@askexenow/exe-os 0.9.227 → 0.9.229

package/dist/chunk-7EZCYO76.js

@@ -0,0 +1,128 @@
+// src/lib/tool-telemetry.ts
+var _toolCalls = /* @__PURE__ */ new Map();
+var _sessionStartedAt = Date.now();
+var _flushTimer = null;
+function recordCall(toolName, action, isError) {
+  let record = _toolCalls.get(toolName);
+  if (!record) {
+    record = { count: 0, actions: /* @__PURE__ */ new Map(), lastCalledAt: 0, errors: 0 };
+    _toolCalls.set(toolName, record);
+  }
+  record.count++;
+  record.lastCalledAt = Date.now();
+  if (isError) record.errors++;
+  if (action) {
+    record.actions.set(action, (record.actions.get(action) ?? 0) + 1);
+  }
+}
+function wrapServerWithTelemetry(server) {
+  const originalRegisterTool = server.registerTool.bind(server);
+  server.registerTool = (name, config, handler) => {
+    const wrappedHandler = async (input, extra) => {
+      const action = input.action;
+      try {
+        const result = await handler(input, extra);
+        const isError = result?.isError === true;
+        recordCall(name, action, isError);
+        return result;
+      } catch (err) {
+        recordCall(name, action, true);
+        throw err;
+      }
+    };
+    return originalRegisterTool(name, config, wrappedHandler);
+  };
+  return server;
+}
+function getToolUsageStats() {
+  let totalCalls = 0;
+  let totalErrors = 0;
+  const tools = {};
+  for (const [name, record] of _toolCalls) {
+    totalCalls += record.count;
+    totalErrors += record.errors;
+    const entry = {
+      calls: record.count,
+      errors: record.errors,
+      lastCalledAt: new Date(record.lastCalledAt).toISOString()
+    };
+    if (record.actions.size > 0) {
+      entry.actions = Object.fromEntries(record.actions);
+    }
+    tools[name] = entry;
+  }
+  return {
+    sessionStartedAt: new Date(_sessionStartedAt).toISOString(),
+    uptimeMs: Date.now() - _sessionStartedAt,
+    totalCalls,
+    totalErrors,
+    tools
+  };
+}
+function resetToolUsageStats() {
+  _toolCalls.clear();
+  _sessionStartedAt = Date.now();
+}
+var FLUSH_INTERVAL_MS = 5 * 60 * 1e3;
+var _lastFlushedAt = 0;
+async function flushToMemory() {
+  const stats = getToolUsageStats();
+  if (stats.totalCalls === 0) return;
+  if (stats.totalCalls === _lastFlushedAt) return;
+  try {
+    const { getClient, isInitialized } = await import("./lib/database.js");
+    if (!isInitialized()) return;
+    const client = getClient();
+    const toolSummary = Object.entries(stats.tools).sort((a, b) => b[1].calls - a[1].calls).map(([name, t]) => {
+      const actionStr = t.actions ? ` (${Object.entries(t.actions).sort((a, b) => b[1] - a[1]).map(([a, c]) => `${a}:${c}`).join(", ")})` : "";
+      return `${name}: ${t.calls} calls${t.errors > 0 ? ` (${t.errors} errors)` : ""}${actionStr}`;
+    }).join("\n");
+    const raw_text = `Tool usage since ${stats.sessionStartedAt} (${Math.round(stats.uptimeMs / 6e4)}min):
+Total: ${stats.totalCalls} calls, ${stats.totalErrors} errors
+
+${toolSummary}`;
+    await client.execute({
+      sql: `INSERT INTO memories (id, agent_id, raw_text, memory_type, project_name, importance, created_at, updated_at, session_scope)
+            VALUES (?, 'system', ?, 'telemetry', 'exe-os', 2, datetime('now'), datetime('now'), NULL)`,
+      args: [
