@johpaz/hive-agents 0.0.34 → 0.0.36

package/packages/core/src/storage/crypto.ts

@@ -0,0 +1,197 @@
+import { logger } from "../utils/logger"
+
+const log = logger.child("crypto")
+const SERVICE = "hive"
+
+// ─── Keychain with in-memory fallback ────────────────────────────────────────
+// On Linux headless (no GNOME Keyring / libsecret) Bun.secrets throws.
+// Fall back to in-memory storage so the server stays functional, but log a
+// warning so operators know secrets won't survive a restart in that mode.
+
+const _mem = new Map<string, string>()
+let _keychainOk: boolean | null = null // null = untested
+
+async function _get(name: string): Promise<string | null> {
+  if (_keychainOk === false) return _mem.get(name) ?? null
+  try {
+    const val = await (Bun as any).secrets.get({ service: SERVICE, name })
+    _keychainOk = true
+    return val ?? null
+  } catch {
+    _keychainOk = false
+    return _mem.get(name) ?? null
+  }
+}
+
+async function _set(name: string, value: string): Promise<void> {
+  if (_keychainOk === false) {
+    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
+    _mem.set(name, value)
+    return
+  }
+  try {
+    await (Bun as any).secrets.set({ service: SERVICE, name, value })
+    _keychainOk = true
+  } catch {
+    _keychainOk = false
+    log.warn(`[secrets] OS keychain unavailable — in-memory fallback (secret lost on restart): ${name}`)
+    _mem.set(name, value)
+  }
+}
+
+async function _del(name: string): Promise<void> {
+  _mem.delete(name)
+  try {
+    await (Bun as any).secrets.delete({ service: SERVICE, name })
+  } catch {
+    // ignore — might not exist or keychain unavailable
+  }
+}
+
+// ─── Primitive API ────────────────────────────────────────────────────────────
+
+export async function storeSecret(name: string, value: string): Promise<void> {
+  await _set(name, value)
+}
+
+export async function loadSecret(name: string): Promise<string | null> {
+  return _get(name)
+}
+
+export async function deleteSecret(name: string): Promise<void> {
+  await _del(name)
+}
+
+// ─── Provider secrets ────────────────────────────────────────────────────────
+
+export async function storeProviderApiKey(id: string, apiKey: string): Promise<void> {
+  await _set(`provider:${id}:api_key`, apiKey)
+}
+
+export async function loadProviderApiKey(id: string): Promise<string> {
+  return (await _get(`provider:${id}:api_key`)) ?? ""
+}
+
+export async function storeProviderHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
+  await _set(`provider:${id}:headers`, JSON.stringify(headers))
+}
+
+export async function loadProviderHeaders(id: string): Promise<Record<string, unknown>> {
+  const raw = await _get(`provider:${id}:headers`)
+  return raw ? JSON.parse(raw) : {}
+}
+
+export async function deleteProviderSecrets(id: string): Promise<void> {
+  await Promise.all([
+    _del(`provider:${id}:api_key`),
+    _del(`provider:${id}:headers`),
+  ])
+}
+
+// ─── Channel secrets ─────────────────────────────────────────────────────────
+
+export async function storeChannelConfig(id: string, config: Record<string, unknown>): Promise<void> {
+  await _set(`channel:${id}:config`, JSON.stringify(config))
+}
+
+export async function loadChannelConfig(id: string): Promise<Record<string, unknown>> {
+  const raw = await _get(`channel:${id}:config`)
+  return raw ? JSON.parse(raw) : {}
+}
+
+export async function deleteChannelSecrets(id: string): Promise<void> {
+  await _del(`channel:${id}:config`)
+}
+
+// ─── MCP secrets ──────────────────────────────────────────────────────────────
+
+export async function storeMcpHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
+  await _set(`mcp:${id}:headers`, JSON.stringify(headers))
+}
+
