@s-gw/s-gw 0.1.0

package/dist/types.d.ts

@@ -0,0 +1,196 @@
+export type SecretType = "api-token" | "ssh-key" | "private-key" | "password" | "credential" | "access-key" | "unknown";
+export type SecretSeverity = "low" | "medium" | "high" | "critical";
+export type RequestState = "pending" | "approved" | "executing" | "denied" | "executed" | "failed";
+export type ApprovalMode = "per-transaction" | "timed-session" | "login-session" | "always";
+export type ApprovalAgentScope = "same-agent" | "any-agent";
+export type ApprovalPolicyDecision = "ask" | "allow" | "deny";
+export type ApprovalPolicyActionKind = "env_command" | "ssh_session";
+export type AgentIdentitySource = "configured" | "mcp-client" | "runtime" | "process" | "reason" | "manual" | "unknown";
+export interface ApprovalSettings {
+    mode: ApprovalMode;
+    durationMs: number;
+}
+export interface ApprovalGrant {
+    id: string;
+    handle: string;
+    actionKey: string;
+    mode: Exclude<ApprovalMode, "per-transaction">;
+    agentScope?: ApprovalAgentScope;
+    agentName?: string;
+    loginSessionId: string;
+    createdAt: string;
+    updatedAt: string;
+    expiresAt?: string;
+    lastRequestId?: string;
+}
+export interface ApprovalPolicyConditions {
+    handles?: string[];
+    secretTypes?: SecretType[];
+    providers?: string[];
+    minSeverity?: SecretSeverity;
+    agents?: string[];
+    actionKinds?: ApprovalPolicyActionKind[];
+    commands?: string[];
+    injectEnvs?: string[];
+    workingDirs?: string[];
+    sshTargets?: string[];
+    sshPorts?: number[];
+}
+export interface ApprovalPolicyRule {
+    id: string;
+    name: string;
+    enabled: boolean;
+    priority: number;
+    decision: ApprovalPolicyDecision;
+    conditions: ApprovalPolicyConditions;
+    expiresAt?: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface EncryptedBox {
+    alg: "aes-256-gcm";
+    kdf: "scrypt";
+    salt: string;
+    iv: string;
+    authTag: string;
+    ciphertext: string;
+}
+export interface SecretPolicy {
+    injectEnv?: string;
+    allowedCommands: string[];
+    maxOutputBytes: number;
+}
+export type SecretBackend = "local" | "onepassword" | "keychain";
+export interface SecretValueCache {
+    backend: "onepassword";
+    encrypted: EncryptedBox;
+    fingerprint: string;
+    approvalGrantId: string;
+    createdAt: string;
+    updatedAt: string;
+    expiresAt?: string;
+    loginSessionId?: string;
+}
+export interface SecretRecord {
+    handle: string;
+    name: string;
+    type: SecretType;
+    backend?: SecretBackend;
+    provider?: string;
+    ruleId?: string;
+    severity?: SecretSeverity;
+    confidence?: number;
+    createdAt: string;
+    updatedAt: string;
+    source?: string;
+    fingerprint: string;
+    encrypted: EncryptedBox;
+    cache?: SecretValueCache;
+    policy: SecretPolicy;
+}
+export interface HandleSummary {
+    handle: string;
+    name: string;
+    type: SecretType;
+    backend?: SecretBackend;
+    provider?: string;
+    ruleId?: string;
+    severity?: SecretSeverity;
+    confidence?: number;
+    createdAt: string;
+    updatedAt: string;
+    source?: string;
+    fingerprint: string;
+    policy: SecretPolicy;
+}
+export interface SshSessionSpec {
+    target: string;
+    port: number;
+}
+export interface CommandEnvBinding {
+    handle: string;
+    injectEnv: string;
+}
+export interface CommandAction {
+    kind: "env_command" | "ssh_session";
+    command: string;
+    args: string[];
+    injectEnv: string;
+    env?: CommandEnvBinding[];
+    workingDir?: string;
+    timeoutMs: number;
+    ssh?: SshSessionSpec;
+}
+export interface ExecutionSummary {
+    exitCode: number | null;
+    signal: NodeJS.Signals | null;
+    stdout: string;
+    stderr: string;
+    proof: string;
+    durationMs: number;
+    timeoutMs: number;
+    timedOut: boolean;
+    sanitized: boolean;
+}
+export interface RequestRecord {
+    id: string;
+    handle: string;
+    reason: string;
+    agentName?: string;
+    agentSource?: AgentIdentitySource;
+    action: CommandAction;
+    state: RequestState;
+    createdAt: string;
+    updatedAt: string;
+    approvedAt?: string;
+    approvalGrantId?: string;
+    approvalPolicyRuleId?: string;
+    deniedAt?: string;
+    executedAt?: string;
+    resultSummary?: ExecutionSummary;
+    error?: string;
+}
+export interface AuditEvent {
+    id: string;
+    ts: string;
+    type: string;
+    handle?: string;
+    requestId?: string;
+    message: string;
+}
+export interface StoreFile {
+    version: 1;
+    secrets: SecretRecord[];
+    requests: RequestRecord[];
+    audit: AuditEvent[];
+    approvalSettings: ApprovalSettings;
+    approvalGrants: ApprovalGrant[];
+    approvalPolicyRules: ApprovalPolicyRule[];
+}
+export interface ScanCandidate {
+    type: SecretType;
+    label: string;
+    provider?: string;
+    ruleId?: string;
+    severity?: SecretSeverity;
+    confidence?: number;
+    value: string;
+    start: number;
+    end: number;
+}
+export interface ScanFinding {
+    type: SecretType;
+    label: string;
+    provider?: string;
+    ruleId?: string;
+    severity?: SecretSeverity;
+    confidence?: number;
+    handle: string;
+    token: string;
+    start: number;
+    end: number;
+}
+export interface ScanResult {
+    tokenizedText: string;
+    findings: ScanFinding[];
+}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/unlock.d.ts

