@wrongstack/core 0.264.0 → 0.265.1

package/dist/{secret-vault-CxiVLbt1.d.ts → secret-vault-B2yw84VT.d.ts}

@@ -1,6 +1,6 @@
-import { S as SecretScrubber } from './permission-4yvGmMRB.js';
+import { S as SecretScrubber } from './permission-B9SB45lp.js';
 import { L as Logger } from './logger-B63L5bTg.js';
-import { S as SecretVault } from './secret-vault-BJDY28ev.js';
+import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
 
 declare class DefaultSecretScrubber implements SecretScrubber {
     scrub(text: string): string;
@@ -24,14 +24,33 @@ interface SecretVaultOptions {
  * The key is loaded lazily on first encrypt/decrypt; if it does not exist,
  * a fresh one is generated. Decryption of plaintext values is a no-op so
  * legacy configs continue to work.
+ *
+ * Key file format:
+ *   - Legacy (v1): exactly 32 raw bytes
+ *   - Versioned (v2+): 4-byte magic `WSKV` + 1-byte version + 32-byte key (37 bytes)
+ *
+ * Encrypted value format: `enc:v<N>:<iv>:<tag>:<ciphertext>` where N is the
+ * key version. After rotation, encrypt() emits the new version prefix.
  */
-declare class DefaultSecretVault implements SecretVault {
+declare class DefaultSecretVault implements RotatableSecretVault {
     private readonly keyFile;
     private key?;
+    private _keyVersion;
     constructor(opts: SecretVaultOptions);
+    /** Current key version. Starts at 1; incremented by rotateKey(). */
+    get keyVersion(): number;
     isEncrypted(value: string): boolean;
     encrypt(plaintext: string): string;
     decrypt(value: string): string;
+    /**
+     * Generate a new encryption key, write it to disk, and increment the key version.
+     * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
+     * The caller must re-encrypt existing config values (see rotateConfigKeys()).
+     */
+    rotateKey(): {
+        oldVersion: number;
+        newVersion: number;
+    };
     private loadOrCreateKey;
 }
 /**
@@ -67,5 +86,25 @@ declare function migratePlaintextSecrets(configPath: string, vault: SecretVault,
     migrated: number;
     file: string;
 }>;
+/**
+ * Rotate the vault's encryption key and re-encrypt all secret-bearing
+ * fields in a config file. This is the atomic key rotation operation:
+ *
+ * 1. Read the config file
+ * 2. Decrypt all encrypted values with the old key
+ * 3. Generate a new key (vault.rotateKey())
+ * 4. Re-encrypt all values with the new key (new version prefix)
+ * 5. Write the config file atomically
+ *
+ * Returns the number of fields re-encrypted and the version transition.
+ * If the config file doesn't exist or has no encrypted fields, returns
+ * { rotated: 0 } without modifying the key.
+ */
+declare function rotateConfigKeys(configPath: string, vault: RotatableSecretVault, logger?: Pick<Logger, 'warn' | 'info'>): Promise<{
+    rotated: number;
+    oldVersion: number;
+    newVersion: number;
+    file: string;
+}>;
 
-export { DefaultSecretScrubber as D, type SecretVaultOptions as S, DefaultSecretVault as a, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };
+export { DefaultSecretScrubber as D, type SecretVaultOptions as S, DefaultSecretVault as a, rotateConfigKeys as b, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };

