@hcu-lab.me/mcp-device 1.0.1 → 1.0.2

package/dist/device/gateway-config.d.ts

@@ -11,17 +11,10 @@ export interface GatewayDeviceConfig {
     appCaPem: string | null;
     securityProtocolFloor: number;
 }
-type SecretProtect = (value: Buffer) => Promise<string>;
-type SecretUnprotect = (value: string) => Promise<Buffer>;
 export declare class GatewayDeviceConfigStore {
     readonly configPath: string;
-    private platform;
-    private protectSecret;
-    private unprotectSecret;
-    constructor(configPath?: string, options?: {
+    constructor(configPath?: string, _options?: {
         platform?: NodeJS.Platform | string;
-        protectSecret?: SecretProtect;
-        unprotectSecret?: SecretUnprotect;
     });
     load(): Promise<GatewayDeviceConfig>;
     update(patch: Partial<GatewayDeviceConfig>): Promise<GatewayDeviceConfig>;
@@ -37,4 +30,3 @@ export declare function captureGatewayConfigFromEnvironment(store: GatewayDevice
 export declare function createGatewayProxyAgent(config: GatewayDeviceConfig): {
     agent: ProxyAgent;
 };
-export {};

package/dist/device/gateway-config.js

@@ -4,7 +4,6 @@ import { createRequire } from 'module';
 import path from 'path';
 import { ProxyAgent } from 'proxy-agent';
 import { deviceStatePaths } from './device-state.js';
-import { protectWindowsSecret, unprotectWindowsSecret } from './windows-dpapi.js';
 const require = createRequire(import.meta.url);
 const { getProxyForUrl } = require('proxy-from-env');
 const PROXY_ENV_NAMES = ['HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'ALL_PROXY', 'http_proxy', 'https_proxy', 'no_proxy', 'all_proxy'];
@@ -61,11 +60,8 @@ function normalizeFloor(value) {
     return Math.max(1, parsed);
 }
 export class GatewayDeviceConfigStore {
-    constructor(configPath = defaultConfigPath(), options = {}) {
+    constructor(configPath = defaultConfigPath(), _options = {}) {
         this.configPath = path.resolve(configPath);
-        this.platform = options.platform || process.platform;
-        this.protectSecret = options.protectSecret || (value => protectWindowsSecret(value, 'proxy', { platform: this.platform }));
-        this.unprotectSecret = options.unprotectSecret || (value => unprotectWindowsSecret(value, 'proxy', { platform: this.platform }));
     }
     async load() {
         let parsed;
@@ -79,16 +75,10 @@ export class GatewayDeviceConfigStore {
         }
         if (!parsed || typeof parsed !== 'object')
             throw new Error('Invalid gateway config record.');
-        let proxy;
-        if (parsed.proxy?.mode === 'configured' && parsed.proxy?.protected?.scheme === 'dpapi-current-user-v1') {
-            if (this.platform !== 'win32')
-                throw new Error('DPAPI-protected proxy configuration requires Windows.');
-            const restored = await this.unprotectSecret(String(parsed.proxy.protected.blob || ''));
-            proxy = normalizedProxy({ mode: 'configured', url: restored.toString('utf8') });
-        }
-        else {
-            proxy = normalizedProxy(parsed.proxy);
+        if (parsed.proxy?.mode === 'configured' && parsed.proxy?.protected) {
+            throw new Error('Legacy protected proxy configuration is unsupported in MCP Device 1.0.2+. Re-run `mcp-device login` with your proxy environment configured.');
         }
+        const proxy = normalizedProxy(parsed.proxy);
         const appCaPem = normalizeAppCa(parsed.appCaPem);
         const requestedFloor = normalizeFloor(parsed.securityProtocolFloor);
         return {
@@ -118,19 +108,9 @@ export class GatewayDeviceConfigStore {
         return next;
     }
     async persist(config) {
-        let proxy = { mode: 'direct' };
-        if (config.proxy.mode === 'configured' && config.proxy.url) {
-            if (this.platform === 'win32') {
-                const blob = await this.protectSecret(Buffer.from(config.proxy.url, 'utf8'));
-                const restored = await this.unprotectSecret(blob);
-                if (restored.toString('utf8') !== config.proxy.url)
-                    throw new Error('DPAPI proxy verification failed.');
-                proxy = { mode: 'configured', protected: { scheme: 'dpapi-current-user-v1', blob } };
-            }
-            else {
-                proxy = { mode: 'configured', url: config.proxy.url };
-            }
-        }
+        const proxy = config.proxy.mode === 'configured' && config.proxy.url
+            ? { mode: 'configured', url: config.proxy.url }
+            : { mode: 'direct' };
         const persisted = {
             version: 1,
             gatewayUrl: config.gatewayUrl,