@@ -0,0 +1,29 @@
+export interface KeychainInfo {
+    supported: boolean;
+    service: string;
+    account: string;
+    provider: "native-helper" | "security-cli" | "windows-helper" | "none";
+    helperPath?: string;
+}
+export interface UnlockStatus {
+    envConfigured: boolean;
+    activeSource: "env" | "macos-keychain" | "windows-credential-manager" | "none";
+    keychain: KeychainInfo & {
+        configured: boolean;
+    };
+}
+export interface MacKeychainItemRef {
+    service: string;
+    account: string;
+    label?: string;
+}
+export declare function requireUnlockPassphrase(): string;
+export declare function unlockStatus(): UnlockStatus;
+export declare function setKeychainPassphrase(passphrase: string): void;
+export declare function deleteKeychainPassphrase(): boolean;
+export declare function hasKeychainPassphrase(): boolean;
+export declare function keychainInfo(): KeychainInfo;
+export declare function defaultSecretKeychainService(): string;
+export declare function setMacKeychainItem(ref: MacKeychainItemRef, value: string): void;
+export declare function getMacKeychainItem(ref: MacKeychainItemRef): string;
+export declare function deleteMacKeychainItem(ref: MacKeychainItemRef): boolean;

package/dist/unlock.js

@@ -0,0 +1,274 @@
+import { execFileSync, spawnSync } from "node:child_process";
+import { existsSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const defaultService = "com.s-gw.sgw.master-passphrase";
+const defaultSecretService = "com.s-gw.sgw.secret";
+const nativeHelperName = "s-gw-keychain-helper";
+const windowsCredentialHelperName = "s-gw-credential.ps1";
+export function requireUnlockPassphrase() {
+    const fromEnv = process.env.SGW_MASTER_PASSPHRASE;
+    if (validPassphrase(fromEnv)) {
+        return fromEnv;
+    }
+    const fromKeychain = readKeychainPassphrase();
+    if (validPassphrase(fromKeychain)) {
+        return fromKeychain;
+    }
+    throw new Error("s-gw needs a local unlock passphrase. Run `s-gw unlock keychain set --value-stdin` or set SGW_MASTER_PASSPHRASE.");
+}
+export function unlockStatus() {
+    const envConfigured = validPassphrase(process.env.SGW_MASTER_PASSPHRASE);
+    const keychain = keychainInfo();
+    const configured = hasKeychainPassphrase();
+    let activeSource = "none";
+    if (envConfigured) {
+        activeSource = "env";
+    }
+    else if (configured) {
+        activeSource = process.platform === "win32" ? "windows-credential-manager" : "macos-keychain";
+    }
+    return {
+        envConfigured,
+        activeSource,
+        keychain: {
+            ...keychain,
+            configured
+        }
+    };
+}
+export function setKeychainPassphrase(passphrase) {
+    if (!validPassphrase(passphrase)) {
+        throw new Error("Unlock passphrase must be at least 8 characters.");
+    }
+    ensureLocalCredentialStore();
+    runKeychainSet(keychainInfo(), passphrase);
+}
+export function deleteKeychainPassphrase() {
+    ensureLocalCredentialStore();
+    try {
+        runKeychainDelete(keychainInfo());
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function hasKeychainPassphrase() {
+    if (!keychainInfo().supported || process.env.SGW_DISABLE_KEYCHAIN === "1") {
+        return false;
+    }
+    const passphrase = readKeychainPassphrase();
+    return validPassphrase(passphrase);
+}
+export function keychainInfo() {
+    return {
+        supported: supportsLocalCredentialStore(),
+        service: process.env.SGW_KEYCHAIN_SERVICE || defaultService,
+        account: process.env.SGW_KEYCHAIN_ACCOUNT || os.userInfo().username || "local-user",
+        ...keychainProvider()
+    };
+}
+export function defaultSecretKeychainService() {
