@tuskydp/cli 0.2.0 → 0.3.0

package/src/crypto.ts

@@ -7,6 +7,13 @@ import {
   pbkdf2Sync,
 } from 'crypto';
 
+export interface FileMeta {
+  /** Original filename */
+  n: string;
+  /** Original MIME type */
+  m: string;
+}
+
 const PBKDF2_ITERATIONS = 600_000;
 const AES_ALGO = 'aes-256-gcm' as const;
 const VERIFIER_CONTEXT = 'tuskydp-key-verifier-v1';
@@ -92,6 +99,34 @@ export function encryptBuffer(plaintext: Buffer, masterKey: Buffer): {
   };
 }
 
+/**
+ * Encrypt filename + MIME type together using master key (AES-256-GCM).
+ * Format: base64([iv(12) | ciphertext | authTag(16)])
+ */
+export function encryptMetadata(name: string, mimeType: string, masterKey: Buffer): string {
+  const plaintext = Buffer.from(JSON.stringify({ n: name, m: mimeType }), 'utf8');
+  const iv = randomBytes(12);
+  const cipher = createCipheriv(AES_ALGO, masterKey, iv);
+  const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  return Buffer.concat([iv, encrypted, tag]).toString('base64');
+}
+
+/**
+ * Decrypt an encryptedName blob produced by encryptMetadata.
+ * Returns the original { name, mimeType }.
+ */
+export function decryptMetadata(encryptedBase64: string, masterKey: Buffer): FileMeta {
+  const buf = Buffer.from(encryptedBase64, 'base64');
+  const iv = buf.subarray(0, 12);
+  const tag = buf.subarray(buf.length - 16);
+  const ciphertext = buf.subarray(12, buf.length - 16);
+  const decipher = createDecipheriv(AES_ALGO, masterKey, iv);
+  decipher.setAuthTag(tag);
+  const plaintext = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  return JSON.parse(plaintext.toString('utf8')) as FileMeta;
+}
+
 export function decryptBuffer(
   ciphertext: Buffer,
   wrappedKeyBase64: string,

package/src/index.ts

@@ -5,6 +5,10 @@ import { registerEncryptionCommands } from './commands/encryption.js';
 import { registerVaultCommands } from './commands/vault.js';
 import { registerFileCommands } from './commands/files.js';
 import { registerAccountCommands } from './commands/account.js';
+import { registerFolderCommands } from './commands/folder.js';
+import { registerTrashCommands } from './commands/trash.js';
+import { registerWebhookCommands } from './commands/webhook.js';
+import { registerWalletCommands } from './commands/wallet.js';
 import { uploadCommand } from './commands/upload.js';
 import { downloadCommand } from './commands/download.js';
 import { rehydrateCommand } from './commands/rehydrate.js';
@@ -12,15 +16,14 @@ import { registerTuiCommand } from './commands/tui.js';
 import { registerMcpCommands } from './commands/mcp.js';
 import { registerExportCommand } from './commands/export.js';
 import { registerDecryptCommand } from './commands/decrypt.js';
-
-const VERSION = '0.1.0';
+import { CLI_VERSION } from './version.js';
 
 const program = new Command();
 
 program
   .name('tusky')
   .description('Tusky — Encrypted decentralized storage for developers, apps, and agents')
-  .version(VERSION)
+  .version(CLI_VERSION)
   .option('--api-key <key>', 'Override API key')
   .option('--api-url <url>', 'Override API URL')
   .option('--format <fmt>', 'Output format: table, json, plain', 'table')
@@ -39,6 +42,10 @@ registerAuthCommands(program);
 registerEncryptionCommands(program);
 registerVaultCommands(program);
 registerFileCommands(program);
+registerFolderCommands(program);
+registerTrashCommands(program);
+registerWebhookCommands(program);
+registerWalletCommands(program);
 registerAccountCommands(program);
 registerTuiCommand(program);
 registerMcpCommands(program);
@@ -46,10 +53,14 @@ registerExportCommand(program);
 registerDecryptCommand(program);
 