+        `telemetry-tools-${Date.now()}`,
+        raw_text
+      ]
+    });
+    _lastFlushedAt = stats.totalCalls;
+  } catch {
+  }
+}
+function startToolTelemetryFlush() {
+  if (_flushTimer) return;
+  _sessionStartedAt = Date.now();
+  _flushTimer = setInterval(() => void flushToMemory(), FLUSH_INTERVAL_MS);
+  _flushTimer.unref();
+}
+async function stopToolTelemetryFlush() {
+  if (_flushTimer) {
+    clearInterval(_flushTimer);
+    _flushTimer = null;
+  }
+  await flushToMemory();
+}
+function getToolUsageSummary() {
+  const summary = {};
+  for (const [tool, record] of _toolCalls) {
+    summary[tool] = {
+      count: record.count,
+      errors: record.errors,
+      actions: Object.fromEntries(record.actions)
+    };
+  }
+  return summary;
+}
+
+export {
+  wrapServerWithTelemetry,
+  getToolUsageStats,
+  resetToolUsageStats,
+  startToolTelemetryFlush,
+  stopToolTelemetryFlush,
+  getToolUsageSummary
+};

package/dist/chunk-7NNXBDOO.js

@@ -0,0 +1,541 @@
+// src/lib/keychain.ts
+import { readFile, writeFile, unlink, mkdir, chmod, rename, copyFile } from "fs/promises";
+import { existsSync, statSync, writeFileSync, readFileSync } from "fs";
+import { execSync } from "child_process";
+import crypto from "crypto";
+import path from "path";
+import os from "os";
+var SERVICE = "exe-os";
+var _plaintextWarningShown = false;
+function warnPlaintextFallback() {
+  if (_plaintextWarningShown) return;
+  _plaintextWarningShown = true;
+  process.stderr.write(
+    "[exe-os] \u26A0 Native keychain unavailable \u2014 encryption key stored in plaintext file.\n[exe-os]   For production security, install: apt install libsecret-tools gnome-keyring\n"
+  );
+}
+var LEGACY_SERVICE = "exe-mem";
+var ACCOUNT = "master-key";
+function getKeyDir() {
+  return process.env.EXE_OS_DIR ?? process.env.EXE_MEM_DIR ?? path.join(os.homedir(), ".exe-os");
+}
+function getKeyPath() {
+  return path.join(getKeyDir(), "master.key");
+}
+function nativeKeychainAllowed() {
+  return process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN !== "1";
+}
+var linuxSecretAvailability = null;
+function linuxSecretAvailable() {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "linux") return false;
+  if (linuxSecretAvailability !== null) return linuxSecretAvailability;
+  try {
+    execSync("command -v secret-tool >/dev/null 2>&1", { timeout: 1e3 });
+  } catch {
+    linuxSecretAvailability = false;
+    return false;
+  }
+  try {
+    execSync("secret-tool search --all exe-os probe >/dev/null 2>&1", { timeout: 1e3 });
+    linuxSecretAvailability = true;
+  } catch {
+    linuxSecretAvailability = false;
+  }
+  return linuxSecretAvailability;
+}
+var SERVER_MODE_MARKER = ".server-mode";
+function getServerModeMarkerPath() {
+  return path.join(getKeyDir(), SERVER_MODE_MARKER);
+}
+function isServerModeMarked() {
+  try {
+    return existsSync(getServerModeMarkerPath());
+  } catch {
+    return false;
+  }
+}
+function writeServerModeMarker() {
+  try {
+    const markerPath = getServerModeMarkerPath();
+    if (!existsSync(markerPath)) {
+      writeFileSync(markerPath, `# Server mode \u2014 keychain migration disabled.
+# Created: ${(/* @__PURE__ */ new Date()).toISOString()}
+# Remove this file to re-enable native keychain migration.
