@aion0/forge 0.2.11 → 0.2.13

package/components/SettingsModal.tsx

@@ -29,6 +29,165 @@ function SecretInput({ value, onChange, placeholder, className }: {
   );
 }
 
+// ─── Secret Change Dialog ──────────────────────────────────────
+
+function SecretChangeDialog({ field, label, isSet, onSave, onClose }: {
+  field: string;
+  label: string;
+  isSet: boolean;
+  onSave: (field: string, adminPassword: string, newValue: string) => Promise<string | null>;
+  onClose: () => void;
+}) {
+  const [mode, setMode] = useState<'change' | 'clear'>('change');
+  const [adminPassword, setAdminPassword] = useState('');
+  const [newValue, setNewValue] = useState('');
+  const [confirmValue, setConfirmValue] = useState('');
+  const [error, setError] = useState('');
+  const [saving, setSaving] = useState(false);
+
+  const canSave = mode === 'clear'
+    ? adminPassword.length > 0
+    : (adminPassword.length > 0 && newValue.length > 0 && newValue === confirmValue);
+
+  const handleSave = async () => {
+    if (mode === 'change' && newValue !== confirmValue) {
+      setError('New values do not match');
+      return;
+    }
+    setSaving(true);
+    setError('');
+    const err = await onSave(field, adminPassword, mode === 'clear' ? '' : newValue);
+    setSaving(false);
+    if (err) {
+      setError(err);
+    } else {
+      onClose();
+    }
+  };
+
+  const inputClass = "w-full px-2 py-1.5 pr-8 bg-[var(--bg-tertiary)] border border-[var(--border)] rounded text-xs text-[var(--text-primary)] font-mono focus:outline-none focus:border-[var(--accent)]";
+
+  return (
+    <div className="fixed inset-0 bg-black/60 flex items-center justify-center z-[60]" onClick={onClose}>
+      <div
+        className="bg-[var(--bg-secondary)] border border-[var(--border)] rounded-lg w-[380px] p-4 space-y-3"
+        onClick={e => e.stopPropagation()}
+      >
+        <div className="flex items-center justify-between">
+          <h3 className="text-xs font-bold">{isSet ? `Change ${label}` : `Set ${label}`}</h3>
+          {isSet && (
+            <div className="flex bg-[var(--bg-tertiary)] rounded p-0.5">
+              <button
+                onClick={() => { setMode('change'); setError(''); }}
+                className={`text-[10px] px-2 py-0.5 rounded ${mode === 'change' ? 'bg-[var(--bg-secondary)] text-[var(--text-primary)] shadow-sm' : 'text-[var(--text-secondary)]'}`}
+              >
+                Change
+              </button>
+              <button
+                onClick={() => { setMode('clear'); setError(''); }}
+                className={`text-[10px] px-2 py-0.5 rounded ${mode === 'clear' ? 'bg-[var(--red)] text-white shadow-sm' : 'text-[var(--text-secondary)]'}`}
+              >
+                Clear
+              </button>
+            </div>
+          )}
+        </div>
+
+        <div className="space-y-1">
+          <label className="text-[10px] text-[var(--text-secondary)]">Admin password (login password)</label>
+          <SecretInput
+            value={adminPassword}
+            onChange={v => { setAdminPassword(v); setError(''); }}
+            placeholder="Enter login password to verify"
+            className={inputClass}
+          />
+        </div>
+
+        {mode === 'change' && (
+          <>
+            <div className="space-y-1">
+              <label className="text-[10px] text-[var(--text-secondary)]">New value</label>
+              <SecretInput
+                value={newValue}
+                onChange={v => { setNewValue(v); setError(''); }}
+                placeholder="Enter new value"
+                className={inputClass}
+              />
+            </div>
+
+            <div className="space-y-1">
+              <label className="text-[10px] text-[var(--text-secondary)]">Confirm new value</label>
+              <SecretInput
+                value={confirmValue}
+                onChange={v => { setConfirmValue(v); setError(''); }}
+                placeholder="Re-enter new value"
+                className={inputClass}
+              />
+              {confirmValue && newValue !== confirmValue && (
+                <p className="text-[9px] text-[var(--red)]">Values do not match</p>
+              )}
+            </div>
+          </>
+        )}
+
+        {mode === 'clear' && (
+          <p className="text-[10px] text-[var(--text-secondary)]">
+            Enter admin password to verify, then click Clear to remove this value.
+          </p>
+        )}
+
+        {error && <p className="text-[10px] text-[var(--red)]">{error}</p>}
+
+        <div className="flex justify-end gap-2 pt-1">
+          <button
+            onClick={onClose}
+            className="px-3 py-1.5 text-xs text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
+          >
+            Cancel
+          </button>
+          <button
+            onClick={handleSave}
+            disabled={!canSave || saving}
+            className={`px-3 py-1.5 text-xs text-white rounded hover:opacity-90 disabled:opacity-50 ${mode === 'clear' ? 'bg-[var(--red)]' : 'bg-[var(--accent)]'}`}
+          >
+            {saving ? 'Saving...' : mode === 'clear' ? 'Clear' : 'Save'}
+          </button>
+        </div>
+      </div>
+    </div>
+  );
+}
+
+// ─── Secret Field Display ──────────────────────────────────────
+
+function SecretField({ label, description, isSet, onEdit }: {
+  label: string;
+  description?: string;
+  isSet: boolean;
+  onEdit: () => void;
+}) {
+  return (
+    <div className="space-y-1">
+      {description && (
+        <label className="text-[10px] text-[var(--text-secondary)]">{description}</label>
+      )}
+      <div className="flex items-center gap-2">
+        <div className="flex-1 px-2 py-1.5 bg-[var(--bg-tertiary)] border border-[var(--border)] rounded text-xs font-mono text-[var(--text-secondary)]">
+          {isSet ? '••••••••' : <span className="italic">Not set</span>}
+        </div>
+        <button
+          onClick={onEdit}
+          className="text-[10px] px-2 py-1 border border-[var(--accent)] text-[var(--accent)] rounded hover:bg-[var(--accent)] hover:text-white transition-colors"
+        >
+          {isSet ? 'Change' : 'Set'}
+        </button>
+      </div>
+    </div>
+  );
+}
+
+// ─── Settings Modal ────────────────────────────────────────────
+
 interface Settings {
   projectRoots: string[];
   docRoots: string[];
@@ -43,6 +202,7 @@ interface Settings {
   pipelineModel: string;
   telegramModel: string;
   skipPermissions: boolean;
+  _secretStatus?: Record<string, boolean>;
 }
 