 // Direct shortcuts for common operations
-program.command('upload <paths...>')
+program.command('upload [paths...]')
   .description('Upload files')
   .option('--vault <vault>', 'Target vault')
+  .option('--folder <folder-id>', 'Target folder ID within the vault')
   .option('--recursive', 'Upload directory contents')
+  .option('--content <text>', 'Upload inline text content instead of a file path')
+  .option('--stdin', 'Read file content from stdin')
+  .option('--name <filename>', 'File name to use (required with --content or --stdin)')
   .action(async (paths: string[], options) => {
     await uploadCommand(paths, options, program);
   });
@@ -57,6 +68,7 @@ program.command('upload <paths...>')
 program.command('download <file-id>')
   .description('Download a file')
   .option('--output <path>', 'Output path')
+  .option('--stdout', 'Write file content to stdout (for sandboxed agents without filesystem access)')
   .action(async (fileId: string, options) => {
     await downloadCommand(fileId, options, program);
   });
@@ -64,6 +76,7 @@ program.command('download <file-id>')
 program.command('rehydrate <blob-id>')
   .description('Download a file directly from Walrus by blob ID')
   .option('--output <path>', 'Output file path')
+  .option('--stdout', 'Write blob content to stdout (for sandboxed agents without filesystem access)')
   .action(async (blobId: string, options) => {
     await rehydrateCommand(blobId, options, program);
   });

package/src/mcp/server.ts

@@ -25,6 +25,7 @@ import { registerFolderTools } from './tools/folders.js';
 import { registerFileTools } from './tools/files.js';
 import { registerTrashTools } from './tools/trash.js';
 import { registerSharedVaultTools } from './tools/sharedVaults.js';
+import { CLI_VERSION } from '../version.js';
 
 // ---------------------------------------------------------------------------
 // Encryption bootstrap
@@ -135,7 +136,7 @@ export async function startMcpServer(options: McpServerOptions): Promise<void> {
   // Create MCP server
   const server = new McpServer({
     name: 'tusky',
-    version: '0.1.0',
+    version: CLI_VERSION,
   });
 
   // Register all tools

package/src/mcp/tools/files.ts

@@ -13,8 +13,8 @@ import { basename, resolve, join } from 'path';
 import { lookup } from 'mime-types';
 import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
 import type { McpContext } from '../context.js';
-import { encryptBuffer, decryptBuffer } from '../../crypto.js';
-import { isSealConfigured, sealEncrypt, sealDecrypt } from '../../seal.js';
+import { encryptBuffer, decryptBuffer, encryptMetadata, decryptMetadata } from '../../crypto.js';
+import { isSealConfigured, sealEncrypt, sealDecrypt, sealEncryptMetadata, sealDecryptMetadata } from '../../seal.js';
 import { wrapToolError } from './helpers.js';
 
 // ---------------------------------------------------------------------------
@@ -117,6 +117,38 @@ async function fetchAndDecryptFile(fileId: string, ctx: McpContext) {
   return { fileBuffer, encryption };
 }
 
+/**
+ * Resolve the real filename from a FileStatusResponse.
+ * Decrypts encryptedName (private vaults) or encryptedMetadata (shared vaults) when present.
+ * Falls back to the stored placeholder name on failure.
+ */
+async function resolveFilename(
+  fileInfo: { name: string; nameEncrypted?: boolean; encryptedName?: string | null; encryptedMetadata?: string | null; fileId?: string },
+  ctx: McpContext,
+): Promise<string> {
+  if (!fileInfo.nameEncrypted) return fileInfo.name;
+  try {
+    if (fileInfo.encryptedName) {
+      const masterKey = ctx.getMasterKey();
+      if (masterKey) {
+        const meta = decryptMetadata(fileInfo.encryptedName, masterKey);
+        return meta.n;
+      }
+    } else if (fileInfo.encryptedMetadata && fileInfo.fileId) {
+      const keypair = ctx.getSuiKeypair();
+      if (keypair) {
+        const fileObj = await ctx.sdk.files.get(fileInfo.fileId);
+        const vault = await ctx.sdk.vaults.get(fileObj.vaultId);
+        const meta = await sealDecryptMetadata(fileInfo.encryptedMetadata, vault, keypair);
+        return meta.n;
+      }
+    }
+  } catch {
+    // Fall through to placeholder
+  }
+  return fileInfo.name;
+}
+
 /**
  * Encrypt (if private vault) and upload a buffer to Tusky.
  * Shared by tusky_file_upload (from disk) and tusky_file_create (from content).
@@ -141,6 +173,8 @@ async function encryptAndUpload(
     plaintextChecksumSha256?: string;
     sealIdentity?: string;
     sealEncryptedObject?: string;
+    encryptedName?: string;
+    encryptedMetadata?: string;
   } = {};
 
