@wolpertingerlabs/drawlatch 1.0.0-alpha.19 → 1.0.0-alpha.29

package/README.md

@@ -137,6 +137,86 @@ drawlatch start
 drawlatch doctor    # Validate full setup
 ```
 
+## Admin Dashboard
+
+`drawlatch start` serves a built-in web dashboard — a React single-page app — that **fully manages** your running daemon: enable/disable connections per caller, set and clear secrets, create and delete callers, configure and control event listeners (start/stop/restart, multi-instance management), and watch the live event/log feed — all from the browser, no config-file editing required. Every change is applied with a **live reload** (the daemon re-resolves routes and ingestors in place), so there is no "restart to apply" step. drawlatch owns 100% of its own state through this password-gated surface; nothing external writes its config.
+
+### Architecture
+
+There is no separate UI service to run. The React app, the `/api/admin/*` API, and the MCP protocol endpoints (`/handshake`, `/request`, `/events`, `/webhooks`, …) are all served by the **same Express process on the same port** as the daemon (default `http://127.0.0.1:9999/`):
+
+```
+┌────────────────────────────── drawlatch daemon (one process, port 9999) ──────────────────────────────┐
+│                                                                                                        │
+│   GET /                 →  React SPA (served from frontend/dist in production)                          │
+│   /api/admin/*          →  read + mutating JSON API  ──┐                                                │
+│   POST /api/auth/*      →  login / logout / check       ├─ password-gated (session cookie)              │
+│   /handshake /request … →  MCP protocol (E2EE)         ─┘  ← unaffected by dashboard auth               │
+│                                                                                                        │
+└────────────────────────────────────────────────────────────────────────────────────────────────────┘
+```
+
+Any unmatched non-API GET falls back to `index.html` so client-side routing works. The MCP protocol endpoints are independent of the dashboard — they keep serving agents even when the dashboard is locked (see below).
+
+### Setup
+
+**1. Set a password** (required — the dashboard is locked until one is set):
+
+```bash
+drawlatch set-password          # prompts on a TTY, or reads a password piped on stdin
+# echo 'my-strong-password' | drawlatch set-password   # non-interactive
+```
+
+The password is hashed with **scrypt** (random 16-byte salt, verified with a constant-time compare); the hash + salt are written to `~/.drawlatch/.env` (`AUTH_PASSWORD_HASH` / `AUTH_PASSWORD_SALT`, mode `0600`). Your plaintext password is never stored. Use `drawlatch change-password` (an alias of the same command) to rotate it later — rotating signs out every other session.
+
+**2. Open the dashboard** at `http://127.0.0.1:9999/` and log in. `drawlatch status` prints the dashboard URL and whether a password is configured.
+
+### Pages
+
+| Page | Route | What it shows | Refresh |
+|------|-------|---------------|---------|
+| **Overview** | `/` | Daemon health at a glance: status, PID, port, version, uptime, active session count, ingestor state breakdown, and secrets-configured progress. | on load |
+| **Connections** | `/connections` | Full management: connections grouped by category with search + a stable/beta/dev filter; a caller selector with create/delete-caller; per-connection enable toggle, secrets modal, test connection/listener, listener config panel (all field types + multi-instance), and quick start/stop/restart — with live ingestor state dots and secret-status badges. | live (5s) |
+| **Logs** | `/logs` | Live event/log feed per caller — ingestor status cards, source filter pills, and expandable event rows (eventType, ids, timestamps, pretty-printed JSON payload). | every 5s |
+| **Callers** | `/callers` | Registered MCP callers — alias, name, connection count, key fingerprint, and whether their keys directory exists. Click through for a caller's connections and secret status. | on load |
+| **Ingestors** | `/ingestors` | Live table of every running ingestor (WebSocket / webhook / poll) — state, buffered event count, total events received, last activity, and any error. | every 2s |
+| **Sessions** | `/sessions` | Active MCP proxy sessions — caller alias, created/last-active times, request count, and current per-window request rate. | every 5s |
+| **Secrets** | `/secrets` | A (caller × connection × secret) matrix showing required/optional and present/missing — with a "only missing" filter. **Never shows secret values**, only whether each is set. | every 10s |
+
+### The `/api/admin/*` API
+
+The pages are views over the `/api/admin/*` JSON API. **Read** endpoints (`/meta`, `/health`, `/connections`, `/callers`, `/callers/:alias/connection-status`, `/callers/:alias/connections`, `/callers/:alias/ingestors`, `/callers/:alias/events`, `/ingestors`, `/sessions`, `/secrets`) **never return a secret value** — caller `env` maps are reduced to key *names*, secret state is reported as booleans, and session crypto material is never serialized.
