Null,`
3730		-	`"seed_path": seed_path,`
3731		-	`"seed_protection": protection.id(),`
3732		-	`"seed_encrypted_at_rest": protection.encrypted_at_rest(),`
3733		-	`});`
3734		-	`println!("{}", value);`
3735		-	`return;`
3736		-	`}`
3737		-	`println!("Identity: {}", identity.npub);`
3738		-	`println!(" public key {}", identity.nostr_public_key_hex);`
3739		-	`println!(" path {}", identity.nostr_derivation_path);`
3740		-	`println!("Wallet: {}", identity.wallet_address);`
3741		-	`println!(" public key {}", identity.wallet_public_key_hex);`
3742		-	`println!(" fingerprint {}", identity.wallet_fingerprint_hex);`
3743		-	`println!(" path {}", identity.wallet_derivation_path);`
3744		-	`println!("Profile: {}", identity.profile);`
3745		-	`println!("{}", protection.describe(seed_path));`
3746		-	`}`
3747		-
3748		-	`fn run_identity(action: IdentityAction, json: bool) {`
3749		-	`use crate::identity::{`
3750		-	`derive_seed_identity, generate_seed_phrase, is_valid_seed_phrase, SeedStore,`
3751		-	`};`
3752		-	`let store = SeedStore::new(None);`
3753		-	`let seed_path = store.path();`
3754		-
3755		-	`let refuse_if_seed_exists = \|force: bool\| {`
3756		-	`if store.present() && !force {`
3757		-	`fail(&format!(`
3758		-	"A seed is already stored at {}. Back it up with `oa identity backup` first, \
3759		-	`then pass --force to replace it.",`
3760		-	`seed_path.display()`
3761		-	`));`
3762		-	`}`
3763		-	`};`
3764		-
3765		-	`// Migrate before reading. A seed written before the CLI could encrypt one is`
3766		-	`// plaintext until something moves it, and the move is the same atomic rename`
3767		-	// either way, so the first `show` after an upgrade protects it rather than
3768		-	// waiting for the next `import`. `forget` and the write paths do not call
3769		-	`// this: sealing a seed that is about to be deleted or replaced would mint a`
3770		-	`// wrapping key for nothing.`
3771		-	`let protection_in_force = \|\| {`
3772		-	`store`
3773		-	`.protect()`
3774		-	`.unwrap_or_else(\|e\| fail(&e.to_string()))`
3775		-	`.unwrap_or_else(\|\| {`
3776		-	`store`
3777		-	`.available_protection()`
3778		-	`.unwrap_or_else(\|e\| fail(&e.to_string()))`
3779		-	`})`
3780		-	`};`
3781		-
3782		-	`match action {`
3783		-	`IdentityAction::Show => {`
3784		-	`let protection = protection_in_force();`
3785		-	`let identity = store.identity().unwrap_or_else(\|e\| fail(&e.to_string()));`
3786		-	`print_identity(&identity, protection, &seed_path, json);`
3787		-	`}`
3788		-	`IdentityAction::Create { words, force } => {`
3789		-	`if words != 12 && words != 24 {`
3790		-	`fail("--words must be 12 or 24.");`
3791		-	`}`
3792		-	`refuse_if_seed_exists(force);`
3793		-
3794		-	`let phrase = generate_seed_phrase(words).unwrap_or_else(\|e\| fail(&e.to_string()));`
3795		-	`// Derive before storing: a phrase that cannot be derived from must not`
3796		-	`// become the identity on this machine.`
3797		-	`let identity = derive_seed_identity(&phrase).unwrap_or_else(\|e\| fail(&e.to_string()));`
3798		-	`let (_, stored_protection) = store.store_phrase(&phrase).unwrap_or_else(\|e\| {`
3799		-	`fail(&format!(`
3800		-	`"The new seed could not be stored at {}: {}",`
3801		-	`seed_path.display(),`
3802		-	`e`
3803		-	`))`
3804		-	`});`
3805		-
3806		-	`if !json {`
3807		-	`println!(`
3808		-	`"Wrote a new {}-word seed to {} (mode 0600).",`
3809		-	`words,`
3810		-	`seed_path.display()`
3811		-	`);`
3812		-	`println!(`
3813		-	"Back it up now with `oa identity backup`. Nothing else on this machine \
3814		-	`can recover it."`
3815		-	`);`
3816		-	`}`
3817		-	`print_identity(&identity, stored_protection, &seed_path, json);`
3818		-	`}`
3819		-	`IdentityAction::Import { force } => {`
3820		-	`refuse_if_seed_exists(force);`
3821		-
3822		-	`let mut phrase = String::new();`
3823		-	`if std::io::Read::read_to_string(&mut std::io::stdin(), &mut phrase).is_err() {`
3824		-	`fail("No seed phrase was provided on standard input.");`
3825		-	`}`
3826		-	`let phrase = phrase.trim().to_string();`
3827		-	`if phrase.is_empty() {`
3828		-	`fail("No seed phrase was provided on standard input.");`
3829		-	`}`
3830		-	`// The phrase is never echoed back, not even the part that parsed.`
3831		-	`if !is_valid_seed_phrase(&phrase) {`
