@mycadet/credential-executor 0.12.6-dev.202610080102.d7d1bec → 0.12.6-dev.202610082233.54244ee

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mycadet/credential-executor",
-  "version": "0.12.6-dev.202610080102.d7d1bec",
+  "version": "0.12.6-dev.202610082233.54244ee",
   "license": "MIT",
   "type": "module",
   "exports": {

package/src/__tests__/managed-reconnect.test.ts

@@ -179,10 +179,8 @@ describe("managed CES reconnection (real entrypoint)", () => {
     const socketPath = resolveIpcEndpoint("ces", {
       workspaceDir: socketDir,
     }).path;
-    const assistantDataMount = join(tmpDir, "assistant-data-ro");
     mkdirSync(dataDir, { recursive: true });
     mkdirSync(socketDir, { recursive: true });
-    mkdirSync(join(assistantDataMount, ".cadet"), { recursive: true });
 
     const healthPort = await pickFreePort();
     const managedMain = resolve(__dirname, "..", "main.ts");
@@ -195,7 +193,6 @@ describe("managed CES reconnection (real entrypoint)", () => {
         CES_DATA_DIR: dataDir,
         CES_BOOTSTRAP_SOCKET_DIR: socketDir,
         CES_HEALTH_PORT: String(healthPort),
-        CES_ASSISTANT_DATA_MOUNT: assistantDataMount,
       },
       stdout: "ignore",
       stderr: "ignore",

package/src/__tests__/transport.test.ts

@@ -14,7 +14,7 @@
 
 import { describe, expect, test } from "bun:test";
 import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
+import { join, resolve } from "node:path";
 import { PassThrough } from "node:stream";
 
 import { resolveIpcEndpoint } from "@mycadet/ipc-server-utils";
@@ -355,25 +355,11 @@ describe("CesRpcServer", () => {
 // ---------------------------------------------------------------------------
 
 describe("CES data paths", () => {
-  test("local mode data root includes 'protected/credential-executor'", () => {
-    const root = getCesDataRoot("local");
-    expect(root).toMatch(/protected[/\\]credential-executor$/);
-  });
-
-  test("managed mode data root defaults to /ces-data", () => {
-    const savedDir = process.env["CES_DATA_DIR"];
-    delete process.env["CES_DATA_DIR"];
-    try {
-      expect(getCesDataRoot("managed")).toBe("/ces-data");
-    } finally {
-      if (savedDir !== undefined) process.env["CES_DATA_DIR"] = savedDir;
-    }
-  });
-
-  test("managed mode data root respects CES_DATA_DIR env var", () => {
+  test("data root resolves CES_DATA_DIR in any mode", () => {
     const savedDir = process.env["CES_DATA_DIR"];
     process.env["CES_DATA_DIR"] = "/custom/ces-data";
     try {
+      expect(getCesDataRoot("local")).toBe("/custom/ces-data");
       expect(getCesDataRoot("managed")).toBe("/custom/ces-data");
     } finally {
       if (savedDir !== undefined) {
@@ -384,11 +370,17 @@ describe("CES data paths", () => {
     }
   });
 
-  test("local data root is under the Cadet root, not the workspace", () => {
-    const root = getCesDataRoot("local");
-    // Must be under .cadet/protected/, NOT .cadet/workspace/
-    expect(root).toMatch(/\.cadet[/\\]protected[/\\]/);
-    expect(root).not.toMatch(/workspace/);
+  test("data root falls back to ./ces-data (cwd convention)", () => {
+    const savedDir = process.env["CES_DATA_DIR"];
+    delete process.env["CES_DATA_DIR"];
+    try {
+      expect(getCesDataRoot("managed")).toBe(
+        join(process.cwd(), "ces-data"),
+      );
+      expect(getCesDataRoot("local")).toBe(join(process.cwd(), "ces-data"));
+    } finally {
+      if (savedDir !== undefined) process.env["CES_DATA_DIR"] = savedDir;
+    }
   });
 
