@profullstack/qryptchat 0.2.0 → 0.3.0

package/README.md

@@ -73,7 +73,12 @@ claude mcp add qryptchat -- qc mcp
 
 Over SSH, `qc login --oob` shows a code in the browser for you to paste instead of redirecting back.
 
-The session and keys are kept in `~/.config/qc/session.json` (or `$QC_HOME`), mode 0600. Sessions refresh themselves; `qc logout` deletes them. Point at another server with `--url` or `QC_URL`.
+Your keys and tokens are **never stored in plaintext**. `~/.config/qc/session.json` (or `$QC_HOME`) keeps only your username and the server URL in the clear. Everything else is sealed with ChaCha20-Poly1305 under a key from:
+
+- your OS keychain (macOS Keychain, or libsecret's `secret-tool` on a Linux desktop), so you're never asked; or
+- a passphrase, stretched with scrypt. qc asks for it once per run; scripts and `qc mcp` read it from `QC_PASSPHRASE`.
+
+Sessions refresh themselves and are re-sealed each time. `qc logout` deletes them. Point at another server with `--url` or `QC_URL`.
 
 ## Licence
 

package/dist/{chunk-c8qkdept.js → chunk-4r99spcc.js}

@@ -2,9 +2,10 @@ import {
   sessionPath,
   baseUrl,
   loadSession,
-  saveSession,
+  unlockSession,
+  storeSession,
   clearSession
-} from "./chunk-fb6zrz6m.js";
+} from "./chunk-vfahhydf.js";
 
 // src/cli/crypto.js
 import { MlKem1024 as MlKem10242 } from "mlkem";
@@ -910,7 +911,7 @@ class QcClient {
   constructor(session, options = {}) {
     this.session = session;
     this.base = baseUrl(session, options.env);
-    this.save = options.save ?? ((s) => saveSession(s, options.env));
+    this.save = options.save ?? (() => {});
     this.fetch = options.fetch ?? globalThis.fetch;
     this.ring = keyring(session.keys);
     this.refreshing = null;
@@ -1285,8 +1286,8 @@ async function login(options = {}) {
     keys,
     created_at: new Date().toISOString()
   };
-  saveSession(session, env);
-  return session;
+  const save = await storeSession(session, env, options.vault);
+  return { session, save };
 }
 
 // src/cli/commands.js
@@ -1305,7 +1306,8 @@ Usage:
   qc mcp                  run as an MCP server on stdio (list_chats, read_chat, send_message)
 
 <chat> is a chat id or part of its name. Options: --json, --url <server> (or QC_URL).
-Keys and session live in ${"$"}QC_HOME or ~/.config/qc (mode 0600).`;
+Keys and tokens are sealed (ChaCha20-Poly1305) in ${"$"}QC_HOME or ~/.config/qc; the key is in your
+OS keychain, or comes from a passphrase (QC_PASSPHRASE for scripts and qc mcp).`;
 function parseArgs2(argv) {
   const args = { _: [], flags: {} };
   for (let i = 0;i < argv.length; i++) {
@@ -1352,13 +1354,13 @@ function findChat2(chats, query) {
 async function client(flags, { interactive = false } = {}) {
   if (flags.url)
     process.env.QC_URL = flags.url;
-  let session = loadSession();
-  if (!session) {
+  let opened = await unlockSession();
+  if (!opened) {
     if (!interactive)
       throw new Error("Not signed in. Run qc login.");
-    session = await login({ oob: !!flags.oob });
+    opened = await login({ oob: !!flags.oob });
   }
-  return new QcClient(session);
+  return new QcClient(opened.session, { save: opened.save });
 }
 var stamp = (iso) => new Date(iso).toLocaleString(undefined, { dateStyle: "short", timeStyle: "short" });
 async function readStdin() {
@@ -1388,8 +1390,8 @@ async function main2(argv, { version = "0.0.0" } = {}) {
       return runTui(c, { initialChat: rest[0] });
     }
     case "login": {
-      const session = await login({ oob: !!flags.oob });
-      return out(`Signed in as @${session.user?.username ?? "unknown"} on ${session.base}. Keys saved to ${sessionPath()}.`);
+      const { session } = await login({ oob: !!flags.oob });
+      return out(`Signed in as @${session.user?.username ?? "unknown"} on ${session.base}. Keys sealed (ChaCha20-Poly1305) in ${sessionPath()}.`);
     }
     case "logout":
       clearSession();