+    return process.env.SGW_SECRET_KEYCHAIN_SERVICE || defaultSecretService;
+}
+export function setMacKeychainItem(ref, value) {
+    if (!value) {
+        throw new Error("Cannot store an empty Keychain item.");
+    }
+    const info = keychainInfoForItem(ref);
+    ensureNativeCredentialStore(info);
+    runKeychainSet(info, value, ref.label || "s-gw local secret");
+}
+export function getMacKeychainItem(ref) {
+    const info = keychainInfoForItem(ref);
+    ensureNativeCredentialStore(info);
+    return runKeychainGet(info).replace(/\r?\n$/, "");
+}
+export function deleteMacKeychainItem(ref) {
+    try {
+        const info = keychainInfoForItem(ref);
+        ensureNativeCredentialStore(info);
+        runKeychainDelete(info);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function readKeychainPassphrase() {
+    const info = keychainInfo();
+    if (!info.supported || process.env.SGW_DISABLE_KEYCHAIN === "1") {
+        return undefined;
+    }
+    try {
+        const output = runKeychainGet(info);
+        return output.replace(/\r?\n$/, "");
+    }
+    catch {
+        return undefined;
+    }
+}
+function ensureLocalCredentialStore() {
+    if (!keychainInfo().supported) {
+        throw new Error("OS credential-store unlock is only available on macOS or Windows.");
+    }
+}
+function ensureNativeCredentialStore(info) {
+    if (!info.supported) {
+        throw new Error("OS credential-store secret storage is only available on macOS or Windows.");
+    }
+    if ((info.provider !== "native-helper" && info.provider !== "windows-helper") || !info.helperPath) {
+        throw new Error("OS credential-store secret storage requires the native s-gw helper. Run `npm run build:native`.");
+    }
+}
+function keychainInfoForItem(ref) {
+    const service = ref.service.trim();
+    const account = ref.account.trim();
+    if (!service || !account) {
+        throw new Error("Keychain service and account are required.");
+    }
+    return {
+        supported: supportsLocalCredentialStore(),
+        service,
+        account,
+        ...keychainProvider()
+    };
+}
+function validPassphrase(value) {
+    return typeof value === "string" && value.trim().length >= 8;
+}
+function keychainProvider() {
+    if (process.platform === "win32") {
+        const helperPath = findWindowsCredentialHelper();
+        return helperPath ? { provider: "windows-helper", helperPath } : { provider: "none" };
+    }
+    if (process.platform !== "darwin") {
+        return { provider: "none" };
+    }
+    const helperPath = findNativeHelper();
+    if (helperPath) {
+        return { provider: "native-helper", helperPath };
+    }
+    if (process.env.SGW_ALLOW_SECURITY_CLI === "1") {
+        return { provider: "security-cli" };
+    }
+    return { provider: "none" };
+}
+function supportsLocalCredentialStore() {
+    return process.platform === "darwin" || process.platform === "win32";
+}
+function findNativeHelper() {
+    const fromEnv = process.env.SGW_KEYCHAIN_HELPER;
+    if (fromEnv && existsSync(fromEnv)) {
+        return fromEnv;
+    }
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        path.resolve(here, "native", nativeHelperName),
+        path.resolve(process.cwd(), "dist", "native", nativeHelperName)
+    ];
+    return candidates.find((candidate) => existsSync(candidate));
+}
+function findWindowsCredentialHelper() {
+    const fromEnv = process.env.SGW_WINDOWS_CREDENTIAL_HELPER || process.env.SGW_KEYCHAIN_HELPER;
+    if (fromEnv && existsSync(fromEnv)) {
+        return fromEnv;
+    }
+    const here = path.dirname(fileURLToPath(import.meta.url));
+    const candidates = [