 interface TunnelStatus {
@@ -69,6 +229,7 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
     telegramModel: 'sonnet',
     skipPermissions: false,
   });
+  const [secretStatus, setSecretStatus] = useState<Record<string, boolean>>({});
   const [newRoot, setNewRoot] = useState('');
   const [newDocRoot, setNewDocRoot] = useState('');
   const [saved, setSaved] = useState(false);
@@ -77,15 +238,28 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
   });
   const [tunnelLoading, setTunnelLoading] = useState(false);
   const [confirmStopTunnel, setConfirmStopTunnel] = useState(false);
+  const [tunnelPasswordPrompt, setTunnelPasswordPrompt] = useState(false);
+  const [tunnelPassword, setTunnelPassword] = useState('');
+  const [tunnelPasswordError, setTunnelPasswordError] = useState('');
+  const [editingSecret, setEditingSecret] = useState<{ field: string; label: string } | null>(null);
 
   const refreshTunnel = useCallback(() => {
     fetch('/api/tunnel').then(r => r.json()).then(setTunnel).catch(() => {});
   }, []);
 
+  const fetchSettings = useCallback(() => {
+    fetch('/api/settings').then(r => r.json()).then((data: Settings) => {
+      const status = data._secretStatus || {};
+      delete data._secretStatus;
+      setSettings(data);
+      setSecretStatus(status);
+    });
+  }, []);
+
   useEffect(() => {
-    fetch('/api/settings').then(r => r.json()).then(setSettings);
+    fetchSettings();
     refreshTunnel();
-  }, [refreshTunnel]);
+  }, [fetchSettings, refreshTunnel]);
 
   // Poll tunnel status while starting
   useEffect(() => {
@@ -104,6 +278,19 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
     setTimeout(() => setSaved(false), 2000);
   };
 