package/dist/chunk-vfahhydf.js

@@ -0,0 +1,190 @@
+// src/cli/config.js
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+// src/cli/vault.js
+import { randomBytes, scryptSync } from "node:crypto";
+import { spawnSync } from "node:child_process";
+import { createInterface } from "node:readline";
+import { chacha20poly1305 } from "@noble/ciphers/chacha.js";
+var SERVICE = "qrypt-qc";
+var SCRYPT = { N: 1 << 16, r: 8, p: 1, maxmem: 256 * 1024 * 1024 };
+var SECRET_FIELDS = ["access_token", "refresh_token", "expires_at", "expires_in", "token_type", "keys"];
+var b64 = (u8) => Buffer.from(u8).toString("base64");
+var unb64 = (s) => Uint8Array.from(Buffer.from(s, "base64"));
+function deriveKey(passphrase, salt) {
+  return new Uint8Array(scryptSync(String(passphrase).normalize("NFKC"), Buffer.from(salt), 32, SCRYPT));
+}
+function seal(session, key, source) {
+  const secret = {};
+  const open = {};
+  for (const [k, v] of Object.entries(session))
+    (SECRET_FIELDS.includes(k) ? secret : open)[k] = v;
+  const nonce = Uint8Array.from(randomBytes(12));
+  const ct = chacha20poly1305(Uint8Array.from(key), nonce).encrypt(Uint8Array.from(Buffer.from(JSON.stringify(secret), "utf8")));
+  return { v: 2, ...open, sealed: { alg: "chacha20-poly1305", source: source.kind, ...source.salt ? { salt: source.salt } : {}, nonce: b64(nonce), ct: b64(ct) } };
+}
+function unseal(file, key) {
+  const { nonce, ct } = file.sealed;
+  let plain;
+  try {
+    plain = chacha20poly1305(Uint8Array.from(key), unb64(nonce)).decrypt(unb64(ct));
+  } catch {
+    throw new Error("Wrong passphrase, or the session was tampered with.");
+  }
+  const { v, sealed, ...open } = file;
+  return { ...open, ...JSON.parse(Buffer.from(plain).toString("utf8")) };
+}
+function run(cmd, args, input) {
+  try {
+    const r = spawnSync(cmd, args, { input, encoding: "utf8", timeout: 1e4 });
+    return r.status === 0 ? { ok: true, out: (r.stdout || "").trim() } : { ok: false };
+  } catch {
+    return { ok: false };
+  }
+}
+function keychain({ platform = process.platform, env = process.env } = {}) {
+  if (env.QC_NO_KEYCHAIN)
+    return null;
+  if (platform === "darwin") {
+    return {
+      get: (account) => {
+        const r = run("security", ["find-generic-password", "-s", SERVICE, "-a", account, "-w"]);
+        return r.ok && r.out ? r.out : null;
+      },
+      set: (account, secret) => run("security", ["add-generic-password", "-U", "-s", SERVICE, "-a", account, "-w", secret]).ok
+    };
+  }
+  if (platform === "linux" && (env.DBUS_SESSION_BUS_ADDRESS || env.DISPLAY || env.WAYLAND_DISPLAY) && run("secret-tool", ["--version"]).ok !== false) {
+    const probe = spawnSync("which", ["secret-tool"], { encoding: "utf8" });
+    if (probe.status !== 0)
+      return null;
+    return {
+      get: (account) => {
+        const r = run("secret-tool", ["lookup", "service", SERVICE, "account", account]);
+        return r.ok && r.out ? r.out : null;
+      },
+      set: (account, secret) => run("secret-tool", ["store", "--label", "qc (qrypt.chat) session key", "service", SERVICE, "account", account], secret).ok
+    };
+  }
+  return null;
+}
+function askHidden(question) {
+  return new Promise((resolve, reject) => {
+    if (!process.stdin.isTTY) {
+      reject(new Error("qc needs a passphrase to unlock your keys: set QC_PASSPHRASE, or run it on a terminal."));
+      return;
+    }
+    const rl = createInterface({ input: process.stdin, output: process.stderr, terminal: true });
+    rl._writeToOutput = (s) => {
+      if (s.includes(question))
+        process.stderr.write(s);
+    };
+    rl.question(question, (answer) => {
+      rl.close();
+      process.stderr.write(`
+`);
+      resolve(answer);
+    });
+  });
+}
+async function dataKey(account, { existing, env = process.env, ask = askHidden, chain = keychain({ env }) } = {}) {
+  if (existing) {
+    if (existing.source === "keychain") {
+      const k = chain?.get(account);
+      if (!k)
+        throw new Error("Your session key is not in the keychain any more. Run qc login again.");
+      return { key: unb64(k), source: { kind: "keychain" } };
+    }
+    const pass = env.QC_PASSPHRASE ?? await ask("  Passphrase for your qc keys: ");
+    return { key: deriveKey(pass, existing.salt), source: { kind: "passphrase", salt: existing.salt } };
+  }
+  if (env.QC_PASSPHRASE) {
+    const salt = b64(randomBytes(16));
+    return { key: deriveKey(env.QC_PASSPHRASE, salt), source: { kind: "passphrase", salt } };
+  }
+  if (chain) {
+    const raw = randomBytes(32);
+    if (chain.set(account, b64(raw)))
+      return { key: new Uint8Array(raw), source: { kind: "keychain" } };
+  }
+  process.stderr.write(`
+  qc keeps your keys encrypted. Choose a passphrase (you will need it each time qc starts).
+`);
+  for (;; ) {
+    const a = await ask("  New passphrase: ");
+    if (a.length < 8) {
+      process.stderr.write(`  At least 8 characters, please.
+`);
+      continue;
+    }
+    const b = await ask("  Again: ");
+    if (a !== b) {
+      process.stderr.write(`  Those did not match.
+`);
+      continue;
+    }
+    const salt = b64(randomBytes(16));
+    return { key: deriveKey(a, salt), source: { kind: "passphrase", salt } };
+  }
+}
+
+// src/cli/config.js
+var DEFAULT_URL = "https://qrypt.chat";
+function configDir(env = process.env) {
+  if (env.QC_HOME)
+    return env.QC_HOME;
+  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "qc");
+}
+var sessionPath = (env = process.env) => join(configDir(env), "session.json");
+function baseUrl(session, env = process.env) {
+  return (env.QC_URL || session?.base || DEFAULT_URL).replace(/\/+$/, "");
+}
+function loadSession(env = process.env) {
+  try {
+    const file = JSON.parse(readFileSync(sessionPath(env), "utf8"));
+    if (file?.v === 2 && file.sealed && file.user)
+      return file;
+    return file && file.access_token && file.keys ? file : null;
+  } catch {
+    return null;
+  }
+}
+function writeFile(obj, env) {
+  const dir = configDir(env);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  try {
+    chmodSync(dir, 448);
+  } catch {}
+  const file = sessionPath(env);
+  const tmp = `${file}.${process.pid}.tmp`;
+  writeFileSync(tmp, JSON.stringify(obj, null, 2), { mode: 384 });
+  renameSync(tmp, file);
+}
+var accountOf = (session) => String(session.user?.id || session.user?.username || "default");
+async function unlockSession(env = process.env, opts = {}) {
+  const file = loadSession(env);
+  if (!file)
+    return null;
+  const existing = file.v === 2 ? file.sealed : undefined;
+  const { key, source } = await dataKey(accountOf(file), { existing, env, ...opts });
+  const session = file.v === 2 ? unseal(file, key) : file;
+  const save = (s) => writeFile(seal(s, key, source), env);
+  if (file.v !== 2)
+    save(session);
+  return { session, save };
+}
+async function storeSession(session, env = process.env, opts = {}) {
+  const { key, source } = await dataKey(accountOf(session), { env, ...opts });
+  const save = (s) => writeFile(seal(s, key, source), env);
+  save(session);
+  return save;
+}
+function clearSession(env = process.env) {
+  const file = sessionPath(env);
+  if (existsSync(file))
+    rmSync(file);
+}
+
+export { configDir, sessionPath, baseUrl, loadSession, unlockSession, storeSession, clearSession };

