feat: 添加 OpenNexus 认证 Core 与 Stronghold 基础能力

backend/app/config.py

@@ -32,7 +32,7 @@ class Settings:
 def get_settings() -> Settings:
     data_dir = Path(os.getenv("APP_DATA_DIR", str(BACKEND_DIR / "data")))
     return Settings(
-        name=os.getenv("APP_NAME", "Notes Agent AI Core"),
+        name=os.getenv("APP_NAME", "OpenNexus AI Core"),
         version=os.getenv("APP_VERSION", "0.1.0"),
         environment=os.getenv("APP_ENVIRONMENT", "development"),
         host=os.getenv("APP_HOST", "127.0.0.1"),

backend/app/container.py

@@ -13,6 +13,7 @@ from app.providers.credentials import (
     ChainedCredentialResolver,
     EncryptedCredentialStore,
     EnvironmentCredentialResolver,
+    HostCredentialStore,
 )
 
 
@@ -21,7 +22,7 @@ class ApplicationContainer:
     providers: ProviderRegistry
     provider_factory: ProviderFactory
     model_routing: ModelRoutingService
-    credentials: EncryptedCredentialStore
+    credentials: EncryptedCredentialStore | HostCredentialStore
     tools: ToolRegistry
     permissions: PermissionManager
     skills: SkillRuntime
@@ -32,9 +33,9 @@ class ApplicationContainer:
 
 def build_container() -> ApplicationContainer:
     settings = get_settings()
-    credentials = EncryptedCredentialStore()
+    credentials = HostCredentialStore() if settings.environment == "desktop" else EncryptedCredentialStore()
     provider_factory = ProviderFactory(
-        ChainedCredentialResolver(credentials, EnvironmentCredentialResolver())
+        credentials if settings.environment == "desktop" else ChainedCredentialResolver(credentials, EnvironmentCredentialResolver())
     )
     providers = ProviderRegistry(provider_factory)
     providers.register(

backend/app/host_bridge.py

@@ -0,0 +1,67 @@
+"""Synchronous, bounded RPC over the inherited Host pipes (never HTTP or env secrets)."""
+from __future__ import annotations
+import json
+import queue
+import threading
+import uuid
+
+
+class HostBridge:
+    def __init__(self, reader, writer):
+        self.reader, self.writer = reader, writer
+        self.pending = {}
+        self.lock = threading.Lock()
+        self.closed = threading.Event()
+
+    def call(self, method, **params):
+        request_id = uuid.uuid4().hex
+        result = queue.Queue(maxsize=1)
+        payload = json.dumps({"rpc": method, "request_id": request_id, "params": params}, separators=(",", ":"))
+        if len(payload.encode()) > 131072:
+            raise RuntimeError("HOST_REQUEST_TOO_LARGE")
+        with self.lock:
+            if self.closed.is_set():
+                raise RuntimeError("HOST_UNAVAILABLE")
+            self.pending[request_id] = result
+            try:
+                self.writer.write(payload + "\n")
+                self.writer.flush()
+            except Exception:
+                self.pending.pop(request_id, None)
+                raise RuntimeError("HOST_UNAVAILABLE") from None
+        try:
+            response = result.get(timeout=30)
+            if response.get("error"):
+                raise RuntimeError(response["error"])
+            return response.get("result")
+        except queue.Empty:
+            raise RuntimeError("HOST_TIMEOUT") from None
+        finally:
+            with self.lock:
+                self.pending.pop(request_id, None)
+
+    def listen(self, on_disconnect):
+        try:
+            while line := self.reader.readline(131073):
+                if len(line) > 131072:
+                    break
+                message = json.loads(line)
+                with self.lock:
+                    target = self.pending.get(message.get("request_id"))
+                if target is not None:
+                    try:
+                        target.put_nowait(message)
+                    except queue.Full:
+                        pass
+        finally:
+            self.closed.set()
+            with self.lock:
+                for result in self.pending.values():
+                    try:
+                        result.put_nowait({"error": "HOST_UNAVAILABLE"})
+                    except queue.Full:
+                        pass
+            on_disconnect()
+
+
+active: HostBridge | None = None

backend/app/providers/credentials.py

@@ -4,6 +4,7 @@ import json
 import os
 import re
 import threading
+from contextlib import contextmanager
 from pathlib import Path
 from typing import ClassVar, Protocol
 
@@ -24,6 +25,37 @@ class CredentialResolver(Protocol):
     def resolve(self, credential_id: str | None) -> str | None: ...
 
