@hasna/contacts 0.6.2 → 0.6.3

package/dist/cli/index.js

@@ -6063,12 +6063,41 @@ __export(exports_vault, {
   decryptFile: () => decryptFile,
   decrypt: () => decrypt
 });
-import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync3, mkdirSync as mkdirSync4, unlinkSync as unlinkSync2 } from "fs";
 import { join as join5 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash } from "crypto";
 function deriveKey(passphrase, salt) {
   return pbkdf2Sync(passphrase, salt, 1e5, 32, "sha512");
 }
+function saveSession(key) {
+  const session = {
+    key: key.toString("hex"),
+    expires_at: new Date(Date.now() + SESSION_TTL_MS).toISOString()
+  };
+  writeFileSync3(VAULT_SESSION, JSON.stringify(session), { mode: 384 });
+}
+function loadSession() {
+  if (!existsSync5(VAULT_SESSION))
+    return null;
+  try {
+    const session = JSON.parse(readFileSync3(VAULT_SESSION, "utf-8"));
+    if (new Date(session.expires_at).getTime() < Date.now()) {
+      try {
+        unlinkSync2(VAULT_SESSION);
+      } catch {}
+      return null;
+    }
+    return Buffer.from(session.key, "hex");
+  } catch {
+    return null;
+  }
+}
+function clearSession() {
+  try {
+    if (existsSync5(VAULT_SESSION))
+      unlinkSync2(VAULT_SESSION);
+  } catch {}
+}
 function initVault(passphrase) {
   if (!existsSync5(VAULT_DIR))
     mkdirSync4(VAULT_DIR, { recursive: true });
@@ -6080,6 +6109,7 @@ function initVault(passphrase) {
   const config = { salt: salt.toString("hex"), key_hash: keyHash, created_at: new Date().toISOString() };
   writeFileSync3(VAULT_CONFIG, JSON.stringify(config, null, 2));
   _derivedKey = key;
+  saveSession(key);
 }
 function isVaultInitialized() {
   return existsSync5(VAULT_CONFIG);
@@ -6094,18 +6124,32 @@ function unlockVault(passphrase) {
   if (keyHash !== config.key_hash)
     return false;
   _derivedKey = key;
+  saveSession(key);
   return true;
 }
 function lockVault() {
   _derivedKey = null;
+  clearSession();
 }
 function isVaultUnlocked() {
-  return _derivedKey !== null;
+  if (_derivedKey)
+    return true;
+  const sessionKey = loadSession();
+  if (sessionKey) {
+    _derivedKey = sessionKey;
+    return true;
+  }
+  return false;
 }
 function requireVault() {
-  if (!_derivedKey)
-    throw new Error("Vault is locked. Unlock with 'contacts vault unlock' or vault_unlock MCP tool first.");
-  return _derivedKey;
+  if (_derivedKey)
+    return _derivedKey;
+  const sessionKey = loadSession();
+  if (sessionKey) {
+    _derivedKey = sessionKey;
+    return _derivedKey;
+  }
+  throw new Error("Vault is locked. Unlock with 'contacts vault unlock --passphrase <pass>' or vault_unlock MCP tool first.");
 }
 function encrypt(plaintext) {
   const key = requireVault();
@@ -6156,11 +6200,13 @@ function getDocumentsDir() {
     mkdirSync4(DOCUMENTS_DIR, { recursive: true });
   return DOCUMENTS_DIR;
 }
-var VAULT_DIR, VAULT_CONFIG, DOCUMENTS_DIR, _derivedKey = null;
+var VAULT_DIR, VAULT_CONFIG, VAULT_SESSION, DOCUMENTS_DIR, SESSION_TTL_MS, _derivedKey = null;
 var init_vault = __esm(() => {
   VAULT_DIR = join5(process.env["HOME"] || "~", ".contacts");
   VAULT_CONFIG = join5(VAULT_DIR, "vault.json");
+  VAULT_SESSION = join5(VAULT_DIR, ".vault-session");
   DOCUMENTS_DIR = join5(VAULT_DIR, "documents");
+  SESSION_TTL_MS = 30 * 60 * 1000;
 });
 
 // src/db/documents.ts
@@ -6172,7 +6218,7 @@ __export(exports_documents, {
   addDocument: () => addDocument,
   DOCUMENT_TYPES: () => DOCUMENT_TYPES
 });
-import { existsSync as existsSync6, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync6, unlinkSync as unlinkSync3 } from "fs";
 function addDocument(input, db) {
   requireVault();
   const _db2 = db || getDatabase();
@@ -6210,7 +6256,7 @@ function deleteDocument(id, db) {
   const row = _db2.query(`SELECT encrypted_file_path FROM contact_documents WHERE id = ?`).get(id);
   if (row?.encrypted_file_path && existsSync6(row.encrypted_file_path)) {
     try {
-      unlinkSync2(row.encrypted_file_path);
+      unlinkSync3(row.encrypted_file_path);
     } catch {}
   }
   _db2.query(`DELETE FROM contact_documents WHERE id = ?`).run(id);