+export async function loadMcpHeaders(id: string): Promise<Record<string, unknown>> {
+  const raw = await _get(`mcp:${id}:headers`)
+  return raw ? JSON.parse(raw) : {}
+}
+
+export async function storeMcpEnv(id: string, env: Record<string, string>): Promise<void> {
+  await _set(`mcp:${id}:env`, JSON.stringify(env))
+}
+
+export async function loadMcpEnv(id: string): Promise<Record<string, string>> {
+  const raw = await _get(`mcp:${id}:env`)
+  return raw ? JSON.parse(raw) : {}
+}
+
+export async function deleteMcpSecrets(id: string): Promise<void> {
+  await Promise.all([
+    _del(`mcp:${id}:headers`),
+    _del(`mcp:${id}:env`),
+  ])
+}
+
+// ─── Agent secrets ────────────────────────────────────────────────────────────
+
+export async function storeAgentHeaders(id: string, headers: Record<string, unknown>): Promise<void> {
+  await _set(`agent:${id}:headers`, JSON.stringify(headers))
+}
+
+export async function loadAgentHeaders(id: string): Promise<Record<string, unknown>> {
+  const raw = await _get(`agent:${id}:headers`)
+  return raw ? JSON.parse(raw) : {}
+}
+
+export async function deleteAgentSecrets(id: string): Promise<void> {
+  await _del(`agent:${id}:headers`)
+}
+
+// ─── Unchanged utilities ──────────────────────────────────────────────────────
+
+export function maskApiKey(apiKey: string): string {
+  if (!apiKey || apiKey.length < 8) return "••••••••"
+  return apiKey.slice(0, 4) + "••••••••" + apiKey.slice(-4)
+}
+
+export function hashPassword(password: string): string {
+  const hasher = new Bun.CryptoHasher("sha256")
+  hasher.update(password)
+  return hasher.digest("hex")
+}
+
+export function verifyPassword(password: string, hash: string): boolean {
+  const hasher = new Bun.CryptoHasher("sha256")
+  hasher.update(password)
+  return hasher.digest("hex") === hash
+}
+
+// ─── Legacy AES-256-GCM decryption ──────────────────────────────────────────
+// Used only by the one-shot migration in storage/migrate.ts.
+// Safe to remove after all installs have run the migration once.
+
+export function legacyDecryptAES(encrypted: string, iv: string): string {
+  const nodeCrypto = require("node:crypto")
+  const nodeFs = require("node:fs")
+  const nodePath = require("node:path")
+  const nodeOs = require("node:os")
+
+  let key: Buffer
+  const masterKey = process.env.HIVE_MASTER_KEY
+  if (masterKey) {
+    key = Buffer.from(masterKey.slice(0, 32).padEnd(32, "0"), "utf8")
+  } else {
+    const hiveDir = process.env.HIVE_HOME || nodePath.join(nodeOs.homedir(), ".hive")
+    const keyPath = nodePath.join(hiveDir, ".master.key")
+    if (!nodeFs.existsSync(keyPath)) return ""
+    key = Buffer.from(nodeFs.readFileSync(keyPath, "utf-8").trim(), "hex")
+  }
+
+  try {
+    const ivBuf = Buffer.from(iv, "hex")
+    const [encData, authTag] = encrypted.split(":")
+    const decipher = nodeCrypto.createDecipheriv("aes-256-gcm", key, ivBuf)
+    decipher.setAuthTag(Buffer.from(authTag, "hex"))
+    return decipher.update(encData, "hex", "utf8") + decipher.final("utf8")
+  } catch {
+    return ""
+  }
+}

package/packages/core/src/storage/migrate.ts

@@ -0,0 +1,147 @@
+import { logger } from "../utils/logger"
+import { getDb } from "./sqlite"
+import {
+  legacyDecryptAES,
+  storeProviderApiKey, storeProviderHeaders,
+  storeChannelConfig,
+  storeMcpHeaders, storeMcpEnv,
+  storeAgentHeaders,
+  loadProviderApiKey,
+} from "./crypto"
+
+const log = logger.child("migrate")
+
+/**
+ * One-shot migration: moves AES-encrypted secrets from SQLite columns to
+ * the OS keychain via Bun.secrets.
+ *
+ * Idempotent — rows that are already NULL in *_encrypted are skipped.
+ * Rows that already have a secret in the keychain are also skipped.
+ * Safe to call on every startup; only does work on the first run after upgrade.
