@askexenow/exe-os 0.9.276 → 0.9.277

package/dist/chunk-WVWJB7BT.js

@@ -0,0 +1,630 @@
+// src/lib/keychain.ts
+import { readFile, writeFile, unlink, mkdir, chmod, rename, copyFile } from "fs/promises";
+import { existsSync, statSync, writeFileSync, readFileSync, readdirSync } from "fs";
+import { execFileSync, spawnSync } from "child_process";
+import crypto from "crypto";
+import path from "path";
+import os from "os";
+var SERVICE = "exe-os";
+var _plaintextWarningShown = false;
+function warnPlaintextFallback() {
+  if (_plaintextWarningShown) return;
+  _plaintextWarningShown = true;
+  process.stderr.write(
+    "[exe-os] \u26A0 Native keychain unavailable \u2014 encryption key stored in plaintext file.\n[exe-os]   For production security, install: apt install libsecret-tools gnome-keyring\n"
+  );
+}
+var LEGACY_SERVICE = "exe-mem";
+var ACCOUNT = "master-key";
+function getKeyDir() {
+  if (process.env.EXE_OS_DIR) return process.env.EXE_OS_DIR;
+  if (process.env.EXE_MEM_DIR) return process.env.EXE_MEM_DIR;
+  const homeDir = os.homedir();
+  const defaultDir = path.join(homeDir, ".exe-os");
+  if (process.getuid?.() === 0) {
+    const sudoUser = process.env.SUDO_USER ?? "";
+    if (sudoUser) {
+      try {
+        const passwdEntry = execFileSync("getent", ["passwd", sudoUser], { encoding: "utf8", timeout: 3e3 });
+        const sudoHome = passwdEntry.split(":")[5]?.trim() ?? "";
+        const sudoDir = path.join(sudoHome, ".exe-os");
+        if (existsSync(sudoDir)) return sudoDir;
+      } catch {
+      }
+    }
+    try {
+      if (existsSync("/home")) {
+        const candidates = [];
+        for (const user of readdirSync("/home")) {
+          const candidate = path.join("/home", user, ".exe-os");
+          if (existsSync(path.join(candidate, "master.key")) || existsSync(path.join(candidate, "config.json"))) {
+            candidates.push(candidate);
+          }
+        }
+        if (candidates.length === 1) return candidates[0];
+      }
+    } catch {
+    }
+  }
+  return defaultDir;
+}
+function getKeyPath() {
+  return path.join(getKeyDir(), "master.key");
+}
+async function removeFileFallbackIfPresent(reason) {
+  const keyPath = getKeyPath();
+  if (!existsSync(keyPath)) return;
+  try {
+    await unlink(keyPath);
+    process.stderr.write(`[keychain] Removed master.key file fallback after ${reason}.
+`);
+  } catch {
+    process.stderr.write(
+      `[keychain] WARNING: OS keychain is authoritative, but could not remove file fallback at ${keyPath}.
+`
+    );
+  }
+}
+function nativeKeychainAllowed() {
+  if (/^(1|true|yes|on)$/i.test(process.env.EXE_SERVER_MODE ?? "")) return false;
+  return process.env.EXE_OS_DISABLE_NATIVE_KEYCHAIN !== "1";
+}
+var linuxSecretAvailability = null;
+function linuxSecretAvailable() {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "linux") return false;
+  if (linuxSecretAvailability !== null) return linuxSecretAvailability;
+  try {
+    execFileSync("which", ["secret-tool"], { timeout: 1e3, stdio: ["pipe", "ignore", "ignore"] });
+  } catch {
+    linuxSecretAvailability = false;
+    return false;
+  }
+  try {
+    execFileSync("secret-tool", ["search", "--all", "exe-os", "probe"], { timeout: 1e3, stdio: ["pipe", "ignore", "ignore"] });
+    linuxSecretAvailability = true;
+  } catch {
+    linuxSecretAvailability = false;
+  }
+  return linuxSecretAvailability;
+}
+var SERVER_MODE_MARKER = ".server-mode";
+function getServerModeMarkerPath() {
+  return path.join(getKeyDir(), SERVER_MODE_MARKER);
+}
+function isServerModeMarked() {
+  try {
+    return existsSync(getServerModeMarkerPath());
+  } catch {
+    return false;
+  }
+}
+function writeServerModeMarker() {
+  try {
+    const markerPath = getServerModeMarkerPath();
+    if (!existsSync(markerPath)) {
+      writeFileSync(markerPath, `# Server mode \u2014 keychain migration disabled.
