agentic-qe 3.7.13 → 3.7.15

package/dist/audit/witness-key-manager.js

@@ -0,0 +1,218 @@
+/**
+ * Witness Key Manager - Ed25519 Signing for Witness Chain
+ * ADR-070: Witness Chain Audit Compliance (Phase 6.2)
+ *
+ * Manages Ed25519 key pairs for cryptographic signing of witness chain entries.
+ * Keys are stored in-memory with support for rotation.
+ * Uses Node.js built-in crypto — no native dependencies required.
+ */
+import { generateKeyPairSync, createPrivateKey, createPublicKey, sign, verify, createHash, } from 'crypto';
+import { existsSync, mkdirSync, writeFileSync, readFileSync, readdirSync } from 'fs';
+import { join } from 'path';
+// ============================================================================
+// WitnessKeyManager Implementation
+// ============================================================================
+/**
+ * Manages Ed25519 key pairs for witness chain entry signing.
+ *
+ * Features:
+ * - Generate Ed25519 key pairs using Node.js crypto
+ * - Sign arbitrary data with the active key
+ * - Verify signatures against any known key
+ * - Rotate keys (retire old, generate new)
+ */
+export class WitnessKeyManager {
+    keys = new Map();
+    activeKeyId = null;
+    keyDir;
+    constructor(options = {}) {
+        this.keyDir = options.keyDir ?? null;
+        // Try loading persisted keys first
+        if (this.keyDir) {
+            this.loadFromDisk();
+        }
+        // Auto-generate only if no keys were loaded
+        const autoGenerate = options.autoGenerate !== false;
+        if (autoGenerate && this.keys.size === 0) {
+            this.generateKeyPair();
+        }
+    }
+    /**
+     * Generate a new Ed25519 key pair and set it as the active signing key.
+     *
+     * @returns The key ID (hex digest of public key) and the public key buffer
+     */
+    generateKeyPair() {
+        const { publicKey, privateKey } = generateKeyPairSync('ed25519');
+        const pubDer = publicKey.export({ type: 'spki', format: 'der' });
+        const keyId = createHash('sha256').update(pubDer).digest('hex').slice(0, 16);
+        const record = {
+            keyId,
+            publicKey,
+            privateKey,
+            createdAt: new Date().toISOString(),
+            retired: false,
+        };
+        this.keys.set(keyId, record);
+        this.activeKeyId = keyId;
+        // Persist to disk if keyDir is configured
+        if (this.keyDir) {
+            this.saveKeyPairToDisk(record);
+            this.saveActiveKeyId();
+        }
+        return { keyId, publicKey: pubDer };
+    }
+    /**
+     * Sign data using the active key (or a specific key by ID).
+     *
+     * @param data - The data to sign
+     * @param keyId - Optional specific key ID to use. Defaults to active key.
+     * @returns The signature buffer and the key ID used
+     * @throws Error if the key is not found or no active key exists
+     */
+    sign(data, keyId) {
+        const targetKeyId = keyId ?? this.activeKeyId;
+        if (!targetKeyId) {
+            throw new Error('No active key available for signing');
+        }
+        const record = this.keys.get(targetKeyId);
+        if (!record) {
+            throw new Error(`Key not found: ${targetKeyId}`);
+        }
+        const signature = sign(null, data, record.privateKey);
+        return { signature, keyId: targetKeyId };
+    }
+    /**
+     * Verify a signature against a known public key.
+     *
+     * @param data - The original data that was signed
+     * @param signature - The signature to verify
+     * @param keyId - The key ID that was used for signing
+     * @returns true if the signature is valid, false otherwise
+     */
+    verify(data, signature, keyId) {
+        const record = this.keys.get(keyId);
+        if (!record) {
+            return false;
+        }
+        try {
+            return verify(null, data, record.publicKey, signature);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Rotate the active key: retire the current key and generate a new one.
+     *
+     * @returns The old key ID and the new key ID
+     * @throws Error if no active key exists to rotate
+     */
+    rotateKey() {
+        const oldKeyId = this.activeKeyId;
+        if (!oldKeyId) {
+            throw new Error('No active key to rotate');
+        }
+        const oldRecord = this.keys.get(oldKeyId);
+        if (oldRecord) {
+            oldRecord.retired = true;
+            // Persist retired status
+            if (this.keyDir)
+                this.saveKeyPairToDisk(oldRecord);
+        }
+        const { keyId: newKeyId } = this.generateKeyPair();
+        return { oldKeyId, newKeyId };
+    }
+    /**
+     * Get the ID of the currently active signing key.
+     *
+     * @returns The active key ID
+     * @throws Error if no active key exists
+     */
+    getActiveKeyId() {
+        if (!this.activeKeyId) {
+            throw new Error('No active key');
+        }
+        return this.activeKeyId;
+    }
+    /**
+     * Check if a key ID is known to this manager.
+     */
+    hasKey(keyId) {
+        return this.keys.has(keyId);
+    }
+    /**
+     * Get the number of keys managed (including retired).
+     */
+    getKeyCount() {
+        return this.keys.size;
+    }
+    // ==========================================================================
+    // Disk Persistence (PEM files in keyDir)
+    // ==========================================================================
+    /** Save a single key pair as PEM files + metadata JSON. */
+    saveKeyPairToDisk(record) {
+        if (!this.keyDir)
+            return;
+        if (!existsSync(this.keyDir))
+            mkdirSync(this.keyDir, { recursive: true });
+        const prefix = join(this.keyDir, record.keyId);
+        writeFileSync(`${prefix}.pub.pem`, record.publicKey.export({ type: 'spki', format: 'pem' }), 'utf-8');
+        writeFileSync(`${prefix}.key.pem`, record.privateKey.export({ type: 'pkcs8', format: 'pem' }), { encoding: 'utf-8', mode: 0o600 });
+        writeFileSync(`${prefix}.meta.json`, JSON.stringify({
+            keyId: record.keyId,
+            createdAt: record.createdAt,
+            retired: record.retired,
+        }), 'utf-8');
+    }
+    /** Save the active key ID pointer. */
+    saveActiveKeyId() {
+        if (!this.keyDir || !this.activeKeyId)
+            return;
+        writeFileSync(join(this.keyDir, 'active-key-id'), this.activeKeyId, 'utf-8');
+    }
+    /** Load all key pairs from PEM files in keyDir. */
+    loadFromDisk() {
+        if (!this.keyDir || !existsSync(this.keyDir))
+            return;
+        const files = readdirSync(this.keyDir);
+        const metaFiles = files.filter(f => f.endsWith('.meta.json'));
+        for (const metaFile of metaFiles) {
+            try {
+                const meta = JSON.parse(readFileSync(join(this.keyDir, metaFile), 'utf-8'));
+                const prefix = join(this.keyDir, meta.keyId);
+                const pubPem = readFileSync(`${prefix}.pub.pem`, 'utf-8');
+                const keyPem = readFileSync(`${prefix}.key.pem`, 'utf-8');
+                const record = {
+                    keyId: meta.keyId,
+                    publicKey: createPublicKey(pubPem),
+                    privateKey: createPrivateKey(keyPem),
+                    createdAt: meta.createdAt,
+                    retired: meta.retired,
+                };
+                this.keys.set(meta.keyId, record);
+            }
+            catch {
+                // Skip corrupt key files
+            }
+        }
+        // Restore active key pointer
+        const activeFile = join(this.keyDir, 'active-key-id');
+        if (existsSync(activeFile)) {
+            const storedId = readFileSync(activeFile, 'utf-8').trim();
+            if (this.keys.has(storedId)) {
+                this.activeKeyId = storedId;
+            }
+        }
+        // Fallback: if no active key ID file, pick the newest non-retired key
+        if (!this.activeKeyId) {
+            const nonRetired = [...this.keys.values()]
+                .filter(k => !k.retired)
+                .sort((a, b) => b.createdAt.localeCompare(a.createdAt));
+            if (nonRetired.length > 0) {
+                this.activeKeyId = nonRetired[0].keyId;
+            }
+        }
+    }
+}
+//# sourceMappingURL=witness-key-manager.js.map

