deploy(S4): Blender headless pipeline + WebAR client + backend fixes (part 2)

modules/remote_unlock.py

@@ -0,0 +1,392 @@
+from __future__ import annotations
+
+"""Unlock this PC's JARVIS session from the phone, from anywhere.
+
+WHY THIS EXISTS
+---------------
+core.commands.run_command() refuses every command until the session is activated
+for the current boot (modules.activation_state). Satisfying that used to require
+activation_system.py: press a hotkey AT the keyboard, read a code from Telegram,
+type it into a tkinter window. That is a physical-presence control, so "control
+my PC from any part of the world" was impossible by construction — and the
+scheduled task that runs activation_system.py is disabled anyway, so the session
+could not be activated at all. Every command relayed from the phone was silently
+dropped.
+
+WHAT THE EXE DOES, AND WHY IT COULD NOT BE REUSED
+-------------------------------------------------
+src-tauri/src/main.rs::cmd_unlock_system takes a password and checks it with
+vault.rs::cmd_check_lock_password, which verifies an Argon2id hash read from
+<app_data>/vault/master.hash. That file does not exist here — and it never can:
+`master.hash` appears exactly once in the whole Rust source, in that read. There
+is no cmd_set_lock_password, no writer, nothing. So the `if !path.exists()`
+branch is the only branch that ever runs, and it returns Ok(true) — the exe's
+unlock accepts ANY password, permanently, by construction. It is not a
+credential this module can defer to.
+
+WHERE THE CREDENTIAL LIVES INSTEAD
+----------------------------------
+backend.services.usb_vault — the project's own encrypted secret store. Only a
+PBKDF2-SHA256 hash is stored, never the password. That matters here: the vault
+logs a warning that without VAULT_MASTER_PASSWORD its key sits in the same
+database as the ciphertext, so anyone with the file can decrypt it. Storing a
+salted hash means that even a fully decrypted vault yields no usable password.
+
+(usb_vault was itself unimportable on this machine until the unconditional
+`import wmi` in usb_monitor.py was made optional — every vault lookup here had
+been silently answering "no such secret". Its vault_secrets table is empty.)
+
+backend/vault/credential_vault.py — the Argon2id + AES-GCM store the Master
+Vault Ledger advertises — is not an option either: it imports argon2.low_level
+inside a try/except that sets hash_secret_raw = None, and _derive_key then
+raises RuntimeError("argon2-cffi is not installed") on every store() and
+retrieve(). argon2-cffi is not installed in this venv, so that class cannot
+currently encrypt or decrypt anything at all.
+
+That is also why this module does its own PBKDF2 instead of calling into either
+one: the credential check has to keep working in the venv, under the system
+Python that also runs the relay, and inside the frozen sidecar.
+
+THE SECOND FACTOR IS THE POINT
+------------------------------
+The cloud token already authenticates the request, and it is compiled into the
+APK. The unlock password is a genuine second factor: an attacker who extracts
+the token from the APK still cannot unlock the desktop. That is why the password
+is never transmitted or stored in plaintext, and why attempts are rate-limited
+with the same escalation the exe uses.
+"""
+
+import base64
+import hashlib
+import hmac
+import json
+import os
+import secrets
+import subprocess
+import time
+from pathlib import Path
+from typing import Any
+
+ROOT = Path(__file__).resolve().parents[1]
+STATE_PATH = ROOT / "data" / "remote_unlock_state.json"
+UNLOCK_JSON = ROOT / "data" / "session_unlocked.json"
+
+VAULT_KEY_NAME = "PC_UNLOCK_PASSWORD"
+
+# PBKDF2 rather than Argon2 deliberately: hashlib is stdlib, so this works
+# identically in the venv, under the system Python that also runs the relay, and
+# inside the frozen sidecar. argon2-cffi is installed in none of them, and a
+# credential check that depends on an optional package is a credential check
+# that silently stops working.
+_PBKDF2_ITERATIONS = 240_000
+_SALT_BYTES = 16
+_ALGO = "pbkdf2_sha256"
+
+MIN_PASSWORD_LENGTH = 8
+
+# Matches the exe's escalation in main.rs::cmd_unlock_system.
+_SOFT_LOCK_AFTER = 6
+_HARD_LOCK_AFTER = 9
+_SOFT_LOCK_SECONDS = 60
+_HARD_LOCK_SECONDS = 3600
+
+
+# --------------------------------------------------------------------------- #
+# vault access
+# --------------------------------------------------------------------------- #
+def _vault():
+    from backend.services import usb_vault
+    return usb_vault
+
+
+def has_unlock_password() -> bool:
+    try:
+        return bool((_vault().get_secret(VAULT_KEY_NAME) or "").strip())
+    except Exception:
+        return False
+
+
+def set_unlock_password(password: str) -> dict[str, Any]:
+    """Enrol (or change) the remote-unlock password. One-time setup."""