+# Created: ${(/* @__PURE__ */ new Date()).toISOString()}
+# Remove this file to re-enable native keychain migration.
+`, { mode: 384 });
+    }
+  } catch {
+  }
+}
+function isRootOnlyTrustedServerKeyFile(keyPath) {
+  if (process.platform !== "linux") return false;
+  try {
+    const st = statSync(keyPath);
+    if (!st.isFile() || (st.mode & 63) !== 0) return false;
+    if (isServerModeMarked()) return true;
+    const uid = typeof os.userInfo().uid === "number" ? os.userInfo().uid : -1;
+    if (uid === 0) {
+      writeServerModeMarker();
+      return true;
+    }
+    const exeOsDir = process.env.EXE_OS_DIR;
+    if (exeOsDir && path.resolve(keyPath).startsWith(path.resolve(exeOsDir) + path.sep)) {
+      writeServerModeMarker();
+      return true;
+    }
+    if (!linuxSecretAvailable()) {
+      writeServerModeMarker();
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function macKeychainGet(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return null;
+  if (process.platform !== "darwin") return null;
+  try {
+    return execFileSync("security", ["find-generic-password", "-s", service, "-a", ACCOUNT, "-w"], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["pipe", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function macKeychainSet(value, service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "darwin") return false;
+  try {
+    process.stderr.write("[exe-os] Storing encryption key in macOS Keychain. You may see a system prompt \u2014 please allow it.\n");
+    try {
+      execFileSync("security", ["delete-generic-password", "-s", service, "-a", ACCOUNT], {
+        timeout: 5e3,
+        stdio: ["pipe", "pipe", "pipe"]
+      });
+    } catch {
+    }
+    execFileSync("security", ["add-generic-password", "-s", service, "-a", ACCOUNT, "-w", value], {
+      timeout: 5e3,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function macKeychainDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "darwin") return false;
+  try {
+    execFileSync("security", ["delete-generic-password", "-s", service, "-a", ACCOUNT], {
+      timeout: 5e3,
+      stdio: ["pipe", "ignore", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretGet(service = SERVICE) {
+  if (!linuxSecretAvailable()) return null;
+  try {
+    return execFileSync("secret-tool", ["lookup", "service", service, "account", ACCOUNT], {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["pipe", "pipe", "ignore"]
+    }).trim();
+  } catch {
+    return null;
+  }
+}
+function linuxSecretSet(value, service = SERVICE) {
+  if (!linuxSecretAvailable()) return false;
+  try {
+    const result = spawnSync("secret-tool", [
+      "store",
+      "--label",
+      "exe-os master key",
+      "service",
+      service,
+      "account",
+      ACCOUNT
+    ], {
+      input: value,
+      stdio: ["pipe", "pipe", "pipe"],
+      timeout: 5e3
+    });
+    return result.status === 0;
+  } catch {
+    return false;
+  }
+}
+function linuxSecretDelete(service = SERVICE) {
+  if (!nativeKeychainAllowed()) return false;
