@sandprivacy/sandgate 0.2.1 → 0.2.2

package/dist/index.js

@@ -5,9 +5,9 @@ import { join } from "node:path";
 import { read } from "read";
 import { getQuota } from "./sandmail.js";
 import { testImapConnection } from "./inbox.js";
-import { resolvePassphrase } from "./passphrase.js";
+import { resolvePassphrase, protectPassphraseDpapi, dpapiDecryptCommand } from "./passphrase.js";
 import { auditPath } from "./paths.js";
-import { vaultExists, loadVault, saveVault, } from "./vault.js";
+import { vaultExists, loadVault, saveVault, rekeyVault, } from "./vault.js";
 import { loadConfig, saveConfig } from "./config.js";
 import { normalizeSecret, generateCode } from "./totp.js";
 import { TelegramApprover, discoverChatId } from "./telegram.js";
@@ -25,6 +25,8 @@ Usage:
   sandgate connect-sandmail <api-key>    Connect the sandmail inbox backend
   sandgate connect-imap                  Connect your own IMAP mailbox instead (self-hosted)
   sandgate test-approval                 Send a test approval to your phone
+  sandgate rekey                         Change the vault passphrase
+  sandgate protect                       Store the passphrase in the OS store (Windows DPAPI)
   sandgate status                        Show what is configured and active
   sandgate audit [n]                     Show the last n audit entries (default 20)
   sandgate serve                         Run the MCP server (stdio)
@@ -221,6 +223,37 @@ async function cmdConnectImap() {
         : "";
     console.log(`IMAP connected (${config.user}@${config.host}).${note}`);
 }
+async function cmdRekey() {
+    const prompter = new Prompter();
+    const current = await prompter.ask("Current passphrase: ", { hidden: true });
+    const next = await prompter.ask("New passphrase: ", { hidden: true });
+    const confirm = await prompter.ask("Confirm new passphrase: ", { hidden: true });
+    prompter.close();
+    if (!next) {
+        console.error("A passphrase is required.");
+        process.exit(1);
+    }
+    if (next !== confirm) {
+        console.error("Passphrases do not match.");
+        process.exit(1);
+    }
+    rekeyVault(current, next); // throws "wrong passphrase" if current is bad
+    console.log("Vault re-encrypted. Update SANDGATE_PASSPHRASE (or your passphrase command's store) everywhere sandgate serve is launched.");
+}
+async function cmdProtect() {
+    const prompter = new Prompter();
+    const pass = await prompter.ask("Vault passphrase: ", { hidden: true });
+    prompter.close();
+    if (!pass) {
+        console.error("A passphrase is required.");
+        process.exit(1);
+    }
+    loadVault(pass); // validate before storing — a typo here would be silent later
+    const target = join(sandgateDir(), "pass.dpapi");
+    protectPassphraseDpapi(pass, target);
+    console.log(`Passphrase verified against the vault and stored, DPAPI-encrypted, at:\n  ${target}\n\n` +
+        `Point your MCP config at it with:\n  SANDGATE_PASSPHRASE_CMD = ${dpapiDecryptCommand(target)}`);
+}
 async function cmdStatus() {
     if (!vaultExists()) {
         console.log("No vault. Run `sandgate init` to get started.");
@@ -386,6 +419,10 @@ async function main() {
             return cmdRelay(args[0]);
         case "pair":
             return cmdPair(args[0]);
+        case "rekey":
+            return cmdRekey();
+        case "protect":
+            return cmdProtect();
         case "status":
             return cmdStatus();
         case "audit":