 
+class HostCredentialStore:
+    """Desktop-only adapter. It cannot fall back to Fernet or environment keys."""
+    @staticmethod
+    def _call(method, **params):
+        from app.host_bridge import active
+        if active is None:
+            raise CredentialStoreError("HOST_UNAVAILABLE")
+        try:
+            return active.call("credentials." + method, **params)
+        except RuntimeError as exc:
+            raise CredentialStoreError(str(exc)) from None
+
+    def resolve(self, credential_id):
+        return self._call("resolve", id=credential_id) if credential_id else None
+
+    def has(self, credential_id):
+        return bool(self._call("has", id=credential_id))
+
+    def put(self, credential_id, secret):
+        self._call("put", id=credential_id, secret=secret)
+
+    def delete(self, credential_id):
+        return bool(self._call("delete", id=credential_id))
+
+    def delete_many(self, credential_ids):
+        return set(self._call("delete_many", ids=credential_ids))
+
+    def move_many(self, replacements):
+        self._call("move_many", replacements=replacements)
+
+
 def validate_provider_credential_id(credential_id: str | None) -> None:
     """阻止 Provider 和通用凭据 API 跨入 Plugin 私有命名空间。"""
 
@@ -62,6 +94,33 @@ class EncryptedCredentialStore:
     def __init__(self) -> None:
         self._lock = threading.RLock()
 
+    @contextmanager
+    def _operation_lock(self):
+        with self._lock:
+            key_path, _ = self._paths()
+            key_path.parent.mkdir(parents=True, exist_ok=True)
+            with (key_path.parent / ".migration.lock").open("a+b") as stream:
+                stream.seek(0)
+                try:
+                    if os.name == "nt":
+                        import msvcrt
+                        msvcrt.locking(stream.fileno(), msvcrt.LK_NBLCK, 1)
+                    else:
+                        import fcntl
+                        fcntl.flock(stream.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+                except OSError:
+                    raise CredentialStoreError("MIGRATION_SOURCE_BUSY") from None
+                try:
+                    if (key_path.parent / ".opennexus-owner.json").exists():
+                        raise CredentialStoreError("CREDENTIAL_OWNER_DESKTOP")
+                    yield
+                finally:
+                    stream.seek(0)
+                    if os.name == "nt":
+                        msvcrt.locking(stream.fileno(), msvcrt.LK_UNLCK, 1)
+                    else:
+                        fcntl.flock(stream.fileno(), fcntl.LOCK_UN)
+
     @staticmethod
     def _validate_id(credential_id: str) -> None:
         if not _CREDENTIAL_ID.fullmatch(credential_id):
@@ -155,7 +214,7 @@ class EncryptedCredentialStore:
         self._validate_id(credential_id)
         if not secret:
             raise CredentialStoreError("Credential secret cannot be empty.")
-        with self._lock:
+        with self._operation_lock():
             tokens = self._read_tokens()
             token = self._fernet().encrypt(secret.encode("utf-8")).decode("ascii")
             tokens[credential_id] = token
@@ -165,7 +224,7 @@ class EncryptedCredentialStore:
         if not credential_id:
             return None
         self._validate_id(credential_id)
-        with self._lock:
+        with self._operation_lock():
             token = self._read_tokens().get(credential_id)
             if token is None:
                 return None
@@ -176,12 +235,12 @@ class EncryptedCredentialStore:
 
