@stitchaxis/latchkey 0.0.0-stage → 0.1.1

package/dist/licensing/enforce.d.ts

@@ -0,0 +1,3 @@
+export declare function enforceBeforeSecretAccess(projectPath?: string): Promise<void>;
+export declare function enforceBeforeVaultWrite(): Promise<void>;
+export declare function enforceOnLogin(): Promise<void>;

package/dist/licensing/enforce.js

@@ -0,0 +1,20 @@
+import { getEffectiveAccess, requireHardenedApproval } from "./access.js";
+import { countVaults, registerProject, registerThisDevice, } from "./registry.js";
+export async function enforceBeforeSecretAccess(projectPath) {
+    const { payload } = await getEffectiveAccess();
+    requireHardenedApproval(payload);
+    if (projectPath) {
+        await registerProject(projectPath, payload.projects);
+    }
+}
+export async function enforceBeforeVaultWrite() {
+    const { payload } = await getEffectiveAccess();
+    const vaults = countVaults();
+    if (vaults >= payload.vaults) {
+        throw new Error(`Vault limit reached (${payload.vaults}). Upgrade at https://modexventures.com/latchkey/pricing`);
+    }
+}
+export async function enforceOnLogin() {
+    const { payload } = await getEffectiveAccess();
+    await registerThisDevice(payload.devices);
+}

package/dist/licensing/enforce.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/licensing/enforce.test.js

@@ -0,0 +1,57 @@
+import { describe, it, expect, beforeEach, afterEach } from "vitest";
+import { mkdtemp, rm } from "node:fs/promises";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { issueLicenseToken, verifyAndDecodeLicense, generateTestKeyPair, } from "@stitchaxis/license";
+describe("license enforcement", () => {
+    let prevHome;
+    let prevPub;
+    let tempHome;
+    let privateKeyPem;
+    let publicKeyPem;
+    beforeEach(async () => {
+        prevHome = process.env.LATCHKEY_HOME;
+        prevPub = process.env.LICENSE_VERIFY_PUBLIC_KEY;
+        tempHome = await mkdtemp(join(tmpdir(), "latchkey-lic-"));
+        process.env.LATCHKEY_HOME = tempHome;
+        const pair = generateTestKeyPair();
+        privateKeyPem = pair.privateKeyPem;
+        publicKeyPem = pair.publicKeyPem;
+        process.env.LICENSE_VERIFY_PUBLIC_KEY = publicKeyPem;
+    });
+    afterEach(async () => {
+        process.env.LATCHKEY_HOME = prevHome;
+        if (prevPub === undefined) {
+            delete process.env.LICENSE_VERIFY_PUBLIC_KEY;
+        }
+        else {
+            process.env.LICENSE_VERIFY_PUBLIC_KEY = prevPub;
+        }
+        await rm(tempHome, { recursive: true, force: true });
+    });
+    it("verifies login token and caches payload", async () => {
+        const token = issueLicenseToken({
+            email: "a@example.com",
+            planId: "pro",
+            privateKeyPem,
+        });
+        const { loginWithToken } = await import("./cache.js");
+        const payload = await loginWithToken(token);
+        expect(payload.tier).toBe("pro");
+        expect(verifyAndDecodeLicense(token, publicKeyPem).devices).toBe(3);
+    });
+    it("enforces scoped project limit", async () => {
+        const token = issueLicenseToken({
+            email: "a@example.com",
+            planId: "solo",
+            privateKeyPem,
+        });
+        const { loginWithToken } = await import("./cache.js");
+        await loginWithToken(token);
+        const { registerProject } = await import("./registry.js");
+        await registerProject("/p1", 3);
+        await registerProject("/p2", 3);
+        await registerProject("/p3", 3);
+        await expect(registerProject("/p4", 3)).rejects.toThrow(/project limit/i);
+    });
+});

