@wipcomputer/memory-crystal 0.7.34-alpha.2 → 0.7.34-alpha.3

package/dist/crypto.js

@@ -1,17 +1,156 @@
-import {
-  RELAY_KEY_PATH,
-  decodePairingString,
-  decrypt,
-  decryptJSON,
-  encodePairingString,
-  encrypt,
-  encryptFile,
-  encryptJSON,
-  generateRelayKey,
-  hashBuffer,
-  loadRelayKey
-} from "./chunk-D3MACYZ4.js";
-import "./chunk-DFQ72B7M.js";
+// src/crypto.ts
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
+import { createCipheriv, createDecipheriv, createHmac, randomBytes, hkdfSync } from "crypto";
+
+// src/ldm.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync, readdirSync } from "fs";
+import { join, dirname } from "path";
+import { execSync } from "child_process";
+import { fileURLToPath } from "url";
+var HOME = process.env.HOME || "";
+var LDM_ROOT = join(HOME, ".ldm");
+function loadAgentConfig(id) {
+  const cfgPath = join(LDM_ROOT, "agents", id, "config.json");
+  try {
+    if (existsSync(cfgPath)) return JSON.parse(readFileSync(cfgPath, "utf-8"));
+  } catch {
+  }
+  return null;
+}
+function getAgentId(harnessHint) {
+  if (process.env.CRYSTAL_AGENT_ID) return process.env.CRYSTAL_AGENT_ID;
+  const agentsDir = join(LDM_ROOT, "agents");
+  if (existsSync(agentsDir)) {
+    try {
+      for (const d of readdirSync(agentsDir)) {
+        const cfg = loadAgentConfig(d);
+        if (!cfg || !cfg.agentId) continue;
+        if (!harnessHint) return cfg.agentId;
+        if (harnessHint === "claude-code" && cfg.harness === "claude-code-cli") return cfg.agentId;
+        if (harnessHint === "openclaw" && cfg.harness === "openclaw") return cfg.agentId;
+      }
+    } catch {
+    }
+  }
+  return harnessHint === "openclaw" ? "oc-lesa-mini" : "cc-mini";
+}
+function ldmPaths(agentId) {
+  const id = agentId || getAgentId();
+  const agentRoot = join(LDM_ROOT, "agents", id);
+  return {
+    root: LDM_ROOT,
+    bin: join(LDM_ROOT, "bin"),
+    secrets: join(LDM_ROOT, "secrets"),
+    state: join(LDM_ROOT, "state"),
+    config: join(LDM_ROOT, "config.json"),
+    crystalDb: join(LDM_ROOT, "memory", "crystal.db"),
+    crystalLance: join(LDM_ROOT, "memory", "lance"),
+    agentRoot,
+    transcripts: join(agentRoot, "memory", "transcripts"),
+    sessions: join(agentRoot, "memory", "sessions"),
+    daily: join(agentRoot, "memory", "daily"),
+    journals: join(agentRoot, "memory", "journals"),
+    workspace: join(agentRoot, "memory", "workspace")
+  };
+}
+var LEGACY_OC_DIR = join(HOME, ".openclaw");
+function resolveSecretPath(filename) {
+  const paths = ldmPaths();
+  const ldmPath = join(paths.secrets, filename);
+  if (existsSync(ldmPath)) return ldmPath;
+  const legacyPath = join(LEGACY_OC_DIR, "secrets", filename);
+  if (existsSync(legacyPath)) return legacyPath;
+  return ldmPath;
+}
+
+// src/crypto.ts
+import { createHash } from "crypto";
+var KEY_PATH = process.env.CRYSTAL_RELAY_KEY_PATH || resolveSecretPath("crystal-relay-key");
+function loadRelayKey() {
+  if (!existsSync2(KEY_PATH)) {
+    throw new Error(
+      `Relay key not found at ${KEY_PATH}