3832		-	`fail(`
3833		-	`"That is not a valid English BIP-39 seed phrase. Check the word count \`
3834		-	`(12, 15, 18, 21, or 24) and the spelling of each word.",`
3835		-	`);`
3836		-	`}`
3837		-	`let identity = derive_seed_identity(&phrase).unwrap_or_else(\|e\| fail(&e.to_string()));`
3838		-	`let (_, stored_protection) = store.store_phrase(&phrase).unwrap_or_else(\|e\| {`
3839		-	`fail(&format!(`
3840		-	`"The seed could not be stored at {}: {}",`
3841		-	`seed_path.display(),`
3842		-	`e`
3843		-	`))`
3844		-	`});`
3845		-
3846		-	`if !json {`
3847		-	`println!("Stored the seed at {} (mode 0600).", seed_path.display());`
3848		-	`}`
3849		-	`print_identity(&identity, stored_protection, &seed_path, json);`
3850		-	`}`
3851		-	`IdentityAction::Backup => {`
3852		-	`// The one command that prints the secret, and the one that refuses`
3853		-	`// --json: the phrase must not land in machine-collected output.`
3854		-	`if json {`
3855		-	`fail(`
3856		-	"`oa identity backup` does not support --json. The seed phrase must not \
3857		-	`land in machine-collected output; run it without --json and copy the \`
3858		-	`phrase yourself.",`
3859		-	`);`
3860		-	`}`
3861		-	`let protection = protection_in_force();`
3862		-	`let phrase = match store.read_phrase() {`
3863		-	`Ok(Some(phrase)) => phrase,`
3864		-	`Ok(None) => fail(&crate::identity::IdentityError::NoSeed.to_string()),`
3865		-	`Err(e) => fail(&e.to_string()),`
3866		-	`};`
3867		-	`println!(`
3868		-	`"This is the only secret on this machine. Anyone holding it holds the \`
3869		-	`identity and the wallet."`
3870		-	`);`
3871		-	`// The person about to write the phrase down is the one who most`
3872		-	`// needs to know whether the copy they are leaving behind on disk is`
3873		-	`// encrypted or is the phrase itself.`
3874		-	`println!("{}", protection.describe(&seed_path));`
3875		-	`println!("{}", phrase);`
3876		-	`}`
3877		-	`IdentityAction::Forget { force } => {`
3878		-	`if !force {`
3879		-	`fail(&format!(`
3880		-	`"Deleting {} destroys the identity and the wallet it derives. Back the \`
3881		-	phrase up with `oa identity backup`, then pass --force.",
3882		-	`seed_path.display()`
3883		-	`));`
3884		-	`}`
3885		-	`let removed = store.forget().unwrap_or_else(\|e\| {`
3886		-	`fail(&format!(`
3887		-	`"The seed at {} could not be removed: {}",`
3888		-	`seed_path.display(),`
3889		-	`e`
3890		-	`))`
3891		-	`});`
3892		-	`if json {`
3893		-	`println!(`
3894		-	`"{}",`
3895		-	`serde_json::json!({`
3896		-	`"schema": "openagents.cli_identity_forget.v1",`
3897		-	`"removed": removed,`
3898		-	`"seed_path": seed_path,`
3899		-	`})`
3900		-	`);`
3901		-	`} else if removed {`
3902		-	`println!("Removed {}.", seed_path.display());`
3903		-	`} else {`
3904		-	`println!("No seed was stored at {}.", seed_path.display());`
3905		-	`}`
3906		-	`}`
3907		-	`}`
3908		-	`}`
3909	3678
3910	3679		`// ---------------------------------------------------------------------------`
3911	3680		`// trace`

710	710		// started. `process_group` is a Unix extension and is absent on Windows.
711	711		`#[cfg(unix)]`
712	712		`{`
713		-	`use std::os::unix::process::CommandExt;`
714	713		`spawn.process_group(0);`
715	714		`}`
716	715		`let mut child = match spawn.spawn() {`

25	25		`pub mod fleet;`
26	26		`pub mod foreign_resume;`
27	27		`pub mod forum;`
28		-	`pub mod identity;`
29	28		`pub mod interactive;`
30	29		`pub mod markdown;`
31	30		`pub mod memory_client;`

7	7		`use openagents_cli::workspace::Isolation;`
8	8		`use openagents_cli::tools::{HarnessToolRegistry, ToolCall};`
9	9		`use openagents_cli::auth::CredentialStore;`
10		-	`use openagents_cli::identity::{derive_seed_identity, SeedStore};`
11	10		`use openagents_cli::tracker::{slug_from_remote_url, IssueListOptions, RepoTarget, TrackerClient};`
12	11		`use openagents_cli::repo::{admitted_credential_request, parse_git_credential_request};`
13	12		`use openagents_cli::box_client::BoxClient;`

38	37		`assert!(store.find_token().unwrap().is_none());`
39	38		`}`
40	39
41		-	/// The old assertion checked only that the strings began `npub1`/`nsec1`, which
42		-	/// a `format!` over a SHA-256 digest satisfied. These assert the derivation.