+`, { mode: 384 });
+    }
+  } catch {
+  }
+}
+function isRootOnlyTrustedServerKeyFile(keyPath) {
+  if (process.platform !== "linux") return false;
+  try {
+    const st = statSync(keyPath);
+    if (!st.isFile() || (st.mode & 63) !== 0) return false;
+    if (isServerModeMarked()) return true;
+    const uid = typeof os.userInfo().uid === "number" ? os.userInfo().uid : -1;
+    if (uid === 0) {
+      writeServerModeMarker();
+      return true;
+    }
+    const exeOsDir = process.env.EXE_OS_DIR;
+    if (exeOsDir && path.resolve(keyPath).startsWith(path.resolve(exeOsDir) + path.sep)) {
+      writeServerModeMarker();
+      return true;
+    }
+    if (!linuxSecretAvailable()) {
+      writeServerModeMarker();
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function macKeychainGet(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return null;
+  if (process.platform !== "darwin") return null;
+  try {
+    return execSync(
+      `security find-generic-password -s "${service}" -a "${ACCOUNT}" -w 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function macKeychainSet(value, service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "darwin") return false;
+  try {
+    try {
+      execSync(
+        `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
+        { timeout: 5e3 }
+      );
+    } catch {
+    }
+    execSync(
+      `security add-generic-password -s "${service}" -a "${ACCOUNT}" -w "${value}"`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function macKeychainDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "darwin") return false;
+  try {
+    execSync(
+      `security delete-generic-password -s "${service}" -a "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretGet(service = SERVICE) {
+  if (!linuxSecretAvailable()) return null;
+  try {
+    return execSync(
+      `secret-tool lookup service "${service}" account "${ACCOUNT}" 2>/dev/null`,
+      { encoding: "utf-8", timeout: 5e3 }
+    ).trim();
+  } catch {
+    return null;
+  }
+}
+function linuxSecretSet(value, service = SERVICE) {
+  if (!linuxSecretAvailable()) return false;
+  try {
+    execSync(
+      `echo -n "${value}" | secret-tool store --label="exe-os master key" service "${service}" account "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "linux") return false;
+  try {
+    execSync(
+      `secret-tool clear service "${service}" account "${ACCOUNT}" 2>/dev/null`,
+      { timeout: 5e3 }
+    );
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function tryKeytar() {
+  if (!nativeKeychainAllowed()) return null;
+  try {
+    return await import("keytar");
+  } catch {
+    return null;
+  }
+}
+var ENCRYPTED_PREFIX = "enc:";
+function deriveMachineKey() {
+  try {
+    const material = [
+      os.hostname(),
+      os.userInfo().username,
+      os.arch(),
+      os.platform(),
+      // Machine ID on Linux (stable across reboots)
+      process.platform === "linux" ? readMachineId() : ""
+    ].join("|");
+    return crypto.createHash("sha256").update(material).digest();
+  } catch {
+    return null;
+  }
+}
+function readMachineId() {
+  try {
+    return readFileSync("/etc/machine-id", "utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function encryptWithMachineKey(plaintext, machineKey) {
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", machineKey, iv);
+  let encrypted = cipher.update(plaintext, "utf-8", "base64");
+  encrypted += cipher.final("base64");
+  const authTag = cipher.getAuthTag().toString("base64");
+  return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${authTag}:${encrypted}`;
+}
+function decryptWithMachineKey(encrypted, machineKey) {
+  if (!encrypted.startsWith(ENCRYPTED_PREFIX)) return null;
+  try {
+    const parts = encrypted.slice(ENCRYPTED_PREFIX.length).split(":");
+    if (parts.length !== 3) return null;
+    const [ivB64, tagB64, cipherB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const authTag = Buffer.from(tagB64, "base64");
+    const decipher = crypto.createDecipheriv("aes-256-gcm", machineKey, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(cipherB64, "base64", "utf-8");
+    decrypted += decipher.final("utf-8");
+    return decrypted;
+  } catch {
+    return null;
+  }
+}
+async function writeMachineBoundFileFallback(b64) {
+  const dir = getKeyDir();
+  await mkdir(dir, { recursive: true });
+  const keyPath = getKeyPath();
+  const machineKey = deriveMachineKey();
+  const content = machineKey ? encryptWithMachineKey(b64, machineKey) + "\n" : b64 + "\n";
