@wrongstack/core 0.264.0 → 0.267.0

package/dist/secret-vault-BAKpgFw_.d.ts

@@ -0,0 +1,57 @@
+/**
+ * SecretVault encrypts secrets-at-rest in config files. The wire format is
+ * `enc:v<N>:<base64-iv>:<base64-tag>:<base64-ciphertext>` where `<N>` is the
+ * key version used for encryption. Plaintext strings (those that do not match
+ * this prefix) are passed through unchanged so that existing configs and
+ * env-var-derived values keep working.
+ *
+ * Key rotation produces a new key and re-encrypts all secrets under it.
+ * After rotation, `encrypt()` emits the new version prefix (e.g. `enc:v2:`)
+ * and `decrypt()` accepts any version prefix — it uses the current key
+ * regardless, since rotation re-encrypts every value atomically.
+ *
+ * The vault is intentionally NOT designed to defeat a determined local
+ * attacker who can read both the config file and the key file — that level
+ * of secrecy needs the OS keychain. The goal is to keep keys from being
+ * visible in screen shares, accidental log captures, and `cat config.json`
+ * over someone's shoulder.
+ */
+interface SecretVault {
+    encrypt(plaintext: string): string;
+    decrypt(value: string): string;
+    isEncrypted(value: string): boolean;
+    /** Current key version. Starts at 1; incremented by `rotateKey()`. */
+    readonly keyVersion: number;
+}
+/**
+ * RotatableSecretVault extends SecretVault with key rotation support.
+ * `rotateKey()` generates a fresh key, writes it to disk, and increments
+ * the key version. All subsequent `encrypt()` calls use the new version
+ * prefix. The caller is responsible for re-encrypting existing config
+ * values (see `rotateConfigKeys()`).
+ */
+interface RotatableSecretVault extends SecretVault {
+    rotateKey(): {
+        oldVersion: number;
+        newVersion: number;
+    };
+}
+/**
+ * Return the encrypted prefix for a given key version.
+ * @example encryptedPrefixForVersion(1) // 'enc:v1:'
+ * @example encryptedPrefixForVersion(2) // 'enc:v2:'
+ */
+declare function encryptedPrefixForVersion(version: number): string;
+/**
+ * Parse the key version from an encrypted value string.
+ * Returns undefined if the string is not an encrypted value.
+ */
+declare function parseEncryptedVersion(value: string): number | undefined;
+/**
+ * No-op SecretVault that passes values through unchanged.
+ * Used in contexts where encryption is not needed — e.g. reading/writing
+ * config sections that contain no secret fields (models, settings, etc.).
+ */
+declare const noOpVault: SecretVault;
+
+export { type RotatableSecretVault as R, type SecretVault as S, encryptedPrefixForVersion as e, noOpVault as n, parseEncryptedVersion as p };

package/dist/{secret-vault-CxiVLbt1.d.ts → secret-vault-gkvEZZfE.d.ts}

@@ -1,6 +1,6 @@
-import { S as SecretScrubber } from './permission-4yvGmMRB.js';
+import { S as SecretScrubber } from './permission-B75JAi3-.js';
 import { L as Logger } from './logger-B63L5bTg.js';
-import { S as SecretVault } from './secret-vault-BJDY28ev.js';
+import { R as RotatableSecretVault, S as SecretVault } from './secret-vault-BAKpgFw_.js';
 
 declare class DefaultSecretScrubber implements SecretScrubber {
     scrub(text: string): string;
@@ -24,14 +24,33 @@ interface SecretVaultOptions {
  * The key is loaded lazily on first encrypt/decrypt; if it does not exist,
  * a fresh one is generated. Decryption of plaintext values is a no-op so
  * legacy configs continue to work.
+ *
+ * Key file format:
+ *   - Legacy (v1): exactly 32 raw bytes
+ *   - Versioned (v2+): 4-byte magic `WSKV` + 1-byte version + 32-byte key (37 bytes)
+ *
+ * Encrypted value format: `enc:v<N>:<iv>:<tag>:<ciphertext>` where N is the
+ * key version. After rotation, encrypt() emits the new version prefix.
  */
-declare class DefaultSecretVault implements SecretVault {
+declare class DefaultSecretVault implements RotatableSecretVault {
     private readonly keyFile;
     private key?;
+    private _keyVersion;
     constructor(opts: SecretVaultOptions);
+    /** Current key version. Starts at 1; incremented by rotateKey(). */
+    get keyVersion(): number;
     isEncrypted(value: string): boolean;
     encrypt(plaintext: string): string;
     decrypt(value: string): string;
+    /**
+     * Generate a new encryption key, write it to disk, and increment the key version.
+     * After rotation, encrypt() emits the new version prefix (e.g. enc:v2:).
+     * The caller must re-encrypt existing config values (see rotateConfigKeys()).
+     */
+    rotateKey(): {
+        oldVersion: number;
+        newVersion: number;
+    };
     private loadOrCreateKey;
 }
 /**
@@ -67,5 +86,25 @@ declare function migratePlaintextSecrets(configPath: string, vault: SecretVault,
     migrated: number;
     file: string;
 }>;
+/**
+ * Rotate the vault's encryption key and re-encrypt all secret-bearing
+ * fields in a config file. This is the atomic key rotation operation:
+ *
+ * 1. Read the config file
+ * 2. Decrypt all encrypted values with the old key
+ * 3. Generate a new key (vault.rotateKey())
+ * 4. Re-encrypt all values with the new key (new version prefix)
+ * 5. Write the config file atomically
+ *
+ * Returns the number of fields re-encrypted and the version transition.
+ * If the config file doesn't exist or has no encrypted fields, returns
+ * { rotated: 0 } without modifying the key.
+ */
+declare function rotateConfigKeys(configPath: string, vault: RotatableSecretVault, logger?: Pick<Logger, 'warn' | 'info'>): Promise<{
+    rotated: number;
+    oldVersion: number;
+    newVersion: number;
+    file: string;
+}>;
 