package/dist/secret-vault-BAKpgFw_.d.ts

@@ -0,0 +1,57 @@
+/**
+ * SecretVault encrypts secrets-at-rest in config files. The wire format is
+ * `enc:v<N>:<base64-iv>:<base64-tag>:<base64-ciphertext>` where `<N>` is the
+ * key version used for encryption. Plaintext strings (those that do not match
+ * this prefix) are passed through unchanged so that existing configs and
+ * env-var-derived values keep working.
+ *
+ * Key rotation produces a new key and re-encrypts all secrets under it.
+ * After rotation, `encrypt()` emits the new version prefix (e.g. `enc:v2:`)
+ * and `decrypt()` accepts any version prefix — it uses the current key
+ * regardless, since rotation re-encrypts every value atomically.
+ *
+ * The vault is intentionally NOT designed to defeat a determined local
+ * attacker who can read both the config file and the key file — that level
+ * of secrecy needs the OS keychain. The goal is to keep keys from being
+ * visible in screen shares, accidental log captures, and `cat config.json`
+ * over someone's shoulder.
+ */
+interface SecretVault {
+    encrypt(plaintext: string): string;
+    decrypt(value: string): string;
+    isEncrypted(value: string): boolean;
+    /** Current key version. Starts at 1; incremented by `rotateKey()`. */
+    readonly keyVersion: number;
+}
+/**
+ * RotatableSecretVault extends SecretVault with key rotation support.
+ * `rotateKey()` generates a fresh key, writes it to disk, and increments
+ * the key version. All subsequent `encrypt()` calls use the new version
+ * prefix. The caller is responsible for re-encrypting existing config
+ * values (see `rotateConfigKeys()`).
+ */
+interface RotatableSecretVault extends SecretVault {
+    rotateKey(): {
+        oldVersion: number;
+        newVersion: number;
+    };
+}
+/**
+ * Return the encrypted prefix for a given key version.
+ * @example encryptedPrefixForVersion(1) // 'enc:v1:'
+ * @example encryptedPrefixForVersion(2) // 'enc:v2:'
+ */
+declare function encryptedPrefixForVersion(version: number): string;
+/**
+ * Parse the key version from an encrypted value string.
+ * Returns undefined if the string is not an encrypted value.
+ */
+declare function parseEncryptedVersion(value: string): number | undefined;
+/**
+ * No-op SecretVault that passes values through unchanged.
+ * Used in contexts where encryption is not needed — e.g. reading/writing
+ * config sections that contain no secret fields (models, settings, etc.).
+ */
+declare const noOpVault: SecretVault;
+
+export { type RotatableSecretVault as R, type SecretVault as S, encryptedPrefixForVersion as e, noOpVault as n, parseEncryptedVersion as p };

package/dist/security/index.d.ts

@@ -1,9 +1,9 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-CxiVLbt1.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-C6XpsBOy.js';
-import '../permission-4yvGmMRB.js';
-import '../context-BGSpZNSE.js';
+export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-B2yw84VT.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-CkjSXabK.js';
+import '../permission-B9SB45lp.js';
+import '../context-MRk5PhNv.js';
 import '../logger-B63L5bTg.js';
-import '../secret-vault-BJDY28ev.js';
+import '../secret-vault-BAKpgFw_.js';
 import '../input-reader-E-ffP2ee.js';
 
 /**

package/dist/security/index.js

@@ -44,6 +44,27 @@ var PATTERNS = [
   { type: "postgres_uri", regex: /postgres(?:ql)?:\/\/[^\s"'`]+/g },
   { type: "mysql_uri", regex: /mysql:\/\/[^\s"'`]+/g },
   { type: "redis_uri", regex: /redis:\/\/[^\s"'`]+/g },
+  // AI/ML provider keys — modern LLM services with well-known prefixes
+  {
+    type: "huggingface_token",
+    // HuggingFace tokens: hf_ followed by 34 alphanumeric chars
+    regex: /(?<![A-Za-z0-9])hf_[A-Za-z0-9]{34}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "replicate_token",
+    // Replicate tokens: r8_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])r8_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "perplexity_key",
+    // Perplexity API keys: pplx- followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])pplx-[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
+  {
+    type: "groq_key",
+    // Groq API keys: gsk_ followed by 40+ alphanumeric chars
+    regex: /(?<![A-Za-z0-9])gsk_[A-Za-z0-9]{40,}(?![A-Za-z0-9])/g
+  },
   {
     type: "bearer_token",
     // Anchored with alternation instead of negative lookahead — avoids V8
@@ -77,6 +98,10 @@ function hasCredentialAnchors(text) {
   text.includes("xox") || // Slack token (xoxa/xoxb/xoxp/xoxo/xoxs)
   text.includes("Bearer ") || // Bearer token (space suffix reduces false positives)
   text.includes("/bot") || // Telegram bot token (URL path pattern)
+  text.includes("hf_") || // HuggingFace token
+  text.includes("r8_") || // Replicate token
+  text.includes("pplx-") || // Perplexity API key
+  text.includes("gsk_") || // Groq API key
   text.includes("_KEY=") || // High-entropy env vars: API_KEY=, SECRET_KEY=, ...
   text.includes("_TOKEN=") || // ACCESS_TOKEN=, AUTH_TOKEN=, ...
   text.includes("_SECRET=") || // API_SECRET=, CLIENT_SECRET=, ...
@@ -470,7 +495,10 @@ var ConfigError = class extends WrongStackError {
 };
 
