anchi-kit 1.2.0 → 1.2.2

package/src/lib/encryptedStorage.js

@@ -0,0 +1,326 @@
+/**
+ * anchi-kit Encrypted Storage
+ * AES-256-GCM encryption for .ai-memory files
+ * @module lib/encryptedStorage
+ */
+
+const crypto = require('crypto');
+const fs = require('fs');
+const path = require('path');
+
+// =============================================================================
+// CONFIGURATION
+// =============================================================================
+
+const ALGORITHM = 'aes-256-gcm';
+const KEY_LENGTH = 32; // 256 bits
+const IV_LENGTH = 16;  // 128 bits
+const AUTH_TAG_LENGTH = 16;
+const SALT_LENGTH = 32;
+
+// Default key storage location
+const DEFAULT_KEY_DIR = path.join(
+    process.env.HOME || process.env.USERPROFILE || '.',
+    '.anchi-kit'
+);
+const DEFAULT_KEY_FILE = 'encryption.key';
+
+// =============================================================================
+// ENCRYPTED STORAGE CLASS
+// =============================================================================
+
+class EncryptedStorage {
+    /**
+     * Create encrypted storage instance
+     * @param {Object} options - Configuration options
+     * @param {string} options.keyPath - Path to encryption key file
+     * @param {boolean} options.autoGenerate - Auto-generate key if not exists
+     */
+    constructor(options = {}) {
+        this.keyDir = options.keyDir || DEFAULT_KEY_DIR;
+        this.keyFile = options.keyFile || DEFAULT_KEY_FILE;
+        this.keyPath = path.join(this.keyDir, this.keyFile);
+        this.autoGenerate = options.autoGenerate !== false;
+        this.key = null;
+        this.enabled = false;
+    }
+
+    /**
+     * Initialize encryption - load or generate key
+     * @returns {boolean} Whether encryption is enabled
+     */
+    initialize() {
+        try {
+            if (fs.existsSync(this.keyPath)) {
+                this.key = this.loadKey();
+                this.enabled = true;
+                return true;
+            }
+            
+            if (this.autoGenerate) {
+                this.key = this.generateKey();
+                this.enabled = true;
+                return true;
+            }
+            
+            this.enabled = false;
+            return false;
+        } catch (err) {
+            console.warn(`⚠️ Encryption initialization failed: ${err.message}`);
+            this.enabled = false;
+            return false;
+        }
+    }
+
+    /**
+     * Generate new encryption key
+     * @returns {Buffer} Generated key
+     */
+    generateKey() {
+        // Ensure directory exists
+        if (!fs.existsSync(this.keyDir)) {
+            fs.mkdirSync(this.keyDir, { recursive: true, mode: 0o700 });
+        }
+        
+        // Generate random key
+        const key = crypto.randomBytes(KEY_LENGTH);
+        
+        // Save with restricted permissions (owner read/write only)
+        fs.writeFileSync(this.keyPath, key, { mode: 0o600 });
+        
+        console.log(`🔐 Encryption key generated: ${this.keyPath}`);
+        console.log('   ⚠️  Keep this file safe - losing it means losing encrypted data!');
+        
+        return key;
+    }
+
+    /**
+     * Load existing encryption key
+     * @returns {Buffer} Loaded key
+     */
+    loadKey() {
+        const keyData = fs.readFileSync(this.keyPath);
+        
+        if (keyData.length !== KEY_LENGTH) {
+            throw new Error('Invalid key length');
+        }
+        
+        return keyData;
+    }
+
+    /**
+     * Encrypt data
+     * @param {any} data - Data to encrypt (will be JSON stringified)
+     * @returns {Object} Encrypted data object
+     */
+    encrypt(data) {
+        if (!this.enabled || !this.key) {
+            throw new Error('Encryption not initialized');
+        }
+        
+        // Generate random IV for each encryption
+        const iv = crypto.randomBytes(IV_LENGTH);
+        
+        // Create cipher
+        const cipher = crypto.createCipheriv(ALGORITHM, this.key, iv, {
+            authTagLength: AUTH_TAG_LENGTH
+        });
+        
+        // Encrypt
+        const jsonData = JSON.stringify(data);
+        let encrypted = cipher.update(jsonData, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        
+        // Get auth tag
+        const authTag = cipher.getAuthTag();
+        
+        return {
+            v: 1, // Version for future compatibility
+            iv: iv.toString('hex'),
+            data: encrypted,
+            tag: authTag.toString('hex'),
+            ts: Date.now()
+        };
+    }
+
+    /**
+     * Decrypt data
+     * @param {Object} encryptedData - Encrypted data object
+     * @returns {any} Decrypted data
+     */
+    decrypt(encryptedData) {
+        if (!this.enabled || !this.key) {
+            throw new Error('Encryption not initialized');
+        }
+        
+        // Validate structure
+        if (!encryptedData.iv || !encryptedData.data || !encryptedData.tag) {
