chief-helm 0.1.1 → 0.1.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/Readme.md CHANGED
@@ -14,7 +14,7 @@ HELM is how a human operates the CHIEF personal AI operations system. Every flow
14
14
  | npm | v9.0.0 | `npm --version` |
15
15
  | Git | v2.30.0 | `git --version` |
16
16
 
17
- **Platform:** macOS 12+ or Windows 10+. OS keychain support (macOS Keychain / Windows Credential Manager) is required for credential storage.
17
+ **Platform:** macOS 12+ or Windows 10+.
18
18
 
19
19
  **Node.js installation:** [nodejs.org](https://nodejs.org) → download the LTS version. This installs both `node` and `npm`.
20
20
 
@@ -70,10 +70,10 @@ helm config <n> # Open config file n in your editor (auto-commits
70
70
 
71
71
  ### Secrets
72
72
 
73
- Credentials are stored in the OS keychain. Values are never printed, logged, or included in error messages.
73
+ Credentials are encrypted with AES-256-GCM and stored locally. Values are never printed, logged, or included in error messages.
74
74
 
75
75
  ```bash
76
- helm secrets set <KEY> # Masked input → OS keychain
76
+ helm secrets set <KEY> # Masked input → encrypted local storage
77
77
  helm secrets list # Key names only — values never shown
78
78
  helm secrets verify <KEY> # Confirm a key exists
79
79
  helm secrets delete <KEY> # Remove with confirmation prompt
@@ -172,7 +172,7 @@ The main CHIEF repo is never written to by HELM at runtime.
172
172
  ├── core/
173
173
  │ ├── repo.ts conf store, local config, repo validation, setup guard
174
174
  │ ├── config.ts YAML read/write for all instance repo config files
175
- │ ├── secrets.ts keytar wrapper, manifest management
175
+ │ ├── secrets.ts AES-256-GCM encrypted storage, manifest management
176
176
  │ ├── git.ts pull, commit, push, status via simple-git
177
177
  │ ├── state.ts last_run.json and other state file I/O
178
178
  │ └── inputs.ts Credential key map and per-input connectivity tests
@@ -206,15 +206,30 @@ Never swallow errors. Never put secret values in error messages.
206
206
 
207
207
  ### Publishing
208
208
 
209
+ Releases are automated via GitHub Actions. The workflow at `/.github/workflows/helm-release.yml` triggers on tags matching `helm-v*`.
210
+
211
+ **Using the release script:**
212
+
209
213
  ```bash
210
214
  cd helm/
211
- npm version patch # or minor / major
212
- npm publish # prepublishOnly runs tsc automatically
213
- git push && git push --tags
215
+ ./scripts/release.sh 0.2.0 # bumps version, builds, commits, tags
216
+ git push origin main && git push origin helm-v0.2.0 # triggers CI → npm publish + GitHub Release
214
217
  ```
215
218
 
216
- `prepublishOnly` compiles TypeScript to `dist/` before every publish. Only `dist/` and `README.md` are included in the published package.
219
+ **Manual process:**
220
+
221
+ ```bash
222
+ cd helm/
223
+ npm version 0.2.0 --no-git-tag-version
224
+ npm run build
225
+ cd ..
226
+ git add helm/package.json helm/package-lock.json
227
+ git commit -m "[helm-release] v0.2.0"
228
+ git tag helm-v0.2.0
229
+ git push origin main && git push origin helm-v0.2.0
230
+ ```
217
231
 
232
+ `prepublishOnly` compiles TypeScript to `dist/` before every publish. Only `dist/` and `README.md` are included in the published package.
218
233
  ---
219
234
 
220
235
  *HELM is part of the CHIEF personal AI operations system. See [SETUP.md](../SETUP.md) for full system documentation.*
@@ -1,10 +1,10 @@
1
1
  /**
2
- * @file helm secrets — OS keychain credential management.
2
+ * @file helm secrets — encrypted credential management.
3
3
  *
4
4
  * Subcommands:
5
- * helm secrets set <key> Masked input → stored in OS keychain
5
+ * helm secrets set <key> Masked input → encrypted and stored locally
6
6
  * helm secrets list Key names only, never values
7
- * helm secrets verify <key> Confirm key exists in keychain
7
+ * helm secrets verify <key> Confirm key exists in encrypted storage
8
8
  * helm secrets delete <key> Remove with confirmation prompt
9
9
  *
10
10
  * Secret values are never printed, logged, or included in error messages.
@@ -1,10 +1,10 @@
1
1
  /**
2
- * @file helm secrets — OS keychain credential management.
2
+ * @file helm secrets — encrypted credential management.
3
3
  *
4
4
  * Subcommands:
5
- * helm secrets set <key> Masked input → stored in OS keychain
5
+ * helm secrets set <key> Masked input → encrypted and stored locally
6
6
  * helm secrets list Key names only, never values
7
- * helm secrets verify <key> Confirm key exists in keychain
7
+ * helm secrets verify <key> Confirm key exists in encrypted storage
8
8
  * helm secrets delete <key> Remove with confirmation prompt
9
9
  *
10
10
  * Secret values are never printed, logged, or included in error messages.