package/dist/device/gateway-identity.d.ts

@@ -5,18 +5,11 @@ export interface GatewayIdentityRecord {
     enrolled: boolean;
 }
 export declare function deviceIdentityNeedsPairing(record: Pick<GatewayIdentityRecord, 'enrolled'>): boolean;
-type SecretProtect = (value: Buffer) => Promise<string>;
-type SecretUnprotect = (value: string) => Promise<Buffer>;
 export declare class GatewayDeviceIdentity {
     readonly identityPath: string;
     private record?;
-    private platform;
-    private protectSecret;
-    private unprotectSecret;
-    constructor(identityPath?: string, options?: {
+    constructor(identityPath?: string, _options?: {
         platform?: NodeJS.Platform | string;
-        protectSecret?: SecretProtect;
-        unprotectSecret?: SecretUnprotect;
     });
     loadOrCreate(): Promise<GatewayIdentityRecord>;
     markEnrolled(): Promise<void>;
@@ -27,9 +20,7 @@ export declare class GatewayDeviceIdentity {
         exporter: Buffer | string;
         grant?: string | null;
     }): Promise<string>;
-    private loadPersisted;
-    private protectAndVerify;
+    private archiveLegacyProtectedIdentity;
     private persist;
     private persistSerialized;
 }
-export {};

package/dist/device/gateway-identity.js

@@ -3,7 +3,6 @@ import fs from 'fs/promises';
 import os from 'os';
 import path from 'path';
 import { deviceStatePaths } from './device-state.js';
-import { protectWindowsSecret, unprotectWindowsSecret } from './windows-dpapi.js';
 export function deviceIdentityNeedsPairing(record) {
     return record.enrolled !== true;
 }
@@ -45,26 +44,22 @@ function validateRecord(value) {
         throw new Error('Gateway identity private key does not match the stored public key');
     return { deviceId, publicKeyPem: normalizedPublic, privateKeyPem, enrolled: value.enrolled === true };
 }
-function privateKeyDer(privateKeyPem) {
-    return createPrivateKey(privateKeyPem).export({ type: 'pkcs8', format: 'der' });
-}
-function privateKeyPemFromDer(value) {
-    return createPrivateKey({ key: value, type: 'pkcs8', format: 'der' }).export({ type: 'pkcs8', format: 'pem' }).toString();
-}
 export class GatewayDeviceIdentity {
-    constructor(identityPath = defaultIdentityPath(), options = {}) {
+    constructor(identityPath = defaultIdentityPath(), _options = {}) {
         this.identityPath = identityPath;
-        this.platform = options.platform || process.platform;
-        this.protectSecret = options.protectSecret || (value => protectWindowsSecret(value, 'identity', { platform: this.platform }));
-        this.unprotectSecret = options.unprotectSecret || (value => unprotectWindowsSecret(value, 'identity', { platform: this.platform }));
     }
     async loadOrCreate() {
         if (this.record)
             return { ...this.record };
         try {
             const parsed = JSON.parse(await fs.readFile(this.identityPath, 'utf8'));
-            this.record = await this.loadPersisted(parsed);
-            return { ...this.record };
+            if (parsed?.privateKey?.scheme) {
+                await this.archiveLegacyProtectedIdentity();
+            }
+            else {
+                this.record = validateRecord(parsed);
+                return { ...this.record };
+            }
         }
         catch (error) {
             if (error?.code !== 'ENOENT')
@@ -120,49 +115,13 @@ export class GatewayDeviceIdentity {
         ]);
         return sign(null, challenge, current.privateKeyPem).toString('base64');
     }
-    async loadPersisted(value) {
-        if (value?.privateKeyPem) {
-            const legacy = validateRecord(value);
-            if (this.platform !== 'win32')
-                return legacy;
-            const blob = await this.protectAndVerify(legacy);
-            await this.persistSerialized({
-                version: 2,
-                deviceId: legacy.deviceId,
-                publicKeyPem: legacy.publicKeyPem,
-                privateKey: { scheme: 'dpapi-current-user-v1', blob },
-                enrolled: legacy.enrolled
-            });
-            return legacy;
-        }
-        if (value?.privateKey?.scheme !== 'dpapi-current-user-v1' || !value.privateKey.blob) {
-            throw new Error('Invalid gateway identity protected private key');
-        }
-        if (this.platform !== 'win32')
-            throw new Error('DPAPI-protected gateway identity requires Windows');
-        const privateKeyPem = privateKeyPemFromDer(await this.unprotectSecret(String(value.privateKey.blob)));
-        return validateRecord({ ...value, privateKeyPem });
-    }
-    async protectAndVerify(record) {
-        const blob = await this.protectSecret(privateKeyDer(record.privateKeyPem));
-        const restoredPem = privateKeyPemFromDer(await this.unprotectSecret(blob));
-        validateRecord({ ...record, privateKeyPem: restoredPem });
-        return blob;
+    async archiveLegacyProtectedIdentity() {
+        const archivePath = `${this.identityPath}.legacy-protected.${Date.now()}`;
+        await fs.rename(this.identityPath, archivePath);
     }
     async persist() {
         if (!this.record)
             throw new Error('Gateway identity is not initialized');
-        if (this.platform === 'win32') {
-            const blob = await this.protectAndVerify(this.record);
-            await this.persistSerialized({
-                version: 2,
-                deviceId: this.record.deviceId,
-                publicKeyPem: this.record.publicKeyPem,
-                privateKey: { scheme: 'dpapi-current-user-v1', blob },
-                enrolled: this.record.enrolled
-            });
-            return;
-        }
         await this.persistSerialized(this.record);
     }
     async persistSerialized(value) {