   if (isPrivate) {
@@ -159,6 +193,7 @@ async function encryptAndUpload(
       encryptionIv: iv,
       plaintextSizeBytes: fileBuffer.length,
       plaintextChecksumSha256: plaintextChecksum,
+      encryptedName: encryptMetadata(fileName, mimeType, masterKey),
     };
   } else if (isShared) {
     const keypair = ctx.getSuiKeypair();
@@ -176,6 +211,7 @@ async function encryptAndUpload(
       sealIdentity: sealResult.sealIdentity,
       sealEncryptedObject: sealResult.sealEncryptedObject,
       plaintextSizeBytes: fileBuffer.length,
+      encryptedMetadata: await sealEncryptMetadata(fileName, mimeType, vault, fileNonce),
     };
   } else {
     uploadBody = fileBuffer;
@@ -313,13 +349,14 @@ export function registerFileTools(server: McpServer, ctx: McpContext) {
         const { fileBuffer, encryption } = await fetchAndDecryptFile(fileId, ctx);
 
         const fileInfo = await ctx.sdk.files.getStatus(fileId);
+        const realName = await resolveFilename({ ...fileInfo, fileId }, ctx);
         const finalPath = resolve(outputPath);
 
         writeFileSync(finalPath, fileBuffer);
 
         const result = {
           fileId,
-          name: fileInfo.name,
+          name: realName,
           savedTo: finalPath,
           sizeBytes: fileBuffer.length,
           mimeType: fileInfo.mimeType,
@@ -346,6 +383,7 @@ export function registerFileTools(server: McpServer, ctx: McpContext) {
       try {
         const { fileBuffer, encryption } = await fetchAndDecryptFile(fileId, ctx);
         const fileInfo = await ctx.sdk.files.getStatus(fileId);
+        const realName = await resolveFilename({ ...fileInfo, fileId }, ctx);
 
         const isText = isTextMimeType(fileInfo.mimeType);
 
@@ -354,7 +392,7 @@ export function registerFileTools(server: McpServer, ctx: McpContext) {
             content: [
               {
                 type: 'text' as const,
-                text: `--- ${fileInfo.name} (${fileInfo.mimeType}, ${fileBuffer.length} bytes${encryption?.encrypted ? ', decrypted' : ''}) ---\n\n${fileBuffer.toString('utf-8')}`,
+                text: `--- ${realName} (${fileInfo.mimeType}, ${fileBuffer.length} bytes${encryption?.encrypted ? ', decrypted' : ''}) ---\n\n${fileBuffer.toString('utf-8')}`,
               },
             ],
           };
@@ -367,7 +405,7 @@ export function registerFileTools(server: McpServer, ctx: McpContext) {
               type: 'text' as const,
               text: JSON.stringify({
                 fileId,
-                name: fileInfo.name,
+                name: realName,
                 mimeType: fileInfo.mimeType,
                 sizeBytes: fileBuffer.length,
                 wasEncrypted: encryption?.encrypted ?? false,

package/src/seal.ts

@@ -18,7 +18,7 @@ import { Ed25519Keypair } from '@mysten/sui/keypairs/ed25519';
 import { SuiJsonRpcClient } from '@mysten/sui/jsonRpc';
 import { Transaction } from '@mysten/sui/transactions';
 import { fromHex } from '@mysten/sui/utils';
-import { SEAL_PACKAGE_ID, SEAL_DEFAULT_KEY_SERVER_CONFIGS } from '@tuskydp/shared/constants.js';
+import { SEAL_PACKAGE_ID, SEAL_DEFAULT_KEY_SERVER_CONFIGS, METADATA_NONCE_PREFIX } from '@tuskydp/shared/constants.js';
 import type { VaultResponse } from '@tuskydp/sdk';
 import { getSuiPrivateKey } from './config.js';
 
@@ -193,6 +193,39 @@ export async function sealEncrypt(
   };
 }
 
+/**
+ * Encrypt filename + MIME type using SEAL for a shared vault.
+ * Uses a distinct nonce (METADATA_NONCE_PREFIX + fileNonce) so the metadata
+ * identity differs from the file content identity.
+ *
+ * Returns base64-encoded full SEAL EncryptedObject (stored in encrypted_metadata column).
+ */
+export async function sealEncryptMetadata(
+  name: string,
+  mimeType: string,
+  vault: VaultResponse,
+  fileNonce: string,
+): Promise<string> {
+  const plaintext = new TextEncoder().encode(JSON.stringify({ n: name, m: mimeType }));
+  const metaNonce = METADATA_NONCE_PREFIX + fileNonce;
+  const result = await sealEncrypt(plaintext, vault, metaNonce);
+  return Buffer.from(result.encryptedData).toString('base64');
+}
+
+/**
+ * Decrypt an encryptedMetadata blob produced by sealEncryptMetadata.
+ * Returns the original { n: name, m: mimeType }.
+ */
+export async function sealDecryptMetadata(
+  encryptedBase64: string,
+  vault: VaultResponse,
+  keypair: import('@mysten/sui/keypairs/ed25519').Ed25519Keypair,
+): Promise<{ n: string; m: string }> {
+  const encryptedData = new Uint8Array(Buffer.from(encryptedBase64, 'base64'));
+  const plaintext = await sealDecrypt(encryptedData, vault, keypair);
+  return JSON.parse(new TextDecoder().decode(plaintext));
+}
+
 // ---------------------------------------------------------------------------
 // Decrypt
 // ---------------------------------------------------------------------------