@@ -26,11 +26,11 @@ import { theme, symbol } from "../ui/theme.js";
26
26
  export function registerSecretsCommand(program) {
27
27
  const secrets = program
28
28
  .command("secrets")
29
- .description("Manage OS keychain credentials");
29
+ .description("Manage encrypted local storage credentials");
30
30
  // ── set ────────────────────────────────────────────────────────────────────
31
31
  secrets
32
32
  .command("set <key>")
33
- .description("Store a secret in the OS keychain (masked input)")
33
+ .description("Store a secret in the encrypted local storage (masked input)")
34
34
  .action(async (key) => {
35
35
  requireSetup();
36
36
  const { active_user: username } = getLocalConfig();
@@ -44,7 +44,7 @@ export function registerSecretsCommand(program) {
44
44
  },
45
45
  ]);
46
46
  await setSecret(username, key, value);
47
- console.log(` ${chalk.hex(theme.success)(symbol.success)} Secret "${key}" stored in OS keychain.`);
47
+ console.log(` ${chalk.hex(theme.success)(symbol.success)} Secret "${key}" stored in encrypted local storage.`);
48
48
  });
49
49
  // ── list ───────────────────────────────────────────────────────────────────
50
50
  secrets
@@ -67,22 +67,22 @@ export function registerSecretsCommand(program) {
67
67
  // ── verify ─────────────────────────────────────────────────────────────────
68
68
  secrets
69
69
  .command("verify <key>")
70
- .description("Confirm a secret key exists in the OS keychain")
70
+ .description("Confirm a secret key exists in the encrypted local storage")
71
71
  .action(async (key) => {
72
72
  requireSetup();
73
73
  const { active_user: username } = getLocalConfig();
74
74
  const exists = await verifySecret(username, key);
75
75
  if (exists) {
76
- console.log(` ${chalk.hex(theme.success)(symbol.success)} "${key}" exists in the OS keychain.`);
76
+ console.log(` ${chalk.hex(theme.success)(symbol.success)} "${key}" exists in the encrypted local storage.`);
77
77
  }
78
78
  else {
79
- throw new HelmError(`Secret "${key}" was not found in the OS keychain.`, `Run: helm secrets set ${key}`);
79
+ throw new HelmError(`Secret "${key}" was not found in the encrypted local storage.`, `Run: helm secrets set ${key}`);
80
80
  }
81
81
  });
82
82
  // ── delete ─────────────────────────────────────────────────────────────────
83
83
  secrets
84
84
  .command("delete <key>")
85
- .description("Remove a secret from the OS keychain")
85
+ .description("Remove a secret from the encrypted local storage")
86
86
  .action(async (key) => {
87
87
  requireSetup();
88
88
  const { active_user: username } = getLocalConfig();
@@ -90,7 +90,7 @@ export function registerSecretsCommand(program) {
90
90
  {
91
91
  type: "confirm",
92
92
  name: "confirmed",
93
- message: ` Delete secret "${key}" from the OS keychain?`,
93
+ message: ` Delete secret "${key}" from the encrypted local storage?`,
94
94
  default: false,
95
95
  },
96
96
  ]);
@@ -100,10 +100,10 @@ export function registerSecretsCommand(program) {
100
100
  }
101
101
  const deleted = await deleteSecret(username, key);
102
102
  if (deleted) {
103
- console.log(` ${chalk.hex(theme.success)(symbol.success)} Secret "${key}" deleted from OS keychain.`);
103
+ console.log(` ${chalk.hex(theme.success)(symbol.success)} Secret "${key}" deleted from encrypted local storage.`);
104
104
  }
105
105
  else {
106
- throw new HelmError(`Secret "${key}" was not found in the OS keychain.`, `Run: helm secrets list to see what keys are stored.`);
106
+ throw new HelmError(`Secret "${key}" was not found in the encrypted local storage.`, `Run: helm secrets list to see what keys are stored.`);
107
107
  }
108
108
  });
109
109
  }
@@ -1 +1 @@
1
- {"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,SAAS,EACT,cAAc,EACd,YAAY,EACZ,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE/C,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAEjD,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QAEnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAoB;YACzD;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,KAAK,GAAG,GAAG;gBACpB,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CACtB,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,wBAAwB;aAClD;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAEtC,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,0BAA0B,CACxF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,GAAG,EAAE;QACX,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CACpB,2BAA2B,QAAQ,uCAAuC,CAC3E,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,4BAA4B,CAAC,EAAE,CAClI,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,gDAAgD,CAAC;SAC7D,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,8BAA8B,CACrF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CACjB,WAAW,GAAG,qCAAqC,EACnD,yBAAyB,GAAG,EAAE,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,sCAAsC,CAAC;SACnD,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QAEnD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAyB;YAClE;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,oBAAoB,GAAG,yBAAyB;gBACzD,OAAO,EAAE,KAAK;aACf;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAElD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,6BAA6B,CAC3F,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CACjB,WAAW,GAAG,qCAAqC,EACnD,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
1
+ {"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/commands/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAC/D,OAAO,EACL,SAAS,EACT,cAAc,EACd,YAAY,EACZ,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAC/C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAE/C,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,4CAA4C,CAAC,CAAC;IAE7D,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,WAAW,CAAC;SACpB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QAEnD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAoB;YACzD;gBACE,IAAI,EAAE,UAAU;gBAChB,IAAI,EAAE,OAAO;gBACb,OAAO,EAAE,KAAK,GAAG,GAAG;gBACpB,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,CAAC,CAAS,EAAE,EAAE,CACtB,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,wBAAwB;aAClD;SACF,CAAC,CAAC;QAEH,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;QAEtC,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,sCAAsC,CACpG,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uDAAuD,CAAC;SACpE,MAAM,CAAC,GAAG,EAAE;QACX,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;QAEtC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CACpB,2BAA2B,QAAQ,uCAAuC,CAC3E,CACF,CAAC;YACF,OAAO;QACT,CAAC;QAED,OAAO,CAAC,GAAG,CACT,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,4BAA4B,CAAC,EAAE,CAClI,CAAC;QACF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAEjD,IAAI,MAAM,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,0CAA0C,CACjG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CACjB,WAAW,GAAG,iDAAiD,EAC/D,yBAAyB,GAAG,EAAE,CAC/B,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,OAAO;SACJ,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,MAAM,CAAC,KAAK,EAAE,GAAW,EAAE,EAAE;QAC5B,YAAY,EAAE,CAAC;QAEf,MAAM,EAAE,WAAW,EAAE,QAAQ,EAAE,GAAG,cAAc,EAAE,CAAC;QAEnD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAyB;YAClE;gBACE,IAAI,EAAE,SAAS;gBACf,IAAI,EAAE,WAAW;gBACjB,OAAO,EAAE,oBAAoB,GAAG,qCAAqC;gBACrE,OAAO,EAAE,KAAK;aACf;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;YACpD,OAAO;QACT,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAElD,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,aAAa,GAAG,yCAAyC,CACvG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,SAAS,CACjB,WAAW,GAAG,iDAAiD,EAC/D,qDAAqD,CACtD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}
@@ -187,14 +187,14 @@ async function step2CreateUserIdentity(repoRoot) {
187
187
  /**
188
188
  * For each input in inputs.yaml, asks whether to enable it. For enabled
189
189
  * inputs, collects all required credentials via masked prompts, stores
190
- * them in the OS keychain, and runs a connectivity test.
