@wolpertingerlabs/drawlatch 1.0.0-alpha.2 → 1.0.0-alpha.29

package/dist/auth/auth.d.ts

@@ -0,0 +1,10 @@
+import type { Request, Response, NextFunction } from 'express';
+export declare const SESSION_COOKIE_NAME: string;
+export declare const SESSION_TTL_MS: number;
+export declare function isPasswordConfigured(): boolean;
+export declare function loginHandler(req: Request, res: Response): Promise<void>;
+export declare function logoutHandler(req: Request, res: Response): void;
+export declare function checkAuthHandler(req: Request, res: Response): void;
+export declare function changePasswordHandler(req: Request, res: Response): Promise<void>;
+export declare function requireAuth(req: Request, res: Response, next: NextFunction): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth/auth.js

@@ -0,0 +1,146 @@
+import { randomBytes } from 'node:crypto';
+import { getSession, createSession, deleteSession, extendSession, cleanupExpiredSessions, deleteAllSessionsExcept, } from './sessions.js';
+import { verifyPassword, hashPassword, generateSalt } from './password.js';
+import { updateEnvFile } from './env-writer.js';
+export const SESSION_COOKIE_NAME = process.env.SESSION_COOKIE_NAME ?? 'drawlatch_session';
+export const SESSION_TTL_MS = 7 * 24 * 60 * 60 * 1000; // 7 days
+const NO_PASSWORD_MESSAGE = 'Server misconfigured: no password set. Run: drawlatch set-password';
+// ── Password helpers ────────────────────────────────────────────────
+export function isPasswordConfigured() {
+    return !!process.env.AUTH_PASSWORD_HASH;
+}
+async function verifyConfiguredPassword(password) {
+    const storedHash = process.env.AUTH_PASSWORD_HASH;
+    if (!storedHash)
+        return false;
+    const salt = process.env.AUTH_PASSWORD_SALT ?? '';
+    return verifyPassword(password, storedHash, salt);
+}
+// ── Session helpers ─────────────────────────────────────────────────
+function setSessionCookie(res, token) {
+    res.cookie(SESSION_COOKIE_NAME, token, {
+        httpOnly: true,
+        sameSite: 'strict',
+        // No `secure` flag — the daemon serves the dashboard over HTTP on
+        // loopback/LAN. Setting `secure: true` would prevent the cookie from
+        // being sent.
+        maxAge: SESSION_TTL_MS,
+        path: '/',
+    });
+}
+/** Roll the session: extend server-side expiry and refresh the cookie. */
+function rollSession(token, res) {
+    extendSession(token, Date.now() + SESSION_TTL_MS);
+    setSessionCookie(res, token);
+}
+// Best-effort startup cleanup. Skipped when no password is configured —
+// the dashboard is locked in that case anyway, but the import is still
+// performed by tests, where an empty data dir is fine.
+try {
+    cleanupExpiredSessions();
+}
+catch {
+    // sessions file may not exist yet on first run; cleanup is best-effort.
+}
+// ── Handlers ────────────────────────────────────────────────────────
+export async function loginHandler(req, res) {
+    if (!isPasswordConfigured()) {
+        res.status(503).json({ error: NO_PASSWORD_MESSAGE });
+        return;
+    }
+    const { password } = req.body ?? {};
+    if (typeof password !== 'string' || password.length === 0) {
+        res.status(400).json({ error: 'Password is required' });
+        return;
+    }
+    const valid = await verifyConfiguredPassword(password);
+    if (!valid) {
+        res.status(401).json({ error: 'Invalid password' });
+        return;
+    }
+    const token = randomBytes(32).toString('hex');
