ccprofiles-core 0.2.0 → 0.3.0

package/dist/devices.js

@@ -2,7 +2,7 @@ import { readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import { atomicWrite } from './fsutil.js';
-const IGNORE = ['secrets.enc', 'secret-names.json', 'devices.json', 'backups/', '*.ccp-tmp'];
+const IGNORE = ['secrets.enc', 'secrets.dpapi.json', 'secret-names.json', 'devices.json', 'backups/', '*.ccp-tmp'];
 export async function loadDevices(root) {
     const f = join(root, 'devices.json');
     if (!existsSync(f))

package/dist/manifest.d.ts

@@ -1,20 +1,32 @@
 import { z } from 'zod';
 export declare class ManifestError extends Error {
 }
-declare const McpServerSchema: z.ZodObject<{
-    command: z.ZodString;
+declare const McpServerSchema: z.ZodEffects<z.ZodObject<{
+    command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     type: z.ZodOptional<z.ZodString>;
     url: z.ZodOptional<z.ZodString>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-    command: z.ZodString;
+    command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     type: z.ZodOptional<z.ZodString>;
     url: z.ZodOptional<z.ZodString>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-    command: z.ZodString;
+    command: z.ZodOptional<z.ZodString>;
+    args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    type: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+    command: z.ZodOptional<z.ZodString>;
+    args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    type: z.ZodOptional<z.ZodString>;
+    url: z.ZodOptional<z.ZodString>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    command: z.ZodOptional<z.ZodString>;
     args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
     env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
     type: z.ZodOptional<z.ZodString>;
@@ -79,20 +91,32 @@ declare const ManifestSchema: z.ZodObject<{
         mcp?: string[] | undefined;
         settingsEnv?: Record<string, string> | undefined;
     }>, "many">;
-    mcpServers: z.ZodRecord<z.ZodString, z.ZodObject<{
-        command: z.ZodString;
+    mcpServers: z.ZodRecord<z.ZodString, z.ZodEffects<z.ZodObject<{
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;
         url: z.ZodOptional<z.ZodString>;
     }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
-        command: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        type: z.ZodOptional<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+        command: z.ZodOptional<z.ZodString>;
+        args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        type: z.ZodOptional<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+    }, z.ZodTypeAny, "passthrough">>, z.objectOutputType<{
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;
         url: z.ZodOptional<z.ZodString>;
     }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
-        command: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;
@@ -112,7 +136,7 @@ declare const ManifestSchema: z.ZodObject<{
         settingsEnv: Record<string, string>;
     }[];
     mcpServers: Record<string, z.objectOutputType<{
-        command: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;
@@ -132,7 +156,7 @@ declare const ManifestSchema: z.ZodObject<{
         settingsEnv?: Record<string, string> | undefined;
     }[];
     mcpServers: Record<string, z.objectInputType<{
-        command: z.ZodString;
+        command: z.ZodOptional<z.ZodString>;
         args: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
         env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         type: z.ZodOptional<z.ZodString>;

package/dist/manifest.js

@@ -8,12 +8,12 @@ const exec = promisify(execFile);
 export class ManifestError extends Error {
 }
 const McpServerSchema = z.object({
-    command: z.string(),
+    command: z.string().optional(),
     args: z.array(z.string()).optional(),
     env: z.record(z.string()).optional(),
     type: z.string().optional(),
     url: z.string().optional(),
-}).passthrough();
+}).passthrough().refine(s => s.command !== undefined || s.url !== undefined, { message: 'mcp server must have either "command" (local) or "url" (remote)' });
 const ProfileSchema = z.object({
     name: z.string().min(1),
     dir: z.string().min(1),
@@ -94,8 +94,10 @@ export async function loadManifest(root) {
     return parseManifest(await readFile(join(root, 'manifest.yaml'), 'utf8'));
 }
 export async function saveManifest(root, m) {
+    const yaml = serializeManifest(m);
+    parseManifest(yaml); // guard: never write a manifest that cannot be reloaded
     await mkdir(root, { recursive: true });
-    await writeFile(join(root, 'manifest.yaml'), serializeManifest(m), 'utf8');
+    await writeFile(join(root, 'manifest.yaml'), yaml, 'utf8');
     try {
         await exec('git', ['-C', root, 'rev-parse', '--git-dir']);
         await exec('git', ['-C', root, 'add', '-A']);