+            throw new Error('Invalid encrypted data structure');
+        }
+        
+        // Create decipher
+        const iv = Buffer.from(encryptedData.iv, 'hex');
+        const decipher = crypto.createDecipheriv(ALGORITHM, this.key, iv, {
+            authTagLength: AUTH_TAG_LENGTH
+        });
+        
+        // Set auth tag
+        decipher.setAuthTag(Buffer.from(encryptedData.tag, 'hex'));
+        
+        // Decrypt
+        let decrypted = decipher.update(encryptedData.data, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        
+        return JSON.parse(decrypted);
+    }
+
+    /**
+     * Check if data is encrypted
+     * @param {any} data - Data to check
+     * @returns {boolean} Whether data appears to be encrypted
+     */
+    isEncrypted(data) {
+        return data && 
+               typeof data === 'object' && 
+               data.v === 1 && 
+               data.iv && 
+               data.data && 
+               data.tag;
+    }
+
+    /**
+     * Save data to file (encrypted)
+     * @param {string} filePath - Path to save to
+     * @param {any} data - Data to save
+     */
+    saveEncrypted(filePath, data) {
+        const encrypted = this.encrypt(data);
+        fs.writeFileSync(filePath, JSON.stringify(encrypted, null, 2));
+    }
+
+    /**
+     * Load data from file (decrypt if encrypted)
+     * @param {string} filePath - Path to load from
+     * @returns {any} Decrypted data
+     */
+    loadDecrypted(filePath) {
+        if (!fs.existsSync(filePath)) {
+            return null;
+        }
+        
+        const content = fs.readFileSync(filePath, 'utf8');
+        const data = JSON.parse(content);
+        
+        if (this.isEncrypted(data)) {
+            return this.decrypt(data);
+        }
+        
+        // Return as-is if not encrypted
+        return data;
+    }
+
+    /**
+     * Migrate unencrypted file to encrypted
+     * @param {string} filePath - Path to file
+     */
+    migrateFile(filePath) {
+        if (!fs.existsSync(filePath)) {
+            return false;
+        }
+        
+        const content = fs.readFileSync(filePath, 'utf8');
+        const data = JSON.parse(content);
+        
+        if (this.isEncrypted(data)) {
+            // Already encrypted
+            return false;
+        }
+        
+        // Backup original
+        const backupPath = `${filePath}.unencrypted.backup`;
+        fs.copyFileSync(filePath, backupPath);
+        
+        // Encrypt and save
+        this.saveEncrypted(filePath, data);
+        
+        return true;
+    }
+
+    /**
+     * Get encryption status info
+     * @returns {Object} Status information
+     */
+    getStatus() {
+        return {
+            enabled: this.enabled,
+            keyExists: fs.existsSync(this.keyPath),
+            keyPath: this.keyPath,
+            algorithm: ALGORITHM,
+            keyLength: KEY_LENGTH * 8 // bits
+        };
+    }
+
+    /**
+     * Rotate encryption key (re-encrypt all data with new key)
+     * @param {string[]} filePaths - Paths to files to re-encrypt
+     */
+    rotateKey(filePaths) {
+        if (!this.enabled) {
+            throw new Error('Encryption not enabled');
+        }
+        
+        // Decrypt all files with old key
+        const decryptedData = {};
+        for (const filePath of filePaths) {
+            if (fs.existsSync(filePath)) {
+                try {
+                    decryptedData[filePath] = this.loadDecrypted(filePath);
+                } catch (err) {
+                    console.warn(`⚠️ Could not decrypt ${filePath}: ${err.message}`);
+                }
+            }
+        }
+        
+        // Backup old key
+        const backupKeyPath = `${this.keyPath}.backup.${Date.now()}`;
+        fs.copyFileSync(this.keyPath, backupKeyPath);
+        
+        // Generate new key
+        this.key = this.generateKey();
+        
+        // Re-encrypt all files
+        for (const [filePath, data] of Object.entries(decryptedData)) {
+            if (data) {
+                this.saveEncrypted(filePath, data);
+            }
+        }
+        
+        console.log(`🔄 Key rotated. Old key backed up to: ${backupKeyPath}`);
+    }
+}
+
+// =============================================================================
+// FACTORY FUNCTION
+// =============================================================================
+
+/**
+ * Create and initialize encrypted storage instance
+ * @param {Object} options - Options
+ * @returns {EncryptedStorage} Initialized instance
+ */
+function createEncryptedStorage(options = {}) {
+    const storage = new EncryptedStorage(options);
+    storage.initialize();
+    return storage;
+}
+
+// =============================================================================
+// EXPORTS
+// =============================================================================
+
+module.exports = {
+    EncryptedStorage,
+    createEncryptedStorage,
+    ALGORITHM,
+    KEY_LENGTH
+};