   test("getBootstrapSocketPath defaults to /run/ces-bootstrap", () => {

package/src/cli.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env bun
 /**
- * CES CLI — lightweight credential CRUD for the CES container.
+ * CES CLI — lightweight credential CRUD for the encrypted key store.
  *
  * Operates directly on the encrypted key store (`keys.enc` + `store.key`)
  * without requiring the RPC server, HTTP routes, or a running assistant.
@@ -15,40 +15,11 @@
  *
  * Environment variables:
  *   CREDENTIAL_SECURITY_DIR — directory containing `keys.enc` + `store.key`
- *   CES_ASSISTANT_DATA_MOUNT — fallback root for `<mount>/.cadet/protected/`
- *
- * When neither is set, defaults to `~/.cadet/protected/` (local mode).
+ *                             (falls back to `./ces-security`)
  */
 
-import { join } from "node:path";
-import { homedir } from "node:os";
 import { createLocalSecureKeyBackend } from "./materializers/local-secure-key-backend.js";
-
-// ---------------------------------------------------------------------------
-// Path resolution (mirrors the managed-mode path in main.ts)
-// ---------------------------------------------------------------------------
-
-function resolveCadetRoot(): string {
-  const secDir = process.env["CREDENTIAL_SECURITY_DIR"]?.trim();
-  if (secDir) {
-    // CREDENTIAL_SECURITY_DIR points directly at the dir containing
-    // keys.enc, but createLocalSecureKeyBackend wants the parent
-    // (.cadet root) and appends /protected/ itself — unless
-    // CREDENTIAL_SECURITY_DIR is set, in which case the backend reads
-    // from that dir directly. So we pass dirname(secDir) as cadetRoot.
-    // Actually, looking at resolveSecurityDir(): if CREDENTIAL_SECURITY_DIR
-    // is set it uses that directly, ignoring cadetRoot. So cadetRoot
-    // can be anything — the env var takes precedence.
-    return join(secDir, "..");
-  }
-
-  const mount = process.env["CES_ASSISTANT_DATA_MOUNT"]?.trim();
-  if (mount) {
-    return join(mount, ".cadet");
-  }
-
-  return join(homedir(), ".cadet");
-}
+import { getSecurityDir } from "./paths.js";
 
 // ---------------------------------------------------------------------------
 // CLI
@@ -62,8 +33,7 @@ async function main(): Promise<void> {
     process.exit(0);
   }
 
-  const cadetRoot = resolveCadetRoot();
-  const backend = createLocalSecureKeyBackend(cadetRoot);
+  const backend = createLocalSecureKeyBackend(getSecurityDir());
 
   switch (command) {
     case "list": {
@@ -149,7 +119,7 @@ Account format:
 
 Environment:
   CREDENTIAL_SECURITY_DIR    Directory containing keys.enc + store.key
-  CES_ASSISTANT_DATA_MOUNT   Fallback: <mount>/.cadet/protected/`);
+                             (falls back to ./ces-security)`);
 }
 
 main().catch((err) => {

package/src/main.ts

@@ -19,7 +19,7 @@
 
 import { mkdirSync } from "node:fs";
 import { createServer as createNetServer, type Socket } from "node:net";
-import { dirname, join } from "node:path";
+import { dirname } from "node:path";
 import { Readable, Writable } from "node:stream";
 
 import {
@@ -345,19 +345,9 @@ async function main(): Promise<void> {
   process.on("SIGINT", shutdown);
 