+    const forwarded = req.headers['x-forwarded-for'];
+    const firstForwarded = typeof forwarded === 'string' ? forwarded.split(',')[0]?.trim() : undefined;
+    const ip = firstForwarded ?? req.ip;
+    createSession(token, Date.now() + SESSION_TTL_MS, ip);
+    setSessionCookie(res, token);
+    res.json({ ok: true });
+}
+export function logoutHandler(req, res) {
+    const token = req.cookies[SESSION_COOKIE_NAME];
+    if (token)
+        deleteSession(token);
+    res.clearCookie(SESSION_COOKIE_NAME, { path: '/' });
+    res.json({ ok: true });
+}
+export function checkAuthHandler(req, res) {
+    if (!isPasswordConfigured()) {
+        res.status(503).json({
+            authenticated: false,
+            error: NO_PASSWORD_MESSAGE,
+        });
+        return;
+    }
+    const token = req.cookies[SESSION_COOKIE_NAME];
+    if (!token) {
+        res.status(401).json({ authenticated: false });
+        return;
+    }
+    const entry = getSession(token);
+    if (!entry || Date.now() > entry.expires_at) {
+        if (entry)
+            deleteSession(token);
+        res.status(401).json({ authenticated: false });
+        return;
+    }
+    rollSession(token, res);
+    res.json({ authenticated: true });
+}
+export async function changePasswordHandler(req, res) {
+    const { currentPassword, newPassword } = req.body ?? {};
+    if (typeof currentPassword !== 'string' || typeof newPassword !== 'string') {
+        res.status(400).json({ error: 'Both currentPassword and newPassword are required.' });
+        return;
+    }
+    if (newPassword.length < 8) {
+        res.status(400).json({ error: 'New password must be at least 8 characters.' });
+        return;
+    }
+    const valid = await verifyConfiguredPassword(currentPassword);
+    if (!valid) {
+        res.status(401).json({ error: 'Current password is incorrect.' });
+        return;
+    }
+    const salt = generateSalt();
+    const hash = await hashPassword(newPassword, salt);
+    updateEnvFile({ AUTH_PASSWORD_HASH: hash, AUTH_PASSWORD_SALT: salt });
+    process.env.AUTH_PASSWORD_HASH = hash;
+    process.env.AUTH_PASSWORD_SALT = salt;
+    // Invalidate every session except the caller's, so other browsers/devices
+    // are forced to re-authenticate with the new password.
+    const currentToken = req.cookies[SESSION_COOKIE_NAME];
+    deleteAllSessionsExcept(currentToken);
+    res.json({ ok: true });
+}
+// ── Middleware ───────────────────────────────────────────────────────
+export function requireAuth(req, res, next) {
+    if (!isPasswordConfigured()) {
+        res.status(503).json({ error: NO_PASSWORD_MESSAGE });
+        return;
+    }
+    const token = req.cookies[SESSION_COOKIE_NAME];
+    if (!token) {
+        res.status(401).json({ error: 'Not authenticated' });
+        return;
+    }
+    const entry = getSession(token);
+    if (!entry || Date.now() > entry.expires_at) {
+        if (entry)
+            deleteSession(token);
+        res.status(401).json({ error: 'Session expired' });
+        return;
+    }
+    rollSession(token, res);
+    next();
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth/env-writer.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Read the current .env file, update or add the specified key/value pairs,
+ * and write back with mode 0o600. Keys in `keysToRemove` are deleted entirely.
+ */
+export declare function updateEnvFile(updates: Record<string, string>, keysToRemove?: string[]): void;
+//# sourceMappingURL=env-writer.d.ts.map

