@rigour-labs/core 6.1.0-beta.2 → 6.1.0

package/dist/storage/local-encryption.d.ts

@@ -1,2 +1,8 @@
+/**
+ * Create the local encryption key without exposing a partially-written key to
+ * another Rigour process. A fully-written temporary file is linked into place,
+ * so exactly one concurrent process wins and every other process reads it.
+ */
+export declare function loadOrCreateFileKey(keyPath: string): Promise<Buffer>;
 export declare function encryptLocalPayload(value: unknown): Promise<string>;
 export declare function decryptLocalPayload<T>(value: string): Promise<T>;

package/dist/storage/local-encryption.js

@@ -1,27 +1,68 @@
 import { createCipheriv, createDecipheriv, randomBytes } from 'crypto';
+import { chmod, link, readFile, unlink, writeFile } from 'node:fs/promises';
 import fs from 'fs-extra';
 import os from 'os';
 import path from 'path';
 const KEY_PATH = path.join(os.homedir(), '.rigour', 'team-cache.key');
-async function getKey() {
-    const configured = process.env.RIGOUR_LOCAL_CACHE_KEY;
-    if (configured) {
-        const key = Buffer.from(configured, 'base64');
-        if (key.length !== 32)
-            throw new Error('RIGOUR_LOCAL_CACHE_KEY must be a base64-encoded 32-byte key.');
-        return key;
+let fileKeyPromise;
+function decodeKey(value, source) {
+    const normalized = value.trim();
+    const key = Buffer.from(normalized, 'base64');
+    if (!/^[A-Za-z0-9+/]+={0,2}$/.test(normalized) || key.length !== 32) {
+        throw new Error(`${source} must contain a base64-encoded 32-byte key.`);
     }
+    return key;
+}
+async function readFileKey(keyPath) {
+    return decodeKey(await readFile(keyPath, 'utf8'), keyPath);
+}
+/**
+ * Create the local encryption key without exposing a partially-written key to
+ * another Rigour process. A fully-written temporary file is linked into place,
+ * so exactly one concurrent process wins and every other process reads it.
+ */
+export async function loadOrCreateFileKey(keyPath) {
     try {
-        const key = Buffer.from((await fs.readFile(KEY_PATH, 'utf8')).trim(), 'base64');
-        if (key.length === 32)
-            return key;
+        return await readFileKey(keyPath);
     }
-    catch { /* create below */ }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    await fs.ensureDir(path.dirname(keyPath));
     const key = randomBytes(32);
-    await fs.ensureDir(path.dirname(KEY_PATH));
-    await fs.writeFile(KEY_PATH, key.toString('base64'), { mode: 0o600 });
-    await fs.chmod(KEY_PATH, 0o600);
-    return key;
+    const temporaryPath = `${keyPath}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`;
+    try {
+        await writeFile(temporaryPath, key.toString('base64'), { mode: 0o600, flag: 'wx' });
+        await chmod(temporaryPath, 0o600);
+        try {
+            await link(temporaryPath, keyPath);
+            await chmod(keyPath, 0o600);
+            return key;
+        }
+        catch (error) {
+            if (error.code !== 'EEXIST')
+                throw error;
+            return await readFileKey(keyPath);
+        }
+    }
+    finally {
+        await unlink(temporaryPath).catch(error => {
+            if (error.code !== 'ENOENT')
+                throw error;
+        });
+    }
+}
+async function getKey() {
+    const configured = process.env.RIGOUR_LOCAL_CACHE_KEY;
+    if (configured) {
+        return decodeKey(configured, 'RIGOUR_LOCAL_CACHE_KEY');
+    }
+    fileKeyPromise ??= loadOrCreateFileKey(KEY_PATH).catch(error => {
+        fileKeyPromise = undefined;
+        throw error;
+    });
+    return fileKeyPromise;
 }
 export async function encryptLocalPayload(value) {
     const key = await getKey();

package/dist/storage/local-encryption.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/storage/local-encryption.test.js

@@ -0,0 +1,34 @@
+import fs from 'fs-extra';
+import os from 'os';
+import path from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { loadOrCreateFileKey } from './local-encryption.js';
+const temporaryDirectories = [];
+afterEach(async () => {
+    await Promise.all(temporaryDirectories.splice(0).map(directory => fs.remove(directory)));
+});
+async function temporaryKeyPath() {
+    const directory = await fs.mkdtemp(path.join(os.tmpdir(), 'rigour-key-test-'));
+    temporaryDirectories.push(directory);
+    return path.join(directory, 'team-cache.key');
+}
+describe('local encryption key storage', () => {
+    it('returns one key when concurrent processes initialize the same path', async () => {
+        const keyPath = await temporaryKeyPath();
+        const keys = await Promise.all(Array.from({ length: 32 }, () => loadOrCreateFileKey(keyPath)));
+        expect(new Set(keys.map(key => key.toString('base64')))).toHaveLength(1);
+        expect(await fs.readFile(keyPath, 'utf8')).toBe(keys[0].toString('base64'));
+    });
+    it('rejects an invalid existing key without replacing it', async () => {
+        const keyPath = await temporaryKeyPath();
+        await fs.writeFile(keyPath, 'not-a-valid-key', 'utf8');
+        await expect(loadOrCreateFileKey(keyPath)).rejects.toThrow('must contain a base64-encoded 32-byte key');
+        expect(await fs.readFile(keyPath, 'utf8')).toBe('not-a-valid-key');
+    });
+    it('accepts an existing key without base64 padding for backward compatibility', async () => {
+        const keyPath = await temporaryKeyPath();
+        const encodedKey = Buffer.alloc(32, 7).toString('base64').replace(/=+$/, '');
+        await fs.writeFile(keyPath, encodedKey, 'utf8');
+        expect((await loadOrCreateFileKey(keyPath)).equals(Buffer.alloc(32, 7))).toBe(true);
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rigour-labs/core",
-  "version": "6.1.0-beta.2",
+  "version": "6.1.0",
   "description": "AI-native quality gate engine with local Bayesian learning. AST analysis, drift detection, Fix Packet generation, and agent self-healing across TypeScript, JavaScript, Python, Go, Ruby, and C#.",
   "license": "MIT",
   "homepage": "https://rigour.run",
@@ -67,11 +67,11 @@
     "pg": "^8.16.3",
     "sqlite3": "^5.1.7",
     "openai": "^4.104.0",
-    "@rigour-labs/brain-darwin-arm64": "6.1.0-beta.2",
-    "@rigour-labs/brain-win-x64": "6.1.0-beta.2",
-    "@rigour-labs/brain-linux-x64": "6.1.0-beta.2",
-    "@rigour-labs/brain-darwin-x64": "6.1.0-beta.2",
-    "@rigour-labs/brain-linux-arm64": "6.1.0-beta.2"
+    "@rigour-labs/brain-darwin-arm64": "6.1.0",
+    "@rigour-labs/brain-darwin-x64": "6.1.0",
+    "@rigour-labs/brain-linux-x64": "6.1.0",
+    "@rigour-labs/brain-win-x64": "6.1.0",
+    "@rigour-labs/brain-linux-arm64": "6.1.0"
   },
   "devDependencies": {
     "@types/fs-extra": "^11.0.4",