autho 3.0.4 → 3.0.5

package/dist/autho.js

@@ -590,7 +590,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "autho",
-    version: "3.0.4",
+    version: "3.0.5",
     description: "Local-first secret manager for humans and coding agents, rebuilt on Bun",
     type: "module",
     bin: {
@@ -4105,7 +4105,7 @@ var init_palette = __esm(() => {
 // apps/cli/src/tui/settings.tsx
 import { existsSync as existsSync5, writeFileSync as writeFileSync2 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname3, join as join3, resolve as resolve4 } from "path";
+import { dirname as dirname3, join as join3, resolve as resolve5 } from "path";
 import { useKeyboard as useKeyboard4, useTerminalDimensions as useTerminalDimensions3 } from "@opentui/react";
 import { useCallback, useEffect as useEffect4, useMemo as useMemo3, useRef as useRef5, useState as useState4 } from "react";
 import { jsx as jsx4, jsxs as jsxs4, Fragment } from "@opentui/react/jsx-runtime";
@@ -4372,7 +4372,7 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
         return;
       case "vaultDir": {
         const config = { ...loadConfig() };
-        const target = first.trim() ? resolve4(first.trim()).replace(/\\/g, "/") : null;
+        const target = first.trim() ? resolve5(first.trim()).replace(/\\/g, "/") : null;
         if (target)
           config.vaultDir = target;
         else
@@ -4440,7 +4440,7 @@ function SettingsScreen({ vaultPath, setHints, onBack, passkeyRunner = runPasske
         registerPasskey(first.trim());
         return;
       case "recoveryPath": {
-        const target = resolve4(first.trim() || join3(homedir2(), "autho-recovery.txt"));
+        const target = resolve5(first.trim() || join3(homedir2(), "autho-recovery.txt"));
         if (existsSync5(target)) {
           setError("That file already exists \u2014 pick another name");
           return;
@@ -6238,10 +6238,9 @@ var init_tui = __esm(() => {
 init_clipboard();
 init_passkey();
 init_package();
-import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync6, readFileSync as readFileSync6, writeFileSync as writeFileSync3 } from "fs";
 import { createInterface as createInterface2 } from "readline/promises";
-import { basename as basename4, isAbsolute, resolve as resolve5 } from "path";
+import { basename as basename4, isAbsolute, resolve as resolve6 } from "path";
 
 // apps/cli/src/password.ts
 import { createInterface } from "readline/promises";
@@ -6683,6 +6682,321 @@ async function daemonStop(options) {
 // apps/cli/src/index.ts
 init_src3();
 init_os_secrets();
+
+// apps/web/src/server.ts
+init_src();
+init_src3();
+init_os_secrets();
+import { randomBytes as randomBytes6 } from "crypto";
+import { resolve as resolve4 } from "path";
+function json2(data, status = 200, headers) {
+  return new Response(JSON.stringify(data, null, 2), {
+    headers: {
+      "content-type": "application/json; charset=utf-8",
+      ...headers ?? {}
+    },
+    status
+  });
+}
+function html(body) {
+  return new Response(body, {
+    headers: {
+      "content-type": "text/html; charset=utf-8"
+    }
+  });
+}
+function parseCookies(request) {
+  const cookieHeader = request.headers.get("cookie") ?? "";
+  return Object.fromEntries(cookieHeader.split(";").map((part) => part.trim()).filter(Boolean).map((part) => {
+    const index = part.indexOf("=");
+    return [part.slice(0, index), decodeURIComponent(part.slice(index + 1))];
+  }));
+}
+async function openSession(vaultPath, state) {
+  return new VaultSession(new AuthoDatabase(vaultPath), state.rootKey, {
+    sealBound: state.sealBound,
+    sealRecord: await loadSealRecord(vaultPath)
+  });
+}
+function requireSession(request, sessions) {
+  const cookies = parseCookies(request);
+  const sessionId = cookies.autho_session;
+  if (!sessionId) {
+    throw new Error("Missing web session");
+  }
+  const session = sessions.get(sessionId);
+  if (!session) {
+    throw new Error("Unknown web session");
+  }
+  if (Date.parse(session.expiresAt) <= Date.now()) {
+    sessions.delete(sessionId);
+    throw new Error("Expired web session");
+  }
+  return { ...session, id: sessionId };
+}
+async function readJson2(request) {
+  return await request.json();
+}
+function page2() {
+  return `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <meta name="viewport" content="width=device-width, initial-scale=1" />
+  <title>Autho</title>
+  <style>
+    :root { color-scheme: light; font-family: ui-sans-serif, system-ui, sans-serif; }
+    body { margin: 0; background: #f5f1e8; color: #1f2937; }