package/src/lib/secretScanner.js

@@ -0,0 +1,330 @@
+/**
+ * anchi-kit Secret Scanner
+ * Detects API keys, passwords, and tokens in code files
+ * @module lib/secretScanner
+ */
+
+const fs = require('fs');
+const path = require('path');
+
+// =============================================================================
+// SECRET PATTERNS
+// =============================================================================
+
+const SECRET_PATTERNS = {
+    openai: {
+        pattern: /sk-[a-zA-Z0-9]{20,}/g,
+        description: 'OpenAI API Key',
+        severity: 'high'
+    },
+    anthropic: {
+        pattern: /sk-ant-[a-zA-Z0-9_-]+/g,
+        description: 'Anthropic API Key',
+        severity: 'high'
+    },
+    google: {
+        pattern: /AIza[a-zA-Z0-9_-]{35}/g,
+        description: 'Google API Key',
+        severity: 'high'
+    },
+    github_pat: {
+        pattern: /ghp_[a-zA-Z0-9]{36}/g,
+        description: 'GitHub Personal Access Token',
+        severity: 'high'
+    },
+    github_oauth: {
+        pattern: /gho_[a-zA-Z0-9]{36}/g,
+        description: 'GitHub OAuth Token',
+        severity: 'high'
+    },
+    aws_access_key: {
+        pattern: /AKIA[A-Z0-9]{16}/g,
+        description: 'AWS Access Key ID',
+        severity: 'critical'
+    },
+    aws_secret: {
+        pattern: /(?<![A-Za-z0-9\/+=])[A-Za-z0-9\/+=]{40}(?![A-Za-z0-9\/+=])/g,
+        description: 'Potential AWS Secret Key',
+        severity: 'medium'
+    },
+    slack: {
+        pattern: /xox[baprs]-[a-zA-Z0-9-]+/g,
+        description: 'Slack Token',
+        severity: 'high'
+    },
+    discord_webhook: {
+        pattern: /https:\/\/discord\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/g,
+        description: 'Discord Webhook URL',
+        severity: 'high'
+    },
+    telegram_token: {
+        pattern: /\d{8,10}:[A-Za-z0-9_-]{35}/g,
+        description: 'Telegram Bot Token',
+        severity: 'high'
+    },
+    generic_api_key: {
+        pattern: /(?:api[_-]?key|apikey)\s*[=:]\s*['"][^'"]{10,}['"]/gi,
+        description: 'Generic API Key Assignment',
+        severity: 'medium'
+    },
+    generic_secret: {
+        pattern: /(?:secret|password|passwd|pwd)\s*[=:]\s*['"][^'"]+['"]/gi,
+        description: 'Hardcoded Secret/Password',
+        severity: 'high'
+    },
+    private_key: {
+        pattern: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/g,
+        description: 'Private Key',
+        severity: 'critical'
+    },
+    jwt: {
+        pattern: /eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*/g,
+        description: 'JWT Token',
+        severity: 'medium'
+    }
+};
+
+// Files to skip
+const SKIP_EXTENSIONS = [
+    '.png', '.jpg', '.jpeg', '.gif', '.ico', '.svg',
+    '.woff', '.woff2', '.ttf', '.eot',
+    '.pdf', '.zip', '.tar', '.gz', '.7z',
+    '.mp3', '.mp4', '.wav', '.avi',
+    '.lock', '.sum'
+];
+
+const SKIP_PATTERNS = [
+    /node_modules/,
+    /\.git\//,
+    /dist\//,
+    /build\//,
+    /coverage\//,
+    /\.env\.example$/,
+    /\.md$/,  // Documentation files often have examples
+    /test.*fixture/i,
+    /mock/i
+];
+
+// =============================================================================
+// SCANNER FUNCTIONS
+// =============================================================================
+
+/**
+ * Scan content for secrets
+ * @param {string} content - File content to scan
+ * @param {string} filePath - Path to file (for context)
+ * @returns {Array} Array of findings
+ */
+function scanContent(content, filePath = 'unknown') {
+    const findings = [];
+    const lines = content.split('\n');
+    
+    for (const [type, config] of Object.entries(SECRET_PATTERNS)) {
+        // Reset regex state
+        config.pattern.lastIndex = 0;
+        
+        let match;
+        while ((match = config.pattern.exec(content)) !== null) {
+            // Find line number
+            const beforeMatch = content.substring(0, match.index);
+            const lineNumber = beforeMatch.split('\n').length;
+            const lineContent = lines[lineNumber - 1] || '';
+            
+            // Mask the secret value
+            const maskedValue = maskSecret(match[0]);
+            
+            findings.push({
+                type,
+                description: config.description,
+                severity: config.severity,
+                file: filePath,
+                line: lineNumber,
+                column: match.index - beforeMatch.lastIndexOf('\n'),
+                maskedValue,
+                linePreview: maskLineContent(lineContent)
+            });
+        }
+    }
+    
+    return findings;
+}
+
+/**
+ * Scan a single file for secrets
+ * @param {string} filePath - Path to file
+ * @returns {Array} Array of findings
+ */
+function scanFile(filePath) {
+    // Check if should skip
+    const ext = path.extname(filePath).toLowerCase();
+    if (SKIP_EXTENSIONS.includes(ext)) {
+        return [];
+    }
+    