190
+ * them in the encrypted local storage, and runs a connectivity test.
191
191
  *
192
192
  * Updates the `enabled` and `configured` fields in inputs.yaml after
193
193
  * each input is processed. This ensures partial progress is persisted
194
194
  * even if the wizard is interrupted.
195
195
  *
196
196
  * @param repoRoot - Absolute path to the instance repo.
197
- * @param username - Active username for keychain scoping.
197
+ * @param username - Active username for secret scoping.
198
198
  */
199
199
  async function step3ConnectInputs(repoRoot, username) {
200
200
  printStep(3, "Connect inputs");
@@ -12,13 +12,13 @@
12
12
  * and instructs the user to refresh it via helm secrets set. No silent
13
13
  * token refresh is attempted in Phase 1 — that is Phase 2 scope.
14
14
  *
15
- * Secret values retrieved from the keychain are used directly in HTTP
15
+ * Secret values retrieved from encrypted local storage are used directly in HTTP
16
16
  * Authorization headers and are never included in any log output or
17
17
  * error message.
18
18
  */
19
19
  import type { InputTestResult } from "../types/index.js";
20
20
  /**
21
- * Ordered list of OS keychain key names required by each input.
21
+ * Ordered list of secret key names required by each input.
22
22
  * Used during helm setup to prompt for each credential and during
23
23
  * helm inputs test to retrieve them for connectivity checks.
24
24
  *
@@ -12,14 +12,14 @@
12
12
  * and instructs the user to refresh it via helm secrets set. No silent
13
13
  * token refresh is attempted in Phase 1 — that is Phase 2 scope.
14
14
  *
15
- * Secret values retrieved from the keychain are used directly in HTTP
15
+ * Secret values retrieved from encrypted local storage are used directly in HTTP
16
16
  * Authorization headers and are never included in any log output or
17
17
  * error message.
18
18
  */
19
19
  import { getSecret } from "./secrets.js";
20
20
  // ─── Credential Key Definitions ───────────────────────────────────────────────
21
21
  /**
22
- * Ordered list of OS keychain key names required by each input.
22
+ * Ordered list of secret key names required by each input.
23
23
  * Used during helm setup to prompt for each credential and during
24
24
  * helm inputs test to retrieve them for connectivity checks.
25
25
  *
@@ -1 +1 @@
1
- {"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/core/repo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAgDrD;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,mBAIrB,CAAC;AAIH;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAIrE;AAID;;;;;;;;GAQG;AACH,wBAAgB,YAAY,IAAI,IAAI,CASnC;AAID;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAY9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAGtD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKxD"}
1
+ {"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/core/repo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAiDrD;;;;;;;;;GASG;AACH,eAAO,MAAM,UAAU,mBAIrB,CAAC;AAIH;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,IAAI,CAIrE;AAID;;;;;;;;GAQG;AACH,wBAAgB,YAAY,IAAI,IAAI,CASnC;AAID;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAY9D;AAED;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,CAGtD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAKxD"}
package/dist/core/repo.js CHANGED
@@ -54,6 +54,7 @@ const LOCAL_CONFIG_DEFAULTS = {
54
54
  setup_complete: false,
55
55
  last_sync: "",
56
56
  secrets_manifest: [],
57
+ encrypted_secrets: {},
57
58
  };
58
59
  /**
59
60
  * Singleton conf store backed by ~/.chief/config.json.
@@ -1 +1 @@
1
- {"version":3,"file":"repo.js","sourceRoot":"","sources":["../../src/core/repo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,OAAO;IACP,cAAc;IACd,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,MAAM;IACN,WAAW;CACH,CAAC;AAEX;;;GAGG;AACH,MAAM,qBAAqB,GAAG;IAC5B,aAAa;IACb,aAAa;IACb,YAAY;IACZ,eAAe;CACP,CAAC;AAEX,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,qBAAqB,GAAgB;IACzC,kBAAkB,EAAE,EAAE;IACtB,WAAW,EAAE,EAAE;IACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM;IACvC,cAAc,EAAE,KAAK;IACrB,SAAS,EAAE,EAAE;IACb,gBAAgB,EAAE,EAAE;CACrB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAc;IAC9C,WAAW,EAAE,OAAO;IACpB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;IACtC,QAAQ,EAAE,qBAAqB;CAChC,CAAC,CAAC;AAEH,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC,KAAoB,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA6B;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAA0D,EAAE,CAAC;QAC5G,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,kBAAkB,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CACjB,2CAA2C,EAC3C,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC7D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACxE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAG,QAAkB;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAW,CAAC;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
1
+ {"version":3,"file":"repo.js","sourceRoot":"","sources":["../../src/core/repo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,iFAAiF;AAEjF;;;GAGG;AACH,MAAM,kBAAkB,GAAG;IACzB,QAAQ;IACR,OAAO;IACP,cAAc;IACd,WAAW;IACX,SAAS;IACT,SAAS;IACT,OAAO;IACP,MAAM;IACN,WAAW;CACH,CAAC;AAEX;;;GAGG;AACH,MAAM,qBAAqB,GAAG;IAC5B,aAAa;IACb,aAAa;IACb,YAAY;IACZ,eAAe;CACP,CAAC;AAEX,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,qBAAqB,GAAgB;IACzC,kBAAkB,EAAE,EAAE;IACtB,WAAW,EAAE,EAAE;IACf,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM;IACvC,cAAc,EAAE,KAAK;IACrB,SAAS,EAAE,EAAE;IACb,gBAAgB,EAAE,EAAE;IACpB,iBAAiB,EAAE,EAAE;CACtB,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAc;IAC9C,WAAW,EAAE,OAAO;IACpB,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC;IACtC,QAAQ,EAAE,qBAAqB;CAChC,CAAC,CAAC;AAEH,iFAAiF;AAEjF;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,UAAU,CAAC,KAAoB,CAAC;AACzC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAA6B;IAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAA0D,EAAE,CAAC;QAC5G,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAEhC,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,kBAAkB,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CACjB,2CAA2C,EAC3C,iBAAiB,CAClB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,KAAK,CAAC;IAE3C,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IAC7D,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,qBAAqB,EAAE,CAAC;QACzC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;IACxE,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAG,QAAkB;IAC5C,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAW,CAAC;IAC5D,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
@@ -1,39 +1,42 @@
1
1
  /**
2
- * @file OS keychain integration for HELM.
