ciphermesh 1.0.0

package/src/client/index.js

@@ -0,0 +1,231 @@
+import * as readline from 'node:readline/promises';
+import { stdin, stdout } from 'node:process';
+import { readFileSync } from 'node:fs';
+import sodium from 'sodium-native';
+import { SERVER_PORT } from '../shared/constants.js';
+import {
+  animatedBanner,
+  bootSequence,
+  clientConnectingBox,
+  promptLabel,
+  promptDim,
+  promptError,
+} from '../shared/banner.js';
+import { KeyManager } from '../crypto/KeyManager.js';
+import { StateManager } from '../crypto/StateManager.js';
+import { HistoryStore } from '../crypto/HistoryStore.js';
+import { parseInvite } from '../shared/invite.js';
+import { importBackup } from '../crypto/IdentityBackup.js';
+import { questionHidden } from '../shared/prompt.js';
+import { loadConfig, startupCommands } from '../shared/config.js';
+import { setTheme } from '../shared/themes.js';
+import { Connection } from './Connection.js';
+import { UI } from './UI.js';
+import { ChatController } from './ChatController.js';
+import { PluginManager } from '../shared/PluginManager.js';
+
+// ── Banner ──────────────────────────────────────────────────────
+await animatedBanner();
+
+// ── Config (optional defaults from ~/.ciphermesh/config.json) ────
+const config = loadConfig();
+if (config.theme) {
+  setTheme(config.theme);
+}
+
+// ── Prompt setup ────────────────────────────────────────────────
+const rl = readline.createInterface({ input: stdin, output: stdout });
+
+let nickname = '';
+while (!nickname) {
+  const hint = config.nickname ? `(${config.nickname})` : '(a-z, 0-9, _, -)';
+  const raw = await rl.question(promptLabel(`Nickname ${promptDim(hint)}: `));
+  const clean = (raw.trim() || config.nickname || '').replace(/[^a-zA-Z0-9_-]/g, '');
+  if (clean.length >= 1 && clean.length <= 20) {
+    nickname = clean;
+  } else {
+    console.log(promptError('Invalid nickname. Use 1-20 alphanumeric characters.'));
+  }
+}
+
+// ── State restoration ────────────────────────────────────────────
+const stateManager = new StateManager();
+let restoredState = null;
+
+if (stateManager.hasState()) {
+  const passphrase = await questionHidden(
+    rl,
+    promptLabel(`Passphrase to restore session ${promptDim('(Enter to skip)')}: `),
+  );
+  if (passphrase.trim()) {
+    restoredState = stateManager.loadState(passphrase.trim());
+    if (restoredState) {
+      restoredState.passphrase = passphrase.trim();
+      console.log(promptLabel('Previous session restored successfully!'));
+    } else {
+      console.log(promptError('Incorrect passphrase or corrupted state. Starting a new session.'));
+    }
+  }
+} else {
+  const passphrase = await questionHidden(
+    rl,
+    promptLabel(`Passphrase to protect session ${promptDim('(Enter to skip)')}: `),
+  );
+  if (passphrase.trim()) {
+    const confirm = await questionHidden(rl, promptLabel('Confirm the passphrase: '));
+    if (confirm.trim() === passphrase.trim()) {
+      restoredState = { passphrase: passphrase.trim() };
+    } else {
+      console.log(
+        promptError('Passphrases do not match — session will not be protected this time.'),
+      );
+    }
+  }
+}
+
+// Offer to restore identity + trust from an encrypted backup (only when there
+// is no session to restore).
+if (!restoredState?.keyManager) {
+  const backupPath = await rl.question(
+    promptLabel(`Restore identity from a backup? ${promptDim('(path or Enter)')}: `),
+  );
+  if (backupPath.trim()) {
+    try {
+      const raw = readFileSync(backupPath.trim(), 'utf-8');
+      const pass = await questionHidden(rl, promptLabel('Backup passphrase: '));
+      const data = importBackup(raw, pass.trim());
+      if (data?.identity) {
+        restoredState = {
+          ...(restoredState || {}),
+          keyManager: data.identity,
+          trust: data.trust,
+          passphrase: pass.trim(),
+        };