 // src/types/secret-vault.ts
-var ENCRYPTED_PREFIX = "enc:v1:";
+var ENCRYPTED_PREFIX_PATTERN = /^enc:v(\d+):/;
+function encryptedPrefixForVersion(version) {
+  return `enc:v${version}:`;
+}
 
 // src/security/secret-vault.ts
 var KEY_BYTES = 32;
@@ -478,6 +506,8 @@ var IV_BYTES = 12;
 var TAG_BYTES = 16;
 var ALGO = "aes-256-gcm";
 var KEY_FILE_MODE = 384;
+var KEY_FILE_MAGIC = Buffer.from("WSKV", "ascii");
+var VERSIONED_KEY_FILE_SIZE = KEY_FILE_MAGIC.length + 1 + KEY_BYTES;
 function checkKeyFilePermissions(keyFile) {
   if (process.platform === "win32") return;
   try {
@@ -500,11 +530,17 @@ function checkKeyFilePermissions(keyFile) {
 var DefaultSecretVault = class {
   keyFile;
   key;
+  _keyVersion = 1;
   constructor(opts) {
     this.keyFile = opts.keyFile;
   }
+  /** Current key version. Starts at 1; incremented by rotateKey(). */
+  get keyVersion() {
+    if (!this.key) this.loadOrCreateKey();
+    return this._keyVersion;
+  }
   isEncrypted(value) {
-    return typeof value === "string" && value.startsWith(ENCRYPTED_PREFIX);
+    return typeof value === "string" && ENCRYPTED_PREFIX_PATTERN.test(value);
   }
   encrypt(plaintext) {
     if (this.isEncrypted(plaintext)) return plaintext;
@@ -513,11 +549,20 @@ var DefaultSecretVault = class {
     const cipher = createCipheriv(ALGO, key, iv);
     const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
     const tag = cipher.getAuthTag();
-    return `${ENCRYPTED_PREFIX}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
+    const prefix = encryptedPrefixForVersion(this._keyVersion);
+    return `${prefix}${iv.toString("base64")}:${tag.toString("base64")}:${ct.toString("base64")}`;
   }
   decrypt(value) {
     if (!this.isEncrypted(value)) return value;
-    const rest = value.slice(ENCRYPTED_PREFIX.length);
+    const prefixMatch = value.match(ENCRYPTED_PREFIX_PATTERN);
+    if (!prefixMatch) {
+      throw new ConfigError({
+        message: "SecretVault: malformed encrypted value",
+        code: ERROR_CODES.CONFIG_PARSE_FAILED,
+        context: { field: "encrypted_value" }
+      });
+    }
+    const rest = value.slice(prefixMatch[0].length);
     const parts = rest.split(":");
     if (parts.length !== 3) {
       throw new ConfigError({
@@ -546,20 +591,64 @@ var DefaultSecretVault = class {
     const pt = Buffer.concat([decipher.update(ct), decipher.final()]);
     return pt.toString("utf8");
   }
+  /**
+   * Generate a new encryption key, write it to disk, and increment the key version.
+   * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
+   * The caller must re-encrypt existing config values (see rotateConfigKeys()).
+   */
+  rotateKey() {
+    const oldVersion = this._keyVersion;
+    const newKey = randomBytes(KEY_BYTES);
+    const newVersion = oldVersion + 1;
+    const keyFileBuf = Buffer.alloc(VERSIONED_KEY_FILE_SIZE);
+    KEY_FILE_MAGIC.copy(keyFileBuf, 0);
+    keyFileBuf[KEY_FILE_MAGIC.length] = newVersion;
+    newKey.copy(keyFileBuf, KEY_FILE_MAGIC.length + 1);
+    fs2.mkdirSync(path3.dirname(this.keyFile), { recursive: true });
+    fs2.writeFileSync(this.keyFile, keyFileBuf, { mode: 384 });
+    checkKeyFilePermissions(this.keyFile);
+    this.key = newKey;
+    this._keyVersion = newVersion;
+    return { oldVersion, newVersion };
+  }
   loadOrCreateKey() {
     if (this.key) return this.key;
     try {
       const buf = fs2.readFileSync(this.keyFile);
-      if (buf.length !== KEY_BYTES) {
-        throw new ConfigError({
-          message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`,