2
+ * @file Encrypted local secret storage for HELM.
3
3
  *
4
4
  * All secret storage and retrieval is routed through this module.
5
5
  * Secret values are handled as transiently as possible:
6
6
  *
7
- * - Values are never written to any file, log, or error message.
7
+ * - Values are never written to any file, log, or error message in plaintext.
8
8
  * - The only moment a value appears in memory outside this module is
9
9
  * during the masked inquirer prompt in the setup wizard and
10
10
  * helm secrets set — immediately passed to setSecret() and discarded.
11
11
  * - listSecretKeys() returns key names only. Values are never returned
12
12
  * to callers that don't explicitly call getSecret().
13
13
  *
14
- * A manifest of key names (not values) is stored in the local conf store
15
- * at ~/.chief/config.json because the OS keychain API does not provide
16
- * an enumeration method. The manifest is always kept in sync with the
17
- * keychain by setSecret() and deleteSecret().
14
+ * Secrets are encrypted with AES-256-GCM using a key derived via PBKDF2
15
+ * from machine-specific entropy (hostname + OS username). Encrypted values
16
+ * are stored in the local conf store at ~/.chief/config.json under the
17
+ * `encrypted_secrets` key. A manifest of key names (not values) is stored
18
+ * separately under `secrets_manifest` for enumeration.
18
19
  *
19
- * Keychain service name: "chief"
20
- * Account format: "[username]/[KEY_NAME]"
20
+ * Encrypted value format: "iv:authTag:ciphertext" (all hex-encoded).
21
+ *
22
+ * Account format in manifest: "[username]/[KEY_NAME]"
21
23
  */
22
24
  /**
23
- * Stores a secret value in the OS keychain and records the key name
24
- * in the local manifest.
25
+ * Encrypts and stores a secret value in the local conf store, and records
26
+ * the key name in the manifest.
25
27
  *
26
- * The value is accepted as a parameter and immediately forwarded to
27
- * keytar. Callers must not retain the value after this call returns.
28
+ * The value is encrypted immediately upon receipt and discarded from
29
+ * this function's scope. Callers must not retain the value after this
30
+ * call returns.
28
31
  *
29
32
  * @param username - Active username (used as the account prefix).
30
- * @param key - Secret key name, e.g. "GMAIL_CLIENT_ID".
31
- * @param value - The secret value. Never logged.
32
- * @throws {HelmError} If the keychain write fails.
33
+ * @param key - Secret key name, e.g. "GMAIL_CLIENT_ID".
34
+ * @param value - The secret value. Never logged or stored in plaintext.
35
+ * @throws {HelmError} If encryption fails.
33
36
  */
34
37
  export declare function setSecret(username: string, key: string, value: string): Promise<void>;
35
38
  /**
36
- * Retrieves a secret value from the OS keychain.
39
+ * Retrieves and decrypts a secret value from the local conf store.
37
40
  *
38
41
  * Returns null if the key does not exist. Callers must handle the null
39
42
  * case by throwing an appropriate HelmError naming the missing key and
@@ -43,37 +46,38 @@ export declare function setSecret(username: string, key: string, value: string):
43
46
  * user-facing string.
44
47
  *
45
48
  * @param username - Active username.
46
- * @param key - Secret key name to retrieve.
47
- * @throws {HelmError} If the keychain read fails unexpectedly.
49
+ * @param key - Secret key name to retrieve.
50
+ * @returns The decrypted secret value, or null if not found.
51
+ * @throws {HelmError} If decryption fails.
48
52
  */
49
53
  export declare function getSecret(username: string, key: string): Promise<string | null>;
50
54
  /**
51
55
  * Returns the list of secret key names stored for the given username.
52
56
  * Values are never returned — only names.
53
57
  *
54
- * Reads from the local manifest rather than querying the keychain
55
- * directly, because the keychain API does not support enumeration.
58
+ * Reads from the local manifest rather than iterating encrypted entries.
56
59
  *
57
60
  * @param username - Active username to filter by.
61
+ * @returns Sorted array of key names (without the username prefix).
58
62
  */
59
63
  export declare function listSecretKeys(username: string): string[];
60
64
  /**
61
65
  * Returns true if a secret with the given key name exists in the
62
- * OS keychain for the given username.
66
+ * local conf store for the given username.
63
67
  *
64
68
  * @param username - Active username.
65
- * @param key - Secret key name to check.
66
- * @throws {HelmError} If the keychain read fails.
69
+ * @param key - Secret key name to check.
70
+ * @returns True if the secret exists and can be decrypted.
71
+ * @throws {HelmError} If decryption fails.
67
72
  */
68
73
  export declare function verifySecret(username: string, key: string): Promise<boolean>;
69
74
  /**
70
- * Removes a secret from the OS keychain and removes its name from the
71
- * local manifest.
75
+ * Removes an encrypted secret from the local conf store and removes its
76
+ * name from the manifest.
72
77
  *
73
78
  * @param username - Active username.
74
- * @param key - Secret key name to delete.
79
+ * @param key - Secret key name to delete.
75
80
  * @returns True if the key existed and was deleted; false if it did not exist.
76
- * @throws {HelmError} If the keychain deletion fails.