43		-	`/// The full contract, including parity with the TypeScript CLI, is in`
44		-	/// `tests/identity_test.rs`.
45		-	`#[test]`
46		-	`fn test_identity_generation_issue_75() {`
47		-	`let phrase = "abandon abandon abandon abandon abandon abandon \`
48		-	`abandon abandon abandon abandon abandon about";`
49		-	`let identity = derive_seed_identity(phrase).unwrap();`
50		-	`assert_eq!(`
51		-	`identity.npub,`
52		-	`"npub1az708q3kd9zy6z6f44zav5ygvdwelkzspf6mtusttx47lft2z38sghk0w7"`
53		-	`);`
54		-	`assert!(derive_seed_identity("not a mnemonic").is_err());`
55		-
56		-	`// Nothing is persisted until something asks for it to be.`
57		-	`let directory = tempfile::tempdir().unwrap();`
58		-	`let store = SeedStore::new(Some(directory.path().join("identity")));`
59		-	`assert!(!store.present());`
60		-	`assert!(store.identity().is_err());`
61		-	`}`
62		-
63	40		/// The old assertion was `issues.is_empty() \|\| !issues.is_empty()`, which is
64	41		`/// true of every value of every list and so held while the client asked for`
65	42		/// a route that does not exist and answered the refusal with `Ok(vec![])`.

1	-	`//! Derivation parity with the TypeScript CLI, and the storage contract.`
2	-	`//!`
3	-	//! The vectors below are the ones `packages/openagents-cli/test/seed-identity.test.ts`
4	-	//! freezes, which in turn are `packages/sovereign-identity/src/contract/vectors.ts`.
5	-	//! An `npub` that differs between the two CLIs is a different account, so a change
6	-	`//! to the Rust derivation fails here rather than silently reissuing every identity.`
7	-
8	-	`use openagents_cli::identity::{`
9	-	`derive_seed_identity, generate_seed_phrase, is_valid_seed_phrase, InMemoryKeyStore, NoKeyStore,`
10	-	`SeedKeyStore, SeedProtection, SeedStore, DERIVATION_PROFILE_ID, NOSTR_DERIVATION_PATH,`
11	-	`WALLET_DERIVATION_PATH,`
12	-	`};`
13	-	`use std::path::{Path, PathBuf};`
14	-
15	-	`/// A store whose wrapping key lives for the length of one test. Nothing here`
16	-	`/// reaches the developer's own OS keychain, and nothing depends on the machine`
17	-	`/// running the tests having one.`
18	-	`fn sealed_store(directory: &Path) -> SeedStore {`
19	-	`SeedStore::with_key_store(`
20	-	`directory.join("identity"),`
21	-	`Box::new(InMemoryKeyStore::new()),`
22	-	`)`
23	-	`}`
24	-
25	-	`/// A store on a machine with no keychain: CI, a container, an agent host.`
26	-	`fn headless_store(directory: &Path) -> SeedStore {`
27	-	`SeedStore::with_key_store(directory.join("identity"), Box::new(NoKeyStore))`
28	-	`}`
29	-
30	-	`fn seed_bytes(path: &PathBuf) -> String {`
31	-	`std::fs::read_to_string(path).expect("the seed file is on disk")`
32	-	`}`
33	-
34	-	`/// The canonical published BIP-39 test phrase. It is not a secret and never was;`
35	-	`/// it exists so a deterministic answer can be committed.`
36	-	`const TEST_PHRASE: &str =`
37	-	`"abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon abandon about";`
38	-
39	-	`const FROZEN_NPUB: &str = "npub1az708q3kd9zy6z6f44zav5ygvdwelkzspf6mtusttx47lft2z38sghk0w7";`
40	-	`const FROZEN_NOSTR_PUBKEY_HEX: &str =`
41	-	`"e8bcf3823669444d0b49ad45d65088635d9fd8500a75b5f20b59abefa56a144f";`
42	-	`const FROZEN_WALLET_PUBKEY_HEX: &str =`
43	-	`"03aaeb52dd7494c361049de67cc680e83ebcbbbdbeb13637d92cd845f70308af5e";`
44	-	`const FROZEN_WALLET_FINGERPRINT_HEX: &str = "d986ed01";`
45	-	`const FROZEN_WALLET_ADDRESS: &str = "1LqBGSKuX5yYUonjxT5qGfpUsXKYYWeabA";`
46	-
47	-	`#[test]`
48	-	`fn derives_the_frozen_identity_from_the_published_test_phrase() {`
49	-	`let identity = derive_seed_identity(TEST_PHRASE).expect("the test phrase is valid BIP-39");`
50	-
51	-	`assert_eq!(identity.profile, DERIVATION_PROFILE_ID);`
52	-	`assert_eq!(identity.npub, FROZEN_NPUB);`
53	-	`assert_eq!(identity.nostr_public_key_hex, FROZEN_NOSTR_PUBKEY_HEX);`
54	-	`assert_eq!(identity.nostr_derivation_path, NOSTR_DERIVATION_PATH);`