-          code: ERROR_CODES.CONFIG_INVALID,
-          context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-        });
+      if (buf.length === KEY_BYTES) {
+        this.key = buf;
+        this._keyVersion = 1;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
+      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
+        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
+        if (!magic.equals(KEY_FILE_MAGIC)) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile }
+          });
+        }
+        const version = buf[KEY_FILE_MAGIC.length];
+        const key2 = buf.subarray(KEY_FILE_MAGIC.length + 1);
+        if (key2.length !== KEY_BYTES) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has wrong key size (${key2.length} bytes, expected ${KEY_BYTES})`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: key2.length }
+          });
+        }
+        this.key = Buffer.from(key2);
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
       }
-      this.key = buf;
-      checkKeyFilePermissions(this.keyFile);
-      return this.key;
+      throw new ConfigError({
+        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+      });
     } catch (err) {
       if (err.code !== "ENOENT") throw err;
     }
@@ -570,18 +659,36 @@ var DefaultSecretVault = class {
     } catch (err) {
       if (err.code !== "EEXIST") throw err;
       const buf = fs2.readFileSync(this.keyFile);
-      if (buf.length !== KEY_BYTES) {
-        throw new ConfigError({
-          message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES}). Remove it manually to generate a new key.`,
-          code: ERROR_CODES.CONFIG_INVALID,
-          context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
-        });
+      if (buf.length === KEY_BYTES) {
+        this.key = buf;
+        this._keyVersion = 1;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
+      }
+      if (buf.length === VERSIONED_KEY_FILE_SIZE) {
+        const magic = buf.subarray(0, KEY_FILE_MAGIC.length);
+        if (!magic.equals(KEY_FILE_MAGIC)) {
+          throw new ConfigError({
+            message: `SecretVault: key file ${this.keyFile} has invalid magic header`,
+            code: ERROR_CODES.CONFIG_INVALID,
+            context: { keyFile: this.keyFile }
+          });
+        }
+        const version = buf[KEY_FILE_MAGIC.length];
+        const winnerKey = buf.subarray(KEY_FILE_MAGIC.length + 1);
+        this.key = Buffer.from(winnerKey);
+        this._keyVersion = version;
+        checkKeyFilePermissions(this.keyFile);
+        return this.key;
       }
-      this.key = buf;
-      checkKeyFilePermissions(this.keyFile);
-      return this.key;
+      throw new ConfigError({
+        message: `SecretVault: key file ${this.keyFile} is ${buf.length} bytes (expected ${KEY_BYTES} for v1 or ${VERSIONED_KEY_FILE_SIZE} for v2+). Remove it manually to generate a new key.`,
+        code: ERROR_CODES.CONFIG_INVALID,
+        context: { keyFile: this.keyFile, expectedBytes: KEY_BYTES, actualBytes: buf.length }
+      });
     }
     this.key = key;
+    this._keyVersion = 1;
     return key;
   }
 };
@@ -662,6 +769,80 @@ async function migratePlaintextSecrets(configPath, vault, logger) {
   );
   return { migrated: counter.n, file: configPath };
 }
+async function rotateConfigKeys(configPath, vault, logger) {
+  const log = logger?.info ?? (() => {
+  });
+  const warn = logger?.warn ?? ((msg) => console.warn(msg));
+  let raw;
+  try {
