ashlr-plugin 1.36.4

package/scripts/genome-key.ts

@@ -0,0 +1,233 @@
+#!/usr/bin/env bun
+/**
+ * genome-key.ts — CLI for managing team genome encryption keys.
+ *
+ * Usage:
+ *   bun run scripts/genome-key.ts generate <genomeId>
+ *   bun run scripts/genome-key.ts export   <genomeId>
+ *   bun run scripts/genome-key.ts import   <genomeId> <base32>
+ *   bun run scripts/genome-key.ts rotate   <genomeId>
+ *
+ * Keys are stored at ~/.ashlr/team-keys/<genomeId>.key (mode 0600, 32 raw bytes).
+ * Export/import uses base32 (RFC 4648) for human-friendly sharing over Signal,
+ * 1Password, etc.
+ *
+ * Key rotation procedure:
+ *   1. Reads all sections from the remote genome via the API.
+ *   2. Decrypts each section with the current key.
+ *   3. Generates a new key, encrypts all sections with it.
+ *   4. Pushes all re-encrypted sections to the remote.
+ *   5. Saves the new key file.
+ *   After rotation, share the new key with all team members via a secure channel.
+ *   Members who do not receive the new key will be unable to decrypt future sections.
+ */
+
+import { join } from "path";
+import { homedir } from "os";
+import {
+  generateKey,
+  loadKey,
+  saveKey,
+  encryptSection,
+  decryptSection,
+  serializeBlob,
+  parseBlob,
+  encodeBase32,
+  decodeBase32,
+} from "../servers/_genome-crypto.ts";
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function die(msg: string): never {
+  process.stderr.write(`[genome-key] ERROR: ${msg}\n`);
+  process.exit(1);
+}
+
+function info(msg: string): void {
+  process.stdout.write(`${msg}\n`);
+}
+
+function keyFilePath(genomeId: string): string {
+  return join(homedir(), ".ashlr", "team-keys", `${genomeId}.key`);
+}
+
+async function promptConfirm(question: string): Promise<boolean> {
+  process.stdout.write(`${question} [y/N] `);
+  // Use process.stdin — works on Windows, macOS, and Linux without /dev/tty.
+  return new Promise((resolve) => {
+    const chunks: Buffer[] = [];
+    const onData = (c: Buffer) => {
+      chunks.push(c);
+      const s = Buffer.concat(chunks).toString("utf-8");
+      if (s.includes("\n") || s.includes("\r")) {
+        process.stdin.removeListener("data", onData);
+        process.stdin.pause();
+        const answer = s.trim().toLowerCase();
+        resolve(answer === "y" || answer === "yes");
+      }
+    };
+    process.stdin.resume();
+    process.stdin.setEncoding("utf-8");
+    process.stdin.on("data", onData);
+    process.stdin.once("end", () => resolve(false));
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Commands
+// ---------------------------------------------------------------------------
+
+async function cmdGenerate(genomeId: string): Promise<void> {
+  const existing = await loadKey(genomeId);
+  if (existing) {
+    const ok = await promptConfirm(
+      `A key already exists at ${keyFilePath(genomeId)}. Overwrite?`,
+    );
+    if (!ok) die("Aborted.");
+  }
+  const key = generateKey();
+  await saveKey(genomeId, key);
+  info(`Key generated and saved to ${keyFilePath(genomeId)} (mode 0600).`);
+  info(`Share it with team members using: bun run scripts/genome-key.ts export ${genomeId}`);
+}
+
+async function cmdExport(genomeId: string): Promise<void> {
+  const key = await loadKey(genomeId);
+  if (!key) die(`No key found at ${keyFilePath(genomeId)}. Run 'generate' first.`);
+
+  const ok = await promptConfirm(
+    "This will print your team encryption key to stdout. Only share over a secure channel (Signal, 1Password, etc.). Continue?",
+  );
+  if (!ok) die("Aborted.");
+
+  const encoded = encodeBase32(key);
+  info("");
+  info("=== TEAM GENOME KEY (keep secret) ===");
+  info(encoded);
+  info("=====================================");
+  info("");
+  info("Share this with team members. They import it with:");
+  info(`  bun run scripts/genome-key.ts import ${genomeId} <key>`);
+}
+
+async function cmdImport(genomeId: string, base32Key: string): Promise<void> {
+  let key: Buffer;
+  try {
+    key = decodeBase32(base32Key);
+  } catch (err) {
+    die(`Invalid base32 key: ${String(err)}`);
+  }
+  if (key.length !== 32) {
+    die(`Key must be 32 bytes when decoded (got ${key.length}). Make sure you copied the full key.`);
+  }
+  await saveKey(genomeId, key);
+  info(`Key imported and saved to ${keyFilePath(genomeId)} (mode 0600).`);
+}
+