+  const saveSecret = async (field: string, adminPassword: string, newValue: string): Promise<string | null> => {
+    const res = await fetch('/api/settings', {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ _secretUpdate: { field, adminPassword, newValue } }),
+    });
+    const data = await res.json();
+    if (!data.ok) return data.error || 'Failed to save';
+    // Refresh status
+    setSecretStatus(prev => ({ ...prev, [field]: !!newValue }));
+    return null;
+  };
+
   const addRoot = () => {
     const path = newRoot.trim();
     if (!path || settings.projectRoots.includes(path)) return;
@@ -242,12 +429,15 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
           <p className="text-[10px] text-[var(--text-secondary)]">
             Get notified when tasks complete or fail. Create a bot via @BotFather, then send /start to it and use the test button below to get your chat ID.
           </p>
-          <SecretInput
-            value={settings.telegramBotToken}
-            onChange={v => setSettings({ ...settings, telegramBotToken: v })}
-            placeholder="Bot token (from @BotFather)"
-            className="w-full px-2 py-1.5 pr-8 bg-[var(--bg-tertiary)] border border-[var(--border)] rounded text-xs text-[var(--text-primary)] font-mono focus:outline-none focus:border-[var(--accent)]"
+
+          <SecretField
+            label="Bot Token"
+            description="Telegram Bot API token (from @BotFather)"
+            isSet={!!secretStatus.telegramBotToken}
+            onEdit={() => setEditingSecret({ field: 'telegramBotToken', label: 'Bot Token' })}
+
           />
+
           <input
             value={settings.telegramChatId}
             onChange={e => setSettings({ ...settings, telegramChatId: e.target.value })}
@@ -276,7 +466,7 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
               />
               Notify on failure
             </label>
-            {settings.telegramBotToken && settings.telegramChatId && (
+            {secretStatus.telegramBotToken && settings.telegramChatId && (
               <button
                 type="button"
                 onClick={async () => {
@@ -377,25 +567,82 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
 
           <div className="flex items-center gap-2">
             {tunnel.status === 'stopped' || tunnel.status === 'error' ? (
+              tunnelPasswordPrompt ? (
+                <div className="flex items-center gap-2">
+                  <input
+                    type="password"
+                    value={tunnelPassword}
+                    onChange={e => { setTunnelPassword(e.target.value); setTunnelPasswordError(''); }}
+                    onKeyDown={async e => {
+                      if (e.key === 'Enter' && tunnelPassword) {
+                        setTunnelLoading(true);
+                        setTunnelPasswordError('');
+                        try {
+                          const res = await fetch('/api/tunnel', {
+                            method: 'POST',
+                            headers: { 'Content-Type': 'application/json' },
+                            body: JSON.stringify({ action: 'start', password: tunnelPassword }),
+                          });
+                          const data = await res.json();
+                          if (res.status === 403) {
+                            setTunnelPasswordError('Wrong password');
+                          } else {
+                            setTunnel(data);
+                            setTunnelPasswordPrompt(false);
+                            setTunnelPassword('');
+                          }
+                        } catch {}
+                        setTunnelLoading(false);
+                      }
+                    }}
+                    placeholder="Login password"
+                    autoFocus
+                    className={`w-[140px] text-[10px] px-2 py-1 bg-[var(--bg-tertiary)] border rounded font-mono focus:outline-none ${
+                      tunnelPasswordError ? 'border-[var(--red)]' : 'border-[var(--border)] focus:border-[var(--accent)]'
+                    } text-[var(--text-primary)]`}
+                  />
+                  <button
+                    disabled={!tunnelPassword || tunnelLoading}
+                    onClick={async () => {
+                      setTunnelLoading(true);
+                      setTunnelPasswordError('');
+                      try {
+                        const res = await fetch('/api/tunnel', {
+                          method: 'POST',
+                          headers: { 'Content-Type': 'application/json' },
+                          body: JSON.stringify({ action: 'start', password: tunnelPassword }),
+                        });
+                        const data = await res.json();
+                        if (res.status === 403) {
+                          setTunnelPasswordError('Wrong password');
+                        } else {
+                          setTunnel(data);
+                          setTunnelPasswordPrompt(false);
+                          setTunnelPassword('');
+                        }
+                      } catch {}
+                      setTunnelLoading(false);
+                    }}
+                    className="text-[10px] px-2 py-1 bg-[var(--green)] text-black rounded hover:opacity-90 disabled:opacity-50"
+                  >
+                    {tunnelLoading ? 'Starting...' : 'Start'}
+                  </button>
+                  <button
+                    onClick={() => { setTunnelPasswordPrompt(false); setTunnelPassword(''); setTunnelPasswordError(''); }}
+                    className="text-[10px] px-2 py-1 text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
+                  >
+                    Cancel
+                  </button>
+                  {tunnelPasswordError && <span className="text-[9px] text-[var(--red)]">{tunnelPasswordError}</span>}
+                </div>
+              ) : (
               <button
-                disabled={tunnelLoading}
-                onClick={async () => {
-                  setTunnelLoading(true);
-                  try {
-                    const res = await fetch('/api/tunnel', {
-                      method: 'POST',
-                      headers: { 'Content-Type': 'application/json' },
-                      body: JSON.stringify({ action: 'start' }),
-                    });
-                    const data = await res.json();
-                    setTunnel(data);
-                  } catch {}
-                  setTunnelLoading(false);
-                }}
-                className="text-[10px] px-3 py-1.5 bg-[var(--green)] text-black rounded hover:opacity-90 disabled:opacity-50"
+                onClick={() => setTunnelPasswordPrompt(true)}
+                className="text-[10px] px-3 py-1.5 bg-[var(--green)] text-black rounded hover:opacity-90"
               >
-                {tunnelLoading ? (tunnel.installed ? 'Starting...' : 'Downloading...') : 'Start Tunnel'}
+                Start Tunnel
               </button>
+              )
             ) : confirmStopTunnel ? (
               <div className="flex items-center gap-2">
                 <span className="text-[10px] text-[var(--text-secondary)]">Stop tunnel?</span>
@@ -487,17 +734,21 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
             Auto-start tunnel on server startup
           </label>
 