+    main { max-width: 760px; margin: 0 auto; padding: 32px 20px 64px; }
+    section { background: #fffdf8; border: 1px solid #d6cbb8; border-radius: 16px; padding: 20px; margin-bottom: 16px; box-shadow: 0 8px 30px rgba(83,58,18,0.08); }
+    h1 { margin-top: 0; font-size: 2rem; }
+    input, select, button { font: inherit; padding: 10px 12px; border-radius: 10px; border: 1px solid #bca889; }
+    button { background: #1f4d3a; color: white; border: none; cursor: pointer; }
+    form { display: flex; gap: 8px; flex-wrap: wrap; }
+    pre { background: #1f2937; color: #f9fafb; padding: 12px; border-radius: 12px; overflow: auto; }
+    ul { padding-left: 18px; }
+  </style>
+</head>
+<body>
+  <main>
+    <section>
+      <h1>Autho Local Web</h1>
+      <p>Local-only Bun web UI for vault unlock and secret browsing.</p>
+      <form id="unlock-form">
+        <input id="password" type="password" placeholder="Master password" required />
+        <input id="totp" inputmode="numeric" autocomplete="one-time-code" placeholder="Authenticator code (if enabled)" />
+        <button type="submit">Unlock</button>
+      </form>
+    </section>
+    <section>
+      <h2>Secrets</h2>
+      <button id="refresh">Refresh</button>
+      <ul id="secret-list"></ul>
+      <pre id="output"></pre>
+    </section>
+    <section id="linked" hidden>
+      <h2>Linked to <span id="linked-name"></span></h2>
+      <ul id="linked-list"></ul>
+      <p id="linked-from"></p>
+      <form id="link-form">
+        <input id="link-ref" placeholder="Secret name or id to link" required />
+        <button type="submit">Link</button>
+      </form>
+    </section>
+  </main>
+  <script>
+    const output = document.getElementById('output');
+    const secretList = document.getElementById('secret-list');
+    async function refresh() {
+      const response = await fetch('/api/secrets');
+      if (!response.ok) {
+        output.textContent = await response.text();
+        return;
+      }
+      const data = await response.json();
+      secretList.innerHTML = '';
+      data.data.forEach((secret) => {
+        const item = document.createElement('li');
+        const open = document.createElement('a');
+        open.href = '#';
+        open.textContent = secret.name + " (" + secret.type + ")" + (secret.linkCount ? " \xB7 " + secret.linkCount + " linked" : "");
+        open.addEventListener('click', (event) => { event.preventDefault(); showSecret(secret.id); });
+        item.appendChild(open);
+        secretList.appendChild(item);
+      });
+      output.textContent = JSON.stringify(data, null, 2);
+    }
+    let current = null;
+    async function showSecret(ref) {
+      const response = await fetch('/api/secrets/' + encodeURIComponent(ref));
+      if (!response.ok) {
+        output.textContent = await response.text();
+        return;
+      }
+      const secret = (await response.json()).data;
+      current = secret;
+      const { links, linkedFrom, ...rest } = secret;
+      output.textContent = JSON.stringify(rest, null, 2);
+      document.getElementById('linked').hidden = false;
+      document.getElementById('linked-name').textContent = secret.name;
+      const list = document.getElementById('linked-list');
+      list.innerHTML = '';
+      if (!links.length) {
+        list.innerHTML = '<li>No linked secrets</li>';
+      }
+      links.forEach((linked) => {
+        const item = document.createElement('li');
+        const open = document.createElement('a');
+        open.href = '#';
+        open.textContent = linked.name + " (" + linked.type + ") ";
+        open.addEventListener('click', (event) => { event.preventDefault(); showSecret(linked.id); });
+        const unlink = document.createElement('button');
+        unlink.textContent = 'Unlink';
+        unlink.addEventListener('click', () => changeLink('DELETE', linked.id));
+        item.append(open, unlink);
+        list.appendChild(item);
+      });
+      document.getElementById('linked-from').textContent = linkedFrom.length
+        ? 'Linked from: ' + linkedFrom.map((primary) => primary.name).join(', ')
+        : '';
+    }
+    async function changeLink(method, secret) {
+      const response = await fetch('/api/links', {
+        method,
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ primary: current.id, secret })
+      });
+      if (!response.ok) {
+        output.textContent = await response.text();
+        return;
+      }
+      await showSecret(current.id);
+      await refresh();
+    }
+    document.getElementById('link-form').addEventListener('submit', async (event) => {