+async function cmdRotate(genomeId: string): Promise<void> {
+  const apiUrl   = process.env["ASHLR_API_URL"]        ?? "https://api.ashlr.ai";
+  const proToken = process.env["ASHLR_PRO_TOKEN"]      ?? "";
+  if (!proToken) die("ASHLR_PRO_TOKEN is not set. Cannot pull/push sections for rotation.");
+
+  const currentKey = await loadKey(genomeId);
+  if (!currentKey) die(`No key found at ${keyFilePath(genomeId)}. Cannot rotate without the current key.`);
+
+  info(`Rotating key for genome ${genomeId}...`);
+  info("Step 1/4: Fetching all sections from remote...");
+
+  const pullRes = await fetch(`${apiUrl}/genome/${genomeId}/pull?since=0`, {
+    headers: { Authorization: `Bearer ${proToken}` },
+  });
+  if (!pullRes.ok) die(`Pull failed: ${pullRes.status} ${await pullRes.text()}`);
+
+  const pullData = await pullRes.json() as {
+    sections: Array<{ path: string; content: string; content_encrypted: boolean; vclock: Record<string, number> }>;
+  };
+
+  info(`Step 2/4: Decrypting ${pullData.sections.length} section(s) with current key...`);
+  const decrypted: Array<{ path: string; plaintext: string; vclock: Record<string, number> }> = [];
+  for (const sec of pullData.sections) {
+    if (!sec.content_encrypted) {
+      // Plaintext section — carry forward as-is
+      decrypted.push({ path: sec.path, plaintext: sec.content, vclock: sec.vclock });
+      continue;
+    }
+    try {
+      const blob      = parseBlob(sec.content);
+      const plaintext = decryptSection(blob, currentKey);
+      decrypted.push({ path: sec.path, plaintext, vclock: sec.vclock });
+    } catch {
+      process.stderr.write(`[genome-key] WARNING: failed to decrypt ${sec.path} — skipping\n`);
+    }
+  }
+
+  info("Step 3/4: Generating new key and re-encrypting sections...");
+  const newKey = generateKey();
+  const reencrypted = decrypted.map((sec) => ({
+    path:    sec.path,
+    content: serializeBlob(encryptSection(sec.plaintext, newKey)),
+    vclock:  sec.vclock,
+  }));
+
+  if (reencrypted.length > 0) {
+    info(`Step 4/4: Pushing ${reencrypted.length} re-encrypted section(s)...`);
+    const clientId = `genome-key-rotate-${process.pid}`;
+    // Push in batches of 10 (rate limit)
+    for (let i = 0; i < reencrypted.length; i += 10) {
+      const batch = reencrypted.slice(i, i + 10);
+      const pushRes = await fetch(`${apiUrl}/genome/${genomeId}/push`, {
+        method:  "POST",
+        headers: { Authorization: `Bearer ${proToken}`, "Content-Type": "application/json" },
+        body:    JSON.stringify({ clientId, sections: batch }),
+      });
+      if (!pushRes.ok) die(`Push failed on batch ${i / 10 + 1}: ${pushRes.status} ${await pushRes.text()}`);
+    }
+  } else {
+    info("Step 4/4: No sections to push.");
+  }
+
+  await saveKey(genomeId, newKey);
+  info(`\nRotation complete. New key saved to ${keyFilePath(genomeId)} (mode 0600).`);
+  info("IMPORTANT: Share the new key with all active team members:");
+  info(`  bun run scripts/genome-key.ts export ${genomeId}`);
+  info("Team members who do not receive the new key will be unable to read future encrypted sections.");
+}
+
+// ---------------------------------------------------------------------------
+// Entry point
+// ---------------------------------------------------------------------------
+
+const [,, command, genomeId, ...rest] = process.argv;
+
+if (!command || !genomeId) {
+  process.stderr.write(
+    "Usage:\n" +
+    "  bun run scripts/genome-key.ts generate <genomeId>\n" +
+    "  bun run scripts/genome-key.ts export   <genomeId>\n" +
+    "  bun run scripts/genome-key.ts import   <genomeId> <base32>\n" +
+    "  bun run scripts/genome-key.ts rotate   <genomeId>\n",
+  );
+  process.exit(1);
+}
+
+switch (command) {
+  case "generate":
+    await cmdGenerate(genomeId);
+    break;
+  case "export":
+    await cmdExport(genomeId);
+    break;
+  case "import": {
+    const b32 = rest[0];
+    if (!b32) die("Missing base32 key argument.");
+    await cmdImport(genomeId, b32);
+    break;
+  }
+  case "rotate":
+    await cmdRotate(genomeId);
+    break;
+  default:
+    die(`Unknown command: ${command}. Use generate | export | import | rotate.`);
+}

package/scripts/genome-keygen.ts

@@ -0,0 +1,168 @@
+#!/usr/bin/env bun
+/**
+ * genome-keygen.ts — generate an X25519 keypair for team-cloud-genome v2 and
+ * upload the public half to the Ashlr server.
