bluelamp 4.1.2 → 4.2.0

package/lib/mcp-password-manager/index.js

@@ -0,0 +1,248 @@
+#!/usr/bin/env node
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema, } from "@modelcontextprotocol/sdk/types.js";
+import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+import initSqlJs from "sql.js";
+const ALGORITHM = "aes-256-gcm";
+const VAULT_DIR = join(homedir(), ".musuhi");
+const DB_PATH = join(VAULT_DIR, "vault.db");
+const KEY_PATH = join(VAULT_DIR, "vault.key");
+function ensureVaultDir() {
+    if (!existsSync(VAULT_DIR)) {
+        mkdirSync(VAULT_DIR, { recursive: true, mode: 0o700 });
+    }
+}
+function getEncryptionKey() {
+    // 1. Environment variable takes priority (backward compat)
+    const envKey = process.env.VAULT_ENCRYPTION_KEY;
+    if (envKey) {
+        const buf = Buffer.from(envKey, "hex");
+        if (buf.length !== 32) {
+            throw new Error("VAULT_ENCRYPTION_KEY must be 32 bytes (64 hex characters)");
+        }
+        return buf;
+    }
+    // 2. Read from key file, or auto-generate on first run
+    ensureVaultDir();
+    if (existsSync(KEY_PATH)) {
+        const hex = readFileSync(KEY_PATH, "utf-8").trim();
+        const buf = Buffer.from(hex, "hex");
+        if (buf.length !== 32) {
+            throw new Error(`Invalid key file at ${KEY_PATH}. Delete it to regenerate.`);
+        }
+        return buf;
+    }
+    // 3. First run: generate and save
+    const newKey = randomBytes(32);
+    writeFileSync(KEY_PATH, newKey.toString("hex"), { mode: 0o600 });
+    return newKey;
+}
+let _db = null;
+async function getDB() {
+    if (_db)
+        return _db;
+    ensureVaultDir();
+    const SQL = await initSqlJs();
+    if (existsSync(DB_PATH)) {
+        const buffer = readFileSync(DB_PATH);
+        _db = new SQL.Database(buffer);
+    }
+    else {
+        _db = new SQL.Database();
+    }
+    _db.run(`
+    CREATE TABLE IF NOT EXISTS vault_entries (
+      service TEXT PRIMARY KEY,
+      username TEXT NOT NULL,
+      encrypted TEXT NOT NULL,
+      iv TEXT NOT NULL,
+      auth_tag TEXT NOT NULL,
+      note TEXT,
+      updated_at TEXT DEFAULT (datetime('now'))
+    )
+  `);
+    return _db;
+}
+function saveDB(db) {
+    const data = db.export();
+    writeFileSync(DB_PATH, Buffer.from(data), { mode: 0o600 });
+}
+function encrypt(plaintext) {
+    const key = getEncryptionKey();
+    const iv = randomBytes(16);
+    const cipher = createCipheriv(ALGORITHM, key, iv);
+    let encrypted = cipher.update(plaintext, "utf-8", "hex");
+    encrypted += cipher.final("hex");
+    const authTag = cipher.getAuthTag().toString("hex");
+    return { encrypted, iv: iv.toString("hex"), authTag };
+}
+function decrypt(encrypted, ivHex, authTagHex) {
+    const key = getEncryptionKey();
+    const iv = Buffer.from(ivHex, "hex");
+    const authTag = Buffer.from(authTagHex, "hex");
+    const decipher = createDecipheriv(ALGORITHM, key, iv);
+    decipher.setAuthTag(authTag);
+    let decrypted = decipher.update(encrypted, "hex", "utf-8");
+    decrypted += decipher.final("utf-8");
+    return decrypted;
+}
+const server = new Server({ name: "password-manager", version: "3.1.0" }, { capabilities: { tools: {} } });
+server.setRequestHandler(ListToolsRequestSchema, async () => ({
+    tools: [
+        {
+            name: "store_password",
+            description: "サービス名・ユーザー名・パスワード/APIキーを暗号化してローカルに保存",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    service: { type: "string", description: "サービス名(例: OpenAI, Google)" },
+                    username: { type: "string", description: "ユーザー名・メールアドレス" },
+                    password: { type: "string", description: "パスワード・APIキー・秘密鍵" },
+                    note: { type: "string", description: "メモ(任意)" },
+                },
+                required: ["service", "username", "password"],
+            },
+        },
+        {
+            name: "get_password",
+            description: "サービス名で検索し、復号したパスワード/APIキーを返す",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    service: { type: "string", description: "サービス名" },
+                },
+                required: ["service"],
+            },
+        },
+        {
+            name: "list_passwords",
+            description: "保存済みサービス一覧を表示(パスワードは非表示)",
+            inputSchema: {
+                type: "object",
+                properties: {},
+            },
+        },
+        {
+            name: "delete_password",
+            description: "指定サービスのパスワードを削除",
+            inputSchema: {
+                type: "object",
+                properties: {
+                    service: { type: "string", description: "削除するサービス名" },