+    raw = await fs.readFile(configPath, "utf8");
+  } catch {
+    const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
+    log(`[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no config file to re-encrypt`);
+    return { rotated: 0, oldVersion: oldVersion2, newVersion: newVersion2, file: configPath };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    warn(`[secret-vault] Config file ${configPath} is not valid JSON \u2014 skipping rotation`);
+    return { rotated: 0, oldVersion: vault.keyVersion, newVersion: vault.keyVersion, file: configPath };
+  }
+  const counter = { n: 0 };
+  const decrypted = walkDecryptCount(parsed, vault, counter);
+  if (counter.n === 0) {
+    const { oldVersion: oldVersion2, newVersion: newVersion2 } = vault.rotateKey();
+    log(`[secret-vault] Key rotated (v${oldVersion2} \u2192 v${newVersion2}) \u2014 no encrypted fields to re-encrypt`);
+    return { rotated: 0, oldVersion: oldVersion2, newVersion: newVersion2, file: configPath };
+  }
+  const { oldVersion, newVersion } = vault.rotateKey();
+  const reencrypted = walkReencrypt(decrypted, vault);
+  await atomicWrite(configPath, JSON.stringify(reencrypted, null, 2), { mode: 384 });
+  await restrictFilePermissions(configPath, { warn });
+  log(`[secret-vault] Key rotated (v${oldVersion} \u2192 v${newVersion}) \u2014 re-encrypted ${counter.n} field(s)`);
+  return { rotated: counter.n, oldVersion, newVersion, file: configPath };
+}
+function walkDecryptCount(node, vault, counter) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walkDecryptCount(item, vault, counter));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && vault.isEncrypted(v)) {
+      try {
+        out[k] = vault.decrypt(v);
+        counter.n++;
+      } catch {
+        out[k] = v;
+      }
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkDecryptCount(v, vault, counter);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function walkReencrypt(node, vault) {
+  if (node === null || node === void 0) return node;
+  if (typeof node !== "object") return node;
+  if (Array.isArray(node)) {
+    return node.map((item) => walkReencrypt(item, vault));
+  }
+  const out = /* @__PURE__ */ Object.create(null);
+  for (const [k, v] of Object.entries(node)) {
+    if (typeof v === "string" && isSecretField(k) && v.length > 0 && !vault.isEncrypted(v)) {
+      out[k] = vault.encrypt(v);
+    } else if (typeof v === "object" && v !== null) {
+      out[k] = walkReencrypt(v, vault);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
 async function restrictFilePermissions(filePath, opts) {
   const warn = opts?.warn ?? ((msg) => console.warn(msg));
   if (process.platform === "win32") {
@@ -1222,6 +1403,6 @@ var AutoApprovePermissionPolicy = class _AutoApprovePermissionPolicy {
   }
 };
 
-export { AutoApprovePermissionPolicy, DANGEROUS_FOR_SUBAGENTS, DefaultPermissionPolicy, DefaultSecretScrubber, DefaultSecretVault, ToolCapabilities, decryptConfigSecrets, encryptConfigSecrets, getDangerousCapabilities, hasCapability, hasDangerousCapabilityForSubagents, isSecretField, migratePlaintextSecrets, rewriteConfigEncrypted };
+export { AutoApprovePermissionPolicy, DANGEROUS_FOR_SUBAGENTS, DefaultPermissionPolicy, DefaultSecretScrubber, DefaultSecretVault, ToolCapabilities, decryptConfigSecrets, encryptConfigSecrets, getDangerousCapabilities, hasCapability, hasDangerousCapabilityForSubagents, isSecretField, migratePlaintextSecrets, rewriteConfigEncrypted, rotateConfigKeys };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map