package/dist/index.js

@@ -4503,16 +4503,47 @@ function listImages() {
   }));
 }
 // src/lib/vault.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "fs";
 import { join as join4 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash } from "crypto";
 var VAULT_DIR = join4(process.env["HOME"] || "~", ".contacts");
 var VAULT_CONFIG = join4(VAULT_DIR, "vault.json");
+var VAULT_SESSION = join4(VAULT_DIR, ".vault-session");
 var DOCUMENTS_DIR = join4(VAULT_DIR, "documents");
+var SESSION_TTL_MS = 30 * 60 * 1000;
 var _derivedKey = null;
 function deriveKey(passphrase, salt) {
   return pbkdf2Sync(passphrase, salt, 1e5, 32, "sha512");
 }
+function saveSession(key) {
+  const session = {
+    key: key.toString("hex"),
+    expires_at: new Date(Date.now() + SESSION_TTL_MS).toISOString()
+  };
+  writeFileSync2(VAULT_SESSION, JSON.stringify(session), { mode: 384 });
+}
+function loadSession() {
+  if (!existsSync4(VAULT_SESSION))
+    return null;
+  try {
+    const session = JSON.parse(readFileSync3(VAULT_SESSION, "utf-8"));
+    if (new Date(session.expires_at).getTime() < Date.now()) {
+      try {
+        unlinkSync2(VAULT_SESSION);
+      } catch {}
+      return null;
+    }
+    return Buffer.from(session.key, "hex");
+  } catch {
+    return null;
+  }
+}
+function clearSession() {
+  try {
+    if (existsSync4(VAULT_SESSION))
+      unlinkSync2(VAULT_SESSION);
+  } catch {}
+}
 function initVault(passphrase) {
   if (!existsSync4(VAULT_DIR))
     mkdirSync3(VAULT_DIR, { recursive: true });
@@ -4524,6 +4555,7 @@ function initVault(passphrase) {
   const config = { salt: salt.toString("hex"), key_hash: keyHash, created_at: new Date().toISOString() };
   writeFileSync2(VAULT_CONFIG, JSON.stringify(config, null, 2));
   _derivedKey = key;
+  saveSession(key);
 }
 function isVaultInitialized() {
   return existsSync4(VAULT_CONFIG);
@@ -4538,18 +4570,32 @@ function unlockVault(passphrase) {
   if (keyHash !== config.key_hash)
     return false;
   _derivedKey = key;
+  saveSession(key);
   return true;
 }
 function lockVault() {
   _derivedKey = null;
+  clearSession();
 }
 function isVaultUnlocked() {
-  return _derivedKey !== null;
+  if (_derivedKey)
+    return true;
+  const sessionKey = loadSession();
+  if (sessionKey) {
+    _derivedKey = sessionKey;
+    return true;
+  }
+  return false;
 }
 function requireVault() {
-  if (!_derivedKey)
-    throw new Error("Vault is locked. Unlock with 'contacts vault unlock' or vault_unlock MCP tool first.");
-  return _derivedKey;
+  if (_derivedKey)
+    return _derivedKey;
+  const sessionKey = loadSession();
+  if (sessionKey) {
+    _derivedKey = sessionKey;
+    return _derivedKey;
+  }
+  throw new Error("Vault is locked. Unlock with 'contacts vault unlock --passphrase <pass>' or vault_unlock MCP tool first.");
 }
 function encrypt(plaintext) {
   const key = requireVault();
@@ -4602,7 +4648,7 @@ function getDocumentsDir() {
 }
 // src/db/documents.ts
 init_database();
-import { existsSync as existsSync5, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync5, unlinkSync as unlinkSync3 } from "fs";
 var DOCUMENT_TYPES = [
   "passport",
   "national_id",
@@ -4661,7 +4707,7 @@ function deleteDocument(id, db) {
   const row = _db2.query(`SELECT encrypted_file_path FROM contact_documents WHERE id = ?`).get(id);
   if (row?.encrypted_file_path && existsSync5(row.encrypted_file_path)) {
     try {
-      unlinkSync2(row.encrypted_file_path);
+      unlinkSync3(row.encrypted_file_path);
     } catch {}
   }
   _db2.query(`DELETE FROM contact_documents WHERE id = ?`).run(id);

package/dist/lib/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/lib/vault.ts"],"names":[],"mappings":"AAoBA,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CASlD;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CASvD;AAED,wBAAgB,SAAS,IAAI,IAAI,CAEhC;AAED,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAED,wBAAgB,YAAY,IAAI,MAAM,CAGrC;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAQ7E;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAS9D;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAaxE;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,wBAAgB,eAAe,IAAI,MAAM,CAGxC"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../../src/lib/vault.ts"],"names":[],"mappings":"AAgDA,wBAAgB,SAAS,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAUlD;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAUvD;AAED,wBAAgB,SAAS,IAAI,IAAI,CAGhC;AAED,wBAAgB,eAAe,IAAI,OAAO,CASzC;AAED,wBAAgB,YAAY,IAAI,MAAM,CASrC;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,CAQ7E;AAED,wBAAgB,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAS9D;AAED,wBAAgB,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAaxE;AAED,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,wBAAgB,eAAe,IAAI,MAAM,CAGxC"}