+Generate one: mkdir -p ~/.ldm/secrets && openssl rand -base64 32 > ~/.ldm/secrets/crystal-relay-key && chmod 600 ~/.ldm/secrets/crystal-relay-key
+Or run: crystal pair`
+    );
+  }
+  const raw = readFileSync2(KEY_PATH, "utf-8").trim();
+  const key = Buffer.from(raw, "base64");
+  if (key.length !== 32) {
+    throw new Error(`Relay key must be 32 bytes (256 bits). Got ${key.length} bytes. Regenerate with: openssl rand -base64 32`);
+  }
+  return key;
+}
+function deriveSigningKey(masterKey) {
+  return Buffer.from(hkdfSync("sha256", masterKey, "", "crystal-relay-sign", 32));
+}
+function encrypt(plaintext, masterKey) {
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", masterKey, nonce);
+  const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+  const tag = cipher.getAuthTag();
+  const signingKey = deriveSigningKey(masterKey);
+  const hmacData = Buffer.concat([nonce, ciphertext, tag]);
+  const hmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
+  return {
+    v: 1,
+    nonce: nonce.toString("base64"),
+    ciphertext: ciphertext.toString("base64"),
+    tag: tag.toString("base64"),
+    hmac
+  };
+}
+function decrypt(payload, masterKey) {
+  if (payload.v !== 1) {
+    throw new Error(`Unknown payload version: ${payload.v}`);
+  }
+  const nonce = Buffer.from(payload.nonce, "base64");
+  const ciphertext = Buffer.from(payload.ciphertext, "base64");
+  const tag = Buffer.from(payload.tag, "base64");
+  const signingKey = deriveSigningKey(masterKey);
+  const hmacData = Buffer.concat([nonce, ciphertext, tag]);
+  const expectedHmac = createHmac("sha256", signingKey).update(hmacData).digest("hex");
+  if (payload.hmac !== expectedHmac) {
+    throw new Error("HMAC verification failed \u2014 blob rejected (tampered or wrong key)");
+  }
+  const decipher = createDecipheriv("aes-256-gcm", masterKey, nonce);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+}
+function encryptJSON(data, masterKey) {
+  const plaintext = Buffer.from(JSON.stringify(data), "utf-8");
+  return encrypt(plaintext, masterKey);
+}
+function decryptJSON(payload, masterKey) {
+  const plaintext = decrypt(payload, masterKey);
+  return JSON.parse(plaintext.toString("utf-8"));
+}
+function encryptFile(filePath, masterKey) {
+  const plaintext = readFileSync2(filePath);
+  return encrypt(plaintext, masterKey);
+}
+var RELAY_KEY_PATH = KEY_PATH;
+function generateRelayKey() {
+  return randomBytes(32);
+}
+function encodePairingString(key) {
+  if (key.length !== 32) throw new Error("Key must be 32 bytes");
+  return `mc1:${key.toString("base64")}`;
+}
+function decodePairingString(str) {
+  const trimmed = str.trim();
+  if (!trimmed.startsWith("mc1:")) {
+    throw new Error("Invalid pairing string (expected mc1: prefix)");
+  }
+  const key = Buffer.from(trimmed.slice(4), "base64");
+  if (key.length !== 32) {
+    throw new Error(`Invalid key length: expected 32 bytes, got ${key.length}`);
+  }
+  return key;
+}
+function hashBuffer(data) {
+  return createHash("sha256").update(data).digest("hex");
+}
 export {
   RELAY_KEY_PATH,
   decodePairingString,

