chat-recall 0.0.1 → 0.4.8

package/dist/keyring.js

@@ -0,0 +1,163 @@
+/**
+ * OS keyring access for the vault passphrase — the only way the unattended
+ * daemon can decrypt cross-device artifacts without a secret sitting on disk.
+ *
+ * No new dependency: we shell out to the platform's own tool, exactly as this
+ * codebase already does for services (systemctl / launchctl / schtasks in
+ * service-installer.ts). A native addon (keytar, @napi-rs/keyring) would trip
+ * the bundle's native-free guard and reintroduce prebuilt-binary pain to a
+ * package deliberately built without any.
+ *
+ *   macOS    `security`     built in
+ *   Linux    `secret-tool`  needs libsecret-tools (the gap — see probe())
+ *   Windows  PowerShell + DPAPI, encrypting under the user's own key
+ *
+ * SECRETS NEVER GO IN ARGV. /proc/<pid>/cmdline is world-readable on Linux and
+ * `ps` shows arguments to every local user, so a passphrase passed as a flag
+ * would leak to any process on the box for the lifetime of the call. Every
+ * backend below writes the secret to the child's STDIN instead:
+ *   - secret-tool store          reads the secret from stdin by design
+ *   - security -i                reads *commands* from stdin (batch mode)
+ *   - powershell -Command -      reads the script from stdin
+ *
+ * There is deliberately NO plaintext fallback. A machine with no keyring does
+ * not get cross-device artifacts, and is told exactly how to fix that — a
+ * silent downgrade to a file on disk would quietly defeat the entire point.
+ */
+import { execFileSync } from 'node:child_process';
+const SERVICE = 'chat-recall';
+const ACCOUNT = 'vault-passphrase';
+const realRunner = {
+    run(file, args, input) {
+        return execFileSync(file, args, {
+            input,
+            encoding: 'utf-8',
+            stdio: input === undefined ? ['ignore', 'pipe', 'pipe'] : ['pipe', 'pipe', 'pipe'],
+        });
+    },
+    platform: process.platform,
+};
+/** Which backend this platform uses, and whether it's actually usable here. */
+export function probeKeyring(r = realRunner) {
+    if (r.platform === 'darwin') {
+        // `security` ships with macOS; if it's missing the install is broken.
+        try {
+            r.run('security', ['help']);
+            return { backend: 'macos-keychain', available: true };
+        }
+        catch {
+            return { backend: 'macos-keychain', available: false, hint: '`security` not found — is this really macOS?' };
+        }
+    }
+    if (r.platform === 'win32') {
+        try {
+            r.run('powershell', ['-NoProfile', '-Command', '$PSVersionTable.PSVersion.Major']);
+            return { backend: 'windows-dpapi', available: true };
+        }
+        catch {
+            return { backend: 'windows-dpapi', available: false, hint: 'PowerShell not found — required for DPAPI-protected storage.' };
+        }
+    }
+    if (r.platform === 'linux') {
+        try {
+            r.run('secret-tool', ['--version']);
+            return { backend: 'libsecret', available: true };
+        }
+        catch {
+            return {
+                backend: 'libsecret',
+                available: false,
+                // The common case is a running keyring daemon with the CLI absent —
+                // observed on a desktop with gnome-keyring-daemon up and no secret-tool.
+                hint: 'No keyring access: install libsecret-tools (Debian/Ubuntu: `sudo apt install libsecret-tools`, '
+                    + 'Fedora: `sudo dnf install libsecret`). Headless machines have no keyring at all — '
+                    + 'cross-device artifacts will not apply there.',
+            };
+        }
+    }
+    return { backend: 'none', available: false, hint: `No keyring backend for platform ${r.platform}.` };
+}
+/** Thrown when the keyring is unusable. Callers surface .message as-is. */