+    password = (password or "").strip()
+    if len(password) < MIN_PASSWORD_LENGTH:
+        return {"ok": False,
+                "message": f"Password must be at least {MIN_PASSWORD_LENGTH} characters."}
+    salt = secrets.token_bytes(_SALT_BYTES)
+    digest = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt,
+                                 _PBKDF2_ITERATIONS)
+    stored = "$".join([
+        _ALGO,
+        str(_PBKDF2_ITERATIONS),
+        base64.b64encode(salt).decode("ascii"),
+        base64.b64encode(digest).decode("ascii"),
+    ])
+    try:
+        _vault().set_secret(VAULT_KEY_NAME, stored)
+    except Exception as exc:
+        return {"ok": False, "message": f"Could not write to the vault: {exc}"}
+    _reset_attempts()
+    return {"ok": True, "message": "Remote unlock password saved."}
+
+
+def _verify_password(password: str) -> bool:
+    try:
+        stored = (_vault().get_secret(VAULT_KEY_NAME) or "").strip()
+    except Exception:
+        return False
+    if not stored:
+        return False
+    try:
+        algo, iterations, salt_b64, hash_b64 = stored.split("$")
+        if algo != _ALGO:
+            return False
+        salt = base64.b64decode(salt_b64)
+        expected = base64.b64decode(hash_b64)
+    except Exception:
+        return False
+    candidate = hashlib.pbkdf2_hmac("sha256", (password or "").encode("utf-8"),
+                                    salt, int(iterations))
+    return hmac.compare_digest(candidate, expected)
+
+
+# --------------------------------------------------------------------------- #
+# attempt limiting (on disk: the relay gets restarted by its supervisor, and an
+# attacker must not be able to reset the counter by making it crash)
+# --------------------------------------------------------------------------- #
+def _read_state() -> dict[str, Any]:
+    try:
+        data = json.loads(STATE_PATH.read_text(encoding="utf-8"))
+        return data if isinstance(data, dict) else {}
+    except Exception:
+        return {}
+
+
+def _write_state(state: dict[str, Any]) -> None:
+    try:
+        STATE_PATH.parent.mkdir(parents=True, exist_ok=True)
+        STATE_PATH.write_text(json.dumps(state), encoding="utf-8")
+    except Exception:
+        pass
+
+
+def _reset_attempts() -> None:
+    _write_state({"attempts": 0, "locked_until": 0})
+
+
+def _lock_remaining() -> int:
+    state = _read_state()
+    remaining = float(state.get("locked_until") or 0) - time.time()
+    return int(remaining) if remaining > 0 else 0
+
+
+def _record_failure() -> int:
+    state = _read_state()
+    attempts = int(state.get("attempts") or 0) + 1
+    state["attempts"] = attempts
+    if attempts >= _HARD_LOCK_AFTER:
+        state["locked_until"] = time.time() + _HARD_LOCK_SECONDS
+    elif attempts >= _SOFT_LOCK_AFTER:
+        state["locked_until"] = time.time() + _SOFT_LOCK_SECONDS
+    _write_state(state)
+    return attempts
+
+
+# --------------------------------------------------------------------------- #
+# unlock
+# --------------------------------------------------------------------------- #
+def _boot_id() -> int:
+    """Must match modules.activation_state._boot_id exactly, or the marker this
+    writes will not satisfy the gate it is meant to open."""
+    try:
+        import psutil  # type: ignore
+        return int(psutil.boot_time())
+    except Exception:
+        return int(time.time() // 3600)
+
+
+def is_unlocked() -> bool:
+    try:
+        from modules.activation_state import is_activated_for_this_boot
+        return bool(is_activated_for_this_boot())
+    except Exception:
+        return False
+
+
+def _write_unlock_marker() -> None:
+    """Scoped to this boot on purpose: a reboot re-locks the machine, exactly as
+    the original design intended. Unlocking remotely must never be more
+    permanent than unlocking at the keyboard."""
+    UNLOCK_JSON.parent.mkdir(parents=True, exist_ok=True)
+    UNLOCK_JSON.write_text(json.dumps({
+        "unlocked_at": time.time(),
+        "boot_id": _boot_id(),
+        "source": "remote_unlock",
+    }), encoding="utf-8")
+
+
+def status() -> dict[str, Any]:
+    if not has_unlock_password():
+        return {"ok": False, "enrolled": False, "unlocked": is_unlocked(),
+                "message": "No unlock password is set on this PC yet. Run "
+                           "tools/set_unlock_password.py once on the desktop."}
+    if is_unlocked():
+        return {"ok": True, "enrolled": True, "unlocked": True,
+                "message": "This PC is already unlocked for this boot."}
+    locked = _lock_remaining()
+    if locked:
+        return {"ok": False, "enrolled": True, "unlocked": False,
+                "message": f"Too many wrong attempts. Try again in {locked} seconds."}
+    return {"ok": True, "enrolled": True, "unlocked": False,
+            "message": "This PC is locked. Send: unlock pc <your password>"}
+
+
+def verify_and_unlock(password: str, launch_app: bool | None = None) -> dict[str, Any]:
+    """Check the password and, if it is right, unlock this boot.
+
+    NO WINDOW IS OPENED. Unlocking is a remote action — the user is not at the
+    machine, so popping the JARVIS GUI on an unattended desktop achieves nothing
+    and leaves a window sitting open on a PC nobody is looking at. What the user
+    actually wants after unlocking is a PC that is attached to the cloud and will
+    run commands, and that is what this reports on.