55	-	`assert_eq!(identity.wallet_public_key_hex, FROZEN_WALLET_PUBKEY_HEX);`
56	-	`assert_eq!(`
57	-	`identity.wallet_fingerprint_hex,`
58	-	`FROZEN_WALLET_FINGERPRINT_HEX`
59	-	`);`
60	-	`assert_eq!(identity.wallet_address, FROZEN_WALLET_ADDRESS);`
61	-	`assert_eq!(identity.wallet_derivation_path, WALLET_DERIVATION_PATH);`
62	-	`}`
63	-
64	-	`#[test]`
65	-	`fn the_npub_is_real_bech32_not_a_prefixed_hex_string() {`
66	-	`let identity = derive_seed_identity(TEST_PHRASE).unwrap();`
67	-
68	-	`// A NIP-19 npub is 63 characters. The fabricated implementation produced 37.`
69	-	`assert_eq!(identity.npub.len(), 63, "npub: {}", identity.npub);`
70	-
71	-	`// It decodes, the checksum holds, and the payload is the x-only public key.`
72	-	`let (hrp, payload) = bech32::decode(&identity.npub).expect("npub is valid bech32");`
73	-	`assert_eq!(hrp.as_str(), "npub");`
74	-	`assert_eq!(payload.len(), 32);`
75	-	`assert_eq!(`
76	-	`payload`
77	-	`.iter()`
78	-	`.map(\|b\| format!("{:02x}", b))`
79	-	`.collect::<String>(),`
80	-	`FROZEN_NOSTR_PUBKEY_HEX`
81	-	`);`
82	-
83	-	// Bech32 has no uppercase and excludes `1`, `b`, `i`, and `o` from its alphabet.
84	-	`let data = &identity.npub["npub1".len()..];`
85	-	`assert!(`
86	-	`data.chars()`
87	-	`.all(\|c\| "qpzry9x8gf2tvdw0s3jn54khce6mua7l".contains(c)),`
88	-	`"npub payload is outside the bech32 alphabet: {}",`
89	-	`data`
90	-	`);`
91	-	`}`
92	-
93	-	`#[test]`
94	-	`fn is_insensitive_to_surrounding_whitespace_but_not_to_the_words() {`
95	-	`let spaced = format!(" {}\n", TEST_PHRASE.replace(' ', " "));`
96	-	`assert_eq!(derive_seed_identity(&spaced).unwrap().npub, FROZEN_NPUB);`
97	-	`}`
98	-
99	-	`#[test]`
100	-	`fn refuses_a_phrase_whose_checksum_does_not_hold() {`
101	-	`let wrong_checksum = TEST_PHRASE.replace("about", "abandon");`
102	-	`assert!(!is_valid_seed_phrase(&wrong_checksum));`
103	-	`assert!(derive_seed_identity(&wrong_checksum).is_err());`
104	-	`}`
105	-
106	-	`#[test]`
107	-	`fn generated_phrases_come_from_os_entropy_not_a_constant() {`
108	-	`// The defect this replaces derived every key from a string literal, so two`
109	-	`// empty HOMEs on two machines minted the same npub. Distinct phrases and`
110	-	`// distinct identities are the property that proves the literal is gone.`
111	-	`let first = generate_seed_phrase(12).unwrap();`
112	-	`let second = generate_seed_phrase(12).unwrap();`
113	-	`assert_ne!(first, second);`
114	-	`assert_eq!(first.split_whitespace().count(), 12);`
115	-	`assert_eq!(`
116	-	`generate_seed_phrase(24).unwrap().split_whitespace().count(),`
117	-	`24`
118	-	`);`
119	-
120	-	`let first_identity = derive_seed_identity(&first).unwrap();`
121	-	`let second_identity = derive_seed_identity(&second).unwrap();`
122	-	`assert_ne!(first_identity.npub, second_identity.npub);`
123	-	`assert_ne!(`
124	-	`first_identity.wallet_address,`
125	-	`second_identity.wallet_address`
126	-	`);`
127	-
128	-	`// Every generated phrase must validate, or it could not be written back.`
129	-	`assert!(is_valid_seed_phrase(&first));`
130	-	`}`
131	-
132	-	`#[test]`
133	-	`fn writes_the_phrase_0600_and_reads_it_back_unchanged() {`
134	-	`let directory = tempfile::tempdir().unwrap();`
135	-	`let store = sealed_store(directory.path());`
136	-
137	-	`assert!(!store.present());`
138	-	`assert!(store.read_phrase().unwrap().is_none());`
139	-	`assert!(store.identity().is_err(), "no seed means no identity");`
140	-
141	-	`let path = store.write_phrase(TEST_PHRASE).unwrap();`
142	-	`assert!(store.present());`
143	-	`assert_eq!(store.read_phrase().unwrap().as_deref(), Some(TEST_PHRASE));`
144	-
145	-	`// Create, then show: the identity shown is the one just created.`
146	-	`assert_eq!(store.identity().unwrap().npub, FROZEN_NPUB);`
147	-
148	-	`#[cfg(unix)]`
149	-	`{`
150	-	`use std::os::unix::fs::PermissionsExt;`
151	-	`let file_mode = std::fs::metadata(&path).unwrap().permissions().mode() & 0o777;`