-export { DefaultSecretScrubber as D, type SecretVaultOptions as S, DefaultSecretVault as a, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };
+export { DefaultSecretVault as D, type SecretVaultOptions as S, DefaultSecretScrubber as a, rotateConfigKeys as b, decryptConfigSecrets as d, encryptConfigSecrets as e, isSecretField as i, migratePlaintextSecrets as m, rewriteConfigEncrypted as r };

package/dist/security/index.d.ts

@@ -1,70 +1,8 @@
-export { D as DefaultSecretScrubber, a as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted } from '../secret-vault-CxiVLbt1.js';
-export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-C6XpsBOy.js';
-import '../permission-4yvGmMRB.js';
-import '../context-BGSpZNSE.js';
+export { a as DefaultSecretScrubber, D as DefaultSecretVault, S as SecretVaultOptions, d as decryptConfigSecrets, e as encryptConfigSecrets, i as isSecretField, m as migratePlaintextSecrets, r as rewriteConfigEncrypted, b as rotateConfigKeys } from '../secret-vault-gkvEZZfE.js';
+export { A as AutoApprovePermissionPolicy, D as DefaultPermissionPolicy, P as PermissionPolicyOptions } from '../permission-policy-DlR9eJAM.js';
+export { D as DANGEROUS_FOR_SUBAGENTS, T as ToolCapabilities, a as ToolCapability, g as getDangerousCapabilities, h as hasCapability, b as hasDangerousCapabilityForSubagents } from '../index-IEuxQd-E.js';
+import '../permission-B75JAi3-.js';
+import '../context-dT5Ueund.js';
 import '../logger-B63L5bTg.js';
-import '../secret-vault-BJDY28ev.js';
+import '../secret-vault-BAKpgFw_.js';
 import '../input-reader-E-ffP2ee.js';
-
-/**
- * Well-known tool capabilities used for authorization decisions.
- *
- * These are the preferred values for `Tool.capabilities`.
- * New capabilities should be added here with clear documentation.
- *
- * Philosophy (2026-06+):
- * - Prefer capabilities over exact tool name matching.
- * - Subagent guards and future policies should primarily key off capabilities.
- * - Name-based denylists are legacy and will be phased down.
- */
-declare const ToolCapabilities: {
-    /** Can execute arbitrary commands in the user's shell (the `bash` tool). */
-    readonly SHELL_ARBITRARY: "shell.arbitrary";
-    /** Can execute a restricted set of commands (the `exec` tool). */
-    readonly SHELL_RESTRICTED: "shell.restricted";
-    /** Can read files inside the project (and possibly outside via symlinks if not guarded). */
-    readonly FS_READ: "fs.read";
-    /** Can write / modify / delete files inside the project. */
-    readonly FS_WRITE: "fs.write";
-    /** Can write files outside the current project root (very high risk). */
-    readonly FS_WRITE_OUTSIDE_PROJECT: "fs.write.outside-project";
-    /** Can perform outbound network requests. */
-    readonly NET_OUTBOUND: "net.outbound";
-    /** Proxies tools from external MCP servers (unknown capability). */
-    readonly MCP_PROXY: "mcp.proxy";
-    /** Can spawn or manage subagents / multi-agent tasks. */
-    readonly SUBAGENT_SPAWN: "subagent.spawn";
-    /** Can mutate global or session configuration / trust state. */
-    readonly CONFIG_MUTATE: "config.mutate";
-    /** Can install packages or run package managers with side effects. */
-    readonly PACKAGE_INSTALL: "package.install";
-};
-type ToolCapability = (typeof ToolCapabilities)[keyof typeof ToolCapabilities];
-/**
- * Set of capabilities that are considered dangerous for subagents by default.
- * Subagents should not receive these capabilities unless the leader explicitly
- * allows the specific tool at spawn time.
- */
-declare const DANGEROUS_FOR_SUBAGENTS: readonly ToolCapability[];
-/**
- * Check if a tool (or its capabilities array) includes any dangerous capability
- * for subagent execution.
- */
-declare function hasDangerousCapabilityForSubagents(toolOrCaps: {
-    capabilities?: readonly string[] | undefined;
-} | readonly string[] | undefined): boolean;
-/**
- * Check if a tool declares a specific capability (or any of the provided ones).
- */
-declare function hasCapability(toolOrCaps: {
-    capabilities?: readonly string[] | undefined;
-} | readonly string[] | undefined, capability: ToolCapability | ToolCapability[]): boolean;
-/**
- * Returns the intersection of a tool's capabilities with the dangerous set.
- * Useful for logging and audit trails.
- */
-declare function getDangerousCapabilities(toolOrCaps: {
-    capabilities?: readonly string[] | undefined;
-} | readonly string[] | undefined): ToolCapability[];
-
-export { DANGEROUS_FOR_SUBAGENTS, ToolCapabilities, type ToolCapability, getDangerousCapabilities, hasCapability, hasDangerousCapabilityForSubagents };