package/dist/passphrase.js

@@ -1,4 +1,4 @@
-import { execSync } from "node:child_process";
+import { execSync, spawnSync } from "node:child_process";
 /**
  * Resolve the vault passphrase for non-interactive runs (MCP clients
  * launching `sandgate serve`). Two sources, in order:
@@ -13,6 +13,32 @@ import { execSync } from "node:child_process";
  * Either way the model never sees it: it lives in the launcher's
  * environment, not in the agent's context.
  */
+/**
+ * Windows only: encrypt the passphrase with DPAPI (bound to the current
+ * Windows session) and write the blob to filePath. The plaintext travels
+ * to PowerShell via stdin — never argv, never env.
+ */
+export function protectPassphraseDpapi(passphrase, filePath) {
+    if (process.platform !== "win32") {
+        throw new Error("DPAPI is Windows-only. On macOS use the keychain (`security add-generic-password`), on Linux `secret-tool store` — see docs/integrations/claude-code.md.");
+    }
+    const script = "$plain = [Console]::In.ReadToEnd().TrimEnd([char]13, [char]10); " +
+        "if ($plain.Length -eq 0) { exit 2 }; " +
+        "$ss = ConvertTo-SecureString $plain -AsPlainText -Force; " +
+        `$ss | ConvertFrom-SecureString | Out-File -Encoding ascii '${filePath.replace(/'/g, "''")}'`;
+    const result = spawnSync("powershell", ["-NoProfile", "-Command", script], {
+        input: passphrase,
+        windowsHide: true,
+        timeout: 30_000,
+    });
+    if (result.status !== 0) {
+        throw new Error(`DPAPI protection failed (exit ${result.status}): ${result.stderr?.toString().slice(0, 300)}`);
+    }
+}
+/** The command that decrypts what protectPassphraseDpapi wrote. */
+export function dpapiDecryptCommand(filePath) {
+    return `powershell -NoProfile -Command "[Net.NetworkCredential]::new('', (Get-Content '${filePath}' | ConvertTo-SecureString)).Password"`;
+}
 export function resolvePassphrase(env) {
     if (env.SANDGATE_PASSPHRASE)
         return env.SANDGATE_PASSPHRASE;

package/dist/test/core.test.js

@@ -5,7 +5,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 // Point sandgate at a throwaway home before importing modules that use it.
 process.env.SANDGATE_HOME = mkdtempSync(join(tmpdir(), "sandgate-test-"));
-const { saveVault, loadVault } = await import("../vault.js");
+const { saveVault, loadVault, rekeyVault } = await import("../vault.js");
 const { generateCode, normalizeSecret } = await import("../totp.js");
 const { loadConfig, saveConfig, totpPolicy } = await import("../config.js");
 test("vault round-trips and rejects a wrong passphrase", () => {
@@ -17,6 +17,14 @@ test("vault round-trips and rejects a wrong passphrase", () => {
     assert.deepEqual(loadVault("correct horse"), data);
     assert.throws(() => loadVault("wrong"), /wrong passphrase/);
 });
+test("rekey re-encrypts under the new passphrase and retires the old one", () => {
+    const data = { totp: { "site.com": { secret: "JBSWY3DPEHPK3PXP" } } };
+    saveVault("old-pass", data);
+    rekeyVault("old-pass", "new-pass");
+    assert.deepEqual(loadVault("new-pass"), data);
+    assert.throws(() => loadVault("old-pass"), /wrong passphrase/);
+    assert.throws(() => rekeyVault("old-pass", "whatever"), /wrong passphrase/);
+});
 test("totp generates stable 6-digit codes", () => {
     const a = generateCode("JBSWY3DPEHPK3PXP");
     const b = generateCode("JBSWY3DPEHPK3PXP");

package/dist/test/protect.test.js

@@ -0,0 +1,18 @@
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { execSync } from "node:child_process";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { protectPassphraseDpapi, dpapiDecryptCommand } from "../passphrase.js";
+// DPAPI is Windows-only; the CI matrix covers both, so skip cleanly elsewhere.
+const windowsOnly = { skip: process.platform !== "win32" };
+test("DPAPI protect/decrypt round-trips the passphrase", windowsOnly, () => {
+    const file = join(mkdtempSync(join(tmpdir(), "sandgate-dpapi-")), "pass.dpapi");
+    protectPassphraseDpapi("correct horse battery staple", file);
+    const decrypted = execSync(dpapiDecryptCommand(file), { encoding: "utf8" }).trim();
+    assert.equal(decrypted, "correct horse battery staple");
+});
+test("protect refuses on non-Windows platforms", { skip: process.platform === "win32" }, () => {
+    assert.throws(() => protectPassphraseDpapi("x", "/tmp/x"), /Windows-only/);
+});

package/dist/vault.js

@@ -25,6 +25,11 @@ export function saveVault(passphrase, data) {
     };
     writeFileSync(vaultPath(), JSON.stringify(file), { mode: 0o600 });
 }
+/** Change the vault passphrase in place: decrypt with the old, re-encrypt with the new. */
+export function rekeyVault(oldPassphrase, newPassphrase) {
+    const data = loadVault(oldPassphrase);
+    saveVault(newPassphrase, data);
+}
 export function loadVault(passphrase) {
     if (!vaultExists()) {
         throw new Error(`No vault found at ${vaultPath()}. Run \`sandgate init\` first.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sandprivacy/sandgate",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "The human gateway for AI agents — approvals, 2FA codes and email verification, self-hosted. Your agent asks; you decide; secrets never touch the LLM.",
   "license": "AGPL-3.0-only",
   "type": "module",