+ *
+ * Invoked by /ashlr-genome-keygen. Idempotent: if a keypair already exists
+ * on disk and the server already has the matching pubkey, it prints "already
+ * registered" and exits 0.
+ *
+ * Flow:
+ *   1. Read ~/.ashlr/pro-token (from /ashlr-upgrade).
+ *   2. GET /user/me → userId.
+ *   3. Check local ~/.ashlr/member-keys/<userId>.json + server /user/genome-pubkey:
+ *        - both present + same pubkey → no-op.
+ *        - local absent OR server absent → regenerate + upload.
+ *   4. Generate X25519 keypair.
+ *   5. Save locally (mode 0600).
+ *   6. POST /user/genome-pubkey with { pubkey, alg: "x25519-v1" }.
+ *
+ * Flags:
+ *   --force          regenerate even if a keypair already exists (rotates it)
+ *   --endpoint <url> override default https://api.ashlr.ai
+ *   --dry-run        print what would happen; no network, no file writes
+ */
+
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+
+import {
+  generateKeyPair,
+  loadKeypair,
+  memberKeyPath,
+  saveKeypair,
+  type StoredKeypair,
+} from "../servers/_genome-crypto-v2";
+
+const DEFAULT_API = process.env.ASHLR_API_URL ?? "https://api.ashlr.ai";
+const ALG = "x25519-v1";
+
+function proTokenPath(): string {
+  return join(process.env.HOME ?? homedir(), ".ashlr", "pro-token");
+}
+
+function readProToken(): string | null {
+  const path = proTokenPath();
+  if (!existsSync(path)) return null;
+  const t = readFileSync(path, "utf-8").trim();
+  return t || null;
+}
+
+interface Args {
+  force: boolean;
+  dryRun: boolean;
+  endpoint: string;
+  help: boolean;
+}
+
+function parseArgs(argv: string[]): Args {
+  const out: Args = { force: false, dryRun: false, endpoint: DEFAULT_API, help: false };
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "-h" || a === "--help") out.help = true;
+    else if (a === "--force") out.force = true;
+    else if (a === "--dry-run") out.dryRun = true;
+    else if (a === "--endpoint") out.endpoint = argv[++i] ?? out.endpoint;
+  }
+  return out;
+}
+
+function err(m: string): void { process.stderr.write(m + "\n"); }
+function out(m: string): void { process.stdout.write(m + "\n"); }
+
+async function api<T>(method: string, url: string, token: string, body?: unknown): Promise<{ status: number; body: T | null }> {
+  const headers: Record<string, string> = {
+    authorization: `Bearer ${token}`,
+  };
+  const init: RequestInit = { method, headers };
+  if (body !== undefined) {
+    headers["content-type"] = "application/json";
+    init.body = JSON.stringify(body);
+  }
+  const res = await fetch(url, init);
+  let j: T | null = null;
+  try { j = (await res.json()) as T; } catch { /* non-JSON / 404 body */ }
+  return { status: res.status, body: j };
+}
+
+export async function run(argv: string[]): Promise<number> {
+  const args = parseArgs(argv);
+  if (args.help) {
+    err("Usage: /ashlr-genome-keygen [--force] [--dry-run] [--endpoint <url>]");
+    return 0;
+  }
+
+  const token = readProToken();
+  if (!token) {
+    err("No Ashlr Pro token found. Run /ashlr-upgrade first.");
+    return 2;
+  }
+
+  // Resolve user id.
+  const me = await api<{ userId: string; email: string }>("GET", `${args.endpoint}/user/me`, token);
+  if (me.status !== 200 || !me.body) {
+    err(`Couldn't resolve your Ashlr account (status ${me.status}).`);
+    return 3;
+  }
+  const userId = me.body.userId;
+
+  // Current state.