77
81
  */
78
82
  export declare function deleteSecret(username: string, key: string): Promise<boolean>;
79
83
  //# sourceMappingURL=secrets.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/core/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAiEH;;;;;;;;;;;GAWG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAcf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAYxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAuBlB"}
1
+ {"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/core/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AA6IH;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAkBf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAmBxB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAQzD;AAED;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAGlB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,OAAO,CAAC,CAalB"}
@@ -1,52 +1,112 @@
1
1
  /**
2
- * @file OS keychain integration for HELM.
2
+ * @file Encrypted local secret storage for HELM.
3
3
  *
4
4
  * All secret storage and retrieval is routed through this module.
5
5
  * Secret values are handled as transiently as possible:
6
6
  *
7
- * - Values are never written to any file, log, or error message.
7
+ * - Values are never written to any file, log, or error message in plaintext.
8
8
  * - The only moment a value appears in memory outside this module is
9
9
  * during the masked inquirer prompt in the setup wizard and
10
10
  * helm secrets set — immediately passed to setSecret() and discarded.
11
11
  * - listSecretKeys() returns key names only. Values are never returned
12
12
  * to callers that don't explicitly call getSecret().
13
13
  *
14
- * A manifest of key names (not values) is stored in the local conf store
15
- * at ~/.chief/config.json because the OS keychain API does not provide
16
- * an enumeration method. The manifest is always kept in sync with the
17
- * keychain by setSecret() and deleteSecret().
14
+ * Secrets are encrypted with AES-256-GCM using a key derived via PBKDF2
15
+ * from machine-specific entropy (hostname + OS username). Encrypted values
16
+ * are stored in the local conf store at ~/.chief/config.json under the
17
+ * `encrypted_secrets` key. A manifest of key names (not values) is stored
18
+ * separately under `secrets_manifest` for enumeration.
18
19
  *
19
- * Keychain service name: "chief"
20
- * Account format: "[username]/[KEY_NAME]"
20
+ * Encrypted value format: "iv:authTag:ciphertext" (all hex-encoded).
21
+ *
22
+ * Account format in manifest: "[username]/[KEY_NAME]"
21
23
  */
22
- import keytar from "keytar";
23
- import chalk from "chalk";
24
+ import { randomBytes, pbkdf2Sync, createCipheriv, createDecipheriv } from "node:crypto";
25
+ import os from "node:os";
24
26
  import { localStore } from "./repo.js";
25
27
  import { HelmError } from "../utils/errors.js";
26
- /** Service name used for all entries in the OS keychain. */
27
- const KEYCHAIN_SERVICE = "chief";
28
- // ─── Keychain Heads-Up ────────────────────────────────────────────────────────
28
+ // ─── Encryption Constants ─────────────────────────────────────────────────────
29
+ /** AES-256-GCM cipher algorithm identifier. */
30
+ const CIPHER_ALGORITHM = "aes-256-gcm";
31
+ /** Length in bytes of the initialisation vector for AES-GCM. */
32
+ const IV_LENGTH = 16;
33
+ /** Length in bytes of the GCM authentication tag. */
34
+ const AUTH_TAG_LENGTH = 16;
35
+ /** Length in bytes of the derived encryption key (256 bits for AES-256). */
36
+ const KEY_LENGTH = 32;
37
+ /** PBKDF2 iteration count. OWASP recommends >= 600,000 for SHA-256. */
38
+ const PBKDF2_ITERATIONS = 600_000;
39
+ /** PBKDF2 digest algorithm. */
40
+ const PBKDF2_DIGEST = "sha256";
41
+ /**
42
+ * Static salt prefix combined with machine-specific entropy.
43
+ * Changing this value invalidates all previously encrypted secrets.
44
+ */
45
+ const SALT_PREFIX = "chief-helm-secrets";
46
+ // ─── Key Derivation ───────────────────────────────────────────────────────────
47
+ /**
48
+ * Derives a 256-bit encryption key from machine-specific entropy using PBKDF2.
49
+ *
50
+ * The derivation input combines a static salt prefix with the machine's
51
+ * hostname and OS-level username. This ties encrypted secrets to the
52
+ * specific machine and OS user account, preventing portability of the
53
+ * encrypted config file to a different machine without re-entering secrets.
54
+ *
55
+ * @returns A 32-byte Buffer suitable for use as an AES-256 key.
56
+ */
57
+ function deriveEncryptionKey() {
58
+ const machineEntropy = `${SALT_PREFIX}:${os.hostname()}:${os.userInfo().username}`;
59
+ return pbkdf2Sync(machineEntropy, SALT_PREFIX, PBKDF2_ITERATIONS, KEY_LENGTH, PBKDF2_DIGEST);
60
+ }
61
+ // ─── Encrypt / Decrypt ────────────────────────────────────────────────────────
29
62
  /**
30
- * Module-level flag ensuring the macOS keychain access prompt
31
- * explanation is printed only once per process invocation.
63
+ * Encrypts a plaintext string using AES-256-GCM.
64
+ *
65
+ * @param plaintext - The secret value to encrypt.
66
+ * @returns A colon-delimited string: "iv:authTag:ciphertext" (all hex-encoded).
32
67
  */
33
- let keychainHeadsUpShown = false;
68
+ function encrypt(plaintext) {
69
+ const key = deriveEncryptionKey();
70
+ const iv = randomBytes(IV_LENGTH);
71
+ const cipher = createCipheriv(CIPHER_ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
72
+ const encrypted = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
73
+ const authTag = cipher.getAuthTag();
74
+ return `${iv.toString("hex")}:${authTag.toString("hex")}:${encrypted.toString("hex")}`;
75
+ }
34
76
  /**
35
- * Prints a one-line notice before the first keychain operation in a
36
- * process. macOS will show a native permission dialog the first time
37
- * an app accesses the keychain; without this notice users may be
38
- * confused or alarmed by the unexpected OS popup.
77
+ * Decrypts a value previously encrypted by {@link encrypt}.
78
+ *
79
+ * @param encryptedValue - Colon-delimited string: "iv:authTag:ciphertext" (hex-encoded).
80
+ * @returns The original plaintext string.
81
+ * @throws {HelmError} If the encrypted value format is invalid or decryption fails.