package/dist/licensing/registry.d.ts

@@ -0,0 +1,5 @@
+export declare function getMachineId(): Promise<string>;
+export declare function registerThisDevice(maxDevices: number): Promise<void>;
+export declare function countVaults(): number;
+export declare function registerProject(projectPath: string, maxProjects: number | null): Promise<void>;
+export declare function countProjects(): Promise<number>;

package/dist/licensing/registry.js

@@ -0,0 +1,59 @@
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { DEVICES_FILE, MACHINE_ID_FILE, PROJECTS_FILE, LATCHKEY_DIR, VAULT_FILE, } from "../paths.js";
+export async function getMachineId() {
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    if (existsSync(MACHINE_ID_FILE)) {
+        return (await readFile(MACHINE_ID_FILE, "utf8")).trim();
+    }
+    const id = randomUUID();
+    await writeFile(MACHINE_ID_FILE, id, "utf8");
+    return id;
+}
+async function readDevices() {
+    if (!existsSync(DEVICES_FILE))
+        return { registered: [] };
+    return JSON.parse(await readFile(DEVICES_FILE, "utf8"));
+}
+async function writeDevices(reg) {
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    await writeFile(DEVICES_FILE, JSON.stringify(reg, null, 2), "utf8");
+}
+export async function registerThisDevice(maxDevices) {
+    const machineId = await getMachineId();
+    const reg = await readDevices();
+    if (reg.registered.includes(machineId))
+        return;
+    if (reg.registered.length >= maxDevices) {
+        throw new Error(`Device limit reached (${maxDevices}). Upgrade your plan at https://modexventures.com/latchkey/pricing or retire another device from your account.`);
+    }
+    reg.registered.push(machineId);
+    await writeDevices(reg);
+}
+export function countVaults() {
+    return existsSync(VAULT_FILE) ? 1 : 0;
+}
+export async function registerProject(projectPath, maxProjects) {
+    if (maxProjects === null)
+        return;
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    let reg = { paths: [] };
+    if (existsSync(PROJECTS_FILE)) {
+        reg = JSON.parse(await readFile(PROJECTS_FILE, "utf8"));
+    }
+    const normalized = projectPath;
+    if (reg.paths.includes(normalized))
+        return;
+    if (reg.paths.length >= maxProjects) {
+        throw new Error(`Scoped project limit reached (${maxProjects}). Upgrade at https://modexventures.com/latchkey/pricing`);
+    }
+    reg.paths.push(normalized);
+    await writeFile(PROJECTS_FILE, JSON.stringify(reg, null, 2), "utf8");
+}
+export async function countProjects() {
+    if (!existsSync(PROJECTS_FILE))
+        return 0;
+    const reg = JSON.parse(await readFile(PROJECTS_FILE, "utf8"));
+    return reg.paths.length;
+}

package/dist/licensing/trial.d.ts

@@ -0,0 +1,6 @@
+export interface TrialState {
+    startedAt: string;
+}
+export declare function ensureTrialStarted(): Promise<TrialState>;
+export declare function trialDaysRemaining(): Promise<number>;
+export declare function isTrialActive(): Promise<boolean>;

package/dist/licensing/trial.js

@@ -0,0 +1,23 @@
+import { readFile, writeFile, mkdir } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { TRIAL_FILE, LATCHKEY_DIR } from "../paths.js";
+const TRIAL_DAYS = 14;
+export async function ensureTrialStarted() {
+    await mkdir(LATCHKEY_DIR, { recursive: true });
+    if (existsSync(TRIAL_FILE)) {
+        const raw = await readFile(TRIAL_FILE, "utf8");
+        return JSON.parse(raw);
+    }
+    const state = { startedAt: new Date().toISOString() };
+    await writeFile(TRIAL_FILE, JSON.stringify(state, null, 2), "utf8");
+    return state;
+}
+export async function trialDaysRemaining() {
+    const state = await ensureTrialStarted();
+    const end = new Date(state.startedAt).getTime() + TRIAL_DAYS * 24 * 60 * 60 * 1000;
+    const left = Math.ceil((end - Date.now()) / (24 * 60 * 60 * 1000));
+    return Math.max(0, left);
+}
+export async function isTrialActive() {
+    return (await trialDaysRemaining()) > 0;
+}