package/dist/mcp/index.js

@@ -4317,16 +4317,47 @@ function deleteImage(entityId) {
 }
 
 // src/lib/vault.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync3, unlinkSync as unlinkSync2 } from "fs";
 import { join as join4 } from "path";
 import { createCipheriv, createDecipheriv, randomBytes, pbkdf2Sync, createHash } from "crypto";
 var VAULT_DIR = join4(process.env["HOME"] || "~", ".contacts");
 var VAULT_CONFIG = join4(VAULT_DIR, "vault.json");
+var VAULT_SESSION = join4(VAULT_DIR, ".vault-session");
 var DOCUMENTS_DIR = join4(VAULT_DIR, "documents");
+var SESSION_TTL_MS = 30 * 60 * 1000;
 var _derivedKey = null;
 function deriveKey(passphrase, salt) {
   return pbkdf2Sync(passphrase, salt, 1e5, 32, "sha512");
 }
+function saveSession(key) {
+  const session = {
+    key: key.toString("hex"),
+    expires_at: new Date(Date.now() + SESSION_TTL_MS).toISOString()
+  };
+  writeFileSync2(VAULT_SESSION, JSON.stringify(session), { mode: 384 });
+}
+function loadSession() {
+  if (!existsSync4(VAULT_SESSION))
+    return null;
+  try {
+    const session = JSON.parse(readFileSync3(VAULT_SESSION, "utf-8"));
+    if (new Date(session.expires_at).getTime() < Date.now()) {
+      try {
+        unlinkSync2(VAULT_SESSION);
+      } catch {}
+      return null;
+    }
+    return Buffer.from(session.key, "hex");
+  } catch {
+    return null;
+  }
+}
+function clearSession() {
+  try {
+    if (existsSync4(VAULT_SESSION))
+      unlinkSync2(VAULT_SESSION);
+  } catch {}
+}
 function initVault(passphrase) {
   if (!existsSync4(VAULT_DIR))
     mkdirSync3(VAULT_DIR, { recursive: true });
@@ -4338,6 +4369,7 @@ function initVault(passphrase) {
   const config = { salt: salt.toString("hex"), key_hash: keyHash, created_at: new Date().toISOString() };
   writeFileSync2(VAULT_CONFIG, JSON.stringify(config, null, 2));
   _derivedKey = key;
+  saveSession(key);
 }
 function isVaultInitialized() {
   return existsSync4(VAULT_CONFIG);
@@ -4352,18 +4384,32 @@ function unlockVault(passphrase) {
   if (keyHash !== config.key_hash)
     return false;
   _derivedKey = key;
+  saveSession(key);
   return true;
 }
 function lockVault() {
   _derivedKey = null;
+  clearSession();
 }
 function isVaultUnlocked() {
-  return _derivedKey !== null;
+  if (_derivedKey)
+    return true;
+  const sessionKey = loadSession();
+  if (sessionKey) {
+    _derivedKey = sessionKey;
+    return true;
+  }
+  return false;
 }
 function requireVault() {
-  if (!_derivedKey)
-    throw new Error("Vault is locked. Unlock with 'contacts vault unlock' or vault_unlock MCP tool first.");
-  return _derivedKey;
+  if (_derivedKey)
+    return _derivedKey;
+  const sessionKey = loadSession();
+  if (sessionKey) {
+    _derivedKey = sessionKey;
+    return _derivedKey;
+  }
+  throw new Error("Vault is locked. Unlock with 'contacts vault unlock --passphrase <pass>' or vault_unlock MCP tool first.");
 }
 function encrypt(plaintext) {
   const key = requireVault();
@@ -4402,7 +4448,7 @@ function encryptFile(sourcePath, entityId) {
 
 // src/db/documents.ts
 init_database();
-import { existsSync as existsSync5, unlinkSync as unlinkSync2 } from "fs";
+import { existsSync as existsSync5, unlinkSync as unlinkSync3 } from "fs";
 var DOCUMENT_TYPES = [
   "passport",
   "national_id",
@@ -4461,7 +4507,7 @@ function deleteDocument(id, db) {
   const row = _db2.query(`SELECT encrypted_file_path FROM contact_documents WHERE id = ?`).get(id);
   if (row?.encrypted_file_path && existsSync5(row.encrypted_file_path)) {
     try {
-      unlinkSync2(row.encrypted_file_path);
+      unlinkSync3(row.encrypted_file_path);
     } catch {}
   }
   _db2.query(`DELETE FROM contact_documents WHERE id = ?`).run(id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hasna/contacts",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Contact management for AI coding agents — CLI + MCP + Web",
   "type": "module",
   "main": "dist/index.js",