package/dist/auth/env-writer.js

@@ -0,0 +1,52 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from 'node:fs';
+import { getConfigDir, getEnvFilePath } from '../shared/config.js';
+/** Ensure the daemon's config dir and .env file exist before reading/writing. */
+function ensureEnvFile() {
+    mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });
+    const envFile = getEnvFilePath();
+    if (!existsSync(envFile)) {
+        writeFileSync(envFile, '', { mode: 0o600 });
+    }
+}
+/**
+ * Read the current .env file, update or add the specified key/value pairs,
+ * and write back with mode 0o600. Keys in `keysToRemove` are deleted entirely.
+ */
+export function updateEnvFile(updates, keysToRemove = []) {
+    ensureEnvFile();
+    const envFile = getEnvFilePath();
+    const content = readFileSync(envFile, 'utf-8');
+    const lines = content.split('\n');
+    const updatedKeys = new Set();
+    const result = [];
+    for (const line of lines) {
+        const trimmed = line.trim();
+        const shouldRemove = keysToRemove.some((key) => {
+            return trimmed.startsWith(`${key}=`) || trimmed === `${key}=`;
+        });
+        if (shouldRemove)
+            continue;
+        let replaced = false;
+        for (const [key, value] of Object.entries(updates)) {
+            if (trimmed.startsWith(`${key}=`) || trimmed === `${key}=`) {
+                result.push(`${key}=${value}`);
+                updatedKeys.add(key);
+                replaced = true;
+                break;
+            }
+        }
+        if (!replaced)
+            result.push(line);
+    }
+    for (const [key, value] of Object.entries(updates)) {
+        if (!updatedKeys.has(key)) {
+            let insertIdx = result.length;
+            while (insertIdx > 0 && result[insertIdx - 1].trim() === '') {
+                insertIdx--;
+            }
+            result.splice(insertIdx, 0, `${key}=${value}`);
+        }
+    }
+    writeFileSync(envFile, result.join('\n'), { mode: 0o600 });
+}
+//# sourceMappingURL=env-writer.js.map

package/dist/auth/password.d.ts

@@ -0,0 +1,8 @@
+export declare function generateSalt(): string;
+export declare function hashPassword(password: string, salt: string): Promise<string>;
+/**
+ * Verify a password against a stored hash and salt.
+ * Uses timing-safe comparison to prevent timing attacks.
+ */
+export declare function verifyPassword(password: string, storedHash: string, salt: string): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/auth/password.js

@@ -0,0 +1,28 @@
+import { scrypt, randomBytes, timingSafeEqual } from 'node:crypto';
+const KEY_LENGTH = 64;
+const SALT_LENGTH = 16;
+export function generateSalt() {
+    return randomBytes(SALT_LENGTH).toString('hex');
+}
+export function hashPassword(password, salt) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, KEY_LENGTH, (err, derivedKey) => {
+            if (err)
+                return reject(err);
+            resolve(derivedKey.toString('hex'));
+        });
+    });
+}
+/**
+ * Verify a password against a stored hash and salt.
+ * Uses timing-safe comparison to prevent timing attacks.
+ */
+export async function verifyPassword(password, storedHash, salt) {
+    const derivedKey = await hashPassword(password, salt);
+    const hashBuffer = Buffer.from(storedHash, 'hex');
+    const derivedBuffer = Buffer.from(derivedKey, 'hex');
+    if (hashBuffer.length !== derivedBuffer.length)
+        return false;
+    return timingSafeEqual(hashBuffer, derivedBuffer);
+}
+//# sourceMappingURL=password.js.map

package/dist/auth/sessions.d.ts

@@ -0,0 +1,13 @@
+export interface SessionData {
+    expires_at: number;
+    created_at: number;
+    ip?: string;
+}
+export declare function getSession(token: string): SessionData | undefined;
+export declare function createSession(token: string, expiresAt: number, ip?: string): void;
+export declare function extendSession(token: string, newExpiresAt: number): void;
+export declare function deleteSession(token: string): void;
+/** Used after change-password to log out every other session. */
+export declare function deleteAllSessionsExcept(exceptToken?: string): void;
+export declare function cleanupExpiredSessions(): number;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/auth/sessions.js