package/dist/lock.d.ts

@@ -0,0 +1,6 @@
+export declare function configureIdleLock(ms: number): void;
+export declare function setCachedMasterKey(key: Uint8Array | null): void;
+export declare function getCachedMasterKey(): Uint8Array | null;
+export declare function touchActivity(): void;
+export declare function isLocked(): boolean;
+export declare function lockVault(): void;

package/dist/lock.js

@@ -0,0 +1,55 @@
+const DEFAULT_IDLE_MS = 15 * 60 * 1000;
+let cachedMasterKey = null;
+let lastActivity = 0;
+let idleMs = DEFAULT_IDLE_MS;
+let idleTimer = null;
+export function configureIdleLock(ms) {
+    idleMs = ms;
+}
+export function setCachedMasterKey(key) {
+    cachedMasterKey = key;
+    if (key) {
+        touchActivity();
+    }
+    else {
+        clearIdleTimer();
+    }
+}
+export function getCachedMasterKey() {
+    if (cachedMasterKey && isLocked()) {
+        cachedMasterKey = null;
+        return null;
+    }
+    return cachedMasterKey;
+}
+export function touchActivity() {
+    lastActivity = Date.now();
+    scheduleIdleLock();
+}
+export function isLocked() {
+    if (!cachedMasterKey)
+        return true;
+    if (Date.now() - lastActivity > idleMs) {
+        return true;
+    }
+    return false;
+}
+export function lockVault() {
+    cachedMasterKey = null;
+    lastActivity = 0;
+    clearIdleTimer();
+}
+function clearIdleTimer() {
+    if (idleTimer) {
+        clearTimeout(idleTimer);
+        idleTimer = null;
+    }
+}
+function scheduleIdleLock() {
+    clearIdleTimer();
+    idleTimer = setTimeout(() => {
+        if (cachedMasterKey && Date.now() - lastActivity > idleMs) {
+            cachedMasterKey = null;
+        }
+    }, idleMs + 100);
+}

package/dist/mcp-server.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/mcp-server.js

@@ -0,0 +1,82 @@
+#!/usr/bin/env node
+/**
+ * MCP server mode (stretch): agents may request scoped keys — requires explicit
+ * LATCHKEY_MCP_APPROVE=1 in the environment for each grant (human-in-the-loop).
+ */
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { getSecret } from "./vault.js";
+import { redactSecrets } from "./redact.js";
+import { auditLog } from "./audit.js";
+const server = new Server({ name: "latchkey", version: "0.1.0" }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: [
+        {
+            name: "latchkey_get_secret",
+            description: "Request a vault secret by env var name. Requires LATCHKEY_MCP_APPROVE=1 and respects .latchkey.toml scope.",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    name: { type: "string", description: "Secret name e.g. OPENAI_API_KEY" },
+                },
+                required: ["name"],
+            },
+        },
+    ],
+}));
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    if (request.params.name !== "latchkey_get_secret") {
+        throw new Error("Unknown tool");
+    }
+    const name = request.params.arguments?.name;
+    if (!name) {
+        return { content: [{ type: "text", text: "Missing name" }], isError: true };
+    }
+    if (process.env.LATCHKEY_MCP_APPROVE !== "1") {
+        await auditLog({
+            action: "mcp_deny",
+            name,
+            detail: "LATCHKEY_MCP_APPROVE not set",
+        });
+        return {
+            content: [
+                {
+                    type: "text",
+                    text: "Denied: set LATCHKEY_MCP_APPROVE=1 in your shell after reviewing the request.",
+                },
+            ],
+            isError: true,
+        };
+    }
+    try {
+        const value = await getSecret(name, { enforceScope: true });
+        await auditLog({
+            action: "mcp_approve",
+            name,
+            detail: "latchkey_get_secret",
+        });
+        return {
+            content: [{ type: "text", text: value }],
+        };
+    }
+    catch (e) {
+        await auditLog({
+            action: "mcp_error",
+            name,
+            detail: "get_secret_failed",
+        });
+        return {
+            content: [{ type: "text", text: redactSecrets(String(e)) }],
+            isError: true,
+        };
+    }
+});
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((e) => {
+    process.stderr.write(redactSecrets(String(e)) + "\n");
+    process.exit(1);
+});