   // -- Secure key backend + migrations --------------------------------------
-  // The secure key backend path differs by mode:
-  // - Local: dirname(getSecurityDir()) — the parent of ~/.cadet/protected
-  //   (or CREDENTIAL_SECURITY_DIR when set by the CLI).
-  // - Managed: join(assistantDataMount, ".cadet") — the assistant data mount.
-  const secureKeyBackend =
-    mode === "managed"
-      ? createLocalSecureKeyBackend(
-          join(
-            process.env["CES_ASSISTANT_DATA_MOUNT"] ?? "/assistant-data-ro",
-            ".cadet",
-          ),
-        )
-      : createLocalSecureKeyBackend(dirname(getSecurityDir()));
+  // Both modes resolve the store location through getSecurityDir() (env var,
+  // cwd fallback convention) — see paths.ts.
+  const secureKeyBackend = createLocalSecureKeyBackend(getSecurityDir());
 
   await runCesMigrations(
     getCesDataRoot(mode),

package/src/materializers/local-secure-key-backend.ts

@@ -2,8 +2,8 @@
  * CES-native SecureKeyBackend for **local mode only**.
  *
  * In local mode, CES runs as a child process of the assistant on the same
- * machine as the same user and can read/write the assistant's encrypted key
- * store file at `<cadetRoot>/protected/keys.enc`.
+ * machine as the same user and can read/write the encrypted key store file
+ * at `<ces-security>/keys.enc`.
  *
  * This implementation replicates the encryption/decryption logic from the
  * assistant's `encrypted-store.ts` without importing assistant-internal
@@ -15,7 +15,7 @@
  * Two store formats are supported:
  *
  * - **v2 (primary):** AES-256-GCM with a random 32-byte key stored at
- *   `<cadetRoot>/protected/store.key`. The key is machine-independent —
+ *   `<ces-security>/store.key`. The key is machine-independent —
  *   any process that can read the key file can decrypt the store.
  *
  * - **v1 (legacy):** AES-256-GCM with a key derived from machine-specific
@@ -106,13 +106,14 @@ const KEYS_ENC_FILENAME = "keys.enc";
  *
  * When `CREDENTIAL_SECURITY_DIR` is set, files are read from (and written to)
  * that directory directly. This allows Docker deployments to mount a separate
- * CES-only security volume.
+ * CES-only security volume, and the CLI to point CES at the per-instance
+ * security dir.
  *
- * When the env var is unset, falls back to `<cadetRoot>/protected/` for
- * backwards compatibility.
+ * When the env var is unset, falls back to the passed-in default
+ * (`./ces-security` under the cwd fallback convention).
  */
-function resolveSecurityDir(cadetRoot: string): string {
-  return process.env.CREDENTIAL_SECURITY_DIR || join(cadetRoot, "protected");
+function resolveSecurityDir(securityDir: string): string {
+  return process.env.CREDENTIAL_SECURITY_DIR?.trim() || securityDir;
 }
 
 /**
@@ -120,9 +121,9 @@ function resolveSecurityDir(cadetRoot: string): string {
  * Returns the raw 32-byte key buffer, or null if the file is missing,
  * wrong size, or unreadable.
  */
-function readStoreKey(cadetRoot: string): Buffer | null {
+function readStoreKey(securityDir: string): Buffer | null {
   try {
-    const keyPath = join(resolveSecurityDir(cadetRoot), STORE_KEY_FILENAME);
+    const keyPath = join(resolveSecurityDir(securityDir), STORE_KEY_FILENAME);
     if (!existsSync(keyPath)) return null;
     const buf = readFileSync(keyPath);
     if (buf.length !== KEY_LENGTH) return null;
@@ -140,15 +141,15 @@ function readStoreKey(cadetRoot: string): Buffer | null {
  * Read or generate the v2 store key. If the key file does not exist,
  * creates a new 32-byte random key and writes it atomically.
  */
-function getOrReadStoreKey(cadetRoot: string): Buffer {
-  const existing = readStoreKey(cadetRoot);
+function getOrReadStoreKey(securityDir: string): Buffer {
+  const existing = readStoreKey(securityDir);
   if (existing) return existing;
 