+export class KeyringUnavailableError extends Error {
+}
+function requireBackend(r) {
+    const p = probeKeyring(r);
+    if (!p.available)
+        throw new KeyringUnavailableError(p.hint || 'No OS keyring available on this machine.');
+    return p.backend;
+}
+/**
+ * Windows has no credential store we can READ from the shell (cmdkey stores
+ * but cannot retrieve), so we use DPAPI: the ciphertext is decryptable only by
+ * this user on this machine, which is the same trust boundary as a keyring
+ * entry. Stored in the user profile, not in our data dir, to keep it out of
+ * anything that gets synced or archived.
+ */
+const WIN_BLOB = '$env:USERPROFILE\\.chat-recall-vault.dpapi';
+export function keyringSet(secret, r = realRunner) {
+    const backend = requireBackend(r);
+    if (backend === 'macos-keychain') {
+        // Batch mode: the command line (with -w and the secret) goes over stdin,
+        // so it never appears in argv. -U updates an existing item in place.
+        r.run('security', ['-i'], `add-generic-password -U -a ${ACCOUNT} -s ${SERVICE} -w ${shQuote(secret)}\n`);
+        return;
+    }
+    if (backend === 'libsecret') {
+        r.run('secret-tool', ['store', '--label=chat-recall vault passphrase', 'service', SERVICE, 'account', ACCOUNT], secret);
+        return;
+    }
+    // windows-dpapi — script on stdin; the secret is interpolated into the
+    // script text, which is piped, never argv.
+    r.run('powershell', ['-NoProfile', '-Command', '-'], `$s = ${psQuote(secret)}\n`
+        + `ConvertTo-SecureString -String $s -AsPlainText -Force | ConvertFrom-SecureString | Set-Content -Path ${WIN_BLOB} -Encoding ascii\n`);
+}
+/** The stored passphrase, or null when absent. Throws only if unusable. */
+export function keyringGet(r = realRunner) {
+    const backend = requireBackend(r);
+    try {
+        if (backend === 'macos-keychain') {
+            return r.run('security', ['find-generic-password', '-a', ACCOUNT, '-s', SERVICE, '-w']).replace(/\n$/, '') || null;
+        }
+        if (backend === 'libsecret') {
+            // secret-tool prints the secret with NO trailing newline; empty = absent.
+            return r.run('secret-tool', ['lookup', 'service', SERVICE, 'account', ACCOUNT]) || null;
+        }
+        const out = r.run('powershell', ['-NoProfile', '-Command', '-'], `if (!(Test-Path ${WIN_BLOB})) { exit 1 }\n`
+            + `$sec = Get-Content ${WIN_BLOB} | ConvertTo-SecureString\n`
+            + `[Runtime.InteropServices.Marshal]::PtrToStringAuto([Runtime.InteropServices.Marshal]::SecureStringToBSTR($sec))\n`);
+        return out.replace(/\r?\n$/, '') || null;
+    }
+    catch {
+        // Every backend exits non-zero for "no such entry"; that is not an error.
+        return null;
+    }
+}
+/** Remove the stored passphrase. True if something was removed. */
+export function keyringDelete(r = realRunner) {
+    const backend = requireBackend(r);
+    try {
+        if (backend === 'macos-keychain') {
+            r.run('security', ['delete-generic-password', '-a', ACCOUNT, '-s', SERVICE]);
+            return true;
+        }
+        if (backend === 'libsecret') {
+            r.run('secret-tool', ['clear', 'service', SERVICE, 'account', ACCOUNT]);
+            return true;
+        }
+        r.run('powershell', ['-NoProfile', '-Command', '-'], `Remove-Item -Force -ErrorAction Stop ${WIN_BLOB}\n`);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/* ── quoting ──────────────────────────────────────────────────────── */
+/** Single-quote for the `security -i` command line (POSIX-ish tokenizer). */
+export function shQuote(s) {
+    return `'${s.replace(/'/g, `'\\''`)}'`;
+}
+/** Single-quote for PowerShell, where '' is the escaped quote. */
+export function psQuote(s) {
+    return `'${s.replace(/'/g, "''")}'`;
+}
+//# sourceMappingURL=keyring.js.map