package/src/tui/files-panel.ts

@@ -2,6 +2,12 @@ import blessed from 'blessed';
 import type { TuskyClient } from '@tuskydp/sdk';
 import { formatBytes, formatDate, formatRow, statusColor, statusColorClose, getCurrentTheme } from './helpers.js';
 
+export interface FolderItem {
+  id: string;
+  name: string;
+  parentId: string | null;
+}
+
 export interface FileItem {
   id: string;
   name: string;
@@ -13,6 +19,9 @@ export interface FileItem {
   walrusBlobId: string | null;
   walrusBlobObjectId: string | null;
   encrypted: boolean;
+  folderId: string | null;
+  autoRenew: boolean;
+  ppuEpochEnd: string | null;
 }
 
 export class FilesPanel {
@@ -20,9 +29,15 @@ export class FilesPanel {
   private screen: blessed.Widgets.Screen;
   private sdk: TuskyClient;
   private files: FileItem[] = [];
+  private folders: FolderItem[] = [];
+  /** Combined display items: folders first, then files */
+  private displayItems: Array<{ type: 'folder'; folder: FolderItem } | { type: 'file'; file: FileItem } | { type: 'parent' }> = [];
   private loading = false;
   private currentVaultId: string | null = null;
   private currentVaultName = '';
+  private currentFolderId: string | null = null;
+  private currentFolderName: string | null = null;
+  private folderStack: Array<{ id: string | null; name: string | null }> = [];
 
   constructor(
     screen: blessed.Widgets.Screen,
@@ -63,18 +78,43 @@ export class FilesPanel {
     });
   }
 
-  async loadForVault(vaultId: string, vaultName: string) {
+  async loadForVault(vaultId: string, vaultName: string, folderId?: string | null) {
     if (this.loading) return;
     this.loading = true;
     this.currentVaultId = vaultId;
     this.currentVaultName = vaultName;
-    this.list.setLabel(` Files — ${vaultName} `);
-    this.list.setItems(['Loading files...'] as any);
+
+    if (folderId !== undefined) {
+      this.currentFolderId = folderId;
+    }
+
+    const folderPath = this.currentFolderName
+      ? `${vaultName} / ${this.currentFolderName}`
+      : vaultName;
+    this.list.setLabel(` Files — ${folderPath} `);
+    this.list.setItems(['Loading...'] as any);
     this.screen.render();
 
     try {
-      const { files } = await this.sdk.files.list({ vaultId, limit: 100, sortBy: 'createdAt', order: 'desc' });
-      this.files = files.map((f) => ({
+      // Load folders and files for current context
+      const [foldersResult, filesResult] = await Promise.all([
+        this.sdk.folders.list({ vaultId, parentId: this.currentFolderId || undefined }).catch(() => []),
+        this.sdk.files.list({
+          vaultId,
+          folderId: this.currentFolderId || undefined,
+          limit: 100,
+          sortBy: 'createdAt',
+          order: 'desc',
+        }),
+      ]);
+
+      this.folders = (foldersResult as any[]).map((f) => ({
+        id: f.id,
+        name: f.name,
+        parentId: f.parentId || null,
+      }));
+
+      this.files = filesResult.files.map((f) => ({
         id: f.id,
         name: f.name,
         sizeBytes: f.sizeBytes || 0,
@@ -85,10 +125,31 @@ export class FilesPanel {
         walrusBlobId: f.walrusBlobId || null,
         walrusBlobObjectId: f.walrusBlobObjectId || null,
         encrypted: f.encrypted || false,
+        folderId: f.folderId || null,
+        autoRenew: f.autoRenew || false,
+        ppuEpochEnd: f.ppuEpochEnd || null,
       }));
 