@@ -0,0 +1,85 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync, chmodSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { getConfigDir } from '../shared/config.js';
+/** File-backed session store at ~/.drawlatch/data/sessions.json (mode 0o600). */
+function getSessionsFile() {
+    return join(getConfigDir(), 'data', 'sessions.json');
+}
+function loadSessions() {
+    const file = getSessionsFile();
+    if (!existsSync(file)) {
+        const initial = {
+            sessions: {},
+            metadata: { last_cleanup: Date.now(), version: 1 },
+        };
+        saveSessions(initial);
+        return initial;
+    }
+    return JSON.parse(readFileSync(file, 'utf-8'));
+}
+function saveSessions(data) {
+    const file = getSessionsFile();
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, JSON.stringify(data, null, 2), { mode: 0o600 });
+    // writeFileSync only applies mode on file creation; chmod on every write
+    // ensures stricter perms even if the file was created externally.
+    try {
+        chmodSync(file, 0o600);
+    }
+    catch {
+        // best effort
+    }
+}
+export function getSession(token) {
+    return loadSessions().sessions[token];
+}
+export function createSession(token, expiresAt, ip) {
+    const data = loadSessions();
+    data.sessions[token] = {
+        expires_at: expiresAt,
+        created_at: Date.now(),
+        ip,
+    };
+    saveSessions(data);
+}
+export function extendSession(token, newExpiresAt) {
+    const data = loadSessions();
+    if (!(token in data.sessions))
+        return;
+    data.sessions[token].expires_at = newExpiresAt;
+    saveSessions(data);
+}
+export function deleteSession(token) {
+    const data = loadSessions();
+    // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- token-keyed session store
+    delete data.sessions[token];
+    saveSessions(data);
+}
+/** Used after change-password to log out every other session. */
+export function deleteAllSessionsExcept(exceptToken) {
+    const data = loadSessions();
+    for (const token of Object.keys(data.sessions)) {
+        // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- token-keyed session store
+        if (token !== exceptToken)
+            delete data.sessions[token];
+    }
+    saveSessions(data);
+}
+export function cleanupExpiredSessions() {
+    const data = loadSessions();
+    const now = Date.now();
+    let removed = 0;
+    for (const [token, session] of Object.entries(data.sessions)) {
+        if (now > session.expires_at) {
+            // eslint-disable-next-line @typescript-eslint/no-dynamic-delete -- token-keyed session store
+            delete data.sessions[token];
+            removed++;
+        }
+    }
+    if (removed > 0) {
+        data.metadata.last_cleanup = now;
+        saveSessions(data);
+    }
+    return removed;
+}
+//# sourceMappingURL=sessions.js.map

package/dist/cli/generate-keys.d.ts

@@ -3,13 +3,13 @@
  * Key generation CLI.
  *
  * Generates Ed25519 (signing) + X25519 (key exchange) keypairs for either
- * the local MCP proxy or the remote server, and saves them with correct
+ * a caller identity or the server, and saves them with correct
  * file permissions (0600 for private keys, 0644 for public keys).
  *
  * Usage:
- *   npx tsx src/cli/generate-keys.ts local    # Generate MCP proxy keys
- *   npx tsx src/cli/generate-keys.ts remote   # Generate remote server keys
- *   npx tsx src/cli/generate-keys.ts --dir /path/to/keys  # Custom directory
+ *   npx tsx src/cli/generate-keys.ts caller [alias]  # Generate caller keys
+ *   npx tsx src/cli/generate-keys.ts server           # Generate server keys
+ *   npx tsx src/cli/generate-keys.ts --dir /path       # Custom directory
  */
 export {};
 //# sourceMappingURL=generate-keys.d.ts.map

package/dist/cli/generate-keys.js

@@ -3,16 +3,16 @@
  * Key generation CLI.
  *
  * Generates Ed25519 (signing) + X25519 (key exchange) keypairs for either
- * the local MCP proxy or the remote server, and saves them with correct
+ * a caller identity or the server, and saves them with correct
  * file permissions (0600 for private keys, 0644 for public keys).
  *
  * Usage:
- *   npx tsx src/cli/generate-keys.ts local    # Generate MCP proxy keys
- *   npx tsx src/cli/generate-keys.ts remote   # Generate remote server keys
- *   npx tsx src/cli/generate-keys.ts --dir /path/to/keys  # Custom directory
+ *   npx tsx src/cli/generate-keys.ts caller [alias]  # Generate caller keys
+ *   npx tsx src/cli/generate-keys.ts server           # Generate server keys
+ *   npx tsx src/cli/generate-keys.ts --dir /path       # Custom directory
  */
 import { generateKeyBundle, saveKeyBundle, loadKeyBundle, fingerprint, extractPublicKeys, } from '../shared/crypto/index.js';
-import { getLocalKeysDir, getRemoteKeysDir, getConfigDir } from '../shared/config.js';
+import { getCallerKeysDir, getServerKeysDir, getConfigDir } from '../shared/config.js';
 import fs from 'node:fs';
 import path from 'node:path';
 function usage() {
@@ -20,12 +20,13 @@ function usage() {
 Drawlatch key generation
 