package/dist/commands.js

@@ -3,7 +3,8 @@ import {
   parseArgs2,
   findChat2,
   main2
-} from "./chunk-c8qkdept.js";
+} from "./chunk-4r99spcc.js";
+import"./chunk-vfahhydf.js";
 export {
   HELP2 as HELP,
   findChat2 as findChat,

package/dist/mcp.js

@@ -1,6 +1,7 @@
+import"./chunk-vfahhydf.js";
 import {
   findChat2
-} from "./chunk-c8qkdept.js";
+} from "./chunk-4r99spcc.js";
 
 // src/cli/mcp.js
 import { createInterface } from "node:readline";

package/dist/tui.js

@@ -1,6 +1,6 @@
 import {
   configDir
-} from "./chunk-fb6zrz6m.js";
+} from "./chunk-vfahhydf.js";
 
 // src/cli/tui.js
 import { createApp, editText, emojify, insertText, stringWidth, truncate, widgets, wrap } from "@profullstack/hqtui";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@profullstack/qryptchat",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "qc: qrypt.chat in your terminal. A full-screen end-to-end encrypted chat client (ML-KEM-1024), plus a scriptable CLI and an MCP server.",
   "type": "module",
   "bin": {

package/dist/chunk-fb6zrz6m.js

@@ -1,40 +0,0 @@
-// src/cli/config.js
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var DEFAULT_URL = "https://qrypt.chat";
-function configDir(env = process.env) {
-  if (env.QC_HOME)
-    return env.QC_HOME;
-  return join(env.XDG_CONFIG_HOME || join(homedir(), ".config"), "qc");
-}
-var sessionPath = (env = process.env) => join(configDir(env), "session.json");
-function baseUrl(session, env = process.env) {
-  return (env.QC_URL || session?.base || DEFAULT_URL).replace(/\/+$/, "");
-}
-function loadSession(env = process.env) {
-  try {
-    const session = JSON.parse(readFileSync(sessionPath(env), "utf8"));
-    return session && session.access_token && session.keys ? session : null;
-  } catch {
-    return null;
-  }
-}
-function saveSession(session, env = process.env) {
-  const dir = configDir(env);
-  mkdirSync(dir, { recursive: true, mode: 448 });
-  try {
-    chmodSync(dir, 448);
-  } catch {}
-  const file = sessionPath(env);
-  const tmp = `${file}.${process.pid}.tmp`;
-  writeFileSync(tmp, JSON.stringify(session, null, 2), { mode: 384 });
-  renameSync(tmp, file);
-}
-function clearSession(env = process.env) {
-  const file = sessionPath(env);
-  if (existsSync(file))
-    rmSync(file);
-}
-
-export { configDir, sessionPath, baseUrl, loadSession, saveSession, clearSession };