@i4ctime/q-ring 0.11.7 → 0.13.0

package/dist/mcp.js

@@ -32,13 +32,14 @@ import {
   registry,
   remember,
   removeHook,
+  setPolicyRoot,
   setSecret,
   tunnelCreate,
   tunnelDestroy,
   tunnelList,
   tunnelRead,
   verifyAuditChain
-} from "./chunk-MQM4DLPI.js";
+} from "./chunk-CWV3WTPF.js";
 
 // src/mcp.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
@@ -118,24 +119,28 @@ function generateSecret(opts2 = {}) {
     }
     case "password": {
       const len = opts2.length ?? 24;
-      let pw = randomString(PASSWORD_CHARS, len);
-      const hasUpper = /[A-Z]/.test(pw);
-      const hasLower = /[a-z]/.test(pw);
-      const hasDigit = /[0-9]/.test(pw);
-      const hasSpecial = /[^A-Za-z0-9]/.test(pw);
-      if (!hasUpper) pw = replaceAt(pw, randomInt(len), randomString("ABCDEFGHIJKLMNOPQRSTUVWXYZ", 1));
-      if (!hasLower) pw = replaceAt(pw, randomInt(len), randomString("abcdefghijklmnopqrstuvwxyz", 1));
-      if (!hasDigit) pw = replaceAt(pw, randomInt(len), randomString("0123456789", 1));
-      if (!hasSpecial) pw = replaceAt(pw, randomInt(len), randomString("!@#$%^&*()-_=+", 1));
-      return pw;
+      const classCharsets = [
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZ",
+        "abcdefghijklmnopqrstuvwxyz",
+        "0123456789",
+        "!@#$%^&*()-_=+"
+      ];
+      const guaranteed = classCharsets.slice(0, Math.min(classCharsets.length, len)).map((cs) => randomString(cs, 1));
+      const remaining = Math.max(0, len - guaranteed.length);
+      const chars = [
+        ...guaranteed,
+        ...remaining > 0 ? randomString(PASSWORD_CHARS, remaining).split("") : []
+      ];
+      for (let i = chars.length - 1; i > 0; i--) {
+        const j = randomInt(i + 1);
+        [chars[i], chars[j]] = [chars[j], chars[i]];
+      }
+      return chars.join("");
     }
     default:
       return randomBytes(32).toString("hex");
   }
 }
-function replaceAt(str, index, char) {
-  return str.slice(0, index) + char + str.slice(index + 1);
-}
 function estimateEntropy(secret) {
   const charsets = [
     { regex: /[a-z]/, size: 26 },
@@ -173,8 +178,11 @@ function parseDotenv(content) {
       '"': '"'
     };
     value = value.replace(/\\([nrt"\\])/g, (_, ch) => escapeMap[ch] ?? ch);
-    if (value.includes("#") && !line.includes('"') && !line.includes("'")) {
-      value = value.split("#")[0].trim();
+    if (!line.includes('"') && !line.includes("'")) {
+      const commentMatch = value.match(/\s#/);
+      if (commentMatch && commentMatch.index !== void 0) {
+        value = value.slice(0, commentMatch.index).trim();
+      }
     }
     if (key) result.set(key, value);
   }
@@ -182,9 +190,14 @@ function parseDotenv(content) {
 }
 function importDotenv(filePathOrContent, options = {}) {
   let content;
-  try {
-    content = readFileSync(filePathOrContent, "utf8");
-  } catch {
+  const source = options.source ?? "cli";
+  if (source === "cli") {
+    try {
+      content = readFileSync(filePathOrContent, "utf8");
+    } catch {
+      content = filePathOrContent;
+    }
+  } else {
     content = filePathOrContent;
   }
   const pairs = parseDotenv(content);
@@ -1329,7 +1342,8 @@ var ALGORITHM = "aes-256-gcm";
 var KEY_LENGTH = 32;
 var IV_LENGTH = 12;
 var SALT_LENGTH = 32;
-var PBKDF2_ITERATIONS = 1e5;
+var PBKDF2_ITERATIONS = 21e4;
+var LEGACY_PBKDF2_ITERATIONS = 1e5;
 var TeleportBundleSchema = z4.object({
   v: z4.literal(1),
   data: z4.string(),
@@ -1337,7 +1351,8 @@ var TeleportBundleSchema = z4.object({
   iv: z4.string(),
   tag: z4.string(),