package/dist/paths.d.ts

@@ -0,0 +1,13 @@
+export declare const LATCHKEY_DIR: string;
+export declare const VAULT_FILE: string;
+export declare const CONFIG_FILE: string;
+export declare const AUDIT_FILE: string;
+export declare const PASSPHRASE_WRAP_FILE: string;
+export declare const KEYCHAIN_SERVICE = "latchkey";
+export declare const KEYCHAIN_ACCOUNT = "master-key";
+export declare const PROJECT_SCOPE_FILE = ".latchkey.toml";
+export declare const LICENSE_CACHE_FILE: string;
+export declare const TRIAL_FILE: string;
+export declare const MACHINE_ID_FILE: string;
+export declare const DEVICES_FILE: string;
+export declare const PROJECTS_FILE: string;

package/dist/paths.js

@@ -0,0 +1,15 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const LATCHKEY_DIR = process.env.LATCHKEY_HOME ?? join(homedir(), ".latchkey");
+export const VAULT_FILE = join(LATCHKEY_DIR, "vault.enc.json");
+export const CONFIG_FILE = join(LATCHKEY_DIR, "config.json");
+export const AUDIT_FILE = join(LATCHKEY_DIR, "audit.jsonl");
+export const PASSPHRASE_WRAP_FILE = join(LATCHKEY_DIR, "master.wrap.json");
+export const KEYCHAIN_SERVICE = "latchkey";
+export const KEYCHAIN_ACCOUNT = "master-key";
+export const PROJECT_SCOPE_FILE = ".latchkey.toml";
+export const LICENSE_CACHE_FILE = join(LATCHKEY_DIR, "license.cache.json");
+export const TRIAL_FILE = join(LATCHKEY_DIR, "trial.json");
+export const MACHINE_ID_FILE = join(LATCHKEY_DIR, "machine.id");
+export const DEVICES_FILE = join(LATCHKEY_DIR, "devices.json");
+export const PROJECTS_FILE = join(LATCHKEY_DIR, "projects.json");

package/dist/redact.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Replace likely secret material with a fixed token. Safe for logs and stderr.
+ */
+export declare function redactSecrets(input: string): string;
+export declare function redactValue(name: string, value: string): string;

package/dist/redact.js

@@ -0,0 +1,32 @@
+/** Patterns for common AI / cloud API key shapes (heuristic, not exhaustive). */
+const KEY_PATTERNS = [
+    /\bsk-[a-zA-Z0-9]{20,}\b/g,
+    /\bsk-ant-[a-zA-Z0-9_-]{20,}\b/g,
+    /\bxai-[a-zA-Z0-9]{20,}\b/g,
+    /\bAIza[0-9A-Za-z_-]{35}\b/g,
+    /\bghp_[a-zA-Z0-9]{36,}\b/g,
+    /\bgho_[a-zA-Z0-9]{36,}\b/g,
+    /\bgithub_pat_[a-zA-Z0-9_]{22,}\b/g,
+    /\bAKIA[0-9A-Z]{16}\b/g,
+    /\bBearer\s+[A-Za-z0-9._~+/=-]{20,}\b/gi,
+];
+const ENV_ASSIGNMENT = /^(export\s+)?([A-Z][A-Z0-9_]*)\s*=\s*.+$/m;
+/**
+ * Replace likely secret material with a fixed token. Safe for logs and stderr.
+ */
+export function redactSecrets(input) {
+    let out = input;
+    for (const re of KEY_PATTERNS) {
+        out = out.replace(re, "[REDACTED]");
+    }
+    return out.replace(ENV_ASSIGNMENT, (line, exp, name) => {
+        const prefix = exp ? "export " : "";
+        return `${prefix}${name}=[REDACTED]`;
+    });
+}
+export function redactValue(name, value) {
+    if (/key|token|secret|password|credential/i.test(name)) {
+        return "[REDACTED]";
+    }
+    return redactSecrets(value);
+}

package/dist/redact.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/redact.test.js