+ */
+export async function migrateEncryptedSecretsToKeychain(): Promise<void> {
+  const db = getDb()
+  let migrated = 0
+
+  // ── Providers ──────────────────────────────────────────────────────────────
+  const providers = db.query(`
+    SELECT id, api_key_encrypted, api_key_iv, headers_encrypted, headers_iv
+    FROM providers
+    WHERE api_key_encrypted IS NOT NULL OR headers_encrypted IS NOT NULL
+  `).all() as Array<{
+    id: string
+    api_key_encrypted: string | null
+    api_key_iv: string | null
+    headers_encrypted: string | null
+    headers_iv: string | null
+  }>
+
+  for (const p of providers) {
+    if (p.api_key_encrypted && p.api_key_iv) {
+      const existing = await loadProviderApiKey(p.id)
+      if (!existing) {
+        const plain = legacyDecryptAES(p.api_key_encrypted, p.api_key_iv)
+        if (plain) {
+          await storeProviderApiKey(p.id, plain)
+          migrated++
+        }
+      }
+      db.query(`UPDATE providers SET api_key_encrypted = NULL, api_key_iv = NULL WHERE id = ?`).run(p.id)
+    }
+
+    if (p.headers_encrypted && p.headers_iv) {
+      const plain = legacyDecryptAES(p.headers_encrypted, p.headers_iv)
+      if (plain) {
+        try {
+          await storeProviderHeaders(p.id, JSON.parse(plain))
+          migrated++
+        } catch { /* ignore JSON parse errors */ }
+      }
+      db.query(`UPDATE providers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(p.id)
+    }
+  }
+
+  // ── Channels ───────────────────────────────────────────────────────────────
+  const channels = db.query(`
+    SELECT id, config_encrypted, config_iv
+    FROM channels
+    WHERE config_encrypted IS NOT NULL
+  `).all() as Array<{
+    id: string
+    config_encrypted: string
+    config_iv: string
+  }>
+
+  for (const c of channels) {
+    const plain = legacyDecryptAES(c.config_encrypted, c.config_iv)
+    if (plain) {
+      try {
+        await storeChannelConfig(c.id, JSON.parse(plain))
+        migrated++
+      } catch { /* ignore JSON parse errors */ }
+    }
+    db.query(`UPDATE channels SET config_encrypted = NULL, config_iv = NULL WHERE id = ?`).run(c.id)
+  }
+
+  // ── MCP servers ────────────────────────────────────────────────────────────
+  const mcpServers = db.query(`
+    SELECT id, headers_encrypted, headers_iv, env_encrypted, env_iv
+    FROM mcp_servers
+    WHERE headers_encrypted IS NOT NULL OR env_encrypted IS NOT NULL
+  `).all() as Array<{
+    id: string
+    headers_encrypted: string | null
+    headers_iv: string | null
+    env_encrypted: string | null
+    env_iv: string | null
+  }>
+
+  for (const m of mcpServers) {
+    if (m.headers_encrypted && m.headers_iv) {
+      const plain = legacyDecryptAES(m.headers_encrypted, m.headers_iv)
+      if (plain) {
+        try {
+          await storeMcpHeaders(m.id, JSON.parse(plain))
+          migrated++
+        } catch { /* ignore */ }
+      }
+      db.query(`UPDATE mcp_servers SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(m.id)
+    }
+    if (m.env_encrypted && m.env_iv) {
+      const plain = legacyDecryptAES(m.env_encrypted, m.env_iv)
+      if (plain) {
+        try {
+          await storeMcpEnv(m.id, JSON.parse(plain))
+          migrated++
+        } catch { /* ignore */ }
+      }
+      db.query(`UPDATE mcp_servers SET env_encrypted = NULL, env_iv = NULL WHERE id = ?`).run(m.id)
+    }
+  }
+
+  // ── Agents ─────────────────────────────────────────────────────────────────
+  const agents = db.query(`
+    SELECT id, headers_encrypted, headers_iv
+    FROM agents
+    WHERE headers_encrypted IS NOT NULL
+  `).all() as Array<{
+    id: string
+    headers_encrypted: string
+    headers_iv: string
+  }>
+
+  for (const a of agents) {
+    const plain = legacyDecryptAES(a.headers_encrypted, a.headers_iv)
+    if (plain) {
+      try {
+        await storeAgentHeaders(a.id, JSON.parse(plain))
+        migrated++
+      } catch { /* ignore */ }
+    }
+    db.query(`UPDATE agents SET headers_encrypted = NULL, headers_iv = NULL WHERE id = ?`).run(a.id)
+  }
+
+  if (migrated > 0) {
+    log.info(`[migrate] Migrated ${migrated} secret(s) from SQLite AES to OS keychain`)
+  }
+}