152	-	`assert_eq!(`
153	-	`file_mode, 0o600,`
154	-	`"seed file must not be readable by anyone else"`
155	-	`);`
156	-	`let dir_mode = std::fs::metadata(path.parent().unwrap())`
157	-	`.unwrap()`
158	-	`.permissions()`
159	-	`.mode()`
160	-	`& 0o777;`
161	-	`assert_eq!(dir_mode, 0o700);`
162	-	`}`
163	-	`}`
164	-
165	-	`/// The claim under test is not "encryption was called". It is that the bytes a`
166	-	/// backup tool, a sync client, or an agent reading `$HOME` would carry away are
167	-	`/// not the phrase, and not any word of it.`
168	-	`#[test]`
169	-	`fn the_sealed_seed_file_holds_no_word_of_the_phrase() {`
170	-	`let directory = tempfile::tempdir().unwrap();`
171	-	`let store = sealed_store(directory.path());`
172	-	`let path = store.write_phrase(TEST_PHRASE).unwrap();`
173	-
174	-	`let on_disk = seed_bytes(&path);`
175	-	`assert!(`
176	-	`!on_disk.contains(TEST_PHRASE),`
177	-	`"the phrase is in the seed file"`
178	-	`);`
179	-	`assert!(`
180	-	`!on_disk.contains("abandon"),`
181	-	`"a phrase word is in the seed file"`
182	-	`);`
183	-	`assert!(`
184	-	`!on_disk.contains("about"),`
185	-	`"a phrase word is in the seed file"`
186	-	`);`
187	-
188	-	`// And it is the sealed envelope, not some other encoding of the same words:`
189	-	`// a base64 or hex of the phrase would pass the checks above.`
190	-	`assert!(on_disk.contains("chacha20-poly1305"));`
191	-	`assert!(on_disk.contains("openagents.cli_identity_seed.v1"));`
192	-	`assert_eq!(`
193	-	`store.protection_on_disk().unwrap(),`
194	-	`Some(SeedProtection::OsKeychain)`
195	-	`);`
196	-	`assert!(SeedProtection::OsKeychain.encrypted_at_rest());`
197	-
198	-	`// The wrapping key is not in the identity directory. If it were, the file`
199	-	`// and the key would travel together and the encryption would be theatre.`
200	-	`for entry in std::fs::read_dir(path.parent().unwrap()).unwrap() {`
201	-	`let entry = entry.unwrap();`
202	-	`assert_eq!(`
203	-	`entry.file_name(),`
204	-	`"seed",`
205	-	`"the identity directory holds a second file: {:?}",`
206	-	`entry.file_name()`
207	-	`);`
208	-	`}`
209	-	`}`
210	-
211	-	`/// Two writes of the same phrase produce different bytes, which is what a fresh`
212	-	`/// nonce per write buys and what a fixed-nonce or ECB-shaped mistake would fail.`
213	-	`#[test]`
214	-	`fn every_seal_uses_a_fresh_nonce() {`
215	-	`let directory = tempfile::tempdir().unwrap();`
216	-	`let store = sealed_store(directory.path());`
217	-
218	-	`let path = store.write_phrase(TEST_PHRASE).unwrap();`
219	-	`let first = seed_bytes(&path);`
220	-	`store.write_phrase(TEST_PHRASE).unwrap();`
221	-	`let second = seed_bytes(&path);`
222	-
223	-	`assert_ne!(`
224	-	`first, second,`
225	-	`"two seals of one phrase produced one ciphertext"`
226	-	`);`
227	-	`assert_eq!(store.read_phrase().unwrap().as_deref(), Some(TEST_PHRASE));`
228	-	`}`
229	-
230	-	`/// A sealed seed whose key is gone must say so. Reporting "no seed" would read`
231	-	`/// as an identity that vanished, and the next command would offer a new one.`
232	-	`#[test]`
233	-	`fn a_sealed_seed_without_its_key_is_an_error_not_an_absence() {`
234	-	`let directory = tempfile::tempdir().unwrap();`
235	-	`let keys = std::sync::Arc::new(InMemoryKeyStore::new());`
236	-	`let store = SeedStore::with_key_store(`
237	-	`directory.path().join("identity"),`
238	-	`Box::new(SharedKeys(keys.clone())),`
239	-	`);`
240	-	`store.write_phrase(TEST_PHRASE).unwrap();`
241	-	`keys.delete();`
242	-
243	-	`assert!(store.present(), "the file is still there");`
244	-	`let message = store.read_phrase().unwrap_err().to_string();`
245	-	`assert!(message.contains("encrypted"), "message: {message}");`
246	-	`assert!(!message.contains("abandon"), "the error quoted the phrase");`
247	-	`}`
248	-
249	-	`/// A wrapping key that does not open the envelope is not a reason to mint a new`