+
+**Mutating** endpoints (all behind the password gate) let the dashboard own management end-to-end:
+
+| Method + path | Action |
+|---|---|
+| `POST /callers` | Create a caller **with a fresh keypair** (no interactive sync) |
+| `DELETE /callers/:alias` | Delete a caller (its keys + prefixed env vars); `default` is protected |
+| `POST /callers/:alias/connections/:connection` `{enabled}` | Enable/disable a connection |
+| `PUT  /callers/:alias/connections/:connection/secrets` `{secrets}` | Set/clear secrets (empty string = delete) — **write-only**, read back as booleans |
+| `POST /callers/:alias/connections/:connection/test` · `/test-ingestor` | Run a connection / listener test |
+| `POST /callers/:alias/connections/:connection/listener/control` `{action,instance_id?}` | Start/stop/restart a listener |
+| `GET/PUT /…/listener/params`, `GET/POST/DELETE /…/listener/instances[/:id]`, `POST /…/listener/resolve-options` | Listener params + multi-instance management |
+
+Secrets are **write-only** through this API: you `PUT` values, and every read path reports only booleans. After any mutation the daemon live-reloads routes/ingestors for the affected caller. The same logic powers the encrypted MCP tools and the admin API through a single shared `tool-dispatch` module, so the two surfaces can never drift.
+
+A loopback-only `POST /sync/auto-enroll` lets a **co-located** client (one that shares drawlatch's filesystem) provision a caller with zero interaction by presenting the one-time token drawlatch writes to `~/.drawlatch/enroll.token` at startup.
+
+### Security model
+
+The **password is the trust boundary** for the dashboard and `/api/admin/*` — not loopback. That lets you expose the dashboard to a LAN by binding a non-loopback host:
+
+```bash
+DRAWLATCH_HOST=0.0.0.0 drawlatch start    # or: drawlatch start --host 0.0.0.0
+```
+
+Auth uses a `drawlatch_session` cookie that is `httpOnly` and `sameSite=strict`, with a **7-day rolling expiry** (every authenticated request extends it). Login, password-change, and auth-check endpoints are rate-limited per IP (5/min for login & change-password, 20/min for checks). If **no** password is configured, the daemon still starts and serves MCP normally — only the dashboard is locked: `/api/auth/*` and `/api/admin/*` return `503` and the SPA shows a locked state prompting `drawlatch set-password`. The daemon never exits just because the dashboard is unconfigured.
+
+> **Cookies run over plain HTTP** on loopback/LAN (no `secure` flag). Put the daemon behind a TLS-terminating reverse proxy if you expose it beyond a trusted network.
+
+> **Migrating from `drawlatch-ui`?** The standalone `drawlatch-ui` service and its `~/.drawlatch-ui/` config directory are abandoned — its dashboard, auth gate, and password now live inside drawlatch. There is no automatic migration: just run `drawlatch set-password` once to set the password in `~/.drawlatch/.env`.
+
 ## MCP Tools
 
 Once connected, agents get these tools:
@@ -274,7 +354,7 @@ Key paths are derived automatically — no configuration needed:
 
 ### Advanced Configuration
 
-#### `MCP_CONFIG_DIR`
+#### `MCP_CONFIG_DIR` — the config-dir contract
 
 By default, all config and key files live in `~/.drawlatch/`. Override with:
 
@@ -282,7 +362,28 @@ By default, all config and key files live in `~/.drawlatch/`. Override with:
 export MCP_CONFIG_DIR=/custom/path/to/config
 ```
 
-Useful for CI environments or running multiple independent setups on the same machine.