+      event.preventDefault();
+      const input = document.getElementById('link-ref');
+      await changeLink('POST', input.value);
+      input.value = '';
+    });
+    document.getElementById('unlock-form').addEventListener('submit', async (event) => {
+      event.preventDefault();
+      const response = await fetch('/api/session/unlock', {
+        method: 'POST',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({
+          password: document.getElementById('password').value,
+          totp: document.getElementById('totp').value || undefined
+        })
+      });
+      output.textContent = await response.text();
+      if (response.ok) {
+        await refresh();
+      }
+    });
+    document.getElementById('refresh').addEventListener('click', refresh);
+  </script>
+</body>
+</html>`;
+}
+async function startWebServer(options = {}) {
+  const vaultPath = resolve4(options.vaultPath ?? defaultVaultPath());
+  const host = options.host ?? "127.0.0.1";
+  const port = options.port ?? 8061;
+  const sessions = new Map;
+  const cleanup = () => {
+    for (const [id, session] of sessions.entries()) {
+      if (Date.parse(session.expiresAt) <= Date.now()) {
+        sessions.delete(id);
+      }
+    }
+  };
+  const server = Bun.serve({
+    fetch: async (request) => {
+      cleanup();
+      const url = new URL(request.url);
+      try {
+        if (request.method === "GET" && url.pathname === "/health") {
+          return json2({ ok: true, running: true, vaultPath });
+        }
+        if (request.method === "GET" && url.pathname === "/") {
+          return html(page2());
+        }
+        if (request.method === "POST" && url.pathname === "/api/session/unlock") {
+          const body = await readJson2(request);
+          const ttlSeconds = body.ttlSeconds ?? 3600;
+          if (ttlSeconds <= 0 || ttlSeconds > 86400) {
+            return json2({ error: "Session TTL must be between 1 and 86400 seconds" }, 400);
+          }
+          const { rootKey, sealBound } = VaultService.unlockRootKey(vaultPath, {
+            password: body.password,
+            sealRecord: await loadSealRecord(vaultPath),
+            totp: body.totp
+          });
+          const sessionId = randomBytes6(16).toString("hex");
+          const expiresAt = new Date(Date.now() + ttlSeconds * 1000).toISOString();
+          sessions.set(sessionId, { expiresAt, rootKey, sealBound });
+          return json2({ expiresAt, sessionId }, 200, { "set-cookie": `autho_session=${sessionId}; HttpOnly; SameSite=Strict; Path=/; Secure` });
+        }
+        if (request.method === "POST" && url.pathname === "/api/session/lock") {
+          const cookies = parseCookies(request);
+          if (cookies.autho_session) {
+            sessions.delete(cookies.autho_session);
+          }
+          return json2({ locked: true }, 200, { "set-cookie": "autho_session=; Max-Age=0; Path=/; Secure" });
+        }
+        if (url.pathname.startsWith("/api/")) {
+          const webSession = requireSession(request, sessions);
+          const session = await openSession(vaultPath, webSession);
+          try {
+            if (request.method === "GET" && url.pathname === "/api/status") {
+              return json2({
+                initialized: true,
+                secretCount: session.listSecrets().length,
+                unlocked: true,
+                vaultPath
+              });
+            }
+            if (request.method === "GET" && url.pathname === "/api/secrets") {
+              return json2({ data: session.listSecretIndex() });
+            }
+            if (request.method === "GET" && url.pathname.startsWith("/api/secrets/")) {
+              const ref = decodeURIComponent(url.pathname.slice("/api/secrets/".length));
+              const { linkedFrom, links } = session.getLinks(ref);
+              return json2({ data: { ...session.getSecret(ref), linkedFrom, links } });
+            }
+            if ((request.method === "POST" || request.method === "DELETE") && url.pathname === "/api/links") {
+              const body = await readJson2(request);
+              return json2({
+                data: request.method === "POST" ? session.linkSecrets(body.primary, body.secret) : session.unlinkSecrets(body.primary, body.secret)
+              });
+            }
+            if (request.method === "POST" && url.pathname === "/api/secrets") {
+              const body = await readJson2(request);
+              return json2({
+                data: session.addSecret({
+                  metadata: Object.fromEntries(Object.entries({