+  if (process.platform !== "linux") return false;
+  try {
+    execFileSync("secret-tool", ["clear", "service", service, "account", ACCOUNT], {
+      timeout: 5e3,
+      stdio: ["pipe", "ignore", "ignore"]
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function tryKeytar() {
+  if (!nativeKeychainAllowed()) return null;
+  try {
+    return await import("keytar");
+  } catch {
+    return null;
+  }
+}
+var ENCRYPTED_PREFIX = "enc:";
+function deriveMachineKey() {
+  try {
+    const material = [
+      os.hostname(),
+      os.userInfo().username,
+      os.arch(),
+      os.platform(),
+      // Machine ID on Linux (stable across reboots)
+      process.platform === "linux" ? readMachineId() : ""
+    ].join("|");
+    return crypto.createHash("sha256").update(material).digest();
+  } catch {
+    return null;
+  }
+}
+function readMachineId() {
+  try {
+    return readFileSync("/etc/machine-id", "utf-8").trim();
+  } catch {
+    return "";
+  }
+}
+function encryptWithMachineKey(plaintext, machineKey) {
+  const iv = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv("aes-256-gcm", machineKey, iv);
+  let encrypted = cipher.update(plaintext, "utf-8", "base64");
+  encrypted += cipher.final("base64");
+  const authTag = cipher.getAuthTag().toString("base64");
+  return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${authTag}:${encrypted}`;
+}
+function decryptWithMachineKey(encrypted, machineKey) {
+  if (!encrypted.startsWith(ENCRYPTED_PREFIX)) return null;
+  try {
+    const parts = encrypted.slice(ENCRYPTED_PREFIX.length).split(":");
+    if (parts.length !== 3) return null;
+    const [ivB64, tagB64, cipherB64] = parts;
+    const iv = Buffer.from(ivB64, "base64");
+    const authTag = Buffer.from(tagB64, "base64");
+    const decipher = crypto.createDecipheriv("aes-256-gcm", machineKey, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(cipherB64, "base64", "utf-8");
+    decrypted += decipher.final("utf-8");
+    return decrypted;
+  } catch {
+    return null;
+  }
+}
+async function writeMachineBoundFileFallback(b64) {
+  const dir = getKeyDir();
+  await mkdir(dir, { recursive: true });
+  const keyPath = getKeyPath();
+  const machineKey = deriveMachineKey();
+  const content = machineKey ? encryptWithMachineKey(b64, machineKey) + "\n" : b64 + "\n";
+  const result = machineKey ? "encrypted" : "plaintext";
+  const tmpPath = keyPath + ".tmp";
+  try {
+    if (existsSync(keyPath)) {
+      await copyFile(keyPath, keyPath + ".bak").catch(() => {
+      });
+    }
+    await writeFile(tmpPath, content, "utf-8");
+    await chmod(tmpPath, 384);
+    await rename(tmpPath, keyPath);
+  } catch (err) {
+    try {
+      await unlink(tmpPath);
+    } catch {
+    }
+    throw err;
+  }
+  return result;
+}
+async function getMasterKey() {
+  if (/^(1|true|yes|on)$/i.test(process.env.EXE_SERVER_MODE ?? "")) {
+    const keyPath2 = getKeyPath();
+    if (!existsSync(keyPath2)) {
+      process.stderr.write(
+        `[keychain] EXE_SERVER_MODE=1 and no server master key at ${keyPath2}; skipping native keychain lookup.