+Useful for CI environments or running multiple independent setups on the same machine. drawlatch **owns this layout as a stable contract** (and migrates legacy key layouts into it automatically on startup):
+
+```
+$MCP_CONFIG_DIR/                 (default: ~/.drawlatch)
+  remote.config.json    — RemoteServerConfig (callers, connectors, port, tunnel flag)
+  proxy.config.json     — ProxyConfig (local MCP proxy → remote URL)
+  .env                  — secret values, prefixed per caller (mode 0600)
+  enroll.token          — one-time loopback auto-enroll token (mode 0600)
+  keys/
+    server/             — the daemon's own Ed25519 + X25519 keypair
+    callers/<alias>/    — one keypair per caller alias
+```
+
+Legacy `keys/local`, `keys/remote`, and `keys/peers/*` directories are migrated to `keys/callers` / `keys/server` on first start — idempotent and safe to re-run.
+
+#### Self-managed tunnel
+
+Set `"tunnel": true` in `remote.config.json` (or `DRAWLATCH_TUNNEL=1` / `drawlatch start --tunnel`) and drawlatch brings up and supervises its own Cloudflare quick tunnel on startup: it learns the public URL, injects it into callback-dependent connection configs (e.g. `TRELLO_CALLBACK_URL`) **before** secret resolution and ingestor start, and surfaces it in `drawlatch status`, the Overview page, and `/api/admin/meta`. It is a config flag, not a runtime control surface.
+
+#### Daemon lifecycle
+
+`drawlatch start` runs the **whole** daemon in one process (MCP protocol + admin API + dashboard UI + optional tunnel). It is daemon-first and cleanly supervisable: a PID file, a deterministic `start` / `stop` / `restart` / `status`, an unauthenticated `/health` endpoint, and `drawlatch start --foreground` for running under a process manager. Local and remote deployments differ only by host binding (`DRAWLATCH_HOST`) and the dashboard password.
 
 ## Connections
 
@@ -382,10 +483,11 @@ Commands:
   start              Start the remote server (background daemon)
   stop               Stop the remote server
   restart            Restart the remote server
-  status             Show server status (PID, port, uptime, health, sessions)
+  status             Show server status (PID, port, uptime, health, sessions, dashboard URL)
   logs               View server logs
   config             Show effective configuration and secret status
   doctor             Validate setup and diagnose issues
+  set-password       Set/change the dashboard password (alias: change-password)
   generate-keys      Generate Ed25519 + X25519 keypairs
   sync               Exchange keys with a callboard instance
 
@@ -487,9 +589,11 @@ npm run dev:mcp           # MCP proxy with hot reload
 src/
 ├── cli/                     # Key generation CLI
 ├── connections/             # 23 pre-built route templates (JSON)
+├── auth/                    # Dashboard auth (scrypt password, session cookies)
 ├── mcp/server.ts            # Local MCP proxy (stdio transport)
 ├── remote/
-│   ├── server.ts            # Remote secure server (Express)
+│   ├── server.ts            # Remote secure server (Express) — also serves the dashboard
+│   ├── admin.ts             # Read-only /api/admin/* API
 │   └── ingestors/           # Event ingestion system
 │       ├── discord/         # Discord Gateway WebSocket
 │       ├── slack/           # Slack Socket Mode WebSocket
@@ -501,6 +605,9 @@ src/
     ├── env-utils.ts         # Environment variable utilities
     ├── crypto/              # Ed25519/X25519 keys, AES-256-GCM channel
     └── protocol/            # Handshake, message types
+
+frontend/                    # React + Vite dashboard SPA (built to frontend/dist)
+└── src/pages/               # Overview, Connections, Callers, Ingestors, Sessions, Secrets
 ```
 
 ## License

package/bin/drawlatch.js

@@ -186,6 +186,14 @@ switch (subcommand) {
       await cmdSync();
     }
     break;
+  case "set-password":
+  case "change-password":
+    if (values.help) {
+      printSetPasswordHelp(subcommand);
+    } else {
+      await cmdSetPassword();
+    }
+    break;
   case "watch":
     if (values.help) {
       printWatchHelp();
@@ -464,6 +472,10 @@ async function cmdStatus() {
   console.log("Drawlatch remote server is running.");
   console.log(`  PID:             ${pid}`);
   console.log(`  Listening:       ${host}:${port}`);
+  console.log(`  Dashboard:       http://${connectHost(host)}:${port}/`);
+  console.log(
+    `  Password:        ${isPasswordConfigured() ? "configured" : "not set (run: drawlatch set-password)"}`,
+  );
   console.log(`  Uptime:          ${uptime}`);
   console.log(
     `  Health:          ${healthData ? "healthy" : "unhealthy (not responding)"}`,
@@ -978,6 +990,131 @@ async function promptInput(prompt) {
   });
 }
 
+// ── set-password / change-password ────────────────────────────────
+//
+// Sets the dashboard/admin password. The scrypt hash + salt are written to
+// ~/.drawlatch/.env (AUTH_PASSWORD_HASH / AUTH_PASSWORD_SALT) using the same
+// env-writer the daemon's change-password handler uses, so both stay in sync.