39
82
  */
40
- function ensureKeychainHeadsUp() {
41
- if (!keychainHeadsUpShown) {
42
- process.stdout.write(chalk.dim(" ℹ Your OS may prompt you to allow keychain access — this is expected.\n"));
43
- keychainHeadsUpShown = true;
83
+ function decrypt(encryptedValue) {
84
+ const parts = encryptedValue.split(":");
85
+ if (parts.length !== 3) {
86
+ throw new HelmError("Encrypted secret has an invalid format.", "Re-store the secret with: helm secrets set <KEY>");
87
+ }
88
+ const [ivHex, authTagHex, ciphertextHex] = parts;
89
+ const key = deriveEncryptionKey();
90
+ const iv = Buffer.from(ivHex, "hex");
91
+ const authTag = Buffer.from(authTagHex, "hex");
92
+ const ciphertext = Buffer.from(ciphertextHex, "hex");
93
+ const decipher = createDecipheriv(CIPHER_ALGORITHM, key, iv, { authTagLength: AUTH_TAG_LENGTH });
94
+ decipher.setAuthTag(authTag);
95
+ try {
96
+ const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]);
97
+ return decrypted.toString("utf8");
98
+ }
99
+ catch {
100
+ throw new HelmError("Failed to decrypt secret. The encryption key may have changed (hostname or OS user changed).", "Re-store the secret with: helm secrets set <KEY>");
44
101
  }
45
102
  }
46
103
  // ─── Manifest Helpers ─────────────────────────────────────────────────────────
47
104
  /**
48
105
  * Adds a fully-qualified key name ("[username]/[KEY_NAME]") to the
49
106
  * manifest in local config if it is not already present.
107
+ *
108
+ * @param username - Active username.
109
+ * @param key - Secret key name, e.g. "GMAIL_CLIENT_ID".
50
110
  */
51
111
  function addToManifest(username, key) {
52
112
  const fullKey = `${username}/${key}`;
@@ -58,6 +118,9 @@ function addToManifest(username, key) {
58
118
  /**
59
119
  * Removes a fully-qualified key name from the manifest in local config.
60
120
  * No-op if the key is not present.
121
+ *
122
+ * @param username - Active username.
123
+ * @param key - Secret key name to remove.
61
124
  */
62
125
  function removeFromManifest(username, key) {
63
126
  const fullKey = `${username}/${key}`;
@@ -66,30 +129,36 @@ function removeFromManifest(username, key) {
66
129
  }
67
130
  // ─── Public API ───────────────────────────────────────────────────────────────
68
131
  /**
69
- * Stores a secret value in the OS keychain and records the key name
70
- * in the local manifest.
132
+ * Encrypts and stores a secret value in the local conf store, and records
133
+ * the key name in the manifest.
71
134
  *
72
- * The value is accepted as a parameter and immediately forwarded to
73
- * keytar. Callers must not retain the value after this call returns.
135
+ * The value is encrypted immediately upon receipt and discarded from
136
+ * this function's scope. Callers must not retain the value after this
137
+ * call returns.
74
138
  *
75
139
  * @param username - Active username (used as the account prefix).
76
- * @param key - Secret key name, e.g. "GMAIL_CLIENT_ID".
77
- * @param value - The secret value. Never logged.
78
- * @throws {HelmError} If the keychain write fails.
140
+ * @param key - Secret key name, e.g. "GMAIL_CLIENT_ID".
141
+ * @param value - The secret value. Never logged or stored in plaintext.
142
+ * @throws {HelmError} If encryption fails.
79
143
  */
80
144
  export async function setSecret(username, key, value) {
81
- ensureKeychainHeadsUp();
145
+ const fullKey = `${username}/${key}`;
82
146
  try {
83
- await keytar.setPassword(KEYCHAIN_SERVICE, `${username}/${key}`, value);
147
+ const encryptedValue = encrypt(value);
148
+ const secrets = localStore.get("encrypted_secrets") ?? {};
149
+ secrets[fullKey] = encryptedValue;
150
+ localStore.set("encrypted_secrets", secrets);
84
151
  }
85
152
  catch (err) {
153
+ if (err instanceof HelmError)
154
+ throw err;
86
155
  const detail = err instanceof Error ? err.message : String(err);
87
- throw new HelmError(`Failed to store secret "${key}" in the OS keychain: ${detail}`, "Ensure your OS keychain is accessible and try again.");
156
+ throw new HelmError(`Failed to encrypt and store secret "${key}": ${detail}`, "Ensure your system supports AES-256-GCM and try again.");
88
157
  }
89
158
  addToManifest(username, key);
90
159
  }
91
160
  /**
92
- * Retrieves a secret value from the OS keychain.
161
+ * Retrieves and decrypts a secret value from the local conf store.
93
162
  *
94
163
  * Returns null if the key does not exist. Callers must handle the null
95
164
  * case by throwing an appropriate HelmError naming the missing key and
@@ -99,27 +168,35 @@ export async function setSecret(username, key, value) {
99
168
  * user-facing string.
100
169
  *
101
170
  * @param username - Active username.
102
- * @param key - Secret key name to retrieve.
103
- * @throws {HelmError} If the keychain read fails unexpectedly.
171
+ * @param key - Secret key name to retrieve.
172
+ * @returns The decrypted secret value, or null if not found.
173
+ * @throws {HelmError} If decryption fails.
104
174
  */
105
175
  export async function getSecret(username, key) {
106
- ensureKeychainHeadsUp();
176
+ const fullKey = `${username}/${key}`;
177
+ const secrets = localStore.get("encrypted_secrets") ?? {};
178
+ const encryptedValue = secrets[fullKey];
179
+ if (encryptedValue === undefined) {
180
+ return null;
181
+ }
107
182
  try {
108
- return await keytar.getPassword(KEYCHAIN_SERVICE, `${username}/${key}`);
183
+ return decrypt(encryptedValue);
109
184
  }
110
185
  catch (err) {
186
+ if (err instanceof HelmError)
187
+ throw err;
111
188
  const detail = err instanceof Error ? err.message : String(err);
112
- throw new HelmError(`Failed to read secret "${key}" from the OS keychain: ${detail}`, "Ensure your OS keychain is accessible and try again.");
189
+ throw new HelmError(`Failed to decrypt secret "${key}": ${detail}`, "Re-store the secret with: helm secrets set " + key);
113
190
  }
114
191
  }
115
192
  /**
116
193
  * Returns the list of secret key names stored for the given username.