+        console.log(promptLabel('Identity + trust restored from backup!'));
+      } else {
+        console.log(promptError('Invalid backup or incorrect passphrase.'));
+      }
+    } catch (e) {
+      console.log(promptError(`Could not read the backup: ${e.message}`));
+    }
+  }
+}
+
+const defaultServer = config.server || `localhost:${SERVER_PORT}`;
+const serverInput = await rl.question(
+  promptLabel(`Server ${promptDim(`(${defaultServer} or ciphermesh:// invite)`)}: `),
+);
+const serverAddr = serverInput.trim() || defaultServer;
+
+let wsUrl;
+let inviteRoom = null;
+const invite = parseInvite(serverAddr);
+if (invite) {
+  wsUrl = invite.wsUrl;
+  inviteRoom = invite.room !== 'general' ? invite.room : null;
+} else {
+  wsUrl =
+    serverAddr.startsWith('ws://') || serverAddr.startsWith('wss://')
+      ? serverAddr
+      : `wss://${serverAddr}`;
+}
+
+rl.close();
+
+// ── Encrypted local history (opt-in, needs passphrase) ─────────
+let historyStore = null;
+if (restoredState?.passphrase) {
+  historyStore = new HistoryStore();
+  if (!historyStore.open(restoredState.passphrase)) {
+    console.log(promptError('History: passphrase mismatch — history disabled for this session'));
+    historyStore = null;
+  }
+}
+
+// ── Pre-connect info ────────────────────────────────────────────
+// Create a temporary KeyManager to show fingerprint before blessed takes over
+const tempKeys = restoredState?.keyManager
+  ? KeyManager.deserialize(restoredState.keyManager)
+  : new KeyManager();
+const fingerprint = tempKeys.fingerprint;
+tempKeys.destroy();
+
+console.log();
+clientConnectingBox(wsUrl, fingerprint);
+
+// ── Real boot sequence ──────────────────────────────────────────
+// The spinner gates on genuine startup work: plugins actually load, then the
+// relay connection is actually established. If the connection is slow it
+// extends; if it times out we fall through to the TUI, which keeps retrying
+// and shows the live connection status.
+const pluginManager = new PluginManager();
+const connection = new Connection(wsUrl);
+
+await bootSequence([
+  'Curve25519 key exchange',
+  'XSalsa20-Poly1305 cipher',
+  'Double Ratchet — forward secrecy',
+  'TOFU trust store',
+  { label: 'Loading plugins', task: () => pluginManager.loadAll() },
+  {
+    label: 'Connecting to relay',
+    timeoutMs: 3500,
+    task: () =>
+      new Promise((resolve) => {
+        if (connection.connected) {
+          resolve();
+          return;
+        }
+        connection.once('connected', resolve);
+        connection.connect();
+      }),
+  },
+]);
+
+// ── Initialize ──────────────────────────────────────────────────
+
+const ui = new UI(nickname);
+const controller = new ChatController(
+  nickname,
+  connection,
+  ui,
+  restoredState,
+  pluginManager,
+  inviteRoom,
+  historyStore,
+);
+
+ui.setFingerprint(controller.fingerprint);
+ui.addInfoMessage(`Your fingerprint: ${controller.fingerprint}`);
+ui.addInfoMessage('Use /help to see available commands');
+
+if (restoredState?.handshake) {
+  ui.addSystemMessage('Previous session restored — ratchets preserved');
+}
+
+// The connection was already initiated during the boot sequence.
+
+// Apply config toggles by replaying their slash-commands through the controller.
+for (const cmd of startupCommands(config)) {
+  ui.emit('input', cmd);
+}
+
+// ── Graceful shutdown ───────────────────────────────────────────
+function shutdown() {
+  const passphrase = controller.passphrase;
+  if (passphrase) {
+    try {
+      const state = controller.serializeState();
+      const { kek, salt, opslimit, memlimit } = stateManager.deriveKEK(passphrase);
+      stateManager.saveState(state, kek, salt, opslimit, memlimit);
+      sodium.sodium_memzero(kek);
+    } catch {
+      // Best effort — don't block shutdown
+    }
+  }
+  controller.destroy();
+  process.exit(0);
+}
+
+process.on('SIGINT', shutdown);
+process.on('SIGTERM', shutdown);