+                    algorithm: body.algorithm,
+                    description: body.description,
+                    digits: body.digits,
+                    url: body.url
+                  }).filter(([, value]) => value !== undefined)),
+                  name: body.name,
+                  type: body.type,
+                  username: body.username,
+                  value: body.value
+                })
+              }, 201);
+            }
+            if (request.method === "DELETE" && url.pathname.startsWith("/api/secrets/")) {
+              const ref = decodeURIComponent(url.pathname.slice("/api/secrets/".length));
+              return json2({ data: session.removeSecret(ref, { withLinked: url.searchParams.get("withLinked") === "1" }) });
+            }
+            if (request.method === "GET" && url.pathname.startsWith("/api/otp/")) {
+              const ref = decodeURIComponent(url.pathname.slice("/api/otp/".length));
+              return json2({ data: session.generateOtp(ref) });
+            }
+          } finally {
+            await closeSessionAndRecordSeal(vaultPath, session);
+          }
+        }
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const status = /session/i.test(message) ? 401 : 400;
+        return json2({ error: message }, status);
+      }
+      return json2({ error: "Not found" }, 404);
+    },
+    hostname: host,
+    port
+  });
+  process.on("SIGINT", () => process.exit(0));
+  process.on("SIGTERM", () => process.exit(0));
+  console.log(`Autho web server listening on http://${host}:${server.port}`);
+  await new Promise(() => {});
+}
+
+// apps/cli/src/index.ts
 function parseArgs(argv) {
   const dashDashIndex = argv.indexOf("--");
   const main = dashDashIndex === -1 ? argv : argv.slice(0, dashDashIndex);
@@ -6776,7 +7090,7 @@ function printSealChanges(changes, diffTrusted) {
   }
 }
 function absolutePath(path) {
-  return resolve5(path);
+  return resolve6(path);
 }
 function buildSecretMetadata(args) {
   return Object.fromEntries(Object.entries({
@@ -7031,34 +7345,10 @@ async function runInitWizard(vaultPath, password, existingCreds) {
   console.log("Setup complete. Run \x1B[1mautho init\x1B[0m anytime to change these settings.");
 }
 async function runWebServer(vaultPath, args) {
-  const commandArgs = [
-    "run",
-    absolutePath("./apps/web/src/index.ts"),
-    "serve",
-    "--vault",
-    absolutePath(vaultPath)
-  ];
-  const host = getString(args, "host");
-  const port = getString(args, "port") ?? String(numberPreference("webPort"));
-  if (host) {
-    commandArgs.push("--host", host);
-  }
-  if (port) {
-    commandArgs.push("--port", port);
-  }
-  await new Promise((resolvePromise, rejectPromise) => {
-    const child = spawn3(process.execPath, commandArgs, {
-      cwd: process.cwd(),
-      stdio: "inherit"
-    });
-    child.on("exit", (code) => {
-      if (code === 0) {
-        resolvePromise();
-        return;
-      }
-      rejectPromise(new Error(`Web server exited with code ${code ?? 1}`));
-    });
-    child.on("error", rejectPromise);
+  await startWebServer({
+    host: getString(args, "host"),
+    port: Number(getString(args, "port") ?? numberPreference("webPort")),
+    vaultPath: absolutePath(vaultPath)
   });
 }
 function help() {
@@ -7235,7 +7525,7 @@ async function main() {
       console.log("  Tip: Use a cloud-synced folder (e.g. Google Drive) to share the vault across machines.");
       const customDir = (await readLine(`  Path (Enter to keep default): `)).trim();
       if (customDir && customDir !== currentDir) {
-        const resolved = resolve5(customDir).replace(/\\/g, "/");
+        const resolved = resolve6(customDir).replace(/\\/g, "/");
         saveConfig({ ...config, vaultDir: resolved });
         effectiveVaultPath = resolved + "/vault.db";
         console.log(`  \x1B[32m\u2713\x1B[0m Vault directory set to ${resolved}`);
@@ -7303,7 +7593,7 @@ async function main() {
         if (key === "autoLock") {
           updated.autoLock = value === "true";
         } else if (key === "vaultDir") {
-          updated.vaultDir = isAbsolute(value) ? value : resolve5(value);
+          updated.vaultDir = isAbsolute(value) ? value : resolve6(value);
         } else if (key === "editor") {
           updated.editor = value;
         } else if (key === "autoLockTimeout") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "autho",
-  "version": "3.0.4",
+  "version": "3.0.5",
   "description": "Local-first secret manager for humans and coding agents, rebuilt on Bun",
   "type": "module",
   "bin": {