ccem 2.26.0 → 2.27.0

package/dist/index.js

@@ -400,24 +400,57 @@ import crypto from "crypto";
 import fs from "fs";
 import os from "os";
 import path from "path";
-var ALGORITHM = "aes-256-cbc";
-var SECRET_KEY = crypto.scryptSync("claude-code-env-manager-secret", "salt", 32);
+var LEGACY_ALGORITHM = "aes-256-cbc";
+var LEGACY_KEY = crypto.scryptSync("claude-code-env-manager-secret", "salt", 32);
+var V2_ALGORITHM = "aes-256-gcm";
+var _installKey = null;
+function getOrCreateInstallKey() {
+  if (_installKey) return _installKey;
+  const keyPath = path.join(getCcemConfigDir(), ".install-key");
+  if (fs.existsSync(keyPath)) {
+    _installKey = Buffer.from(fs.readFileSync(keyPath, "utf-8").trim(), "hex");
+    return _installKey;
+  }
+  ensureCcemDir();
+  _installKey = crypto.randomBytes(32);
+  fs.writeFileSync(keyPath, _installKey.toString("hex"), { mode: 384 });
+  return _installKey;
+}
 var encrypt = (text) => {
   if (!text) return text;
-  const iv = crypto.randomBytes(16);
-  const cipher = crypto.createCipheriv(ALGORITHM, SECRET_KEY, iv);
+  const key = getOrCreateInstallKey();
+  const nonce = crypto.randomBytes(12);
+  const cipher = crypto.createCipheriv(V2_ALGORITHM, key, nonce);
   let encrypted = cipher.update(text, "utf8", "hex");
   encrypted += cipher.final("hex");
-  return `enc:${iv.toString("hex")}:${encrypted}`;
+  const tag = cipher.getAuthTag();
+  return `enc:v2:${nonce.toString("hex")}:${encrypted}:${tag.toString("hex")}`;
 };
 var decrypt = (text) => {
   if (!text || !text.startsWith("enc:")) return text;
+  if (text.startsWith("enc:v2:")) {
+    const parts = text.split(":");
+    if (parts.length !== 5) return text;
+    try {
+      const key = getOrCreateInstallKey();
+      const nonce = Buffer.from(parts[2], "hex");
+      const ciphertext = parts[3];
+      const tag = Buffer.from(parts[4], "hex");
+      const decipher = crypto.createDecipheriv(V2_ALGORITHM, key, nonce);
+      decipher.setAuthTag(tag);
+      let decrypted = decipher.update(ciphertext, "hex", "utf8");
+      decrypted += decipher.final("utf8");
+      return decrypted;
+    } catch {
+      throw new Error("Failed to decrypt enc:v2: data (tampered or wrong install key)");
+    }
+  }
   try {
     const parts = text.split(":");
     if (parts.length !== 3) return text;
     const iv = Buffer.from(parts[1], "hex");
     const encryptedText = parts[2];
-    const decipher = crypto.createDecipheriv(ALGORITHM, SECRET_KEY, iv);
+    const decipher = crypto.createDecipheriv(LEGACY_ALGORITHM, LEGACY_KEY, iv);
     let decrypted = decipher.update(encryptedText, "hex", "utf8");
     decrypted += decipher.final("utf8");
     return decrypted;
@@ -1396,7 +1429,7 @@ import crypto2 from "crypto";
 import fs3 from "fs";
 import os3 from "os";
 import path3 from "path";
-var SECRET_KEY2 = crypto2.scryptSync("claude-code-env-manager-secret", "salt", 32);
+var SECRET_KEY = crypto2.scryptSync("claude-code-env-manager-secret", "salt", 32);
 var findProjectRoot = () => {
   let currentDir = process.cwd();
   const root = path3.parse(currentDir).root;
@@ -2691,13 +2724,17 @@ var getUniqueName = (baseName, existingNames) => {
   }
   return newName;
 };
-var loadFromRemote = async (url, secret) => {
+var loadFromRemote = async (url, key, secret) => {
   console.log(chalk6.gray("Fetching from remote..."));
+  const headerKey = key || secret;
+  if (!key) {
+    console.log(chalk6.yellow("Warning: --key not provided; using --secret for authentication (deprecated). Use --key <access-key> --secret <encryption-secret>."));
+  }
   let response;