-          <div className="space-y-1">
-            <label className="text-[10px] text-[var(--text-secondary)]">
-              Telegram tunnel password (for /tunnel_password command)
-            </label>
-            <SecretInput
-              value={settings.telegramTunnelPassword}
-              onChange={v => setSettings({ ...settings, telegramTunnelPassword: v })}
-              placeholder="Set a password to get login credentials via Telegram"
-              className="w-full px-2 py-1.5 pr-8 bg-[var(--bg-tertiary)] border border-[var(--border)] rounded text-xs text-[var(--text-primary)] font-mono focus:outline-none focus:border-[var(--accent)]"
-            />
-          </div>
+        </div>
+
+        {/* Admin Password */}
+        <div className="space-y-2">
+          <label className="text-xs text-[var(--text-secondary)] font-semibold uppercase">
+            Admin Password
+          </label>
+          <p className="text-[10px] text-[var(--text-secondary)]">
+            Used for local login, tunnel start, secret changes, and Telegram commands. Remote login requires admin password + session code (generated on tunnel start).
+          </p>
+          <SecretField
+            label="Admin Password"
+            isSet={!!secretStatus.telegramTunnelPassword}
+            onEdit={() => setEditingSecret({ field: 'telegramTunnelPassword', label: 'Admin Password' })}
+          />
         </div>
 
         {/* Actions */}
@@ -521,6 +772,17 @@ export default function SettingsModal({ onClose }: { onClose: () => void }) {
           </div>
         </div>
       </div>
+
+      {/* Secret Change Dialog */}
+      {editingSecret && (
+        <SecretChangeDialog
+          field={editingSecret.field}
+          label={editingSecret.label}
+          isSet={!!secretStatus[editingSecret.field]}
+          onSave={saveSecret}
+          onClose={() => setEditingSecret(null)}
+        />
+      )}
     </div>
   );
 }

package/components/TunnelToggle.tsx

@@ -14,6 +14,9 @@ export default function TunnelToggle() {
   const [copied, setCopied] = useState(false);
   const [isRemote, setIsRemote] = useState(false);
   const [confirmStop, setConfirmStop] = useState(false);
+  const [showPasswordPrompt, setShowPasswordPrompt] = useState(false);
+  const [password, setPassword] = useState('');
+  const [passwordError, setPasswordError] = useState('');
 
   useEffect(() => {
     setIsRemote(!['localhost', '127.0.0.1'].includes(window.location.hostname));
@@ -50,16 +53,24 @@ export default function TunnelToggle() {
     setConfirmStop(false);
   };
 
-  const doStart = async () => {
+  const doStart = async (pw: string) => {
     setLoading(true);
+    setPasswordError('');
     try {
       const res = await fetch('/api/tunnel', {
         method: 'POST',
         headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ action: 'start' }),
+        body: JSON.stringify({ action: 'start', password: pw }),
       });
       const data = await res.json();
+      if (res.status === 403) {
+        setPasswordError('Wrong password');
+        setLoading(false);
+        return;
+      }
       setTunnel(data);
+      setShowPasswordPrompt(false);
+      setPassword('');
     } catch {}
     setLoading(false);
   };
@@ -77,6 +88,38 @@ export default function TunnelToggle() {
     return null;
   }
 