+async function cmdSetPassword() {
+  ensureConfigDir();
+
+  const { hashPassword, generateSalt } = await import(
+    join(PKG_ROOT, "dist/auth/password.js")
+  );
+  const { updateEnvFile } = await import(
+    join(PKG_ROOT, "dist/auth/env-writer.js")
+  );
+
+  let password, confirm;
+  if (process.stdin.isTTY) {
+    password = await promptPasswordTTY("Enter new password: ");
+    if (!password) {
+      console.error("Error: password cannot be empty.");
+      process.exit(1);
+    }
+    if (password.length < 8) {
+      console.error("Error: password must be at least 8 characters.");
+      process.exit(1);
+    }
+    confirm = await promptPasswordTTY("Confirm new password: ");
+  } else {
+    // Piped input — read both lines from a single readline interface so
+    // closing it doesn't break the second prompt.
+    const { createInterface } = await import("node:readline");
+    const rl = createInterface({ input: process.stdin });
+    [password, confirm] = await readTwoLines(rl);
+    rl.close();
+    if (!password) {
+      console.error("Error: password cannot be empty.");
+      process.exit(1);
+    }
+    if (password.length < 8) {
+      console.error("Error: password must be at least 8 characters.");
+      process.exit(1);
+    }
+  }
+
+  if (password !== confirm) {
+    console.error("Error: passwords do not match.");
+    process.exit(1);
+  }
+
+  const salt = generateSalt();
+  const hash = await hashPassword(password, salt);
+
+  updateEnvFile(
+    { AUTH_PASSWORD_HASH: hash, AUTH_PASSWORD_SALT: salt },
+    ["AUTH_PASSWORD"], // strip any plaintext leftover, just in case
+  );
+
+  console.log("\nPassword set successfully.");
+  console.log(`  Stored in: ${ENV_FILE}`);
+
+  const pid = readPid();
+  if (pid) {
+    console.log("  Restart the server to apply: drawlatch restart");
+  }
+}
+
+function readTwoLines(rl) {
+  return new Promise((resolveP) => {
+    const lines = [];
+    const onLine = (line) => {
+      lines.push(line);
+      if (lines.length >= 2) {
+        rl.removeListener("line", onLine);
+        resolveP(lines);
+      }
+    };
+    rl.on("line", onLine);
+    rl.once("close", () => {
+      while (lines.length < 2) lines.push("");
+      resolveP(lines);
+    });
+  });
+}
+
+function promptPasswordTTY(prompt) {
+  return new Promise((resolveP) => {
+    process.stdout.write(prompt);
+    const stdin = process.stdin;
+    stdin.setRawMode(true);
+    stdin.resume();
+    stdin.setEncoding("utf8");
+    let password = "";
+    const onData = (ch) => {
+      ch = ch.toString();
+      if (ch === "\n" || ch === "\r" || ch === "\u0004") {
+        stdin.setRawMode(false);
+        stdin.pause();
+        stdin.removeListener("data", onData);
+        process.stdout.write("\n");
+        resolveP(password);
+      } else if (ch === "\u0003") {
+        // Ctrl+C
+        stdin.setRawMode(false);
+        process.stdout.write("\n");
+        process.exit(0);
+      } else if (ch === "\u007F" || ch === "\b") {
+        if (password.length > 0) password = password.slice(0, -1);
+      } else {
+        password += ch;
+      }
+    };
+    stdin.on("data", onData);
+  });
+}
+
+/** Read ~/.drawlatch/.env and report whether a dashboard password hash is set. */
+function isPasswordConfigured() {
+  try {
+    const envVars = loadEnvFileVars();
+    return !!envVars.AUTH_PASSWORD_HASH;
+  } catch {
+    return false;
+  }
+}
+
 // ── PID utilities ─────────────────────────────────────────────────
 
 function isProcessAlive(pid) {
@@ -1253,6 +1390,7 @@ Commands:
   doctor             Validate setup and diagnose issues
   generate-keys      Generate Ed25519 + X25519 keypairs
   sync               Exchange keys with a callboard instance
+  set-password       Set/change the dashboard password (alias: change-password)
 
 Options:
   -h, --help         Show this help message
@@ -1457,6 +1595,26 @@ The server must be running (drawlatch start) before using this command.