package/src/crypto/CertPinStore.js

@@ -0,0 +1,79 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const PIN_DIR = '.ciphermesh';
+const PIN_FILE = 'pinned-certs.json';
+
+export const PinResult = {
+  PINNED: 'pinned', // first time — fingerprint stored (trust on first use)
+  MATCH: 'match', // fingerprint matches the pin
+  MISMATCH: 'mismatch', // fingerprint changed — possible MITM
+};
+
+/**
+ * Trust-on-first-use pin store for server TLS certificate fingerprints.
+ * Complements the E2EE key TOFU (TrustStore) with transport-layer detection.
+ */
+export class CertPinStore {
+  #path;
+  #store; // Map<host, sha256Fingerprint>
+
+  constructor(baseDir = process.cwd()) {
+    const dir = join(baseDir, PIN_DIR);
+    if (!existsSync(dir)) {
+      mkdirSync(dir, { recursive: true });
+    }
+    this.#path = join(dir, PIN_FILE);
+    this.#store = new Map();
+    this.#load();
+  }
+
+  #load() {
+    try {
+      if (existsSync(this.#path)) {
+        const data = JSON.parse(readFileSync(this.#path, 'utf-8'));
+        for (const [host, fp] of Object.entries(data)) {
+          this.#store.set(host, fp);
+        }
+      }
+    } catch {
+      this.#store = new Map();
+    }
+  }
+
+  #save() {
+    writeFileSync(this.#path, JSON.stringify(Object.fromEntries(this.#store), null, 2), {
+      encoding: 'utf-8',
+      mode: 0o600,
+    });
+  }
+
+  /**
+   * Check a server's cert fingerprint against the pinned one (pinning on first use).
+   * @param {string} host - e.g. "100.73.206.23:3600"
+   * @param {string|null} fingerprint - SHA-256 fingerprint, or null for non-TLS
+   * @returns {string} one of PinResult
+   */
+  check(host, fingerprint) {
+    if (!fingerprint) {
+      return PinResult.MATCH; // nothing to pin (plain ws://)
+    }
+    const pinned = this.#store.get(host);
+    if (!pinned) {
+      this.#store.set(host, fingerprint);
+      this.#save();
+      return PinResult.PINNED;
+    }
+    return pinned === fingerprint ? PinResult.MATCH : PinResult.MISMATCH;
+  }
+
+  getPinned(host) {
+    return this.#store.get(host) || null;
+  }
+
+  /** Explicitly accept a new fingerprint (e.g. after a legitimate cert rotation). */
+  repin(host, fingerprint) {
+    this.#store.set(host, fingerprint);
+    this.#save();
+  }
+}

package/src/crypto/DeniableEncrypt.js

@@ -0,0 +1,53 @@
+import sodium from 'sodium-native';
+import { padMessage, unpadSecure } from './MessageCrypto.js';
+
+/**
+ * Derive a shared symmetric key from a DH key exchange.
+ * X25519(mySecret, peerPublic) → BLAKE2b → 32-byte secretbox key.
+ * Both parties derive the same key (DH symmetry), so either could have created
+ * any message — that is what gives the deniable construction its deniability.
+ *
+ * NOTE: this used to call crypto_box_beforenm, which sodium-native removed
+ * (>=4.3.3), leaving deniable mode broken at runtime. We now derive the key
+ * ourselves from the raw X25519 shared secret.
+ */
+export function deriveSharedKey(mySecretKey, peerPublicKey) {
+  const dh = sodium.sodium_malloc(sodium.crypto_scalarmult_BYTES);
+  sodium.crypto_scalarmult(dh, mySecretKey, peerPublicKey);
+
+  const sharedKey = sodium.sodium_malloc(sodium.crypto_secretbox_KEYBYTES);
+  sodium.crypto_generichash(sharedKey, dh);
+
+  sodium.sodium_memzero(dh);
+  return sharedKey;
+}
+
+/**
+ * Encrypt with crypto_secretbox_easy (symmetric, deniable).
+ * Uses XSalsa20-Poly1305 with a shared key — no sender authentication.
+ */
+export function encryptDeniable(plaintext, nonce, sharedKey) {
+  const message = Buffer.isBuffer(plaintext) ? plaintext : Buffer.from(plaintext, 'utf-8');
+  const padded = padMessage(message);
+  const ciphertext = Buffer.alloc(padded.length + sodium.crypto_secretbox_MACBYTES);
+
+  sodium.crypto_secretbox_easy(ciphertext, padded, nonce, sharedKey);
+  sodium.sodium_memzero(padded);
+
+  return ciphertext;
+}
+
+/**
+ * Decrypt with crypto_secretbox_open_easy (symmetric, deniable).
+ */
+export function decryptDeniable(ciphertext, nonce, sharedKey) {
+  const padded = Buffer.alloc(ciphertext.length - sodium.crypto_secretbox_MACBYTES);
+  const ok = sodium.crypto_secretbox_open_easy(padded, ciphertext, nonce, sharedKey);
+
+  if (!ok) {
+    sodium.sodium_memzero(padded);
+    return null;
+  }
+
+  return unpadSecure(padded);
+}