+`
+      );
+      return null;
+    }
+    try {
+      const content = (await readFile(keyPath2, "utf-8")).trim();
+      const b64Value = content.startsWith(ENCRYPTED_PREFIX) ? (() => {
+        const machineKey = deriveMachineKey();
+        return machineKey ? decryptWithMachineKey(content, machineKey) : null;
+      })() : content;
+      return b64Value ? Buffer.from(b64Value, "base64") : null;
+    } catch (err) {
+      process.stderr.write(
+        `[keychain] EXE_SERVER_MODE=1 server key read failed at ${keyPath2}: ${err instanceof Error ? err.message : String(err)}
+`
+      );
+      return null;
+    }
+  }
+  let nativeValue = macKeychainGet() ?? linuxSecretGet();
+  if (!nativeValue) {
+    const legacyValue = macKeychainGet(LEGACY_SERVICE) ?? linuxSecretGet(LEGACY_SERVICE);
+    if (legacyValue) {
+      const migrated = macKeychainSet(legacyValue) || linuxSecretSet(legacyValue);
+      if (migrated) {
+        macKeychainDelete(LEGACY_SERVICE);
+        linuxSecretDelete(LEGACY_SERVICE);
+        process.stderr.write("[keychain] Migrated keychain service from exe-mem to exe-os.\n");
+      }
+      nativeValue = legacyValue;
+    }
+  }
+  if (nativeValue) {
+    await removeFileFallbackIfPresent("native keychain read");
+    return Buffer.from(nativeValue, "base64");
+  }
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      const keytarValue = await keytar.getPassword(SERVICE, ACCOUNT);
+      const legacyKeytarValue = keytarValue ?? await keytar.getPassword(LEGACY_SERVICE, ACCOUNT);
+      if (legacyKeytarValue) {
+        const migrated = macKeychainSet(legacyKeytarValue) || linuxSecretSet(legacyKeytarValue);
+        if (migrated) {
+          process.stderr.write("[keychain] Migrated key from keytar to native keychain.\n");
+          try {
+            await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
+          } catch {
+          }
+        }
+        return Buffer.from(legacyKeytarValue, "base64");
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync(keyPath)) {
+    process.stderr.write(
+      `[keychain] Key not found at ${keyPath} (HOME=${os.homedir()}, EXE_OS_DIR=${process.env.EXE_OS_DIR ?? "unset"})
+`
+    );
+    return null;
+  }
+  try {
+    const content = (await readFile(keyPath, "utf-8")).trim();
+    let b64Value;
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      const machineKey = deriveMachineKey();
+      if (!machineKey) {
+        process.stderr.write("[keychain] Cannot derive machine key to decrypt stored key.\n");
+        return null;
+      }
+      const decrypted = decryptWithMachineKey(content, machineKey);
+      if (!decrypted) {
+        process.stderr.write(
+          "[keychain] Your computer's hostname or username appears to have changed.\n  Use your 24-word recovery phrase to restore: exe-os setup (option 2)\n"
+        );
+        return null;
+      }
+      b64Value = decrypted;
+    } else {
+      b64Value = content;
+    }
+    const key = Buffer.from(b64Value, "base64");
+    if (isRootOnlyTrustedServerKeyFile(keyPath)) {
+      return key;
+    }
+    const migrated = macKeychainSet(b64Value) || linuxSecretSet(b64Value);
+    if (migrated) {
+      process.stderr.write("[keychain] Migrated key from file to native keychain.\n");
+      try {
+        await unlink(keyPath);
+        process.stderr.write("[keychain] Removed legacy master.key file after native keychain migration.\n");
+      } catch {
+      }
+    } else if (!content.startsWith(ENCRYPTED_PREFIX)) {
+      const fallback = await writeMachineBoundFileFallback(b64Value);
+      if (fallback === "encrypted") {
+        process.stderr.write("[keychain] Upgraded legacy plaintext master.key to machine-bound encrypted fallback.\n");
+      } else {
+        process.stderr.write(
+          "[keychain] WARNING: Could not encrypt legacy master.key \u2014 plaintext fallback remains.\n"
