安全模型
ACP v2.1：WebSocket 上的 Noise IK，套件 Noise_IK_25519_ChaChaPoly_BLAKE2b。没有共享 token。Channel 只能看见握手字节和 AEAD 密文。
Security
ACP v2.1: Noise IK over WebSocket, suite Noise_IK_25519_ChaChaPoly_BLAKE2b. No shared token. Channel sees handshake bytes and AEAD ciphertext only.
身份
Identity
- App 首次启动生成长期 X25519 静态密钥，放进系统安全存储
- 指纹：
SHA-256(publicKey)前 8 字节的 hex（16 个字符） - Agent 把设备公钥写入
authorized_peers.json；不在名单里则握手后以 4405 关闭，不交换数据帧 - App 用 URL 里的
#fp=钉死 Agent 公钥，中继替换身份会 4403
- The app generates a long-term X25519 static key on first launch and stores it in platform secure storage
- Fingerprint: first 8 bytes of
SHA-256(publicKey)as 16 hex chars - The agent allowlists the device in
authorized_peers.json; unknown peers close with 4405 after handshake, no data frames - The app pins the agent key via
#fp=; a swapped identity at the relay closes with 4403
能防什么
Protected against
- 路径上的被动窃听（含 Channel 运营者）
- 中继主动 MITM 换钥
- 重放 / 乱序（Noise 计数器）
- 协议降级（prologue 绑定
shepaw-acp/2.1，与 v2 / v1 硬切断） - 前向保密：每次重连新的 ephemeral
- 共享 token 泄露：v2.1 里已经没有 token
- Passive wiretaps on the path, including a Channel operator
- Active MITM at the relay swapping keys
- Replay / reordering (Noise counters)
- Protocol downgrade (prologue binds
shepaw-acp/2.1; hard cutover from v2 / v1) - Forward secrecy: fresh ephemerals on every reconnect
- Shared-token leak: v2.1 has no token
故意不防什么
Deliberately out of scope
能在你机器上跑 Agent CLI 的人，本来就能读那个仓库。Shepaw 不把「已授权设备上的恶意软件」当成威胁模型。OS Tools 的危险操作仍要你在 App 里点批准。
Anyone who can run the agent CLI on your machine can already read that repo. Shepaw does not treat malware on an authorized device as in-scope. Dangerous OS tools still require an in-app approval.
App 本地
On the app
- 聊天与配置默认在本机 SQLite，无强制云账号
- 主密码 + 可选生物识别
- API Key 走平台 Secure Storage
- 更新检查只发送平台、版本号、构建号
- Chat and config stay in local SQLite; no mandatory cloud account
- Master password + optional biometrics
- API keys in platform secure storage
- Update checks send platform, version, and build number only