ccem 2.32.0 → 2.33.0

package/dist/index.js

@@ -430,15 +430,28 @@ var decrypt = (text) => {
   if (!text || !text.startsWith("enc:")) return text;
   if (text.startsWith("enc:v2:")) {
     const parts = text.split(":");
-    if (parts.length !== 5) return text;
+    if (parts.length !== 5) {
+      throw new Error("Invalid enc:v2: ciphertext format");
+    }
+    const nonceHex = parts[2];
+    const ciphertextHex = parts[3];
+    const tagHex = parts[4];
+    if (!/^[0-9a-f]{24}$/i.test(nonceHex)) {
+      throw new Error("Invalid enc:v2: nonce");
+    }
+    if (!/^[0-9a-f]{32}$/i.test(tagHex)) {
+      throw new Error("Invalid enc:v2: auth tag");
+    }
+    if (ciphertextHex.length === 0 || !/^[0-9a-f]+$/i.test(ciphertextHex) || ciphertextHex.length % 2 !== 0) {
+      throw new Error("Invalid enc:v2: ciphertext");
+    }
     try {
       const key = getOrCreateInstallKey();
-      const nonce = Buffer.from(parts[2], "hex");
-      const ciphertext = parts[3];
-      const tag = Buffer.from(parts[4], "hex");
+      const nonce = Buffer.from(nonceHex, "hex");
+      const tag = Buffer.from(tagHex, "hex");
       const decipher = crypto.createDecipheriv(V2_ALGORITHM, key, nonce);
       decipher.setAuthTag(tag);
-      let decrypted = decipher.update(ciphertext, "hex", "utf8");
+      let decrypted = decipher.update(ciphertextHex, "hex", "utf8");
       decrypted += decipher.final("utf8");
       return decrypted;
     } catch {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccem",
-  "version": "2.32.0",
+  "version": "2.33.0",
   "type": "module",
   "description": "Claude Code Environment Manager",
   "repository": {