-  const securityDir = resolveSecurityDir(cadetRoot);
+  const resolvedSecurityDir = resolveSecurityDir(securityDir);
   mkdirSync(securityDir, { recursive: true });
 
   const key = randomBytes(KEY_LENGTH);
-  const keyPath = join(securityDir, STORE_KEY_FILENAME);
+  const keyPath = join(resolvedSecurityDir, STORE_KEY_FILENAME);
   const tmpPath = keyPath + `.tmp.${process.pid}`;
   writeFileSync(tmpPath, key, { mode: 0o600 });
   chmodSync(tmpPath, 0o600);
@@ -166,14 +167,14 @@ function getOrReadStoreKey(cadetRoot: string): Buffer {
  */
 function getOrCreateStore(
   storePath: string,
-  cadetRoot: string,
+  securityDir: string,
 ): { store: StoreFile; aesKey: Buffer } {
   const existing = readStore(storePath);
   if (existing) {
     if (existing.version === 1) {
       throw new Error("v1 store cannot be auto-initialized");
     }
-    const storeKey = readStoreKey(cadetRoot);
+    const storeKey = readStoreKey(securityDir);
     if (!storeKey) {
       throw new Error("v2 store exists but store.key is missing or corrupt");
     }
@@ -181,7 +182,7 @@ function getOrCreateStore(
   }
 
   // No store exists — create a new empty v2 store
-  const aesKey = getOrReadStoreKey(cadetRoot);
+  const aesKey = getOrReadStoreKey(securityDir);
   const store: StoreFileV2 = { version: 2, entries: {} };
   writeStore(store, storePath);
   return { store, aesKey };
@@ -346,25 +347,27 @@ export class StoreUnavailableError extends Error {
  * persisting refreshed OAuth tokens. `delete` removes a key from the
  * encrypted store.
  *
- * @param cadetRoot - The Cadet root directory (e.g. `~/.cadet`).
+ * @param securityDir - CES security directory (holds keys.enc + store.key).
  * @param options.entropyOverride - If provided, used instead of local
  *   machine entropy for key derivation. In managed mode the CES sidecar
  *   runs in a different container with a different hostname/user, so it
  *   must use the assistant's entropy (read from the shared data mount)
  *   to derive the same AES key.
+ * @param securityDir Default CES security directory (used when
+ *   CREDENTIAL_SECURITY_DIR is unset).
  * @param options.entropyGetter - If provided, called on each `get()`/`set()`
  *   to lazily resolve entropy. This handles the startup race where the
  *   entropy file may not exist at construction time but appears later.
  *   Takes precedence over `entropyOverride`.
  */
 export function createLocalSecureKeyBackend(
-  cadetRoot: string,
+  securityDir: string,
   options?: {
     entropyOverride?: string;
     entropyGetter?: () => string | undefined;
   },
 ): SecureKeyBackend {
-  const storePath = join(resolveSecurityDir(cadetRoot), KEYS_ENC_FILENAME);
+  const storePath = join(resolveSecurityDir(securityDir), KEYS_ENC_FILENAME);
   const staticEntropy = options?.entropyOverride;
   const entropyGetter = options?.entropyGetter;
 
@@ -389,7 +392,7 @@ export function createLocalSecureKeyBackend(
 
       let aesKey: Buffer;
       if (store.version === 2) {
-        const storeKey = readStoreKey(cadetRoot);
+        const storeKey = readStoreKey(securityDir);
         if (!storeKey) {
           // The entry exists but the key material to decrypt it is unavailable
           // (the cold-start race). Unavailable, NOT not-found.
@@ -427,7 +430,7 @@ export function createLocalSecureKeyBackend(
         let aesKey: Buffer;
 
         try {
-          const result = getOrCreateStore(storePath, cadetRoot);
+          const result = getOrCreateStore(storePath, securityDir);
           store = result.store;
           aesKey = result.aesKey;
         } catch {