+  // Password prompt
+  if (showPasswordPrompt) {
+    return (
+      <div className="flex items-center gap-1.5">
+        <input
+          type="password"
+          value={password}
+          onChange={e => { setPassword(e.target.value); setPasswordError(''); }}
+          onKeyDown={e => e.key === 'Enter' && password && doStart(password)}
+          placeholder="Login password"
+          autoFocus
+          className={`w-[120px] text-[10px] px-2 py-0.5 bg-[var(--bg-tertiary)] border rounded font-mono focus:outline-none ${
+            passwordError ? 'border-[var(--red)]' : 'border-[var(--border)] focus:border-[var(--accent)]'
+          } text-[var(--text-primary)]`}
+        />
+        <button
+          onClick={() => password && doStart(password)}
+          disabled={!password || loading}
+          className="text-[10px] px-2 py-0.5 bg-[var(--green)] text-black rounded hover:opacity-90 disabled:opacity-50"
+        >
+          {loading ? 'Starting...' : 'Start'}
+        </button>
+        <button
+          onClick={() => { setShowPasswordPrompt(false); setPassword(''); setPasswordError(''); }}
+          className="text-[10px] px-1.5 py-0.5 text-[var(--text-secondary)] hover:text-[var(--text-primary)]"
+        >
+          Cancel
+        </button>
+      </div>
+    );
+  }
+
   // Stop confirmation dialog
   if (confirmStop) {
     return (
@@ -102,12 +145,12 @@ export default function TunnelToggle() {
   if (tunnel.status === 'stopped' && !tunnel.error) {
     return (
       <button
-        onClick={doStart}
+        onClick={() => setShowPasswordPrompt(true)}
         disabled={loading}
         className="text-[10px] px-2 py-0.5 border border-[var(--border)] rounded text-[var(--text-secondary)] hover:text-[var(--text-primary)] hover:border-[var(--text-secondary)] transition-colors disabled:opacity-50"
         title="Start Cloudflare Tunnel for remote access"
       >
-        {loading ? 'Starting...' : 'Tunnel'}
+        Tunnel
       </button>
     );
   }
@@ -149,7 +192,7 @@ export default function TunnelToggle() {
           Tunnel error
         </span>
         <button
-          onClick={doStart}
+          onClick={() => setShowPasswordPrompt(true)}
           disabled={loading}
           className="text-[10px] px-2 py-0.5 border border-[var(--border)] rounded text-[var(--text-secondary)] hover:text-[var(--text-primary)] transition-colors"
         >

package/install.sh

@@ -25,5 +25,5 @@ fi
 
 echo ""
 echo "[forge] Done."
-forge-server --version
-echo "Run: forge-server"
+forge --version
+echo "Run: forge server start"

package/instrumentation.ts

@@ -1,6 +1,6 @@
 /**
  * Next.js instrumentation — runs once when the server starts.
- * Sets MW_PASSWORD before any request is handled.
+ * Loads .env.local and prints login password.
  */
 export async function register() {
   // Only run on server, not Edge
@@ -23,8 +23,13 @@ export async function register() {
       }
     }
 
-    const { getPassword } = await import('./lib/password');
-    const password = getPassword();
-    process.env.MW_PASSWORD = password;
+    // Print password info
+    const { getAdminPassword } = await import('./lib/password');
+    const admin = getAdminPassword();
+    if (admin) {
+      console.log(`[init] Admin password: configured`);
+    } else {
+      console.log('[init] No admin password set — configure in Settings');
+    }
   }
 }