+  const result = machineKey ? "encrypted" : "plaintext";
+  const tmpPath = keyPath + ".tmp";
+  try {
+    if (existsSync(keyPath)) {
+      await copyFile(keyPath, keyPath + ".bak").catch(() => {
+      });
+    }
+    await writeFile(tmpPath, content, "utf-8");
+    await chmod(tmpPath, 384);
+    await rename(tmpPath, keyPath);
+  } catch (err) {
+    try {
+      await unlink(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+  return result;
+}
+async function getMasterKey() {
+  let nativeValue = macKeychainGet() ?? linuxSecretGet();
+  if (!nativeValue) {
+    const legacyValue = macKeychainGet(LEGACY_SERVICE) ?? linuxSecretGet(LEGACY_SERVICE);
+    if (legacyValue) {
+      const migrated = macKeychainSet(legacyValue) || linuxSecretSet(legacyValue);
+      if (migrated) {
+        macKeychainDelete(LEGACY_SERVICE);
+        linuxSecretDelete(LEGACY_SERVICE);
+        process.stderr.write("[keychain] Migrated keychain service from exe-mem to exe-os.\n");
+      }
+      nativeValue = legacyValue;
+    }
+  }
+  if (nativeValue) {
+    return Buffer.from(nativeValue, "base64");
+  }
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
+      const legacyKeytarValue = keytarValue ?? await keytar.getPassword(LEGACY_SERVICE, ACCOUNT);
+      if (legacyKeytarValue) {
+        const migrated = macKeychainSet(legacyKeytarValue) || linuxSecretSet(legacyKeytarValue);
+        if (migrated) {
+          process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
+          try {
+            await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
+          } catch {
+          }
+        }
+        return Buffer.from(legacyKeytarValue, "base64");
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync(keyPath)) {
+    process.stderr.write(
+      `[keychain] Key not found at ${keyPath} (HOME=${os.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
+`
+    );
+    return null;
+  }
+  try {
+    const content = (await readFile(keyPath, "utf-8")).trim();
+    let b64Value;
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      const machineKey = deriveMachineKey();
+      if (!machineKey) {
+        process.stderr.write("[keychain] Cannot derive machine key to decrypt stored key.\n");
+        return null;
+      }
+      const decrypted = decryptWithMachineKey(content, machineKey);
+      if (!decrypted) {
+        process.stderr.write(
+          "[keychain] Key decryption failed \u2014 machine may have changed.\n  Use your 24-word recovery phrase during setup: exe-os setup\n"
+        );
+        return null;
+      }
+      b64Value = decrypted;
+    } else {
+      b64Value = content;
+    }
+    const key = Buffer.from(b64Value, "base64");
+    if (isRootOnlyTrustedServerKeyFile(keyPath)) {
+      return key;
+    }
+    const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
+    if (migrated) {
+      process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
+      try {
+        await unlink(keyPath);
+        process.stderr.write("[keychain] Removed legacy master.key file after native keychain migration.\n");
+      } catch {
+      }
+    } else if (!content.startsWith(ENCRYPTED_PREFIX)) {
+      const fallback = await writeMachineBoundFileFallback(b64Value);
+      if (fallback === "encrypted") {
+        process.stderr.write("[keychain] Upgraded legacy plaintext master.key to machine-bound encrypted fallback.\n");
+      } else {
+        process.stderr.write(
+          "[keychain] WARNING: Could not encrypt legacy master.key \u2014 plaintext fallback remains.\n"
+        );
+        warnPlaintextFallback();
+      }
+    }
+    return key;
+  } catch (err) {
+    process.stderr.write(
+      `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return null;
+  }
+}
+async function getKeyStorageInfo() {
+  if (macKeychainGet()) {
+    return {
+      kind: "macos-keychain",
+      secure: true,
+      note: "stored in macOS Keychain via built-in security CLI"
+    };
+  }
+  if (macKeychainGet(LEGACY_SERVICE)) {
+    return {
+      kind: "macos-keychain",
+      secure: true,
+      note: "stored in legacy macOS Keychain service exe-mem; next key read migrates it to exe-os"
+    };
+  }
+  if (linuxSecretGet()) {
+    return {
+      kind: "linux-secret-service",
+      secure: true,
+      note: "stored in Linux Secret Service via secret-tool"
+    };
+  }
+  if (linuxSecretGet(LEGACY_SERVICE)) {
+    return {
+      kind: "linux-secret-service",
+      secure: true,