package/dist/crystal-serve.js

@@ -1,13 +1,65 @@
 #!/usr/bin/env node
-import {
-  ldmPaths
-} from "./chunk-DFQ72B7M.js";
 
 // src/crystal-serve.ts
 import { createServer } from "http";
 import { spawn } from "child_process";
-import { existsSync, readFileSync } from "fs";
-import { join } from "path";
+
+// src/ldm.ts
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync, chmodSync, readdirSync } from "fs";
+import { join, dirname } from "path";
+import { execSync } from "child_process";
+import { fileURLToPath } from "url";
+var HOME = process.env.HOME || "";
+var LDM_ROOT = join(HOME, ".ldm");
+function loadAgentConfig(id) {
+  const cfgPath = join(LDM_ROOT, "agents", id, "config.json");
+  try {
+    if (existsSync(cfgPath)) return JSON.parse(readFileSync(cfgPath, "utf-8"));
+  } catch {
+  }
+  return null;
+}
+function getAgentId(harnessHint) {
+  if (process.env.CRYSTAL_AGENT_ID) return process.env.CRYSTAL_AGENT_ID;
+  const agentsDir = join(LDM_ROOT, "agents");
+  if (existsSync(agentsDir)) {
+    try {
+      for (const d of readdirSync(agentsDir)) {
+        const cfg = loadAgentConfig(d);
+        if (!cfg || !cfg.agentId) continue;
+        if (!harnessHint) return cfg.agentId;
+        if (harnessHint === "claude-code" && cfg.harness === "claude-code-cli") return cfg.agentId;
+        if (harnessHint === "openclaw" && cfg.harness === "openclaw") return cfg.agentId;
+      }
+    } catch {
+    }
+  }
+  return harnessHint === "openclaw" ? "oc-lesa-mini" : "cc-mini";
+}
+function ldmPaths(agentId) {
+  const id = agentId || getAgentId();
+  const agentRoot = join(LDM_ROOT, "agents", id);
+  return {
+    root: LDM_ROOT,
+    bin: join(LDM_ROOT, "bin"),
+    secrets: join(LDM_ROOT, "secrets"),
+    state: join(LDM_ROOT, "state"),
+    config: join(LDM_ROOT, "config.json"),
+    crystalDb: join(LDM_ROOT, "memory", "crystal.db"),
+    crystalLance: join(LDM_ROOT, "memory", "lance"),
+    agentRoot,
+    transcripts: join(agentRoot, "memory", "transcripts"),
+    sessions: join(agentRoot, "memory", "sessions"),
+    daily: join(agentRoot, "memory", "daily"),
+    journals: join(agentRoot, "memory", "journals"),
+    workspace: join(agentRoot, "memory", "workspace")
+  };
+}
+var LEGACY_OC_DIR = join(HOME, ".openclaw");
+
+// src/crystal-serve.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
 var DEFAULT_PORT = 18790;
 var AUTH_TOKEN = process.env.CRYSTAL_SERVE_TOKEN || "";
 function checkAuth(req) {
@@ -147,22 +199,22 @@ async function handleProcess(req, res) {
 }
 function handleStatus(_req, res) {
   const paths = ldmPaths();
-  const hasDb = existsSync(paths.crystalDb);
+  const hasDb = existsSync2(paths.crystalDb);
   let lastDreamWeaver = null;
   const agentId = process.env.CRYSTAL_AGENT_ID || "cc-mini";
-  const wmPath = join(paths.state, `dream-weaver-${agentId}.json`);
-  if (existsSync(wmPath)) {
+  const wmPath = join2(paths.state, `dream-weaver-${agentId}.json`);
+  if (existsSync2(wmPath)) {
     try {
-      const wm = JSON.parse(readFileSync(wmPath, "utf-8"));
+      const wm = JSON.parse(readFileSync2(wmPath, "utf-8"));
       lastDreamWeaver = wm.lastRunAt || null;
     } catch {
     }
   }
   let role = "core";
-  const rolePath = join(paths.state, "role.json");
-  if (existsSync(rolePath)) {
+  const rolePath = join2(paths.state, "role.json");
+  if (existsSync2(rolePath)) {
     try {
-      const r = JSON.parse(readFileSync(rolePath, "utf-8"));
+      const r = JSON.parse(readFileSync2(rolePath, "utf-8"));
       role = r.role || "core";
     } catch {
     }