   try {
     response = await fetch(url, {
       headers: {
-        "X-CCEM-Key": secret
+        "X-CCEM-Key": headerKey
       }
     });
   } catch (err) {
@@ -3003,6 +3040,27 @@ function parseStringList(value) {
   }
   return trimmed.split(",").map((item) => item.trim()).filter(Boolean);
 }
+function normalizeWecomNotification(value) {
+  if (!value) {
+    return null;
+  }
+  return {
+    botId: value.botId?.trim() || null,
+    peerId: value.peerId?.trim() || null,
+    enabled: value.enabled ?? true
+  };
+}
+function parseWecomNotification(value) {
+  if (typeof value !== "object" || value === null) {
+    return null;
+  }
+  const record = value;
+  return {
+    botId: typeof record.botId === "string" ? record.botId : typeof record.bot_id === "string" ? record.bot_id : null,
+    peerId: typeof record.peerId === "string" ? record.peerId : typeof record.peer_id === "string" ? record.peer_id : null,
+    enabled: typeof record.enabled === "boolean" ? record.enabled : true
+  };
+}
 function createCronTask(input, tasksPath = getCronTasksPath()) {
   const name = input.name?.trim();
   if (!name) {
@@ -3040,6 +3098,7 @@ function createCronTask(input, tasksPath = getCronTasksPath()) {
     enabled: input.enabled ?? true,
     timeoutSecs,
     templateId: input.templateId?.trim() || null,
+    wecomNotification: normalizeWecomNotification(input.wecomNotification),
     triggerType: "schedule",
     parentTaskId: null,
     createdAt: now,
@@ -3078,6 +3137,7 @@ function resolveJsonInput(raw) {
 }
 function parseCronCreateJson(raw) {
   const parsed = JSON.parse(resolveJsonInput(raw));
+  const wecomNotification = parsed.wecomNotification ?? parsed.wecom_notification;
   return {
     name: String(parsed.name ?? ""),
     cronExpression: String(parsed.cronExpression ?? parsed.schedule ?? ""),
@@ -3090,7 +3150,8 @@ function parseCronCreateJson(raw) {
     disallowedTools: Array.isArray(parsed.disallowedTools) ? parsed.disallowedTools.map(String) : null,
     enabled: typeof parsed.enabled === "boolean" ? parsed.enabled : null,
     timeoutSecs: typeof parsed.timeoutSecs === "number" ? parsed.timeoutSecs : null,
-    templateId: typeof parsed.templateId === "string" ? parsed.templateId : null
+    templateId: typeof parsed.templateId === "string" ? parsed.templateId : null,
+    wecomNotification: parseWecomNotification(wecomNotification)
   };
 }
 function formatCronTaskTableRows(tasks) {
@@ -3745,7 +3806,7 @@ cronCmd.command("list").description("List CCEM cron tasks").option("--json", "Ou
     process.exitCode = 1;
   }
 });
-cronCmd.command("create").description("Create a CCEM cron task").option("--from-json <json>", "Read task input from inline JSON, @file, or - for stdin").option("--name <name>", "Task name").option("--cron-expression <expr>", "5-field cron expression").option("--schedule <expr>", "Alias for --cron-expression").option("--prompt <prompt>", "Prompt to run when the task fires").option("--working-dir <dir>", "Task working directory").option("--env-name <name>", "CCEM environment name").option("--execution-profile <profile>", "conservative, standard, or autonomous").option("--max-budget-usd <amount>", "Optional max budget in USD").option("--allowed-tools <items>", "Comma-separated or JSON array of allowed tools").option("--disallowed-tools <items>", "Comma-separated or JSON array of disallowed tools").option("--timeout-secs <seconds>", "Task timeout in seconds").option("--template-id <id>", "Optional template id").option("--disabled", "Create task disabled").option("--json", "Output as JSON").action((options) => {