package/dist/secrets.d.ts

@@ -35,6 +35,21 @@ export declare class SecretToolBackend implements SecretsBackend {
     get(key: string): Promise<string | null>;
     delete(key: string): Promise<void>;
 }
+export type DpapiCrypt = {
+    protect(plain: string): Promise<string>;
+    unprotect(b64: string): Promise<string>;
+};
+export declare const powershellDpapi: DpapiCrypt;
+export declare class DpapiBackend implements SecretsBackend {
+    private filePath;
+    private crypt;
+    readonly name = "windows-dpapi";
+    constructor(filePath: string, crypt?: DpapiCrypt);
+    private load;
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string): Promise<void>;
+    delete(key: string): Promise<void>;
+}
 export declare class SecretsStore {
     private backend;
     private indexPath;

package/dist/secrets.js

@@ -100,6 +100,64 @@ export class SecretToolBackend {
         catch { /* absent */ }
     }
 }
+// DPAPI via built-in PowerShell. Secret bytes travel through a spawn env var, never argv.
+export const powershellDpapi = {
+    protect: (plain) => runDpapi(
+    // [string] cast coerces a $null CCP_IN (empty env var) to '' before GetBytes, which
+    // otherwise throws on $null. Only needed here — unprotect's CCP_IN is base64 ciphertext
+    // and is never empty for a stored value.
+    "$b=[Text.Encoding]::UTF8.GetBytes([string]$env:CCP_IN);" +
+        "[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Protect($b,$null,'CurrentUser'))", plain),
+    unprotect: async (b64) => {
+        // PS emits base64 of the *decrypted bytes* (not the decoded string) so runDpapi's
+        // trim is always ASCII-safe and we never depend on the PowerShell console's
+        // stdout encoding to round-trip arbitrary plaintext (e.g. non-ASCII, trailing whitespace).
+        const out = await runDpapi("$b=[Convert]::FromBase64String($env:CCP_IN);" +
+            "[Convert]::ToBase64String([Security.Cryptography.ProtectedData]::Unprotect($b,$null,'CurrentUser'))", b64);
+        return Buffer.from(out, 'base64').toString('utf8');
+    },
+};
+async function runDpapi(script, input) {
+    const child = await import('node:child_process');
+    return new Promise((resolve, reject) => {
+        const proc = child.spawn('powershell', ['-NoProfile', '-NonInteractive', '-Command', 'Add-Type -AssemblyName System.Security;' + script], { env: { ...process.env, CCP_IN: input }, stdio: ['ignore', 'pipe', 'pipe'] });
+        let out = '';
+        let err = '';
+        proc.stdout.on('data', d => { out += d; });
+        proc.stderr.on('data', d => { err += d; });
+        proc.on('error', reject);
+        proc.on('close', code => (code === 0 ? resolve(out.trim()) : reject(new Error(`powershell dpapi exited ${code}: ${err.trim()}`))));
+    });
+}
+export class DpapiBackend {
+    filePath;
+    crypt;
+    name = 'windows-dpapi';
+    constructor(filePath, crypt = powershellDpapi) {
+        this.filePath = filePath;
+        this.crypt = crypt;
+    }
+    async load() {
+        if (!existsSync(this.filePath))
+            return { entries: {} };
+        return JSON.parse(await readFile(this.filePath, 'utf8'));
+    }
+    async get(key) {
+        const f = await this.load();
+        const ct = f.entries[key];
+        return ct === undefined ? null : this.crypt.unprotect(ct);
+    }
+    async set(key, value) {
+        const f = await this.load();
+        f.entries[key] = await this.crypt.protect(value);
+        await atomicWrite(this.filePath, JSON.stringify(f));
+    }
+    async delete(key) {
+        const f = await this.load();
+        delete f.entries[key];
+        await atomicWrite(this.filePath, JSON.stringify(f));
+    }
+}
 export class SecretsStore {
     backend;
     indexPath;
@@ -137,6 +195,8 @@ export async function defaultBackend(p, opts) {
         }
         catch { /* fall through */ }
     }
+    if (p.os === 'win32')
+        return new DpapiBackend(opts.filePath.replace(/\.enc$/, '.dpapi.json'));
     const pw = opts.passphrase ? await opts.passphrase() : '';
     if (!pw)
         throw new Error('encrypted-file backend requires a passphrase');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ccprofiles-core",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Core library for ccprofiles — discovery, manifest, secrets, apply, and LAN sync for Claude Code multi-account setups",
   "type": "module",
   "main": "./dist/index.js",