+                },
+                required: ["service"],
+            },
+        },
+    ],
+}));
+server.setRequestHandler(CallToolRequestSchema, async (request) => {
+    const { name, arguments: args } = request.params;
+    try {
+        const db = await getDB();
+        switch (name) {
+            case "store_password": {
+                const { service, username, password, note } = args;
+                const { encrypted, iv, authTag } = encrypt(password);
+                db.run(`INSERT INTO vault_entries (service, username, encrypted, iv, auth_tag, note, updated_at)
+           VALUES (?, ?, ?, ?, ?, ?, datetime('now'))
+           ON CONFLICT (service) DO UPDATE SET
+             username = excluded.username,
+             encrypted = excluded.encrypted,
+             iv = excluded.iv,
+             auth_tag = excluded.auth_tag,
+             note = excluded.note,
+             updated_at = datetime('now')`, [service, username, encrypted, iv, authTag, note ?? null]);
+                saveDB(db);
+                return {
+                    content: [{ type: "text", text: `「${service}」を保存しました(ユーザー: ${username})` }],
+                };
+            }
+            case "get_password": {
+                const { service } = args;
+                const stmt = db.prepare("SELECT * FROM vault_entries WHERE service = ?");
+                stmt.bind([service]);
+                if (!stmt.step()) {
+                    stmt.free();
+                    return {
+                        content: [{ type: "text", text: `「${service}」は見つかりません` }],
+                        isError: true,
+                    };
+                }
+                const entry = stmt.getAsObject();
+                stmt.free();
+                const password = decrypt(entry.encrypted, entry.iv, entry.auth_tag);
+                const lines = [
+                    `${service}`,
+                    `  ユーザー名: ${entry.username}`,
+                    `  パスワード: ${password}`,
+                    ...(entry.note ? [`  メモ: ${entry.note}`] : []),
+                    `  更新日時: ${entry.updated_at}`,
+                ];
+                return { content: [{ type: "text", text: lines.join("\n") }] };
+            }
+            case "list_passwords": {
+                const rows = [];
+                const stmt = db.prepare("SELECT service, username, note, updated_at FROM vault_entries ORDER BY service");
+                while (stmt.step()) {
+                    rows.push(stmt.getAsObject());
+                }
+                stmt.free();
+                if (rows.length === 0) {
+                    return { content: [{ type: "text", text: "保存済みパスワードはありません" }] };
+                }
+                const lines = [`保存済み一覧(${rows.length}件)`, ""];
+                for (const row of rows) {
+                    lines.push(`- ${row.service}`);
+                    lines.push(`  ユーザー: ${row.username}`);
+                    if (row.note)
+                        lines.push(`  メモ: ${row.note}`);
+                    lines.push(`  更新日時: ${row.updated_at}`);
+                    lines.push("");
+                }
+                return { content: [{ type: "text", text: lines.join("\n") }] };
+            }
+            case "delete_password": {
+                const { service } = args;
+                const check = db.prepare("SELECT 1 FROM vault_entries WHERE service = ?");
+                check.bind([service]);
+                const exists = check.step();
+                check.free();
+                if (!exists) {
+                    return {
+                        content: [{ type: "text", text: `「${service}」は見つかりません` }],
+                        isError: true,
+                    };
+                }
+                db.run("DELETE FROM vault_entries WHERE service = ?", [service]);
+                saveDB(db);
+                return {
+                    content: [{ type: "text", text: `「${service}」を削除しました` }],
+                };
+            }
+            default:
+                return {
+                    content: [{ type: "text", text: `Unknown tool: ${name}` }],
+                    isError: true,
+                };
+        }
+    }
+    catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        return {
+            content: [{ type: "text", text: `エラー: ${message}` }],
+            isError: true,
+        };
+    }
+});
+async function main() {
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}
+main().catch((error) => {
+    console.error("Server error:", error);
+    process.exit(1);
+});