+        path.resolve(here, "windows", windowsCredentialHelperName),
+        path.resolve(process.cwd(), "dist", "windows", windowsCredentialHelperName)
+    ];
+    return candidates.find((candidate) => existsSync(candidate));
+}
+function runKeychainGet(info) {
+    if (info.provider === "native-helper" && info.helperPath) {
+        return runNativeHelper(info.helperPath, ["get", "--service", info.service, "--account", info.account]);
+    }
+    if (info.provider === "security-cli") {
+        return runSecurity([
+            "find-generic-password",
+            "-a",
+            info.account,
+            "-s",
+            info.service,
+            "-w"
+        ]);
+    }
+    if (info.provider === "windows-helper" && info.helperPath) {
+        return runWindowsCredentialHelper(info.helperPath, ["get", "-Service", info.service, "-Account", info.account]);
+    }
+    throw new Error("No local OS credential-store provider is available. Run `npm run build:native`.");
+}
+function runKeychainSet(info, passphrase, label = "s-gw local unlock passphrase") {
+    if (info.provider === "native-helper" && info.helperPath) {
+        runNativeHelper(info.helperPath, ["set", "--service", info.service, "--account", info.account, "--label", label], passphrase);
+        return;
+    }
+    if (info.provider === "security-cli") {
+        runSecurity([
+            "add-generic-password",
+            "-U",
+            "-a",
+            info.account,
+            "-s",
+            info.service,
+            "-l",
+            label,
+            "-w",
+            passphrase
+        ]);
+        return;
+    }
+    if (info.provider === "windows-helper" && info.helperPath) {
+        runWindowsCredentialHelper(info.helperPath, ["set", "-Service", info.service, "-Account", info.account, "-Label", label], passphrase);
+        return;
+    }
+    throw new Error("No local OS credential-store provider is available. Run `npm run build:native`.");
+}
+function runKeychainDelete(info) {
+    if (info.provider === "native-helper" && info.helperPath) {
+        runNativeHelper(info.helperPath, ["delete", "--service", info.service, "--account", info.account]);
+        return;
+    }
+    if (info.provider === "security-cli") {
+        runSecurity(["delete-generic-password", "-a", info.account, "-s", info.service]);
+        return;
+    }
+    if (info.provider === "windows-helper" && info.helperPath) {
+        runWindowsCredentialHelper(info.helperPath, ["delete", "-Service", info.service, "-Account", info.account]);
+        return;
+    }
+    throw new Error("No local OS credential-store provider is available. Run `npm run build:native`.");
+}
+function runNativeHelper(helperPath, args, input) {
+    const result = spawnSync(helperPath, args, {
+        input,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (result.status !== 0) {
+        throw new Error(result.stderr.trim() || `Native Keychain helper failed with status ${result.status}`);
+    }
+    return result.stdout;
+}
+function runSecurity(args) {
+    return execFileSync("security", args, {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+    });
+}
+function runWindowsCredentialHelper(helperPath, args, input) {
+    const result = spawnSync("powershell.exe", ["-NoProfile", "-ExecutionPolicy", "Bypass", "-File", helperPath, ...args], {
+        input,
+        encoding: "utf8",
+        stdio: ["pipe", "pipe", "pipe"]
+    });
+    if (result.status !== 0) {
+        throw new Error(result.stderr.trim() || `Windows Credential Manager helper failed with status ${result.status}`);
+    }
+    return result.stdout;
+}
+//# sourceMappingURL=unlock.js.map