package/lib/auth.ts

@@ -10,23 +10,31 @@ if (!process.env.AUTH_SECRET) {
 
 export const { handlers, signIn, signOut, auth } = NextAuth({
   trustHost: true,
+  logger: {
+    error: () => {},  // Suppress noisy CredentialsSignin stack traces
+  },
   providers: [
     // Google OAuth — for production use
     Google({
       clientId: process.env.GOOGLE_CLIENT_ID,
       clientSecret: process.env.GOOGLE_CLIENT_SECRET,
     }),
-    // Local password — auto-generated, rotates daily
+    // Local: admin password only
+    // Remote (tunnel): admin password + session code (2FA)
     Credentials({
       name: 'Local',
       credentials: {
         password: { label: 'Password', type: 'password' },
+        sessionCode: { label: 'Session Code', type: 'text' },
+        isRemote: { label: 'Remote', type: 'text' },
       },
       async authorize(credentials) {
-        // Dynamic import to avoid Edge Runtime pulling in node:path/node:fs
-        const { getPassword } = await import('./password');
-        const localPassword = getPassword();
-        if (credentials?.password === localPassword) {
+        const { verifyLogin } = await import('./password');
+        const password = (credentials?.password ?? '') as string;
+        const sessionCode = (credentials?.sessionCode ?? '') as string;
+        const isRemote = String(credentials?.isRemote) === 'true';
+
+        if (verifyLogin(password, sessionCode, isRemote)) {
           return { id: 'local', name: 'zliu', email: 'local@forge' };
         }
         return null;
@@ -40,13 +48,9 @@ export const { handlers, signIn, signOut, auth } = NextAuth({
     authorized({ auth }) {
       return !!auth;
     },
-    // Allow redirects to tunnel URLs (*.trycloudflare.com) after login
     redirect({ url, baseUrl }) {
-      // Same origin — always allow
       if (url.startsWith(baseUrl)) return url;
-      // Relative path — prepend base
       if (url.startsWith('/')) return `${baseUrl}${url}`;
-      // Cloudflare tunnel URLs — allow
       if (url.includes('.trycloudflare.com')) return url;
       return baseUrl;
     },

package/lib/cloudflared.ts

@@ -154,6 +154,12 @@ export async function startTunnel(localPort: number = 3000): Promise<{ url?: str
   state.error = null;
   state.log = [];
 
+  // Generate new session code for remote login 2FA
+  try {
+    const { rotateSessionCode } = require('./password');
+    rotateSessionCode();
+  } catch {}
+
   let binPath: string;
   try {
     binPath = await downloadCloudflared();

package/lib/crypto.ts

@@ -0,0 +1,68 @@
+/**
+ * Encryption utilities for storing secrets in settings.yaml
+ * Uses AES-256-GCM with a persistent key stored in ~/.forge/.encrypt-key
+ */
+
+import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { createCipheriv, createDecipheriv, randomBytes, createHash } from 'node:crypto';
+
+const DATA_DIR = process.env.FORGE_DATA_DIR || join(homedir(), '.forge');
+const KEY_FILE = join(DATA_DIR, '.encrypt-key');
+const PREFIX = 'enc:';
+
+function getEncryptionKey(): Buffer {
+  if (existsSync(KEY_FILE)) {
+    return Buffer.from(readFileSync(KEY_FILE, 'utf-8').trim(), 'hex');
+  }
+  // Generate a new 32-byte key
+  const key = randomBytes(32);
+  const dir = dirname(KEY_FILE);
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  writeFileSync(KEY_FILE, key.toString('hex'), { mode: 0o600 });
+  return key;
+}
+
+export function encryptSecret(plaintext: string): string {
+  if (!plaintext) return '';
+  const key = getEncryptionKey();
+  const iv = randomBytes(12);
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf-8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  // Format: enc:<iv>:<tag>:<ciphertext> (all base64)
+  return `${PREFIX}${iv.toString('base64')}.${tag.toString('base64')}.${encrypted.toString('base64')}`;
+}
+
+export function decryptSecret(value: string): string {
+  if (!value || !isEncrypted(value)) return value;
+  try {
+    const payload = value.slice(PREFIX.length);
+    const [ivB64, tagB64, dataB64] = payload.split('.');
+    const key = getEncryptionKey();
+    const iv = Buffer.from(ivB64, 'base64');
+    const tag = Buffer.from(tagB64, 'base64');
+    const data = Buffer.from(dataB64, 'base64');
+    const decipher = createDecipheriv('aes-256-gcm', key, iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(data), decipher.final()]).toString('utf-8');
+  } catch {
+    // If decryption fails (key changed, corrupted), return empty
+    return '';
+  }
+}
+
+export function isEncrypted(value: string): boolean {
+  return typeof value === 'string' && value.startsWith(PREFIX);
+}
+
+/** Hash a secret for comparison without exposing plaintext */
+export function hashSecret(value: string): string {
+  if (!value) return '';
+  return createHash('sha256').update(value).digest('hex').slice(0, 16);
+}
+
+/** Secret field names in settings */
+export const SECRET_FIELDS = ['telegramBotToken', 'telegramTunnelPassword'] as const;
+export type SecretField = typeof SECRET_FIELDS[number];