250	-	`/// one, which would silently orphan the seed.`
251	-	`#[test]`
252	-	`fn a_wrong_key_refuses_rather_than_returning_rubbish() {`
253	-	`let directory = tempfile::tempdir().unwrap();`
254	-	`let keys = std::sync::Arc::new(InMemoryKeyStore::new());`
255	-	`let store = SeedStore::with_key_store(`
256	-	`directory.path().join("identity"),`
257	-	`Box::new(SharedKeys(keys.clone())),`
258	-	`);`
259	-	`store.write_phrase(TEST_PHRASE).unwrap();`
260	-	`keys.put(&[7u8; 32]).unwrap();`
261	-
262	-	`assert!(store.read_phrase().is_err());`
263	-	`assert!(store.identity().is_err());`
264	-	`}`
265	-
266	-	`/// The headless case, stated rather than assumed: with no keychain the phrase is`
267	-	`/// on disk as text, and the store says exactly that so the CLI can print it.`
268	-	`#[test]`
269	-	`fn without_a_keychain_the_store_says_the_seed_is_plaintext() {`
270	-	`let directory = tempfile::tempdir().unwrap();`
271	-	`let store = headless_store(directory.path());`
272	-
273	-	`let (path, protection) = store.store_phrase(TEST_PHRASE).unwrap();`
274	-	`assert_eq!(protection, SeedProtection::PlaintextFile);`
275	-	`assert!(!protection.encrypted_at_rest());`
276	-	`assert_eq!(protection.id(), "plaintext_file");`
277	-	`assert!(seed_bytes(&path).contains(TEST_PHRASE));`
278	-	`assert_eq!(store.read_phrase().unwrap().as_deref(), Some(TEST_PHRASE));`
279	-
280	-	`// The sentence a person sees must name the file and say what is not covered.`
281	-	`let described = protection.describe(&path);`
282	-	`assert!(`
283	-	`described.contains(&path.display().to_string()),`
284	-	`"{described}"`
285	-	`);`
286	-	`assert!(described.contains("readable text"), "{described}");`
287	-	`assert!(described.contains("backup tool"), "{described}");`
288	-	`assert!(!described.contains(TEST_PHRASE));`
289	-	`}`
290	-
291	-	`/// The migration. Start from a seed file written by the CLI that could not`
292	-	`/// encrypt one, and prove both halves: the identity is unchanged, and the`
293	-	`/// plaintext is gone.`
294	-	`#[test]`
295	-	`fn migrates_an_existing_plaintext_seed_and_leaves_no_plaintext_behind() {`
296	-	`let directory = tempfile::tempdir().unwrap();`
297	-	`let identity_directory = directory.path().join("identity");`
298	-	`std::fs::create_dir_all(&identity_directory).unwrap();`
299	-	`let path = identity_directory.join("seed");`
300	-
301	-	`// Exactly what the previous CLI wrote: the phrase, one line, mode 0600.`
302	-	`std::fs::write(&path, format!("{}\n", TEST_PHRASE)).unwrap();`
303	-	`#[cfg(unix)]`
304	-	`{`
305	-	`use std::os::unix::fs::PermissionsExt;`
306	-	`std::fs::set_permissions(&path, std::fs::Permissions::from_mode(0o600)).unwrap();`
307	-	`}`
308	-	`let before = derive_seed_identity(TEST_PHRASE).unwrap();`
309	-
310	-	`let store = sealed_store(directory.path());`
311	-	`assert_eq!(`
312	-	`store.protection_on_disk().unwrap(),`
313	-	`Some(SeedProtection::PlaintextFile),`
314	-	`"the fixture must start as plaintext or this test proves nothing"`
315	-	`);`
316	-
317	-	`assert_eq!(store.protect().unwrap(), Some(SeedProtection::OsKeychain));`
318	-
319	-	`// The identity did not move.`
320	-	`let after = store.identity().unwrap();`
321	-	`assert_eq!(after, before);`
322	-	`assert_eq!(after.npub, FROZEN_NPUB);`
323	-
324	-	`// The plaintext is gone, from that file and from every other file the`
325	-	`// migration could have left in the directory.`
326	-	`let on_disk = seed_bytes(&path);`
327	-	`assert!(!on_disk.contains(TEST_PHRASE));`
328	-	`assert!(!on_disk.contains("abandon"));`
329	-	`for entry in std::fs::read_dir(&identity_directory).unwrap() {`
330	-	`let entry = entry.unwrap();`
331	-	`let text = std::fs::read_to_string(entry.path()).unwrap_or_default();`
332	-	`assert!(`
333	-	`!text.contains("abandon"),`
334	-	`"{:?} still holds the phrase",`
335	-	`entry.file_name()`
336	-	`);`
337	-	`}`
338	-
339	-	`// Migrating twice is not a second identity, and not a second file.`