package/dist/windows/VERSION.txt

@@ -0,0 +1 @@
+s-gw 0.1.0

package/dist/windows/s-gw-client.cmd

@@ -0,0 +1,4 @@
+@echo off
+setlocal
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0s-gw-client.ps1" %*
+exit /b %ERRORLEVEL%

package/dist/windows/s-gw-client.ps1

@@ -0,0 +1,106 @@
+[CmdletBinding()]
+param(
+  [int]$Port = 8718,
+  [string]$ConsoleUrl = "",
+  [switch]$NoStart
+)
+
+$ErrorActionPreference = "Stop"
+
+function Resolve-CliPath {
+  if ($env:SGW_CLI_PATH -and (Test-Path -LiteralPath $env:SGW_CLI_PATH)) {
+    return (Resolve-Path -LiteralPath $env:SGW_CLI_PATH).Path
+  }
+
+  $distDir = Split-Path -Parent $PSScriptRoot
+  $candidate = Join-Path $distDir "cli.js"
+  if (Test-Path -LiteralPath $candidate) {
+    return (Resolve-Path -LiteralPath $candidate).Path
+  }
+
+  throw "Unable to find s-gw CLI. Set SGW_CLI_PATH to dist\cli.js."
+}
+
+function Resolve-NodePath {
+  if ($env:SGW_NODE_PATH) {
+    return $env:SGW_NODE_PATH
+  }
+  return "node"
+}
+
+function New-ConsoleUrl {
+  if ($ConsoleUrl.Trim()) {
+    return $ConsoleUrl.Trim()
+  }
+  return "http://127.0.0.1:$Port/"
+}
+
+function Get-OriginUrl([string]$Url) {
+  $uri = [Uri]$Url
+  return $uri.GetLeftPart([UriPartial]::Authority) + "/"
+}
+
+function Test-ConsoleReady([string]$Url) {
+  $origin = Get-OriginUrl $Url
+  try {
+    $health = Invoke-RestMethod -Method Get -Uri ($origin + "api/health") -TimeoutSec 1
+    return ($health.ok -eq $true)
+  } catch {
+    return $false
+  }
+}
+
+function Start-ConsoleDaemon([string]$CliPath, [string]$NodePath) {
+  $logs = Join-Path $env:LOCALAPPDATA "s-gw\logs"
+  New-Item -ItemType Directory -Force -Path $logs | Out-Null
+
+  $args = @($CliPath, "console", "--host", "127.0.0.1", "--port", [string]$Port, "--no-open")
+  $root = Split-Path -Parent (Split-Path -Parent $CliPath)
+
+  Start-Process `
+    -FilePath $NodePath `
+    -ArgumentList $args `
+    -WorkingDirectory $root `
+    -WindowStyle Hidden `
+    -RedirectStandardOutput (Join-Path $logs "console.log") `
+    -RedirectStandardError (Join-Path $logs "console.err.log") | Out-Null
+}
+
+function Wait-Console([string]$Url) {
+  for ($i = 0; $i -lt 30; $i += 1) {
+    if (Test-ConsoleReady $Url) {
+      return $true
+    }
+    Start-Sleep -Milliseconds 250
+  }
+  return $false
+}
+
+function Open-ConsoleWindow([string]$Url) {
+  $edge = Get-Command "msedge.exe" -ErrorAction SilentlyContinue
+  if ($edge) {
+    Start-Process -FilePath $edge.Source -ArgumentList @("--app=$Url") | Out-Null
+    return
+  }
+
+  $chrome = Get-Command "chrome.exe" -ErrorAction SilentlyContinue
+  if ($chrome) {
+    Start-Process -FilePath $chrome.Source -ArgumentList @("--app=$Url") | Out-Null
+    return
+  }
+
+  Start-Process $Url | Out-Null
+}
+
+$url = New-ConsoleUrl
+$cliPath = Resolve-CliPath
+$nodePath = Resolve-NodePath
+
+if (-not $NoStart -and -not (Test-ConsoleReady $url)) {
+  Start-ConsoleDaemon -CliPath $cliPath -NodePath $nodePath
+  if (-not (Wait-Console $url)) {
+    throw "s-gw console did not become ready at $url. Check $env:LOCALAPPDATA\s-gw\logs."
+  }
+}
+
+Open-ConsoleWindow $url

package/dist/windows/s-gw-credential.cmd

@@ -0,0 +1,4 @@
+@echo off
+setlocal
+powershell.exe -NoProfile -ExecutionPolicy Bypass -File "%~dp0s-gw-credential.ps1" %*
+exit /b %ERRORLEVEL%