+      note: "stored in legacy Linux Secret Service service exe-mem; next key read migrates it to exe-os"
+    };
+  }
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      if (await keytar.getPassword(SERVICE, ACCOUNT)) {
+        return {
+          kind: "legacy-keytar",
+          secure: true,
+          note: "stored in legacy keytar backend; will migrate to native keychain when possible"
+        };
+      }
+      if (await keytar.getPassword(LEGACY_SERVICE, ACCOUNT)) {
+        return {
+          kind: "legacy-keytar",
+          secure: true,
+          note: "stored in legacy keytar service exe-mem; will migrate to native exe-os keychain when possible"
+        };
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync(keyPath)) {
+    return {
+      kind: "missing",
+      secure: false,
+      path: keyPath,
+      note: "no key found in OS keychain, legacy keytar, or file fallback"
+    };
+  }
+  try {
+    const content = (await readFile(keyPath, "utf-8")).trim();
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      return {
+        kind: "encrypted-file",
+        secure: true,
+        path: keyPath,
+        note: "stored in machine-bound encrypted file fallback"
+      };
+    }
+    if (isRootOnlyTrustedServerKeyFile(keyPath)) {
+      return {
+        kind: "server-secret-file",
+        secure: true,
+        path: keyPath,
+        note: "stored as root-only trusted server secret file"
+      };
+    }
+    return {
+      kind: "plaintext-file",
+      secure: false,
+      path: keyPath,
+      note: "stored in legacy plaintext file; reading it will migrate or encrypt it"
+    };
+  } catch {
+    return {
+      kind: "missing",
+      secure: false,
+      path: keyPath,
+      note: "key file exists but could not be read"
+    };
+  }
+}
+async function setMasterKey(key) {
+  const b64 = key.toString("base64");
+  let keychainOk = false;
+  if (macKeychainSet(b64)) {
+    const readBack = macKeychainGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write(
+        "[keychain] macOS Keychain write appeared to succeed but read-back failed.\n  This can happen on macOS Tahoe with new permission patterns.\n"
+      );
+    }
+  } else if (linuxSecretSet(b64)) {
+    const readBack = linuxSecretGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write("[keychain] Linux secret-tool write appeared to succeed but read-back failed.\n");
+    }
+  }
+  if (!keychainOk) {
+    const keytar = await tryKeytar();
+    if (keytar) {
+      try {
+        await keytar.setPassword(SERVICE, ACCOUNT, b64);
+        keychainOk = true;
+      } catch {
+      }
+    }
+  }
+  const fallback = await writeMachineBoundFileFallback(b64);
+  if (keychainOk) {
+    process.stderr.write("[keychain] Key stored in OS keychain (file backup also written).\n");
+  } else if (fallback === "encrypted") {
+    process.stderr.write("[keychain] Key stored encrypted (machine-bound file fallback).\n");
+  } else {
+    process.stderr.write(
+      "[keychain] WARNING: Key stored in plaintext file \u2014 no OS keychain available.\n"
+    );
+    warnPlaintextFallback();
+  }
+}
+async function deleteMasterKey() {
+  macKeychainDelete();
+  linuxSecretDelete();
+  macKeychainDelete(LEGACY_SERVICE);
+  linuxSecretDelete(LEGACY_SERVICE);
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.deletePassword(SERVICE, ACCOUNT);
+      await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (existsSync(keyPath)) {
+    await unlink(keyPath);
+  }
+}
+async function loadBip39() {
+  try {
+    return await import("bip39");
+  } catch {
+    throw new Error(
+      "bip39 package not found. Run: npm install -g bip39\nOr reinstall exe-os: npm install -g @askexenow/exe-os"
+    );
+  }
+}
+async function exportMnemonic(key) {
+  if (key.length !== 32) {
+    throw new Error(`Key must be 32 bytes, got ${key.length}`);
+  }
+  const { entropyToMnemonic } = await loadBip39();
+  return entropyToMnemonic(key.toString("hex"));
+}
+async function importMnemonic(mnemonic) {
+  const trimmed = mnemonic.trim();
+  const words = trimmed.split(/\s+/);
+  if (words.length !== 24) {
+    throw new Error(`Expected 24 words, got ${words.length}`);
+  }
+  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
+  if (!validateMnemonic(trimmed)) {
+    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
+  }
+  const entropy = mnemonicToEntropy(trimmed);
+  return Buffer.from(entropy, "hex");
+}
+
+export {
+  getMasterKey,
+  getKeyStorageInfo,
+  setMasterKey,
+  deleteMasterKey,
+  exportMnemonic,
+  importMnemonic
+};