+  const localKp = loadKeypair(userId);
+  const serverPk = await api<{ pubkey: string; alg: string }>(
+    "GET", `${args.endpoint}/user/genome-pubkey`, token,
+  );
+
+  const haveLocal  = localKp !== null;
+  const haveServer = serverPk.status === 200 && !!serverPk.body;
+  const inSync     = haveLocal && haveServer && localKp!.publicKey === serverPk.body!.pubkey;
+
+  if (inSync && !args.force) {
+    out(`Already registered.`);
+    out(`  pubkey: ${localKp!.publicKey}`);
+    out(`  alg:    ${localKp!.alg}`);
+    out(`  path:   ${memberKeyPath(userId)}`);
+    return 0;
+  }
+
+  if (args.dryRun) {
+    err("--dry-run: would generate a fresh X25519 keypair and upload the public half.");
+    return 0;
+  }
+
+  // Generate.
+  const { publicKey, privateKey } = generateKeyPair();
+  const stored: StoredKeypair = {
+    userId,
+    publicKey,
+    privateKey,
+    alg: ALG,
+    createdAt: new Date().toISOString(),
+  };
+  const path = saveKeypair(stored);
+
+  // Upload.
+  const up = await api<{ ok: boolean }>(
+    "POST", `${args.endpoint}/user/genome-pubkey`, token,
+    { pubkey: publicKey, alg: ALG },
+  );
+  if (up.status !== 200) {
+    err(`Upload failed: HTTP ${up.status}`);
+    return 3;
+  }
+
+  out(`Generated X25519 keypair.`);
+  out(`  pubkey: ${publicKey}`);
+  out(`  alg:    ${ALG}`);
+  out(`  path:   ${path}`);
+  out(``);
+  out(`Your public key is now on file with Ashlr. Keep ${path} private — it is`);
+  out(`the only way to decrypt team-cloud genomes shared with you.`);
+  return 0;
+}
+
+if (import.meta.main) {
+  run(process.argv.slice(2))
+    .then((code) => process.exit(code))
+    .catch((e) => { err(`fatal: ${(e as Error).message}`); process.exit(1); });
+}

package/scripts/genome-link.ts

@@ -0,0 +1,59 @@
+/**
+ * genome-link — walk up parent directories looking for a genome.
+ *
+ * When a project has no `.ashlrcode/genome/` of its own, ashlr tools can fall
+ * back to a genome in an ancestor directory (e.g. a workspace-level genome at
+ * `~/Desktop/.ashlrcode/genome/`). This module locates that ancestor.
+ *
+ * The walk stops at whichever comes first:
+ *   - a directory containing `.ashlrcode/genome/manifest.json`
+ *   - `$HOME` (we never look at `$HOME` itself or above — user-level genomes
+ *     are out of scope; we want *workspace* genomes)
+ *   - the filesystem root
+ *   - `maxDepth` parents (default 4)
+ */
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { dirname, join, resolve, sep } from "path";
+
+const GENOME_MANIFEST_REL = ".ashlrcode/genome/manifest.json";
+const DEFAULT_MAX_DEPTH = 4;
+
+function hasGenome(dir: string): boolean {
+  return existsSync(join(dir, GENOME_MANIFEST_REL));
+}
+
+/**
+ * Walk up from `startDir` looking for the first ancestor that contains
+ * `.ashlrcode/genome/manifest.json`. Returns that directory's absolute path,
+ * or `null` if none is found within `maxDepth` steps.
+ *
+ * The walk skips `startDir` itself — callers should check the current dir
+ * separately via `genomeExists(cwd)`. We stop before reaching `$HOME` so we
+ * don't accidentally attach a user-level genome to an unrelated project.
+ */
+export function findParentGenome(
+  startDir: string,
+  maxDepth: number = DEFAULT_MAX_DEPTH,
+): string | null {
+  const home = resolve(homedir());
+  let current = resolve(startDir);
+  let depth = 0;
+
+  while (depth < maxDepth) {
+    const parent = dirname(current);
+    // Stop at filesystem root (dirname of "/" is "/") to avoid infinite loop.
+    if (parent === current) return null;
+    // Stop when we'd cross into or above $HOME — workspace genomes only,
+    // user-level (~/.ashlrcode) is out of scope.
+    if (parent === home) return null;
+    // Safety: if we somehow walked outside the $HOME subtree, bail.
+    if (!parent.startsWith(home + sep)) return null;
+
+    if (hasGenome(parent)) return parent;
+
+    current = parent;
+    depth++;
+  }
+  return null;
+}