340	-	`assert_eq!(store.protect().unwrap(), Some(SeedProtection::OsKeychain));`
341	-	`assert_eq!(store.identity().unwrap(), before);`
342	-	`}`
343	-
344	-	`/// On a machine with no keychain the migration must not pretend. It reports the`
345	-	`/// plaintext store and leaves the file exactly as it found it.`
346	-	`#[test]`
347	-	`fn migration_on_a_headless_machine_reports_plaintext_rather_than_faking_it() {`
348	-	`let directory = tempfile::tempdir().unwrap();`
349	-	`let identity_directory = directory.path().join("identity");`
350	-	`std::fs::create_dir_all(&identity_directory).unwrap();`
351	-	`let path = identity_directory.join("seed");`
352	-	`std::fs::write(&path, format!("{}\n", TEST_PHRASE)).unwrap();`
353	-
354	-	`let store = headless_store(directory.path());`
355	-	`assert_eq!(`
356	-	`store.protect().unwrap(),`
357	-	`Some(SeedProtection::PlaintextFile)`
358	-	`);`
359	-	`assert!(seed_bytes(&path).contains(TEST_PHRASE));`
360	-	`assert_eq!(store.identity().unwrap().npub, FROZEN_NPUB);`
361	-	`}`
362	-
363	-	`/// A seed sealed by one CLI opens in the other. Both write the same envelope`
364	-	`/// under the same key, so this asserts the format, not the language.`
365	-	`#[test]`
366	-	`fn a_sealed_envelope_opens_from_a_second_store_holding_the_same_key() {`
367	-	`let directory = tempfile::tempdir().unwrap();`
368	-	`let key = [42u8; 32];`
369	-
370	-	`let writer = SeedStore::with_key_store(directory.path().join("identity"), {`
371	-	`let store = InMemoryKeyStore::new();`
372	-	`store.put(&key).unwrap();`
373	-	`Box::new(store)`
374	-	`});`
375	-	`writer.write_phrase(TEST_PHRASE).unwrap();`
376	-
377	-	`let reader = SeedStore::with_key_store(directory.path().join("identity"), {`
378	-	`let store = InMemoryKeyStore::new();`
379	-	`store.put(&key).unwrap();`
380	-	`Box::new(store)`
381	-	`});`
382	-	`assert_eq!(reader.read_phrase().unwrap().as_deref(), Some(TEST_PHRASE));`
383	-	`assert_eq!(reader.identity().unwrap().npub, FROZEN_NPUB);`
384	-	`}`
385	-
386	-	`#[test]`
387	-	`fn refuses_to_store_a_phrase_that_could_not_be_recovered() {`
388	-	`let directory = tempfile::tempdir().unwrap();`
389	-	`let store = sealed_store(directory.path());`
390	-
391	-	`assert!(store.write_phrase("not a real mnemonic at all").is_err());`
392	-	`assert!(`
393	-	`!store.present(),`
394	-	`"an invalid phrase must leave no file behind"`
395	-	`);`
396	-	`}`
397	-
398	-	`#[test]`
399	-	`fn forget_deletes_the_seed_the_key_and_is_idempotent() {`
400	-	`let directory = tempfile::tempdir().unwrap();`
401	-	`let keys = std::sync::Arc::new(InMemoryKeyStore::new());`
402	-	`let store = SeedStore::with_key_store(`
403	-	`directory.path().join("identity"),`
404	-	`Box::new(SharedKeys(keys.clone())),`
405	-	`);`
406	-
407	-	`store.write_phrase(TEST_PHRASE).unwrap();`
408	-	`assert!(`
409	-	`keys.get().unwrap().is_some(),`
410	-	`"a key was minted for the seal"`
411	-	`);`
412	-	`assert!(store.forget().unwrap(), "the first forget removes the seed");`
413	-	`assert!(!store.present());`
414	-	`assert!(!store.path().exists());`
415	-	`assert!(`
416	-	`keys.get().unwrap().is_none(),`
417	-	`"forget left the wrapping key behind for an identity that is gone"`
418	-	`);`
419	-	`assert!(`
420	-	`!store.forget().unwrap(),`
421	-	`"a second forget reports nothing to remove"`
422	-	`);`
423	-	`}`
424	-
425	-	/// Lets a test hold on to the key store the `SeedStore` owns, so it can take the
426	-	`/// key away or replace it mid-test.`
427	-	`struct SharedKeys(std::sync::Arc<InMemoryKeyStore>);`
428	-
429	-	`impl SeedKeyStore for SharedKeys {`
430	-	`fn get(&self) -> Result<Option<[u8; 32]>, openagents_cli::identity::IdentityError> {`
431	-	`self.0.get()`
432	-	`}`
433	-	`fn put(&self, key: &[u8; 32]) -> Result<(), openagents_cli::identity::IdentityError> {`
434	-	`self.0.put(key)`
435	-	`}`
436	-	`fn delete(&self) {`