+
+    The relay process that calls this IS the cloud link, so by the time we get
+    here the PC is connected by construction — the command arrived over that very
+    socket. Everything the command stack needs runs in-process.
+
+    Set JARVIS_LAUNCH_ON_UNLOCK=1 (or pass launch_app=True) to also start the
+    desktop app, for anyone who does want the window.
+    """
+    if launch_app is None:
+        launch_app = os.environ.get("JARVIS_LAUNCH_ON_UNLOCK", "").strip().lower() in (
+            "1", "true", "yes")
+    if is_unlocked():
+        return {"ok": True, "already_unlocked": True,
+                "message": "This PC is already unlocked."}
+
+    if not has_unlock_password():
+        return {"ok": False,
+                "message": "No unlock password is set on this PC yet. Run "
+                           "tools/set_unlock_password.py once on the desktop."}
+
+    locked = _lock_remaining()
+    if locked:
+        return {"ok": False,
+                "message": f"Too many wrong attempts. Try again in {locked} seconds."}
+
+    if not _verify_password(password):
+        attempts = _record_failure()
+        wait = _lock_remaining()
+        if wait:
+            return {"ok": False,
+                    "message": f"Wrong password. Locked out for {wait} seconds."}
+        return {"ok": False,
+                "message": f"Wrong password. ({attempts} failed attempt(s).)"}
+
+    _reset_attempts()
+    _write_unlock_marker()
+
+    launched = _launch_jarvis() if launch_app else False
+    message = "PC unlocked and connected to your cloud. Send commands now."
+    if launched:
+        message = "PC unlocked and connected. JARVIS is opening on the desktop."
+    return {"ok": True, "launched": launched, "unlocked": True,
+            "message": message}
+
+
+# --------------------------------------------------------------------------- #
+# launching the desktop app
+# --------------------------------------------------------------------------- #
+def _jarvis_exe() -> Path | None:
+    """Installed app first, then a local release build.
+
+    Installed wins: it is what the user means by "the JARVIS app", and a build in
+    target/release can be stale or half-written mid-compile.
+    """
+    for path in (
+        Path(r"C:\Program Files\JARVIS-OS\JARVIS-OS.exe"),
+        ROOT / "src-tauri" / "target" / "release" / "JARVIS OS.exe",
+        ROOT / "src-tauri" / "target" / "release" / "JARVIS-OS.exe",
+    ):
+        try:
+            if path.exists():
+                return path
+        except Exception:
+            continue
+    return None
+
+
+def jarvis_is_running() -> bool:
+    try:
+        import psutil  # type: ignore
+        for proc in psutil.process_iter(["name"]):
+            if (proc.info.get("name") or "").lower() in ("jarvis-os.exe", "jarvis os.exe"):
+                return True
+    except Exception:
+        pass
+    return False
+
+
+def _launch_jarvis() -> bool:
+    """Start the JARVIS desktop app. Already-running counts as success: the
+    caller asked for JARVIS to be up, and it is."""
+    if jarvis_is_running():
+        return True
+    exe = _jarvis_exe()
+    if exe is None:
+        return False
+    try:
+        # DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP so the app outlives the
+        # relay that started it. The relay is restarted by its supervisor and
+        # must never take the user's desktop app down with it.
+        creationflags = (0x00000008 | 0x00000200) if os.name == "nt" else 0
+        subprocess.Popen(
+            [str(exe)],
+            cwd=str(exe.parent),
+            creationflags=creationflags,
+            stdout=subprocess.DEVNULL,
+            stderr=subprocess.DEVNULL,
+            close_fds=True,
+        )
+        return True
+    except Exception:
+        return False
+
+
+# --------------------------------------------------------------------------- #
+# command-surface parsing
+# --------------------------------------------------------------------------- #
+_STATUS_PHRASES = {
+    "unlock pc", "unlock my pc", "unlock the pc", "unlock computer",
+    "unlock my computer", "unlock jarvis", "unlock", "pc status", "unlock status",
+}
+
+
+def parse_unlock_command(text: str) -> tuple[str, str] | None:
+    """Recognise unlock phrases in a free-text command.
+
+    Returns ("status", "") | ("unlock", password) | None.
+
+    The relay matches this BEFORE handing the text to run_command(), because
+    run_command is precisely the thing that refuses everything while locked —
+    routing the unlock through it would deadlock.
+
+    Case is preserved for the password (passwords are case-sensitive); only the
+    command keywords are lowercased for matching.
+    """
+    if not text:
+        return None
+    raw = " ".join(str(text).strip().split())
+    if not raw:
+        return None
+    lowered = raw.lower()
+
+    if lowered in _STATUS_PHRASES:
+        return ("status", "")
+
+    for prefix in ("unlock pc ", "unlock my pc ", "unlock computer ",
+                   "unlock jarvis ", "unlock "):
+        if lowered.startswith(prefix):
+            password = raw[len(prefix):].strip()
+            if password:
+                return ("unlock", password)
+    return None