     def has(self, credential_id: str) -> bool:
         self._validate_id(credential_id)
-        with self._lock:
+        with self._operation_lock():
             return credential_id in self._read_tokens()
 
     def delete(self, credential_id: str) -> bool:
         self._validate_id(credential_id)
-        with self._lock:
+        with self._operation_lock():
             tokens = self._read_tokens()
             removed = tokens.pop(credential_id, None) is not None
             if removed:
@@ -193,7 +252,7 @@ class EncryptedCredentialStore:
 
         for credential_id in credential_ids:
             self._validate_id(credential_id)
-        with self._lock:
+        with self._operation_lock():
             tokens = self._read_tokens()
             removed = {
                 credential_id
@@ -212,7 +271,7 @@ class EncryptedCredentialStore:
         for old_id, new_id in replacements.items():
             self._validate_id(old_id)
             self._validate_id(new_id)
-        with self._lock:
+        with self._operation_lock():
             tokens = self._read_tokens()
             changed = False
             for old_id, new_id in replacements.items():

backend/app/services/coordination.py

@@ -11,6 +11,8 @@ def web_vault_ownership():
     """与 Rust fs2 使用同一 OS 文件锁，避免首次切换时两套写入者重叠。"""
     from app.config import get_settings
     from app.errors import ApiError
+    if get_settings().environment == 'desktop':
+        raise ApiError(409, 'WORKSPACE_OWNER_DESKTOP', '桌面笔记写入必须通过 Rust Host')
     root = get_settings().vault_path
     managed = root / '.ainote'
     if managed.is_symlink() or (hasattr(managed, 'is_junction') and managed.is_junction()):