437	-	`self.0.delete()`
438	-	`}`
439	-	`}`

23	23
24	24		`use openagents_cli::auth::{CredentialStore, PendingDeviceAuthorization, PendingStore, Secret};`
25	25		`use openagents_cli::computer::{ComputerPaths, PolicyConfig};`
26		-	`use openagents_cli::identity::{generate_seed_phrase, NoKeyStore, SeedStore};`
27	26		`use std::io::{BufRead, BufReader, Read, Write};`
28	27		`use std::net::TcpListener;`
29	28		`use std::path::Path;`

301	300		`assert_no_staging_files_left(directory.path());`
302	301		`}`
303	302
304		-	`/// Concurrent seed writes all succeed and the seed that remains is one somebody`
305		-	`/// actually wrote.`
306		-	`///`
307		-	/// The seed store staged through a fixed `seed.tmp` and removed it before each
308		-	`/// write, so two writers could put half of one phrase and half of another in`
309		-	`/// the file that then got renamed over the seed. A seed is the one file where`
310		-	`/// that costs an identity outright: nothing recovers a mnemonic that is six`
311		-	`/// words from one wallet and six from another.`
312		-	`#[test]`
313		-	`fn concurrent_seed_writes_all_succeed_and_the_seed_still_opens() {`
314		-	`let directory = tempfile::tempdir().expect("an identity directory");`
315		-	`let at = directory.path().join("identity");`
316		-	`let phrases: Vec<String> = (0..WRITERS)`
317		-	`.map(\|_\| generate_seed_phrase(12).expect("a phrase"))`
318		-	`.collect();`
319		-
320		-	`let written = phrases.clone();`
321		-	`let target = at.clone();`
322		-	`let results = race(move \|index\| {`
323		-	`SeedStore::with_key_store(target.clone(), Box::new(NoKeyStore))`
324		-	`.write_phrase(&written[index])`
325		-	`});`
326		-	`for (index, result) in results.iter().enumerate() {`
327		-	`assert!(`
328		-	`result.is_ok(),`
329		-	`"writer {index} was told the seed was not written: {}",`
330		-	`result.as_ref().unwrap_err()`
331		-	`);`
332		-	`}`
333		-
334		-	`let store = SeedStore::with_key_store(at.clone(), Box::new(NoKeyStore));`
335		-	`let recovered = store`
336		-	`.read_phrase()`
337		-	`.expect("the seed opens")`
338		-	`.expect("a seed is stored");`
339		-	`assert!(`
340		-	`phrases.contains(&recovered),`
341		-	`"the stored seed is not any phrase that was written, so two writes were spliced"`
342		-	`);`
343		-	`#[cfg(unix)]`
344		-	`{`
345		-	`assert_eq!(`
346		-	`mode_of(&store.path()),`
347		-	`0o600,`
348		-	`"the seed is readable to the machine"`
349		-	`);`
350		-	`assert_eq!(`
351		-	`mode_of(&at),`
352		-	`0o700,`
353		-	`"the identity directory is open to the machine"`
354		-	`);`
355		-	`}`
356		-	`assert_no_staging_files_left(&at);`
357		-	`}`
358		-
359		-	/// A reader of `computer.json` never sees a policy it cannot decode, however
360		-	`/// many writers are working on it.`
361		-	`///`
362		-	/// `computer.json` wrote in place — truncate the target, then write it — so
363		-	/// between those two calls the file on disk is empty, and any `oa` that read
364		-	`/// the policy in that window was told its own configuration is not valid JSON.`
365		-	`/// It is the policy file: the answer decides which commands the Computer will`
366		-	/// run at all, and `load_config` is right to refuse a file it cannot read
367		-	`/// rather than fall back to a default the owner never chose. So the refusal`
368		-	`/// lands on a reader that did nothing wrong.`
369		-	`///`
370		-	/// Writers alone would not settle this. Two small `write` calls usually land
371		-	`/// whole, so a test that only writes passes against the broken version. Readers`
372		-	`/// are what make the truncate window visible, and staging elsewhere and`
373		-	`/// renaming is what closes it: the target is only ever the old file or the new`
374		-	`/// one.`
375	303		`#[test]`
376	304		`fn a_reader_never_sees_a_half_written_computer_policy() {`
377	305		`/// Enough passes for the truncate window to be observed if it is open.`