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.2.46";
+export declare const VERSION = "1.0.2";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.2.46';
+export const VERSION = '1.0.2';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hcu-lab.me/mcp-device",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "MCP Device securely connects a user-owned computer to an authenticated Model Context Protocol gateway.",
   "license": "MIT",
   "author": "Hirohimeow",
@@ -29,11 +29,11 @@
     "bump": "node scripts/sync-version.js --bump",
     "bump:minor": "node scripts/sync-version.js --bump --minor",
     "bump:major": "node scripts/sync-version.js --bump --major",
-    "build": "shx rm -rf dist/remote-device && shx rm -f dist/device/desktop-commander-integration.js dist/device/desktop-commander-integration.d.ts && tsc && shx chmod +x dist/*.js && shx mkdir -p dist/data && shx cp src/data/onboarding-prompts.json dist/data/ && node scripts/copy-official-ca.cjs && node scripts/build-ui-runtime.cjs",
+    "build": "shx rm -rf dist/remote-device && shx rm -f dist/device/desktop-commander-integration.js dist/device/desktop-commander-integration.d.ts dist/device/windows-dpapi.js dist/device/windows-dpapi.d.ts && tsc && shx chmod +x dist/*.js && shx mkdir -p dist/data && shx cp src/data/onboarding-prompts.json dist/data/ && node scripts/copy-official-ca.cjs && node scripts/build-ui-runtime.cjs",
     "watch": "tsc --watch",
     "start": "node dist/mcp-device.js",
     "start:debug": "node --inspect-brk=9229 dist/mcp-device.js",
-    "prepack": "node scripts/verify-production-trust.cjs && shx rm -rf dist/remote-device && shx rm -f dist/device/desktop-commander-integration.js dist/device/desktop-commander-integration.d.ts dist/hcu-device.js dist/hcu-device.d.ts dist/track-installation.js dist/setup-claude-server.js dist/uninstall-claude-server.js dist/npm-scripts/setup.js dist/npm-scripts/setup.d.ts dist/npm-scripts/uninstall.js dist/npm-scripts/uninstall.d.ts dist/npm-scripts/verify-ripgrep.js dist/npm-scripts/verify-ripgrep.d.ts",
+    "prepack": "node scripts/verify-production-trust.cjs && shx rm -rf dist/remote-device && shx rm -f dist/device/desktop-commander-integration.js dist/device/desktop-commander-integration.d.ts dist/device/windows-dpapi.js dist/device/windows-dpapi.d.ts dist/hcu-device.js dist/hcu-device.d.ts dist/track-installation.js dist/setup-claude-server.js dist/uninstall-claude-server.js dist/npm-scripts/setup.js dist/npm-scripts/setup.d.ts dist/npm-scripts/uninstall.js dist/npm-scripts/uninstall.d.ts dist/npm-scripts/verify-ripgrep.js dist/npm-scripts/verify-ripgrep.d.ts",
     "prepare": "npm run build",
     "clean": "shx rm -rf dist",
     "test": "npm run build && node test/run-all-tests.js",