-      if (this.files.length === 0) {
-        this.list.setItems(['(no files — press u to upload)'] as any);
+      // Build combined display list
+      this.displayItems = [];
+
+      // Show ".." to go up if we're in a subfolder
+      if (this.currentFolderId) {
+        this.displayItems.push({ type: 'parent' });
+      }
+
+      // Folders first
+      for (const folder of this.folders) {
+        this.displayItems.push({ type: 'folder', folder });
+      }
+
+      // Then files
+      for (const file of this.files) {
+        this.displayItems.push({ type: 'file', file });
+      }
+
+      if (this.displayItems.length === 0) {
+        this.list.setItems(['(empty — press u to upload, f to create folder)'] as any);
       } else {
         const totalW = (this.list.width as number) - 4;
         const sizeW = 9;
@@ -97,13 +158,37 @@ export class FilesPanel {
         const encW = 3;
         const nameW = Math.max(10, totalW - sizeW - statusW - dateW - encW - 4);
 
-        const items = this.files.map((f) => {
+        const items = this.displayItems.map((item) => {
+          if (item.type === 'parent') {
+            return formatRow([
+              { text: '../', tagged: '{yellow-fg}../{/yellow-fg}', width: nameW },
+              { text: '', width: sizeW, align: 'right' },
+              { text: '', width: statusW },
+              { text: '', width: encW },
+              { text: '', width: dateW, align: 'right' },
+            ], totalW);
+          }
+          if (item.type === 'folder') {
+            const name = item.folder.name;
+            const display = name.length > nameW - 2
+              ? name.slice(0, nameW - 3) + '...'
+              : name + '/';
+            return formatRow([
+              { text: display, tagged: `{cyan-fg}${display}{/cyan-fg}`, width: nameW },
+              { text: '', width: sizeW, align: 'right' },
+              { text: 'folder', tagged: '{cyan-fg}folder{/cyan-fg}', width: statusW },
+              { text: '', width: encW },
+              { text: '', width: dateW, align: 'right' },
+            ], totalW);
+          }
+          // file
+          const f = item.file;
           const size = formatBytes(f.plaintextSizeBytes ?? f.sizeBytes);
           const status = f.status;
           const statusTagged = `${statusColor(f.status)}${f.status}${statusColorClose(f.status)}`;
           const date = f.createdAt ? formatDate(f.createdAt) : '';
           const enc = f.encrypted ? '🔒' : '';
-          const name = f.name.length > nameW ? f.name.slice(0, nameW - 1) + '…' : f.name;
+          const name = f.name.length > nameW ? f.name.slice(0, nameW - 1) + '...' : f.name;
           return formatRow([
             { text: name, width: nameW },
             { text: size, width: sizeW, align: 'right' },
@@ -122,18 +207,57 @@ export class FilesPanel {
     this.screen.render();
   }
 
+  /** Navigate into a folder or back to parent */
+  async navigateToFolder(folderId: string | null, folderName: string | null) {
+    if (!this.currentVaultId) return;
+
+    // Push current location onto stack before navigating
+    this.folderStack.push({ id: this.currentFolderId, name: this.currentFolderName });
+    this.currentFolderId = folderId;
+    this.currentFolderName = folderName;
+    await this.loadForVault(this.currentVaultId, this.currentVaultName);
+  }
+
+  /** Navigate back to parent folder */
+  async navigateUp() {
+    if (!this.currentVaultId || !this.currentFolderId) return;
+
+    const prev = this.folderStack.pop();
+    this.currentFolderId = prev?.id || null;
+    this.currentFolderName = prev?.name || null;
+    await this.loadForVault(this.currentVaultId, this.currentVaultName);
+  }
+
+  /** Reset folder navigation when switching vaults */
+  resetFolderNav() {
+    this.currentFolderId = null;
+    this.currentFolderName = null;
+    this.folderStack = [];
+  }
+
+  getSelectedItem(): { type: 'parent' } | { type: 'folder'; folder: FolderItem } | { type: 'file'; file: FileItem } | null {
+    const idx = (this.list as any).selected as number;
+    return this.displayItems[idx] || null;
+  }
+
   clear() {
     this.files = [];
+    this.folders = [];
+    this.displayItems = [];
     this.currentVaultId = null;
     this.currentVaultName = '';
+    this.currentFolderId = null;
+    this.currentFolderName = null;
+    this.folderStack = [];
     this.list.setLabel(' Files ');
     this.list.setItems(['Select a vault'] as any);
     this.screen.render();
   }
 
   getSelected(): FileItem | null {
-    const idx = (this.list as any).selected as number;
-    return this.files[idx] || null;
+    const item = this.getSelectedItem();
+    if (item && item.type === 'file') return item.file;
+    return null;
   }
 
   getFiles(): FileItem[] {
@@ -148,6 +272,10 @@ export class FilesPanel {
     return this.currentVaultName;
   }
 
+  getCurrentFolderId(): string | null {
+    return this.currentFolderId;
+  }
+
   focus() {
     this.list.focus();
     this.list.style.border = { fg: getCurrentTheme().borderFocus } as any;