+    for (const pattern of SKIP_PATTERNS) {
+        if (pattern.test(filePath)) {
+            return [];
+        }
+    }
+    
+    try {
+        if (!fs.existsSync(filePath)) {
+            return [];
+        }
+        
+        const stat = fs.statSync(filePath);
+        if (stat.isDirectory() || stat.size > 1024 * 1024) { // Skip files > 1MB
+            return [];
+        }
+        
+        const content = fs.readFileSync(filePath, 'utf8');
+        return scanContent(content, filePath);
+    } catch (err) {
+        // Binary file or read error
+        return [];
+    }
+}
+
+/**
+ * Scan directory recursively for secrets
+ * @param {string} dirPath - Directory path
+ * @param {Object} options - Scan options
+ * @returns {Array} Array of all findings
+ */
+function scanDirectory(dirPath, options = {}) {
+    const { maxDepth = 10, currentDepth = 0 } = options;
+    const findings = [];
+    
+    if (currentDepth > maxDepth) {
+        return findings;
+    }
+    
+    try {
+        const entries = fs.readdirSync(dirPath, { withFileTypes: true });
+        
+        for (const entry of entries) {
+            const fullPath = path.join(dirPath, entry.name);
+            
+            // Skip common directories
+            if (entry.isDirectory()) {
+                if (['node_modules', '.git', 'dist', 'build', 'coverage'].includes(entry.name)) {
+                    continue;
+                }
+                findings.push(...scanDirectory(fullPath, { maxDepth, currentDepth: currentDepth + 1 }));
+            } else {
+                findings.push(...scanFile(fullPath));
+            }
+        }
+    } catch (err) {
+        // Permission error or similar
+    }
+    
+    return findings;
+}
+
+/**
+ * Mask a secret value for safe display
+ * @param {string} secret - The secret value
+ * @returns {string} Masked value
+ */
+function maskSecret(secret) {
+    if (secret.length <= 8) {
+        return '***';
+    }
+    return secret.substring(0, 4) + '***' + secret.substring(secret.length - 4);
+}
+
+/**
+ * Mask sensitive content in a line
+ * @param {string} line - The line content
+ * @returns {string} Masked line
+ */
+function maskLineContent(line) {
+    let masked = line;
+    
+    // Mask common patterns
+    for (const config of Object.values(SECRET_PATTERNS)) {
+        config.pattern.lastIndex = 0;
+        masked = masked.replace(config.pattern, (match) => maskSecret(match));
+    }
+    
+    return masked.trim();
+}
+
+/**
+ * Format findings for console output
+ * @param {Array} findings - Array of findings
+ * @returns {string} Formatted output
+ */
+function formatFindings(findings) {
+    if (findings.length === 0) {
+        return '\n✅ No secrets detected!\n';
+    }
+    
+    const grouped = {};
+    for (const finding of findings) {
+        if (!grouped[finding.file]) {
+            grouped[finding.file] = [];
+        }
+        grouped[finding.file].push(finding);
+    }
+    
+    let output = '\n';
+    output += '══════════════════════════════════════════════════════════════\n';
+    output += '  🚨 SECRETS DETECTED - Review Required\n';
+    output += '══════════════════════════════════════════════════════════════\n\n';
+    
+    for (const [file, fileFindings] of Object.entries(grouped)) {
+        output += `📄 ${file}\n`;
+        output += '─'.repeat(60) + '\n';
+        
+        for (const f of fileFindings) {
+            const severityIcon = {
+                critical: '🔴',
+                high: '🟠',
+                medium: '🟡'
+            }[f.severity] || '⚪';
+            
+            output += `   ${severityIcon} Line ${f.line}: ${f.description}\n`;
+            output += `      Value: ${f.maskedValue}\n`;
+            output += `      Preview: ${f.linePreview.substring(0, 60)}...\n\n`;
+        }
+    }
+    
+    output += '══════════════════════════════════════════════════════════════\n';
+    output += '💡 How to fix:\n';
+    output += '   1. Move secrets to .env file\n';
+    output += '   2. Use process.env.YOUR_SECRET_NAME in code\n';
+    output += '   3. Ensure .env is in .gitignore\n';
+    output += '══════════════════════════════════════════════════════════════\n';
+    
+    return output;
+}
+
+/**
+ * Get severity statistics
+ * @param {Array} findings - Array of findings
+ * @returns {Object} Counts by severity
+ */
+function getSeverityStats(findings) {
+    return {
+        critical: findings.filter(f => f.severity === 'critical').length,
+        high: findings.filter(f => f.severity === 'high').length,
+        medium: findings.filter(f => f.severity === 'medium').length,
+        total: findings.length
+    };
+}
+
+// =============================================================================
+// EXPORTS
+// =============================================================================
+
+module.exports = {
+    SECRET_PATTERNS,
+    scanContent,
+    scanFile,
+    scanDirectory,
+    maskSecret,
+    formatFindings,
+    getSeverityStats
+};