   createdAt: z4.string(),
-  count: z4.number()
+  count: z4.number(),
+  iter: z4.number().optional()
 });
 var TeleportPayloadSchema = z4.object({
   secrets: z4.array(
@@ -1350,8 +1365,8 @@ var TeleportPayloadSchema = z4.object({
   exportedAt: z4.string(),
   exportedBy: z4.string().optional()
 });
-function deriveKey(passphrase, salt) {
-  return pbkdf2Sync(passphrase, salt, PBKDF2_ITERATIONS, KEY_LENGTH, "sha512");
+function deriveKey(passphrase, salt, iterations = PBKDF2_ITERATIONS) {
+  return pbkdf2Sync(passphrase, salt, iterations, KEY_LENGTH, "sha512");
 }
 function teleportPack(secrets, passphrase) {
   const payload = {
@@ -1361,7 +1376,7 @@ function teleportPack(secrets, passphrase) {
   const plaintext = JSON.stringify(payload);
   const salt = randomBytes2(SALT_LENGTH);
   const iv = randomBytes2(IV_LENGTH);
-  const key = deriveKey(passphrase, salt);
+  const key = deriveKey(passphrase, salt, PBKDF2_ITERATIONS);
   const cipher = createCipheriv(ALGORITHM, key, iv);
   const encrypted = Buffer.concat([
     cipher.update(plaintext, "utf8"),
@@ -1375,7 +1390,8 @@ function teleportPack(secrets, passphrase) {
     iv: iv.toString("base64"),
     tag: tag.toString("base64"),
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
-    count: secrets.length
+    count: secrets.length,
+    iter: PBKDF2_ITERATIONS
   };
   return Buffer.from(JSON.stringify(bundle)).toString("base64");
 }
@@ -1403,7 +1419,7 @@ function teleportUnpack(encoded, passphrase) {
   const iv = Buffer.from(bundle.iv, "base64");
   const tag = Buffer.from(bundle.tag, "base64");
   const encrypted = Buffer.from(bundle.data, "base64");
-  const key = deriveKey(passphrase, salt);
+  const key = deriveKey(passphrase, salt, bundle.iter ?? LEGACY_PBKDF2_ITERATIONS);
   const decipher = createDecipheriv(ALGORITHM, key, iv);
   decipher.setAuthTag(tag);
   let decrypted;
@@ -2172,7 +2188,8 @@ async function execCommand(opts2) {
       "dig",
       "nslookup"
     ]);
-    if (profile.allowNetwork === false && networkTools.has(opts2.command)) {
+    const commandBase = opts2.command.split(/[\\/]/).pop() ?? opts2.command;
+    if (profile.allowNetwork === false && networkTools.has(commandBase)) {
       const msg = `[QRING] Execution blocked: network access is disabled for profile "${profile.name}", command "${opts2.command}" is considered network-related`;
       if (opts2.captureOutput) {
         return resolve({ code: 126, stdout: "", stderr: msg });
@@ -2638,14 +2655,14 @@ ${result.stderr}`);
       if (toolBlock) return toolBlock;
       if (dashboardInstance) {
         return text(
-          `Dashboard already running at http://127.0.0.1:${dashboardInstance.port}`
+          `Dashboard already running at ${dashboardInstance.url}`
         );
       }
-      const { startDashboardServer } = await import("./dashboard-FSCJDLJX.js");
+      const { startDashboardServer } = await import("./dashboard-RLMROWIU.js");
       dashboardInstance = startDashboardServer({ port: params.port });
       return text(
-        `Dashboard started at http://127.0.0.1:${dashboardInstance.port}
-Open this URL in a browser to see live quantum status.`
+        `Dashboard started at ${dashboardInstance.url}
+Open this URL in a browser to see live quantum status. The token is required for access.`
       );
     }
   );
@@ -2834,6 +2851,7 @@ function registerMcpTools(server2) {
 
 // src/mcp/server.ts
 function createMcpServer() {
+  setPolicyRoot(process.cwd());
   const server2 = new McpServer({
     name: "q-ring",
     version: PACKAGE_VERSION