 `);
 }
 
+function printSetPasswordHelp(cmd = "set-password") {
+  console.log(`
+drawlatch ${cmd}
+
+Set or change the password that gates the admin dashboard and /api/admin/*.
+
+Usage: drawlatch ${cmd} [options]
+
+Options:
+  -h, --help   Show this help message
+
+Prompts for a new password (hidden in a TTY; reads two lines when piped),
+hashes it with scrypt, and stores AUTH_PASSWORD_HASH / AUTH_PASSWORD_SALT in
+${ENV_FILE}.
+
+The password must be at least 8 characters. 'change-password' is an alias.
+Restart the server afterwards (drawlatch restart) to apply the new password.
+`);
+}
+
 function printGenerateKeysHelp() {
   console.log(`
 drawlatch generate-keys

package/dist/auth/auth.d.ts

@@ -0,0 +1,10 @@
+import type { Request, Response, NextFunction } from 'express';
+export declare const SESSION_COOKIE_NAME: string;
+export declare const SESSION_TTL_MS: number;
+export declare function isPasswordConfigured(): boolean;
+export declare function loginHandler(req: Request, res: Response): Promise<void>;
+export declare function logoutHandler(req: Request, res: Response): void;
+export declare function checkAuthHandler(req: Request, res: Response): void;
+export declare function changePasswordHandler(req: Request, res: Response): Promise<void>;
+export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.js

@@ -0,0 +1,146 @@
+import { randomBytes } from 'node:crypto';
+import { getSession, createSession, deleteSession, extendSession, cleanupExpiredSessions, deleteAllSessionsExcept, } from './sessions.js';
+import { verifyPassword, hashPassword, generateSalt } from './password.js';
+import { updateEnvFile } from './env-writer.js';
+export const SESSION_COOKIE_NAME = process.env.SESSION_COOKIE_NAME ?? 'drawlatch_session';
+export const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+const NO_PASSWORD_MESSAGE = 'Server misconfigured: no password set. Run: drawlatch set-password';
+// ── Password helpers ────────────────────────────────────────────────
+export function isPasswordConfigured() {
+    return !!process.env.AUTH_PASSWORD_HASH;
+}
+async function verifyConfiguredPassword(password) {
+    const storedHash = process.env.AUTH_PASSWORD_HASH;
+    if (!storedHash)
+        return false;
+    const salt = process.env.AUTH_PASSWORD_SALT ?? '';
+    return verifyPassword(password, storedHash, salt);
+}
+// ── Session helpers ─────────────────────────────────────────────────
+function setSessionCookie(res, token) {
+    res.cookie(SESSION_COOKIE_NAME, token, {
+        httpOnly: true,
+        sameSite: 'strict',
+        // No `secure` flag — the daemon serves the dashboard over HTTP on
+        // loopback/LAN. Setting `secure: true` would prevent the cookie from
+        // being sent.
+        maxAge: SESSION_TTL_MS,
+        path: '/',
+    });
+}
+/** Roll the session: extend server-side expiry and refresh the cookie. */
+function rollSession(token, res) {
+    extendSession(token, Date.now() + SESSION_TTL_MS);
+    setSessionCookie(res, token);
+}
+// Best-effort startup cleanup. Skipped when no password is configured —
+// the dashboard is locked in that case anyway, but the import is still
+// performed by tests, where an empty data dir is fine.