package/src/paths.ts

@@ -2,25 +2,26 @@
  * CES private data-root layout.
  *
  * Defines the directory structure for CES-private durable state (grants,
- * audit logs, tool store). This state is never stored on the assistant-visible
- * workspace/data root — it lives in a CES-only path that the assistant process
- * cannot read or write.
+ * audit logs, tool store) and CES-private security material (the encrypted
+ * store, `keys.enc` + `store.key`). This state is never stored on the
+ * assistant-visible workspace/data root — it lives in CES-only paths that
+ * the assistant process cannot read or write.
  *
- * Two modes:
+ * Resolution convention (shared with the gateway and the assistant):
+ * every directory comes from its env var, falling back to
+ * `process.cwd()/<hardcoded-value>`:
  *
- * - **Local**: CES private state lives under the Cadet root's `protected/`
- *   directory at `<rootDir>/protected/credential-executor/`.
+ * - `CREDENTIAL_SECURITY_DIR` → `./ces-security`
+ * - `CES_DATA_DIR` → `./ces-data`
  *
- * - **Managed**: CES private state lives at `/ces-data` by default
- *   (overridable via `CES_DATA_DIR` env var). The assistant container never
- *   sees this path.
- *
- * The assistant-visible data root (where workspace, embeddings, etc. live)
- * is a separate path and must never be used for CES-private writes.
+ * Managed containers set both explicitly (the platform template provisions
+ * `/ces-security` and `/ces-data` volumes); local mode sets them per
+ * instance dir via the CLI. The assistant-visible data root (where
+ * workspace, embeddings, etc. live) is a separate path and must never be
+ * used for CES-private writes.
  */
 
 import { join } from "node:path";
-import { homedir } from "node:os";
 
 import { resolveIpcEndpoint } from "@mycadet/ipc-server-utils";
 
@@ -45,41 +46,31 @@ export function getCesMode(): CesMode {
 // ---------------------------------------------------------------------------
 
 /**
- * Resolve the CES security directory.
+ * Resolve the CES security directory (contains `keys.enc` + `store.key`).
  *
  * Priority:
  * 1. `CREDENTIAL_SECURITY_DIR` env var (set by the platform template for the
- *    CES container — `/ces-security` in managed mode)
- * 2. Default: `~/.cadet/protected` (local mode shares the filesystem with
- *    the gateway)
+ *    CES container — `/ces-security` in managed mode; per-instance
+ *    `<instanceDir>/ces-security` in local mode)
+ * 2. Default: `./ces-security` (cwd fallback convention)
  */
 export function getSecurityDir(): string {
   return (
     process.env["CREDENTIAL_SECURITY_DIR"]?.trim() ||
-    join(homedir(), ".cadet", "protected")
+    join(process.cwd(), "ces-security")
   );
 }
 
 /**
- * Default managed CES data root.
+ * Return the CES-private data root (grants, audit logs, tool store).
  *
- * Defaults to `/ces-data` — the platform template provisions this path
- * via the `CES_DATA_DIR` env var and a dedicated PVC.
- */
-const DEFAULT_MANAGED_CES_DATA_ROOT = "/ces-data";
-
-/**
- * Return the CES-private data root.
- *
- * - Local: `<securityDir>/credential-executor/`
- * - Managed: `CES_DATA_DIR` env var, or `/ces-data` by default
+ * Priority:
+ * 1. `CES_DATA_DIR` env var (set by the platform template — `/ces-data` in
+ *    managed mode; per-instance `<instanceDir>/ces-data` in local mode)
+ * 2. Default: `./ces-data` (cwd fallback convention)
  */
-export function getCesDataRoot(mode?: CesMode): string {
-  const resolvedMode = mode ?? getCesMode();
-  if (resolvedMode === "managed") {
-    return process.env["CES_DATA_DIR"] ?? DEFAULT_MANAGED_CES_DATA_ROOT;
-  }
-  return join(getSecurityDir(), "credential-executor");
+export function getCesDataRoot(_mode?: CesMode): string {
+  return process.env["CES_DATA_DIR"]?.trim() || join(process.cwd(), "ces-data");
 }
 
 // ---------------------------------------------------------------------------