 Usage:
-  generate-keys local [alias]   Generate MCP proxy (local) keypair
-                                Alias defaults to "default" if omitted.
-                                Keys are stored in keys/local/<alias>/
-  generate-keys remote          Generate remote server keypair
-  generate-keys --dir <path>    Generate keypair in a custom directory
-  generate-keys show <path>     Show fingerprint of an existing keypair
+  generate-keys caller [alias]   Generate caller keypair
+                                  Alias defaults to "default" if omitted.
+                                  Keys are stored in keys/callers/<alias>/
+  generate-keys server            Generate server keypair
+                                  Keys are stored in keys/server/
+  generate-keys --dir <path>      Generate keypair in a custom directory
+  generate-keys show <path>       Show fingerprint of an existing keypair
 
 Keys are saved as PEM files:
   <dir>/signing.pub.pem       Ed25519 public key (safe to share)
@@ -71,27 +72,31 @@ if (args.length === 0 || args.includes('--help') || args.includes('-h')) {
 }
 // Ensure base config directory exists
 fs.mkdirSync(getConfigDir(), { recursive: true, mode: 0o700 });
-if (args[0] === 'local') {
+if (args[0] === 'caller' || args[0] === 'local') {
+    if (args[0] === 'local') {
+        console.error('Note: "local" is deprecated, use "caller" instead.');
+    }
     const alias = args[1] && !args[1].startsWith('-') ? args[1] : 'default';
-    const localKeysDir = getLocalKeysDir();
-    const targetDir = path.join(localKeysDir, alias);
-    // Check for legacy flat key layout (PEM files directly in keys/local/)
-    const legacyKeyPath = path.join(localKeysDir, 'signing.key.pem');
+    const callersDir = getCallerKeysDir();
+    const targetDir = path.join(callersDir, alias);
+    // Check for legacy flat key layout (PEM files directly in keys/callers/)
+    const legacyKeyPath = path.join(callersDir, 'signing.key.pem');
     if (fs.existsSync(legacyKeyPath)) {
-        console.error(`\n⚠️  Legacy key layout detected: PEM files found directly in ${localKeysDir}\n` +
-            `   Local keys are now stored per-alias: keys/local/<alias>/\n` +
+        console.error(`\n⚠️  Legacy key layout detected: PEM files found directly in ${callersDir}\n` +
+            `   Caller keys are now stored per-alias: keys/callers/<alias>/\n` +
             `   To migrate, move your existing keys:\n\n` +
             `     mkdir -p ${targetDir}\n` +
-            `     mv ${localKeysDir}/signing.* ${targetDir}/\n` +
-            `     mv ${localKeysDir}/exchange.* ${targetDir}/\n\n` +
-            `   Then update localKeysDir in your proxy.config.json to point to:\n` +
-            `     ${targetDir}\n`);
+            `     mv ${callersDir}/signing.* ${targetDir}/\n` +
+            `     mv ${callersDir}/exchange.* ${targetDir}/\n`);
         process.exit(1);
     }
-    generateAndSave(targetDir, `MCP proxy (local) — alias "${alias}"`);
+    generateAndSave(targetDir, `caller — alias "${alias}"`);
 }
-else if (args[0] === 'remote') {
-    generateAndSave(getRemoteKeysDir(), 'remote server');
+else if (args[0] === 'server' || args[0] === 'remote') {
+    if (args[0] === 'remote') {
+        console.error('Note: "remote" is deprecated, use "server" instead.');
+    }
+    generateAndSave(getServerKeysDir(), 'server');
 }
 else if (args[0] === '--dir' && args[1]) {
     generateAndSave(args[1], 'custom');