package/dist/keyring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keyring.js","sourceRoot":"","sources":["../src/keyring.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,OAAO,GAAG,aAAa,CAAC;AAC9B,MAAM,OAAO,GAAG,kBAAkB,CAAC;AAkBnC,MAAM,UAAU,GAAW;IACzB,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK;QACnB,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE;YAC9B,KAAK;YACL,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;SACnF,CAAC,CAAC;IACL,CAAC;IACD,QAAQ,EAAE,OAAO,CAAC,QAAQ;CAC3B,CAAC;AAEF,+EAA+E;AAC/E,MAAM,UAAU,YAAY,CAAC,IAAY,UAAU;IACjD,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,sEAAsE;QACtE,IAAI,CAAC;YAAC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAAC,CAAC;QAC3F,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC;QAAC,CAAC;IACzH,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,iCAAiC,CAAC,CAAC,CAAC;YAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAAC,CAAC;QACjJ,MAAM,CAAC;YAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,8DAA8D,EAAE,CAAC;QAAC,CAAC;IACxI,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YAAC,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;YAAC,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAAC,CAAC;QAC9F,MAAM,CAAC;YACL,OAAO;gBACL,OAAO,EAAE,WAAW;gBACpB,SAAS,EAAE,KAAK;gBAChB,oEAAoE;gBACpE,yEAAyE;gBACzE,IAAI,EAAE,iGAAiG;sBACnG,oFAAoF;sBACpF,8CAA8C;aACnD,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;AACvG,CAAC;AAED,2EAA2E;AAC3E,MAAM,OAAO,uBAAwB,SAAQ,KAAK;CAAG;AAErD,SAAS,cAAc,CAAC,CAAS;IAC/B,MAAM,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,CAAC,SAAS;QAAE,MAAM,IAAI,uBAAuB,CAAC,CAAC,CAAC,IAAI,IAAI,0CAA0C,CAAC,CAAC;IAC1G,OAAO,CAAC,CAAC,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,QAAQ,GAAG,4CAA4C,CAAC;AAE9D,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,IAAY,UAAU;IAC/D,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QACjC,yEAAyE;QACzE,qEAAqE;QACrE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,EAAE,8BAA8B,OAAO,OAAO,OAAO,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzG,OAAO;IACT,CAAC;IACD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;QAC5B,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,sCAAsC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC;QACxH,OAAO;IACT,CAAC;IACD,uEAAuE;IACvE,2CAA2C;IAC3C,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,EACjD,QAAQ,OAAO,CAAC,MAAM,CAAC,IAAI;UACzB,wGAAwG,QAAQ,oBAAoB,CAAC,CAAC;AAC5I,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,IAAY,UAAU;IAC/C,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;QACrH,CAAC;QACD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,0EAA0E;YAC1E,OAAO,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,IAAI,IAAI,CAAC;QAC1F,CAAC;QACD,MAAM,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,EAC7D,mBAAmB,QAAQ,iBAAiB;cAC1C,sBAAsB,QAAQ,6BAA6B;cAC3D,mHAAmH,CAAC,CAAC;QACzH,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,0EAA0E;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAAC,IAAY,UAAU;IAClD,MAAM,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;YACjC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,KAAK,WAAW,EAAE,CAAC;YAC5B,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;YACxE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,UAAU,EAAE,GAAG,CAAC,EAAE,wCAAwC,QAAQ,IAAI,CAAC,CAAC;QAC3G,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yEAAyE;AAEzE,6EAA6E;AAC7E,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AACzC,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,OAAO,CAAC,CAAS;IAC/B,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC;AACtC,CAAC"}

package/dist/mcp.d.ts

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+/**
+ * MCP server for chat-recall.
+ *
+ * Exposes chat recall as tools that can be used by Claude Code.
+ */
+import '@chat-recall/engine/core/backends/index.js';
+//# sourceMappingURL=mcp.d.ts.map

package/dist/mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcp.d.ts","sourceRoot":"","sources":["../src/mcp.ts"],"names":[],"mappings":";AACA;;;;GAIG;AA0BH,OAAO,4CAA4C,CAAC"}