package/src/lib/vector/store.js

@@ -111,6 +111,8 @@ class VectorStore {
 
     // Helper: Cosine Similarity
     cosineSimilarity(vecA, vecB) {
+        if (!vecA || !vecB || vecA.length !== vecB.length) return 0;
+
         let dotProduct = 0;
         let normA = 0;
         let normB = 0;

package/.antigravity/.ai-memory/context.json

@@ -1,36 +0,0 @@
-{
-  "version": "1.0",
-  "project": {
-    "name": null,
-    "description": null,
-    "tech_stack": [],
-    "architecture": null,
-    "created_at": "2025-12-28T04:11:22.462Z",
-    "updated_at": "2025-12-28T04:11:29.074Z"
-  },
-  "session": {
-    "last_task": null,
-    "current_phase": null,
-    "open_files": [],
-    "pending_actions": [],
-    "last_accessed": "2025-12-28T04:11:29.074Z"
-  },
-  "decisions": [
-    {
-      "id": 1766895086169,
-      "decision": "Tech Stack",
-      "reason": "Next.js 14 + Tailwind CSS + Framer Motion",
-      "files_affected": [],
-      "timestamp": "2025-12-28T04:11:26.169Z"
-    }
-  ],
-  "notes": [
-    {
-      "id": 1766895089072,
-      "note": "Project Goal: High-converting SaaS Landing Page for AI Tool",
-      "category": "general",
-      "timestamp": "2025-12-28T04:11:29.072Z"
-    }
-  ],
-  "entities": {}
-}