@@ -0,0 +1,12 @@
+import { describe, it, expect } from "vitest";
+import { redactSecrets, redactValue } from "./redact.js";
+describe("redact", () => {
+    it("redacts OpenAI-style keys in text", () => {
+        const input = "failed with sk-abcdefghijklmnopqrstuvwxyz1234567890";
+        expect(redactSecrets(input)).not.toContain("sk-abc");
+        expect(redactSecrets(input)).toContain("[REDACTED]");
+    });
+    it("redacts sensitive env names", () => {
+        expect(redactValue("OPENAI_API_KEY", "sk-secret")).toBe("[REDACTED]");
+    });
+});

package/dist/sandbox.d.ts

@@ -0,0 +1,4 @@
+/** M22-cli preview — isolation not enforced yet. */
+export declare const SANDBOX_ENV = "LATCHKEY_SANDBOX_REQUESTED";
+export declare function sandboxPreviewNotice(): void;
+export declare function sandboxEnvFlag(): Record<string, string>;

package/dist/sandbox.js

@@ -0,0 +1,10 @@
+/** M22-cli preview — isolation not enforced yet. */
+export const SANDBOX_ENV = "LATCHKEY_SANDBOX_REQUESTED";
+export function sandboxPreviewNotice() {
+    console.warn("latchkey: --sandbox is a preview flag. Process isolation is NOT enforced yet.\n" +
+        "         Approve gate and .latchkey.toml scopes still apply.\n" +
+        "         https://modexventures.com/latchkey/agent-sandbox");
+}
+export function sandboxEnvFlag() {
+    return { [SANDBOX_ENV]: "1" };
+}

package/dist/scan.d.ts

@@ -0,0 +1,6 @@
+export interface ScanFinding {
+    file: string;
+    line: number;
+    preview: string;
+}
+export declare function scanRepository(root: string): Promise<ScanFinding[]>;

package/dist/scan.js

@@ -0,0 +1,50 @@
+import { readFile, readdir } from "node:fs/promises";
+import { join } from "node:path";
+import { redactSecrets } from "./redact.js";
+const SKIP_DIRS = new Set([
+    "node_modules",
+    ".git",
+    "dist",
+    ".next",
+    "coverage",
+]);
+const KEY_HINT = /\b(sk-[a-zA-Z0-9]{20,}|sk-ant-[a-zA-Z0-9_-]{20,}|ghp_[a-zA-Z0-9]{36,}|AKIA[0-9A-Z]{16})\b/;
+async function walk(dir, findings) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const ent of entries) {
+        if (ent.name.startsWith(".") && ent.name !== ".env")
+            continue;
+        const full = join(dir, ent.name);
+        if (ent.isDirectory()) {
+            if (SKIP_DIRS.has(ent.name))
+                continue;
+            await walk(full, findings);
+        }
+        else if (ent.isFile()) {
+            let text;
+            try {
+                text = await readFile(full, "utf8");
+            }
+            catch {
+                continue;
+            }
+            if (text.length > 2_000_000)
+                continue;
+            const lines = text.split("\n");
+            lines.forEach((line, i) => {
+                if (KEY_HINT.test(line)) {
+                    findings.push({
+                        file: full,
+                        line: i + 1,
+                        preview: redactSecrets(line.trim().slice(0, 120)),
+                    });
+                }
+            });
+        }
+    }
+}
+export async function scanRepository(root) {
+    const findings = [];
+    await walk(root, findings);
+    return findings;
+}

