argus-eye 0.1.0 → 0.2.0

package/lib/crypto.d.ts

@@ -0,0 +1,5 @@
+/** AES-256-GCM 加密。返回 base64(iv | tag | ciphertext)。 */
+export declare function encryptBuffer(plain: Buffer, token: string): string;
+export declare function decryptBuffer(payloadBase64: string, token: string): Buffer;
+export declare const ENC_ALGO: "aes-256-gcm";
+export type EncAlgo = typeof ENC_ALGO;

package/lib/index.mjs

@@ -160,6 +160,37 @@ var FullscreenDetector = class {
   }
 };
 
+// src/crypto.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+  scryptSync
+} from "node:crypto";
+var ALGO = "aes-256-gcm";
+var IV_LEN = 12;
+var KEY_LEN = 32;
+var SALT = Buffer.from("argus.peek.v1", "utf8");
+var keyCache = /* @__PURE__ */ new Map();
+function deriveKey(token) {
+  let key = keyCache.get(token);
+  if (key) return key;
+  key = scryptSync(token, SALT, KEY_LEN);
+  keyCache.set(token, key);
+  return key;
+}
+__name(deriveKey, "deriveKey");
+function encryptBuffer(plain, token) {
+  const key = deriveKey(token);
+  const iv = randomBytes(IV_LEN);
+  const cipher = createCipheriv(ALGO, key, iv);
+  const ct = Buffer.concat([cipher.update(plain), cipher.final()]);
+  const tag2 = cipher.getAuthTag();
+  return Buffer.concat([iv, tag2, ct]).toString("base64");
+}
+__name(encryptBuffer, "encryptBuffer");
+var ENC_ALGO = "aes-256-gcm";
+
 // src/client.ts
 var HEARTBEAT_TIMEOUT_MS = 9e4;
 var ArgusClient = class {
@@ -364,18 +395,19 @@ var ArgusClient = class {
         display: target,
         format: this.config.format
       });
-      const base64 = result.buffer.toString("base64");
+      const payload = encryptBuffer(result.buffer, this.config.token);
       this.send({
         type: "peek_result",
         id: frame.id,
-        image: base64,
+        image: payload,
+        enc: ENC_ALGO,
         mime: result.mime,
         display: frame.display
       });
       const elapsed = Date.now() - start2;
       const kb = (result.buffer.length / 1024).toFixed(1);
       logger.info(
-        `peek #${frame.id} → display ${frame.display ?? "default"} (${kb} KB ${this.config.format}, ${elapsed}ms)`
+        `peek #${frame.id} → display ${frame.display ?? "default"} (${kb} KB ${this.config.format} encrypted, ${elapsed}ms)`
       );
     } catch (err) {
       const message = err instanceof Error ? err.message : String(err);

package/lib/protocol.d.ts

@@ -27,6 +27,7 @@ export interface PeekResultFrame {
     type: 'peek_result';
     id: string;
     image: string;
+    enc?: 'aes-256-gcm' | 'none';
     mime?: string;
     width?: number;
     height?: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "argus-eye",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "type": "module",
   "description": "Argus eye —— koishi-plugin-argus 的截图客户端 CLI。",
   "author": "dingyi222666 <dingyi222666@foxmail.com>",

package/readme.md

@@ -60,6 +60,12 @@ CLI 默认开启全屏检测：当截屏时检测到当前焦点窗口铺满整
 
 环境变量：`ARGUS_SERVER` / `ARGUS_TOKEN` / `ARGUS_NAME`。
 
+## 加密
+
+截图 buffer 走 WebSocket 之前会用 `AES-256-GCM` 加密，key 由 `--token`
+经 scrypt 派生，IV 每帧随机。同一 token 的插件端会解出来；token 不对的
+中间人 / 抓包工具拿到的都是密文。
+
 ## 平台说明
 
 底层使用 [`screenshot-desktop`](https://www.npmjs.com/package/screenshot-desktop)：