package/dist/cli/brain-commands.d.ts

@@ -41,4 +41,13 @@ export declare function importBrain(dbPath: string, containerPath: string, optio
  * Auto-detects format based on path.
  */
 export declare function brainInfo(containerPath: string, format?: string): Promise<BrainManifest>;
+export interface WitnessBackfillResult {
+    created: number;
+    skipped: number;
+}
+/**
+ * Retroactively create witness chain entries for existing patterns
+ * that predate the witness chain feature.
+ */
+export declare function witnessBackfill(dbPath: string): Promise<WitnessBackfillResult>;
 //# sourceMappingURL=brain-commands.d.ts.map

package/dist/cli/brain-commands.js

@@ -12,6 +12,8 @@
 import Database from 'better-sqlite3';
 import { exportBrain as coreExportBrain, importBrain as coreImportBrain, brainInfo as coreBrainInfo, } from '../integrations/ruvector/brain-exporter.js';
 import { exportBrainToRvf, importBrainFromRvf, brainInfoFromRvf, isRvfAvailable, } from '../integrations/ruvector/brain-rvf-exporter.js';
+import { createWitnessChain } from '../audit/witness-chain.js';
+import { backfillWitnessChain } from '../audit/witness-backfill.js';
 /**
  * Export the QE brain state.
  *
@@ -88,6 +90,21 @@ export async function brainInfo(containerPath, format) {
     }
     return coreBrainInfo(containerPath);
 }
+/**
+ * Retroactively create witness chain entries for existing patterns
+ * that predate the witness chain feature.
+ */
+export async function witnessBackfill(dbPath) {
+    const db = new Database(dbPath, { readonly: false });
+    try {
+        const chain = createWitnessChain(db);
+        await chain.initialize();
+        return backfillWitnessChain(db, chain);
+    }
+    finally {
+        db.close();
+    }
+}
 // ============================================================================
 // Format resolution
 // ============================================================================