+        );
+        warnPlaintextFallback();
+      }
+    }
+    return key;
+  } catch (err) {
+    process.stderr.write(
+      `[keychain] Key read failed at ${keyPath}: ${err instanceof Error ? err.message : String(err)}
+`
+    );
+    return null;
+  }
+}
+async function getKeyStorageInfo() {
+  if (macKeychainGet()) {
+    return {
+      kind: "macos-keychain",
+      secure: true,
+      note: "stored in macOS Keychain via built-in security CLI"
+    };
+  }
+  if (macKeychainGet(LEGACY_SERVICE)) {
+    return {
+      kind: "macos-keychain",
+      secure: true,
+      note: "stored in legacy macOS Keychain service exe-mem; next key read migrates it to exe-os"
+    };
+  }
+  if (linuxSecretGet()) {
+    return {
+      kind: "linux-secret-service",
+      secure: true,
+      note: "stored in Linux Secret Service via secret-tool"
+    };
+  }
+  if (linuxSecretGet(LEGACY_SERVICE)) {
+    return {
+      kind: "linux-secret-service",
+      secure: true,
+      note: "stored in legacy Linux Secret Service service exe-mem; next key read migrates it to exe-os"
+    };
+  }
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      if (await keytar.getPassword(SERVICE, ACCOUNT)) {
+        return {
+          kind: "legacy-keytar",
+          secure: true,
+          note: "stored in legacy keytar backend; will migrate to native keychain when possible"
+        };
+      }
+      if (await keytar.getPassword(LEGACY_SERVICE, ACCOUNT)) {
+        return {
+          kind: "legacy-keytar",
+          secure: true,
+          note: "stored in legacy keytar service exe-mem; will migrate to native exe-os keychain when possible"
+        };
+      }
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (!existsSync(keyPath)) {
+    return {
+      kind: "missing",
+      secure: false,
+      path: keyPath,
+      note: "no key found in OS keychain, legacy keytar, or file fallback"
+    };
+  }
+  try {
+    const content = (await readFile(keyPath, "utf-8")).trim();
+    if (content.startsWith(ENCRYPTED_PREFIX)) {
+      return {
+        kind: "encrypted-file",
+        secure: true,
+        path: keyPath,
+        note: "stored in machine-bound encrypted file fallback"
+      };
+    }
+    if (isRootOnlyTrustedServerKeyFile(keyPath)) {
+      return {
+        kind: "server-secret-file",
+        secure: true,
+        path: keyPath,
+        note: "stored as root-only trusted server secret file"
+      };
+    }
+    return {
+      kind: "plaintext-file",
+      secure: false,
+      path: keyPath,
+      note: "stored in legacy plaintext file; reading it will migrate or encrypt it"
+    };
+  } catch {
+    return {
+      kind: "missing",
+      secure: false,
+      path: keyPath,
+      note: "key file exists but could not be read"
+    };
+  }
+}
+async function setMasterKey(key) {
+  const b64 = key.toString("base64");
+  let keychainOk = false;
+  if (macKeychainSet(b64)) {
+    const readBack = macKeychainGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write(
+        "[keychain] macOS Keychain write appeared to succeed but read-back failed.\n  This can happen on macOS Tahoe with new permission patterns.\n"
+      );
+    }
+  } else if (linuxSecretSet(b64)) {
+    const readBack = linuxSecretGet();
+    if (readBack === b64) {
+      keychainOk = true;
+    } else {
+      process.stderr.write("[keychain] Linux secret-tool write appeared to succeed but read-back failed.\n");
+    }
+  }
+  if (!keychainOk) {
+    const keytar = await tryKeytar();
+    if (keytar) {
+      try {
+        await keytar.setPassword(SERVICE, ACCOUNT, b64);
+        const readBack = await keytar.getPassword(SERVICE, ACCOUNT);
+        if (readBack === b64) {
+          keychainOk = true;
+        } else {
+          process.stderr.write("[keychain] keytar write appeared to succeed but read-back failed.\n");
+        }
+      } catch {