117
194
  * Values are never returned — only names.
118
195
  *
119
- * Reads from the local manifest rather than querying the keychain
120
- * directly, because the keychain API does not support enumeration.
196
+ * Reads from the local manifest rather than iterating encrypted entries.
121
197
  *
122
198
  * @param username - Active username to filter by.
199
+ * @returns Sorted array of key names (without the username prefix).
123
200
  */
124
201
  export function listSecretKeys(username) {
125
202
  const manifest = localStore.get("secrets_manifest") ?? [];
@@ -131,38 +208,34 @@ export function listSecretKeys(username) {
131
208
  }
132
209
  /**
133
210
  * Returns true if a secret with the given key name exists in the
134
- * OS keychain for the given username.
211
+ * local conf store for the given username.
135
212
  *
136
213
  * @param username - Active username.
137
- * @param key - Secret key name to check.
138
- * @throws {HelmError} If the keychain read fails.
214
+ * @param key - Secret key name to check.
215
+ * @returns True if the secret exists and can be decrypted.
216
+ * @throws {HelmError} If decryption fails.
139
217
  */
140
218
  export async function verifySecret(username, key) {
141
219
  const value = await getSecret(username, key);
142
220
  return value !== null;
143
221
  }
144
222
  /**
145
- * Removes a secret from the OS keychain and removes its name from the
146
- * local manifest.
223
+ * Removes an encrypted secret from the local conf store and removes its
224
+ * name from the manifest.
147
225
  *
148
226
  * @param username - Active username.
149
- * @param key - Secret key name to delete.
227
+ * @param key - Secret key name to delete.
150
228
  * @returns True if the key existed and was deleted; false if it did not exist.
151
- * @throws {HelmError} If the keychain deletion fails.
152
229
  */
153
230
  export async function deleteSecret(username, key) {
154
- ensureKeychainHeadsUp();
155
- let deleted;
156
- try {
157
- deleted = await keytar.deletePassword(KEYCHAIN_SERVICE, `${username}/${key}`);
158
- }
159
- catch (err) {
160
- const detail = err instanceof Error ? err.message : String(err);
161
- throw new HelmError(`Failed to delete secret "${key}" from the OS keychain: ${detail}`, "Ensure your OS keychain is accessible and try again.");
162
- }
163
- if (deleted) {
164
- removeFromManifest(username, key);
231
+ const fullKey = `${username}/${key}`;
232
+ const secrets = localStore.get("encrypted_secrets") ?? {};
233
+ if (secrets[fullKey] === undefined) {
234
+ return false;
165
235
  }
166
- return deleted;
236
+ delete secrets[fullKey];
237
+ localStore.set("encrypted_secrets", secrets);
238
+ removeFromManifest(username, key);
239
+ return true;
167
240
  }
168
241
  //# sourceMappingURL=secrets.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/core/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,4DAA4D;AAC5D,MAAM,gBAAgB,GAAG,OAAO,CAAC;AAEjC,iFAAiF;AAEjF;;;GAGG;AACH,IAAI,oBAAoB,GAAG,KAAK,CAAC;AAEjC;;;;;GAKG;AACH,SAAS,qBAAqB;IAC5B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,CAAC,GAAG,CACP,4EAA4E,CAC7E,CACF,CAAC;QACF,oBAAoB,GAAG,IAAI,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;GAGG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,GAAW;IAClD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IAExE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,GAAW;IACvD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IACxE,UAAU,CAAC,GAAG,CACZ,kBAAkB,EAClB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,GAAW,EACX,KAAa;IAEb,qBAAqB,EAAE,CAAC;IAExB,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,QAAQ,IAAI,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,2BAA2B,GAAG,yBAAyB,MAAM,EAAE,EAC/D,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,GAAW;IAEX,qBAAqB,EAAE,CAAC;IAExB,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,0BAA0B,GAAG,2BAA2B,MAAM,EAAE,EAChE,sDAAsD,CACvD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,QAAQ,GAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC;IAE9B,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SAClC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,GAAW;IAEX,qBAAqB,EAAE,CAAC;IAExB,IAAI,OAAgB,CAAC;IAErB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CACnC,gBAAgB,EAChB,GAAG,QAAQ,IAAI,GAAG,EAAE,CACrB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,4BAA4B,GAAG,2BAA2B,MAAM,EAAE,EAClE,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
1
+ {"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/core/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,iFAAiF;AAEjF,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,aAAsB,CAAC;AAEhD,gEAAgE;AAChE,MAAM,SAAS,GAAG,EAAE,CAAC;AAErB,qDAAqD;AACrD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B,4EAA4E;AAC5E,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,uEAAuE;AACvE,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAElC,+BAA+B;AAC/B,MAAM,aAAa,GAAG,QAAiB,CAAC;AAExC;;;GAGG;AACH,MAAM,WAAW,GAAG,oBAA6B,CAAC;AAElD,iFAAiF;AAEjF;;;;;;;;;GASG;AACH,SAAS,mBAAmB;IAC1B,MAAM,cAAc,GAAG,GAAG,WAAW,IAAI,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,CAAC;IACnF,OAAO,UAAU,CAAC,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAC/F,CAAC;AAED,iFAAiF;AAEjF;;;;;GAKG;AACH,SAAS,OAAO,CAAC,SAAiB;IAChC,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAE7F,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACpF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AACzF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,OAAO,CAAC,cAAsB;IACrC,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,SAAS,CACjB,yCAAyC,EACzC,kDAAkD,CACnD,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,aAAa,CAAC,GAAG,KAAiC,CAAC;IAC7E,MAAM,GAAG,GAAG,mBAAmB,EAAE,CAAC;IAClC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAC/C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IACjG,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAE7B,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACjF,OAAO,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CACjB,8FAA8F,EAC9F,kDAAkD,CACnD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,iFAAiF;AAEjF;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,QAAgB,EAAE,GAAW;IAClD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IAExE,