package/dist/device/windows-dpapi.d.ts

@@ -1,11 +0,0 @@
-type DpapiLabel = 'identity' | 'proxy';
-type PowerShellRunner = (script: string, input: string) => Promise<string>;
-export declare function protectWindowsSecret(secret: Buffer | Uint8Array | string, label: DpapiLabel, options?: {
-    platform?: NodeJS.Platform | string;
-    runner?: PowerShellRunner;
-}): Promise<string>;
-export declare function unprotectWindowsSecret(blob: string, label: DpapiLabel, options?: {
-    platform?: NodeJS.Platform | string;
-    runner?: PowerShellRunner;
-}): Promise<Buffer>;
-export {};

package/dist/device/windows-dpapi.js

@@ -1,67 +0,0 @@
-import { spawn } from 'child_process';
-const ENTROPY = {
-    identity: 'hcu-device-identity-private-key-v1',
-    proxy: 'hcu-device-proxy-url-v1'
-};
-function assertLabel(label) {
-    if (!(label in ENTROPY))
-        throw new Error('Unsupported DPAPI secret label.');
-}
-async function runPowerShell(script, input) {
-    return await new Promise((resolve, reject) => {
-        const child = spawn('powershell.exe', ['-NoProfile', '-NonInteractive', '-Command', script], {
-            windowsHide: true,
-            stdio: ['pipe', 'pipe', 'pipe']
-        });
-        const stdout = [];
-        const stderr = [];
-        child.stdout.on('data', chunk => stdout.push(Buffer.from(chunk)));
-        child.stderr.on('data', chunk => stderr.push(Buffer.from(chunk)));
-        child.once('error', reject);
-        child.once('close', code => {
-            if (code !== 0) {
-                reject(new Error(Buffer.concat(stderr).toString('utf8').trim() || `DPAPI PowerShell failed with exit code ${code}`));
-                return;
-            }
-            resolve(Buffer.concat(stdout).toString('utf8').trim());
-        });
-        child.stdin.end(input, 'utf8');
-    });
-}
-function dpapiScript(action, label) {
-    const entropy = Buffer.from(ENTROPY[label], 'utf8').toString('base64');
-    return [
-        "$ErrorActionPreference = 'Stop'",
-        'Add-Type -AssemblyName System.Security',
-        '$inputB64 = [Console]::In.ReadToEnd().Trim()',
-        '$data = [Convert]::FromBase64String($inputB64)',
-        `$entropy = [Convert]::FromBase64String('${entropy}')`,
-        '$scope = [System.Security.Cryptography.DataProtectionScope]::CurrentUser',
-        `$output = [System.Security.Cryptography.ProtectedData]::${action}($data, $entropy, $scope)`,
-        '[Console]::Out.Write([Convert]::ToBase64String($output))'
-    ].join('; ');
-}
-export async function protectWindowsSecret(secret, label, options = {}) {
-    const platform = options.platform || process.platform;
-    if (platform !== 'win32')
-        throw new Error('Windows DPAPI is only available on Windows.');
-    assertLabel(label);
-    const bytes = typeof secret === 'string' ? Buffer.from(secret, 'utf8') : Buffer.from(secret);
-    const output = await (options.runner || runPowerShell)(dpapiScript('Protect', label), bytes.toString('base64'));
-    if (!output)
-        throw new Error('Windows DPAPI returned an empty protected value.');
-    return output;
-}
-export async function unprotectWindowsSecret(blob, label, options = {}) {
-    const platform = options.platform || process.platform;
-    if (platform !== 'win32')
-        throw new Error('Windows DPAPI is only available on Windows.');
-    assertLabel(label);
-    const input = String(blob || '').trim();
-    if (!input)
-        throw new Error('Windows DPAPI protected value is empty.');
-    const output = await (options.runner || runPowerShell)(dpapiScript('Unprotect', label), input);
-    if (!output)
-        throw new Error('Windows DPAPI returned an empty unprotected value.');
-    return Buffer.from(output, 'base64');
-}