backend/app/sidecar.py

@@ -0,0 +1,151 @@
+"""Authenticated desktop entry point. Bootstrap secrets travel only over stdin.
+
+stdout is reserved for the bounded handshake; application output goes to stderr.
+The parent keeps stdin open for the lifetime of the Core. EOF shuts it down.
+"""
+from __future__ import annotations
+
+import asyncio
+import hashlib
+import hmac
+import json
+import os
+from pathlib import Path
+import re
+import socket
+import sys
+import threading
+
+PROTOCOL = 1
+MAX_BOOTSTRAP = 16384
+
+
+def bootstrap(line: bytes) -> dict:
+    if len(line) > MAX_BOOTSTRAP or not line.endswith(b"\n"):
+        raise ValueError("CORE_BOOTSTRAP_INVALID")
+    try:
+        value = json.loads(line)
+        if value["protocol"] != PROTOCOL:
+            raise ValueError("PROTOCOL_INCOMPATIBLE")
+        for key in ("secret", "challenge", "generation"):
+            if not isinstance(value[key], str) or not re.fullmatch(r"[0-9a-f]{64}", value[key]):
+                raise ValueError("CORE_BOOTSTRAP_INVALID")
+        if not Path(value["data_dir"]).is_absolute():
+            raise ValueError("CORE_BOOTSTRAP_INVALID")
+        if type(value.get("launcher_pid")) is not int or not 0 < value["launcher_pid"] <= 0xFFFFFFFF:
+            raise ValueError("CORE_BOOTSTRAP_INVALID")
+    except (KeyError, TypeError, json.JSONDecodeError) as exc:
+        raise ValueError("CORE_BOOTSTRAP_INVALID") from exc
+    return value
+
+
+def proof(secret: str, challenge: str, generation: str, pid: int, port: int, launcher_pid: int) -> str:
+    message = f"{PROTOCOL}:{challenge}:{generation}:{launcher_pid}:{pid}:{port}".encode("ascii")
+    return hmac.new(bytes.fromhex(secret), message, hashlib.sha256).hexdigest()
+
+
+class SessionAuth:
+    """Outermost ASGI layer: unauthenticated input never reaches business logs."""
+
+    def __init__(self, app, secret: str, generation: str, port: int):
+        self.app = app
+        self.expected = f"Bearer {secret}".encode("ascii")
+        self.generation = generation.encode("ascii")
+        self.host = f"127.0.0.1:{port}".encode("ascii")
+
+    async def __call__(self, scope, receive, send):
+        if scope["type"] not in {"http", "websocket"}:
+            return await self.app(scope, receive, send)
+        headers = scope.get("headers", [])
+        def single(name):
+            values = [v for k, v in headers if k.lower() == name]
+            return values[0] if len(values) == 1 else b""
+        authorized = (
+            hmac.compare_digest(single(b"authorization"), self.expected)
+            and hmac.compare_digest(single(b"x-core-generation"), self.generation)
+            and single(b"host") == self.host
+            # Host transport does not send Origin. Browser traffic is never trusted.
+            and not any(k.lower() == b"origin" for k, _ in headers)
+        )
+        if not authorized:
+            if scope["type"] == "websocket":
+                await send({"type": "websocket.close", "code": 1008})
+            else:
+                body = b'{"error":{"code":"AUTH_REQUIRED"}}'
+                await send({"type": "http.response.start", "status": 401,
+                            "headers": [(b"content-type", b"application/json"),
+                                        (b"cache-control", b"no-store")]})
+                await send({"type": "http.response.body", "body": body})
+            return
+        await self.app(scope, receive, send)
+
+
+def main() -> int:
+    channel = sys.stdin.buffer
+    try:
+        config = bootstrap(channel.readline(MAX_BOOTSTRAP + 1))
+    except (ValueError, OSError):
+        print("CORE_BOOTSTRAP_INVALID", file=sys.stderr)
+        return 2
+    handshake = sys.stdout
+    sys.stdout = sys.stderr
+    root = Path(config["data_dir"])
+    # Override every data path before importing the application/container.
+    os.environ.update({
+        "APP_ENVIRONMENT": "desktop", "APP_DATA_DIR": str(root),
+        "APP_DB_PATH": str(root / "app.db"),
+        "APP_VAULT_PATH": str(root / "unbound-vault"),
+        "APP_ATTACHMENTS_PATH": str(root / "attachments"),
+        "APP_EXPORTS_PATH": str(root / "exports"),
+        "APP_BENCHMARK_DATASETS_PATH": str(root / "benchmarks"),
+    })
+    import uvicorn
+    from app import host_bridge
+    host_bridge.active = host_bridge.HostBridge(channel, handshake)
+    from app.main import app
+
+    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+    sock.bind(("127.0.0.1", 0))
+    sock.listen(128)
+    port = sock.getsockname()[1]
+    app.openapi_url = None
+    app.router.routes[:] = [r for r in app.router.routes
+                           if getattr(r, "path", "") not in {"/docs", "/redoc", "/openapi.json", "/docs/oauth2-redirect"}]
+    server = uvicorn.Server(uvicorn.Config(
+        SessionAuth(app, config["secret"], config["generation"], port),
+        log_config=None, access_log=False, lifespan="on", timeout_graceful_shutdown=5,
+    ))
+
+    def watch_parent():
+        host_bridge.active.listen(lambda: setattr(server, "should_exit", True))
+
+    threading.Thread(target=watch_parent, name="host-lifetime", daemon=True).start()
+
+    async def run():
+        task = asyncio.create_task(server.serve(sockets=[sock]))
+        for _ in range(3000):
+            if task.done():
+                await task
+                return
+            if server.started:
+                payload = {"protocol": PROTOCOL, "pid": os.getpid(), "port": port,
+                           "generation": config["generation"], "launcher_pid": config["launcher_pid"],
+                           "proof": proof(config["secret"], config["challenge"],
+                                          config["generation"], os.getpid(), port, config["launcher_pid"])}
+                handshake.write(json.dumps(payload, separators=(",", ":")) + "\n")
+                handshake.flush()
+                await task
+                return
+            await asyncio.sleep(0.01)
+        server.should_exit = True
+        await task
+        raise RuntimeError("CORE_READY_TIMEOUT")
+    try:
+        asyncio.run(run())
+    finally:
+        sock.close()
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())