+try {
+    cleanupExpiredSessions();
+}
+catch {
+    // sessions file may not exist yet on first run; cleanup is best-effort.
+}
+// ── Handlers ────────────────────────────────────────────────────────
+export async function loginHandler(req, res) {
+    if (!isPasswordConfigured()) {
+        res.status(503).json({ error: NO_PASSWORD_MESSAGE });
+        return;
+    }
+    const { password } = req.body ?? {};
+    if (typeof password !== 'string' || password.length === 0) {
+        res.status(400).json({ error: 'Password is required' });
+        return;
+    }
+    const valid = await verifyConfiguredPassword(password);
+    if (!valid) {
+        res.status(401).json({ error: 'Invalid password' });
+        return;
+    }
+    const token = randomBytes(32).toString('hex');
+    const forwarded = req.headers['x-forwarded-for'];
+    const firstForwarded = typeof forwarded === 'string' ? forwarded.split(',')[0]?.trim() : undefined;
+    const ip = firstForwarded ?? req.ip;
+    createSession(token, Date.now() + SESSION_TTL_MS, ip);
+    setSessionCookie(res, token);
+    res.json({ ok: true });
+}
+export function logoutHandler(req, res) {
+    const token = req.cookies[SESSION_COOKIE_NAME];
+    if (token)
+        deleteSession(token);
+    res.clearCookie(SESSION_COOKIE_NAME, { path: '/' });
+    res.json({ ok: true });
+}
+export function checkAuthHandler(req, res) {
+    if (!isPasswordConfigured()) {
+        res.status(503).json({
+            authenticated: false,
+            error: NO_PASSWORD_MESSAGE,
+        });
+        return;
+    }
+    const token = req.cookies[SESSION_COOKIE_NAME];
+    if (!token) {
+        res.status(401).json({ authenticated: false });
+        return;
+    }
+    const entry = getSession(token);
+    if (!entry || Date.now() > entry.expires_at) {
+        if (entry)
+            deleteSession(token);
+        res.status(401).json({ authenticated: false });
+        return;
+    }
+    rollSession(token, res);
+    res.json({ authenticated: true });
+}
+export async function changePasswordHandler(req, res) {
+    const { currentPassword, newPassword } = req.body ?? {};
+    if (typeof currentPassword !== 'string' || typeof newPassword !== 'string') {
+        res.status(400).json({ error: 'Both currentPassword and newPassword are required.' });
+        return;
+    }
+    if (newPassword.length < 8) {
+        res.status(400).json({ error: 'New password must be at least 8 characters.' });
+        return;
+    }
+    const valid = await verifyConfiguredPassword(currentPassword);
+    if (!valid) {
+        res.status(401).json({ error: 'Current password is incorrect.' });
+        return;
+    }
+    const salt = generateSalt();
+    const hash = await hashPassword(newPassword, salt);
+    updateEnvFile({ AUTH_PASSWORD_HASH: hash, AUTH_PASSWORD_SALT: salt });
+    process.env.AUTH_PASSWORD_HASH = hash;
+    process.env.AUTH_PASSWORD_SALT = salt;
+    // Invalidate every session except the caller's, so other browsers/devices
+    // are forced to re-authenticate with the new password.
+    const currentToken = req.cookies[SESSION_COOKIE_NAME];
+    deleteAllSessionsExcept(currentToken);
+    res.json({ ok: true });
+}
+// ── Middleware ───────────────────────────────────────────────────────
+export function requireAuth(req, res, next) {
+    if (!isPasswordConfigured()) {
+        res.status(503).json({ error: NO_PASSWORD_MESSAGE });
+        return;
+    }
+    const token = req.cookies[SESSION_COOKIE_NAME];
+    if (!token) {
+        res.status(401).json({ error: 'Not authenticated' });
+        return;
+    }
+    const entry = getSession(token);
+    if (!entry || Date.now() > entry.expires_at) {
+        if (entry)
+            deleteSession(token);
+        res.status(401).json({ error: 'Session expired' });
+        return;
+    }
+    rollSession(token, res);
+    next();
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth/env-writer.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Read the current .env file, update or add the specified key/value pairs,
+ * and write back with mode 0o600. Keys in `keysToRemove` are deleted entirely.