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7D,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,QAAgB,EAAE,GAAW;IACvD,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IACxE,UAAU,CAAC,GAAG,CACZ,kBAAkB,EAClB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,OAAO,CAAC,CACtC,CAAC;AACJ,CAAC;AAED,iFAAiF;AAEjF;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,GAAW,EACX,KAAa;IAEb,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IAErC,IAAI,CAAC;QACH,MAAM,cAAc,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,MAAM,OAAO,GAAI,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAA4B,IAAI,EAAE,CAAC;QACtF,OAAO,CAAC,OAAO,CAAC,GAAG,cAAc,CAAC;QAClC,UAAU,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS;YAAE,MAAM,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,uCAAuC,GAAG,MAAM,MAAM,EAAE,EACxD,wDAAwD,CACzD,CAAC;IACJ,CAAC;IAED,aAAa,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,QAAgB,EAChB,GAAW;IAEX,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,OAAO,GAAI,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAA4B,IAAI,EAAE,CAAC;IACtF,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAExC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,SAAS;YAAE,MAAM,GAAG,CAAC;QACxC,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,6BAA6B,GAAG,MAAM,MAAM,EAAE,EAC9C,6CAA6C,GAAG,GAAG,CACpD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB;IAC7C,MAAM,QAAQ,GAAI,UAAU,CAAC,GAAG,CAAC,kBAAkB,CAAc,IAAI,EAAE,CAAC;IACxE,MAAM,MAAM,GAAG,GAAG,QAAQ,GAAG,CAAC;IAE9B,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;SAClC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC7C,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,GAAW;IAEX,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,GAAG,EAAE,CAAC;IACrC,MAAM,OAAO,GAAI,UAAU,CAAC,GAAG,CAAC,mBAAmB,CAA4B,IAAI,EAAE,CAAC;IAEtF,IAAI,OAAO,CAAC,OAAO,CAAC,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;IACxB,UAAU,CAAC,GAAG,CAAC,mBAAmB,EAAE,OAAO,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAElC,OAAO,IAAI,CAAC;AACd,CAAC"}
@@ -155,11 +155,16 @@ export interface LocalConfig {
155
155
  /** ISO 8601 timestamp of the last successful helm sync. */
156
156
  last_sync: string;
157
157
  /**
158
- * List of secret key names stored in the OS keychain for this machine.
158
+ * List of secret key names stored on this machine.
159
159
  * Format: "[username]/[KEY_NAME]". Values are never stored here — only names.
160
- * This manifest exists because the OS keychain API does not support enumeration.
161
160
  */
162
161
  secrets_manifest: string[];
162
+ /**
163
+ * AES-256-GCM encrypted secret values keyed by "[username]/[KEY_NAME]".
164
+ * Each value is a colon-delimited string: "iv:authTag:ciphertext" (all hex-encoded).
165
+ * Decrypted at runtime using a PBKDF2-derived key from machine-specific entropy.
166
+ */
167
+ encrypted_secrets: Record<string, string>;
163
168
  }
164
169
  /**
165
170
  * A single flow's last execution record.
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mEAAmE;IACnE,wBAAwB,EAAE,OAAO,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC/B,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,MAAM,EAAE,aAAa,GAAG,eAAe,CAAC;IACxC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,cAAc,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAID;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAIzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,+CAA+C;IAC/C,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,oDAAoD;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,UAAU,EAAE,OAAO,CAAC;IACpB,iEAAiE;IACjE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,yEAAyE;IACzE,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,eAAe,EAAE,MAAM,CAAC;CACzB;AAED;;;GAGG;AACH,MAAM,WAAW,KAAK;IACpB,uDAAuD;IACvD,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC;IACjB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;IACzB,kDAAkD;IAClD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,wEAAwE;IACxE,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,IAAI;IACnB,kDAAkD;IAClD,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,0CAA0C;IAC1C,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,gBAAgB,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,kEAAkE;IAClE,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,mEAAmE;IACnE,wBAAwB,EAAE,OAAO,CAAC;IAClC,gEAAgE;IAChE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,MAAM,WAAW,OAAO;IACtB,iCAAiC;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,oCAAoC;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,IAAI,EAAE,WAAW,GAAG,QAAQ,CAAC;IAC7B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,QAAQ,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC/B,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,mEAAmE;IACnE,UAAU,EAAE,OAAO,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,MAAM,EAAE,aAAa,GAAG,eAAe,CAAC;IACxC,+DAA+D;IAC/D,OAAO,EAAE,MAAM,CAAC;IAChB,6DAA6D;IAC7D,eAAe,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAID;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,MAAM,EAAE,MAAM,CAAC;IACf,4EAA4E;IAC5E,cAAc,EAAE,OAAO,CAAC;IACxB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC3C;AAID;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,uCAAuC;IACvC,MAAM,EAAE,SAAS,GAAG,QAAQ,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAIzD;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,gCAAgC;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,uCAAuC;IACvC,EAAE,EAAE,OAAO,CAAC;IACZ;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;OAEG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,2DAA2D;IAC3D,KAAK,EAAE,OAAO,CAAC;IACf,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB"}
package/package.json CHANGED
@@ -1,7 +1,12 @@
1
1
  {
2
2
  "name": "chief-helm",
3
- "version": "0.1.1",
3
+ "version": "0.1.3",
4
4
  "description": "CLI for CHIEF — Personal AI Operations System",
5
+ "repository": {
6
+ "type": "git",
7
+ "url": "https://github.com/joselvelez/CHIEF.git",
8
+ "directory": "helm"
9
+ },
5
10
  "type": "module",
6
11
  "bin": {
7
12
  "helm": "./dist/index.js"
@@ -35,7 +40,6 @@
35
40
  "ink": "^5.1.4",
36
41
  "inquirer": "^13.3.0",
37
42
  "js-yaml": "^4.1.0",
38
- "keytar": "^7.9.0",
39
43
  "open": "^10.1.0",
40
44
  "ora": "^8.0.1",
41
45
  "react": "^18.3.1",