package/dist/connections/{anthropic.json → ai/anthropic.json}

@@ -1,5 +1,7 @@
 {
   "name": "Anthropic API",
+  "stability": "beta",
+  "category": "ai",
   "description": "Anthropic Claude API — messages, models, and more. Auth is handled automatically via the ANTHROPIC_API_KEY environment variable. Uses x-api-key header (not Bearer token). The anthropic-version header is set to 2023-06-01.",
   "docsUrl": "https://docs.anthropic.com/en/api",
   "headers": {
@@ -12,5 +14,21 @@
   },
   "allowedEndpoints": [
     "https://api.anthropic.com/**"
-  ]
+  ],
+  "testConnection": {
+    "method": "POST",
+    "url": "https://api.anthropic.com/v1/messages",
+    "body": {
+      "model": "claude-3-haiku-20240307",
+      "max_tokens": 1,
+      "messages": [
+        {
+          "role": "user",
+          "content": "hi"
+        }
+      ]
+    },
+    "description": "Sends a minimal message to verify API key",
+    "expectedStatus": [200]
+  }
 }

package/dist/connections/{devin.json → ai/devin.json}

@@ -1,5 +1,7 @@
 {
   "name": "Devin API",
+  "stability": "dev",
+  "category": "ai",
   "description": "Devin AI API — sessions, knowledge, and machine management. Auth is handled automatically via the DEVIN_API_KEY environment variable.",
   "docsUrl": "https://docs.devin.ai/api-reference/overview",
   "headers": {
@@ -11,5 +13,9 @@
   },
   "allowedEndpoints": [
     "https://api.devin.ai/**"
-  ]
+  ],
+  "testConnection": {
+    "url": "https://api.devin.ai/v1/sessions",
+    "description": "Lists Devin sessions to verify API key"
+  }
 }

package/dist/connections/{google-ai.json → ai/google-ai.json}

@@ -1,5 +1,7 @@
 {
   "name": "Google AI (Gemini) API",
+  "stability": "stable",
+  "category": "ai",
   "description": "Google AI Gemini API — chat completions, embeddings, image generation, token counting, and more. Auth is handled automatically via the GOOGLE_AI_API_KEY environment variable. Uses x-goog-api-key header (not Bearer token). This is separate from the 'google' connection which covers Google Workspace APIs (Sheets, Drive, etc.).",
   "docsUrl": "https://ai.google.dev/api",
   "headers": {
@@ -11,5 +13,9 @@
   },
   "allowedEndpoints": [
     "https://generativelanguage.googleapis.com/**"
-  ]
+  ],
+  "testConnection": {
+    "url": "https://generativelanguage.googleapis.com/v1beta/models",
+    "description": "Lists available Gemini models"
+  }
 }

package/dist/connections/{openai.json → ai/openai.json}

@@ -1,5 +1,7 @@
 {
   "name": "OpenAI API",
+  "stability": "beta",
+  "category": "ai",
   "description": "OpenAI API — chat completions, embeddings, images, audio, files, fine-tuning, and more. Auth is handled automatically via the OPENAI_API_KEY environment variable.",
   "docsUrl": "https://platform.openai.com/docs/api-reference",
   "openApiUrl": "https://raw.githubusercontent.com/openai/openai-openapi/master/openapi.yaml",
@@ -12,5 +14,9 @@
   },
   "allowedEndpoints": [
     "https://api.openai.com/**"
-  ]
+  ],
+  "testConnection": {
+    "url": "https://api.openai.com/v1/models",
+    "description": "Lists available models"
+  }
 }

package/dist/connections/{openrouter.json → ai/openrouter.json}

@@ -1,5 +1,7 @@
 {
   "name": "OpenRouter API",
+  "stability": "stable",
+  "category": "ai",
   "description": "OpenRouter unified LLM API — chat completions, models, generation stats, and more. Auth is handled automatically via the OPENROUTER_API_KEY environment variable.",
   "docsUrl": "https://openrouter.ai/docs/api-reference",
   "openApiUrl": "https://openrouter.ai/openapi.json",
@@ -12,5 +14,9 @@
   },
   "allowedEndpoints": [
     "https://openrouter.ai/api/**"
-  ]
+  ],
+  "testConnection": {
+    "url": "https://openrouter.ai/api/v1/models",
+    "description": "Lists available models"
+  }
 }