package/dist/scope.d.ts

@@ -0,0 +1,9 @@
+export interface ProjectScope {
+    allowed: string[];
+    projectRoot: string;
+}
+/**
+ * Load `.latchkey.toml` from cwd upward, or at explicit project root.
+ */
+export declare function loadProjectScope(cwd?: string): Promise<ProjectScope | null>;
+export declare function isKeyAllowed(scope: ProjectScope | null, keyName: string): boolean;

package/dist/scope.js

@@ -0,0 +1,36 @@
+import { readFile } from "node:fs/promises";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import TOML from "toml";
+import { PROJECT_SCOPE_FILE } from "./paths.js";
+function normalizeList(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    return raw.map((x) => String(x).trim()).filter(Boolean);
+}
+/**
+ * Load `.latchkey.toml` from cwd upward, or at explicit project root.
+ */
+export async function loadProjectScope(cwd = process.cwd()) {
+    const path = join(cwd, PROJECT_SCOPE_FILE);
+    if (!existsSync(path)) {
+        return null;
+    }
+    const text = await readFile(path, "utf8");
+    const parsed = TOML.parse(text);
+    const scope = (parsed.scope ?? parsed);
+    const allowed = normalizeList(scope.allowed ?? scope.allow ?? scope.keys);
+    if (allowed.length === 0) {
+        return { allowed: [], projectRoot: cwd };
+    }
+    return { allowed, projectRoot: cwd };
+}
+export function isKeyAllowed(scope, keyName) {
+    if (!scope) {
+        return true;
+    }
+    if (scope.allowed.length === 0) {
+        return false;
+    }
+    return scope.allowed.includes(keyName);
+}

package/dist/scope.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/scope.test.js

@@ -0,0 +1,15 @@
+import { describe, it, expect } from "vitest";
+import { isKeyAllowed } from "./scope.js";
+describe("scope", () => {
+    it("allows any key when scope is null", () => {
+        expect(isKeyAllowed(null, "OPENAI_API_KEY")).toBe(true);
+    });
+    it("denies when allowlist is empty", () => {
+        expect(isKeyAllowed({ allowed: [], projectRoot: "/proj" }, "OPENAI_API_KEY")).toBe(false);
+    });
+    it("allows listed keys only", () => {
+        const scope = { allowed: ["OPENAI_API_KEY"], projectRoot: "/proj" };
+        expect(isKeyAllowed(scope, "OPENAI_API_KEY")).toBe(true);
+        expect(isKeyAllowed(scope, "OTHER")).toBe(false);
+    });
+});

package/dist/vault.d.ts

@@ -0,0 +1,35 @@
+import { isLocked } from "./lock.js";
+export interface EncryptedSecret {
+    name: string;
+    ciphertext: string;
+    nonce: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface VaultDocument {
+    version: 1;
+    secrets: EncryptedSecret[];
+}
+export interface LatchkeyConfig {
+    idleLockMinutes?: number;
+}
+export declare function ensureVaultInitialized(options?: {
+    passphrase?: string;
+    preferPassphrase?: boolean;
+}): Promise<void>;
+export declare function unlockVault(passphrase?: string): Promise<Uint8Array>;
+export declare function loadVaultDoc(): Promise<VaultDocument>;
+export declare function addSecret(name: string, value: string, passphrase?: string): Promise<void>;
+export declare function getSecret(name: string, options?: {
+    passphrase?: string;
+    cwd?: string;
+    enforceScope?: boolean;
+}): Promise<string>;
+export declare function listSecrets(passphrase?: string): Promise<string[]>;
+export declare function removeSecret(name: string, passphrase?: string): Promise<void>;
+export declare function buildEnvForRun(keyNames: string[], options?: {
+    passphrase?: string;
+    cwd?: string;
+}): Promise<Record<string, string>>;
+export declare function lock(): void;
+export { isLocked };