+      }
+    }
+  }
+  if (keychainOk) {
+    await removeFileFallbackIfPresent("verified OS keychain write");
+    process.stderr.write("[keychain] Key stored in OS keychain.\n");
+    return;
+  }
+  const fallback = await writeMachineBoundFileFallback(b64);
+  if (fallback === "encrypted") {
+    process.stderr.write("[keychain] Key stored encrypted (machine-bound file fallback).\n");
+  } else {
+    process.stderr.write(
+      "[keychain] WARNING: Key stored in plaintext file \u2014 no OS keychain available.\n"
+    );
+    warnPlaintextFallback();
+  }
+}
+async function deleteMasterKey() {
+  macKeychainDelete();
+  linuxSecretDelete();
+  macKeychainDelete(LEGACY_SERVICE);
+  linuxSecretDelete(LEGACY_SERVICE);
+  const keytar = await tryKeytar();
+  if (keytar) {
+    try {
+      await keytar.deletePassword(SERVICE, ACCOUNT);
+      await keytar.deletePassword(LEGACY_SERVICE, ACCOUNT);
+    } catch {
+    }
+  }
+  const keyPath = getKeyPath();
+  if (existsSync(keyPath)) {
+    await unlink(keyPath);
+  }
+}
+async function loadBip39() {
+  try {
+    return await import("bip39");
+  } catch {
+    throw new Error(
+      "bip39 package not found. Reinstall exe-os: npm install -g @askexenow/exe-os@latest"
+    );
+  }
+}
+async function exportMnemonic(key) {
+  if (key.length !== 32) {
+    throw new Error(`Key must be 32 bytes, got ${key.length}`);
+  }
+  const { entropyToMnemonic } = await loadBip39();
+  return entropyToMnemonic(key.toString("hex"));
+}
+async function importMnemonic(mnemonic) {
+  const trimmed = mnemonic.trim();
+  const words = trimmed.split(/\s+/);
+  if (words.length !== 24) {
+    throw new Error(`Expected 24 words, got ${words.length}`);
+  }
+  const { validateMnemonic, mnemonicToEntropy } = await loadBip39();
+  if (!validateMnemonic(trimmed)) {
+    throw new Error("Invalid mnemonic \u2014 check for typos or missing words");
+  }
+  const entropy = mnemonicToEntropy(trimmed);
+  return Buffer.from(entropy, "hex");
+}
+
+export {
+  getMasterKey,
+  getKeyStorageInfo,
+  setMasterKey,
+  deleteMasterKey,
+  exportMnemonic,
+  importMnemonic
+};

package/dist/chunk-WX55RQRU.js

@@ -0,0 +1,58 @@
+import {
+  MODELS_DIR
+} from "./chunk-DOHKUD26.js";
+
+// src/lib/reranker.ts
+import path from "path";
+import { existsSync } from "fs";
+var RERANKER_MODEL_FILE = "jina-reranker-v3-q4_k_m.gguf";
+function isRerankerAvailable() {
+  return existsSync(path.join(MODELS_DIR, RERANKER_MODEL_FILE));
+}
+function getRerankerModelPath() {
+  return path.join(MODELS_DIR, RERANKER_MODEL_FILE);
+}
+async function disposeReranker() {
+}
+async function rerankWithScores(query, texts, topK) {
+  if (texts.length === 0) return [];
+  const { rerankViaWorker } = await import("./lib/exe-daemon.js");
+  const scored = await rerankViaWorker(query, texts, topK);
+  return scored.map((s) => ({
+    text: texts[s.index] ?? "",
+    score: s.score,
+    index: s.index
+  }));
+}
+async function rerank(query, candidates, topK = 5) {
+  if (candidates.length === 0) return [];
+  if (candidates.length <= topK) return candidates;
+  const scored = await rerankWithScores(
+    query,
+    candidates.map((c) => c.raw_text),
+    topK
+  );
+  return scored.map((s) => candidates[s.index]);
+}
+async function rerankWithContext(query, candidates, topK) {
+  if (candidates.length === 0) return [];
+  const formattedTexts = candidates.map(
+    (c) => c.context ? `[${c.context}] ${c.text.slice(0, 460)}` : c.text.slice(0, 512)
+  );
+  const { rerankViaWorker } = await import("./lib/exe-daemon.js");
+  const scored = await rerankViaWorker(query, formattedTexts, topK);
+  return scored.map((s) => ({
+    text: candidates[s.index]?.text ?? "",
+    score: s.score,
+    index: s.index
+  }));
+}
+
+export {
+  isRerankerAvailable,
+  getRerankerModelPath,
+  disposeReranker,
+  rerankWithScores,
+  rerank,
+  rerankWithContext
+};