+ */
+export declare function updateEnvFile(updates: Record<string, string>, keysToRemove?: string[]): void;
+//# sourceMappingURL=env-writer.d.ts.map

package/dist/auth/env-writer.js

@@ -0,0 +1,52 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { getConfigDir, getEnvFilePath } from '../shared/config.js';
+/** Ensure the daemon's config dir and .env file exist before reading/writing. */
+function ensureEnvFile() {
+    mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });
+    const envFile = getEnvFilePath();
+    if (!existsSync(envFile)) {
+        writeFileSync(envFile, '', { mode: 0o600 });
+    }
+}
+/**
+ * Read the current .env file, update or add the specified key/value pairs,
+ * and write back with mode 0o600. Keys in `keysToRemove` are deleted entirely.
+ */
+export function updateEnvFile(updates, keysToRemove = []) {
+    ensureEnvFile();
+    const envFile = getEnvFilePath();
+    const content = readFileSync(envFile, 'utf-8');
+    const lines = content.split('\n');
+    const updatedKeys = new Set();
+    const result = [];
+    for (const line of lines) {
+        const trimmed = line.trim();
+        const shouldRemove = keysToRemove.some((key) => {
+            return trimmed.startsWith(`${key}=`) || trimmed === `${key}=`;
+        });
+        if (shouldRemove)
+            continue;
+        let replaced = false;
+        for (const [key, value] of Object.entries(updates)) {
+            if (trimmed.startsWith(`${key}=`) || trimmed === `${key}=`) {
+                result.push(`${key}=${value}`);
+                updatedKeys.add(key);
+                replaced = true;
+                break;
+            }
+        }
+        if (!replaced)
+            result.push(line);
+    }
+    for (const [key, value] of Object.entries(updates)) {
+        if (!updatedKeys.has(key)) {
+            let insertIdx = result.length;
+            while (insertIdx > 0 && result[insertIdx - 1].trim() === '') {
+                insertIdx--;
+            }
+            result.splice(insertIdx, 0, `${key}=${value}`);
+        }
+    }
+    writeFileSync(envFile, result.join('\n'), { mode: 0o600 });
+}
+//# sourceMappingURL=env-writer.js.map

package/dist/auth/password.d.ts

@@ -0,0 +1,8 @@
+export declare function generateSalt(): string;
+export declare function hashPassword(password: string, salt: string): Promise<string>;
+/**
+ * Verify a password against a stored hash and salt.
+ * Uses timing-safe comparison to prevent timing attacks.
+ */
+export declare function verifyPassword(password: string, storedHash: string, salt: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/password.js

@@ -0,0 +1,28 @@
+import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto';
+const KEY_LENGTH = 64;
+const SALT_LENGTH = 16;
+export function generateSalt() {
+    return randomBytes(SALT_LENGTH).toString('hex');
+}
+export function hashPassword(password, salt) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, KEY_LENGTH, (err, derivedKey) => {
+            if (err)
+                return reject(err);
+            resolve(derivedKey.toString('hex'));
+        });
+    });
+}
+/**
+ * Verify a password against a stored hash and salt.
+ * Uses timing-safe comparison to prevent timing attacks.
+ */
+export async function verifyPassword(password, storedHash, salt) {
+    const derivedKey = await hashPassword(password, salt);
+    const hashBuffer = Buffer.from(storedHash, 'hex');
+    const derivedBuffer = Buffer.from(derivedKey, 'hex');
+    if (hashBuffer.length !== derivedBuffer.length)
+        return false;
+    return timingSafeEqual(hashBuffer, derivedBuffer);
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/sessions.d.ts

@@ -0,0 +1,13 @@
+export interface SessionData {
+    expires_at: number;
+    created_at: number;
+    ip?: string;
+}
+export declare function getSession(token: string): SessionData | undefined;
+export declare function createSession(token: string, expiresAt: number, ip?: string): void;
+export declare function extendSession(token: string, newExpiresAt: number): void;
+export declare function deleteSession(token: string): void;
+/** Used after change-password to log out every other session. */
+export declare function deleteAllSessionsExcept(exceptToken?: string): void;
+export declare function cleanupExpiredSessions(): number;
+//# sourceMappingURL=sessions.d.ts.map