+cronCmd.command("create").description("Create a CCEM cron task").option("--from-json <json>", "Read task input from inline JSON, @file, or - for stdin").option("--name <name>", "Task name").option("--cron-expression <expr>", "5-field cron expression").option("--schedule <expr>", "Alias for --cron-expression").option("--prompt <prompt>", "Prompt to run when the task fires").option("--working-dir <dir>", "Task working directory").option("--env-name <name>", "CCEM environment name").option("--execution-profile <profile>", "conservative, standard, or autonomous").option("--max-budget-usd <amount>", "Optional max budget in USD").option("--allowed-tools <items>", "Comma-separated or JSON array of allowed tools").option("--disallowed-tools <items>", "Comma-separated or JSON array of disallowed tools").option("--timeout-secs <seconds>", "Task timeout in seconds").option("--template-id <id>", "Optional template id").option("--wecom-result", "Send cron result summary to the configured WeCom default target").option("--wecom-bot-id <id>", "WeCom bot id for cron result notifications").option("--wecom-peer-id <id>", "WeCom peer id for cron result notifications").option("--disabled", "Create task disabled").option("--json", "Output as JSON").action((options) => {
   try {
     const input = options.fromJson ? parseCronCreateJson(options.fromJson) : {
       name: options.name,
@@ -3759,7 +3820,12 @@ cronCmd.command("create").description("Create a CCEM cron task").option("--from-
       disallowedTools: parseStringList(options.disallowedTools),
       enabled: options.disabled ? false : true,
       timeoutSecs: options.timeoutSecs === void 0 ? null : Number(options.timeoutSecs),
-      templateId: options.templateId
+      templateId: options.templateId,
+      wecomNotification: options.wecomResult || options.wecomBotId || options.wecomPeerId ? {
+        botId: options.wecomBotId ?? null,
+        peerId: options.wecomPeerId ?? null,
+        enabled: true
+      } : null
     };
     const task = createCronTask(input);
     if (options.json) {
@@ -3977,8 +4043,8 @@ skillCmd.command("ls").description("\u5217\u51FA\u5DF2\u5B89\u88C5\u7684 skills"
 skillCmd.command("rm <name>").description("\u5220\u9664\u5DF2\u5B89\u88C5\u7684 skill").action((name) => {
   removeSkill(name);
 });
-program.command("load <url>").description("\u4ECE\u8FDC\u7A0B\u670D\u52A1\u5668\u52A0\u8F7D\u73AF\u5883\u914D\u7F6E").requiredOption("--secret <secret>", "\u89E3\u5BC6\u5BC6\u94A5").option("--json", "\u4EE5 JSON \u683C\u5F0F\u8F93\u51FA\u7ED3\u679C\uFF08\u4F9B\u7A0B\u5E8F\u8C03\u7528\uFF09").action(async (url, options) => {
-  const results = await loadFromRemote(url, options.secret);
+program.command("load <url>").description("\u4ECE\u8FDC\u7A0B\u670D\u52A1\u5668\u52A0\u8F7D\u73AF\u5883\u914D\u7F6E").requiredOption("--secret <secret>", "\u89E3\u5BC6\u5BC6\u94A5\uFF08encryption secret\uFF09").option("--key <key>", "\u8BBF\u95EE\u5BC6\u94A5\uFF08access key\uFF0C\u7528\u4E8E\u8BA4\u8BC1\uFF1B\u4E0D\u586B\u5219\u56DE\u9000\u7528 --secret \u8BA4\u8BC1\uFF09").option("--json", "\u4EE5 JSON \u683C\u5F0F\u8F93\u51FA\u7ED3\u679C\uFF08\u4F9B\u7A0B\u5E8F\u8C03\u7528\uFF09").action(async (url, options) => {
+  const results = await loadFromRemote(url, options.key ?? "", options.secret);
   if (options.json) {
     console.log(JSON.stringify({
       count: results.length,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccem",
-  "version": "2.26.0",
+  "version": "2.27.0",
   "type": "module",
   "description": "Claude Code Environment Manager",
   "repository": {