claudemesh-cli 0.8.3 → 0.8.5

package/dist/index.js

@@ -47880,6 +47880,12 @@ class BrokerClient {
   getSessionSecretKey() {
     return this.sessionSecretKey;
   }
+  getMeshPubkey() {
+    return this.mesh.pubkey;
+  }
+  getMeshSecretKey() {
+    return this.mesh.secretKey;
+  }
   makeReqId() {
     return Math.random().toString(36).slice(2) + Date.now().toString(36);
   }
@@ -48817,6 +48823,17 @@ class BrokerClient {
       this.sendRaw({ type: "vault_delete", key, _reqId: reqId });
     });
   }
+  async vaultGet(keys) {
+    return new Promise((resolve) => {
+      const reqId = `vget_${Date.now()}`;
+      const timer = setTimeout(() => {
+        this.vaultListResolvers.delete(reqId);
+        resolve([]);
+      }, 1e4);
+      this.vaultListResolvers.set(reqId, { resolve, timer });
+      this.sendRaw({ type: "vault_get", keys, _reqId: reqId });
+    });
+  }
   async mcpDeploy(serverName, source, config2, scope) {
     return new Promise((resolve) => {
       const reqId = `deploy_${Date.now()}`;
@@ -49435,6 +49452,15 @@ class BrokerClient {
         r.resolve(msg.entries ?? []);
       }
     }
+    if (msg.type === "vault_get_result") {
+      const reqId = msg._reqId;
+      if (reqId && this.vaultListResolvers.has(reqId)) {
+        const r = this.vaultListResolvers.get(reqId);
+        clearTimeout(r.timer);
+        this.vaultListResolvers.delete(reqId);
+        r.resolve(msg.entries ?? []);
+      }
+    }
     if (msg.type === "mcp_deploy_status") {
       const reqId = msg._reqId;
       if (reqId && this.mcpDeployResolvers.has(reqId)) {
@@ -51002,18 +51028,25 @@ ${lines.join(`
         if (!client2)
           return text("vault_set: not connected", true);
         const entryType = vType ?? "env";
-        let plaintext = value;
+        let plaintextBytes;
         if (entryType === "file") {
           const { existsSync: existsSync2, readFileSync: readFileSync2 } = await import("node:fs");
           if (!existsSync2(value))
             return text(`vault_set: file not found: ${value}`, true);
-          plaintext = readFileSync2(value, "base64");
-        }
-        const encoded = Buffer.from(plaintext).toString("base64");
-        const ok = await client2.vaultSet(key, encoded, "placeholder-nonce", "placeholder-sealed", entryType, mount_path, description);
+          plaintextBytes = new Uint8Array(readFileSync2(value));
+        } else {
+          plaintextBytes = new TextEncoder().encode(value);
+        }
+        const { encryptFile: encryptFile2, sealKeyForPeer: sealKeyForPeer2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
+        const { ciphertext, nonce, key: kf } = await encryptFile2(plaintextBytes);
+        const sealedKey = await sealKeyForPeer2(kf, client2.getMeshPubkey());
+        const { ensureSodium: ensureSodium2 } = await Promise.resolve().then(() => (init_keypair(), exports_keypair));
+        const sodium2 = await ensureSodium2();
+        const ciphertextB64 = sodium2.to_base64(ciphertext, sodium2.base64_variants.ORIGINAL);
+        const ok = await client2.vaultSet(key, ciphertextB64, nonce, sealedKey, entryType, mount_path, description);
         if (!ok)
           return text("vault_set: broker did not acknowledge", true);
-        return text(`Vault entry "${key}" stored (${entryType}).`);
+        return text(`Vault entry "${key}" stored (${entryType}, E2E encrypted).`);
       }
       case "vault_list": {
         const client2 = allClients()[0];
@@ -51047,9 +51080,51 @@ ${lines.join(`
         if (!client2)
           return text("mesh_mcp_deploy: not connected", true);
         const source = file_id ? { type: "zip", file_id } : { type: "git", url: git_url, branch: git_branch };
+        const resolvedEnv = {};
+        const vaultResolved = [];
+        if (deployEnv) {
+          const vaultRefs = [];
+          for (const [envKey, envVal] of Object.entries(deployEnv)) {
+            if (typeof envVal === "string" && envVal.startsWith("$vault:")) {
+              const parts = envVal.slice(7).split(":");
+              const vaultKey = parts[0];
+              const isFile = parts[1] === "file";
+              const mountPath = isFile ? parts.slice(2).join(":") : undefined;
+              vaultRefs.push({ envKey, vaultKey, isFile, mountPath });
+            } else {
+              resolvedEnv[envKey] = envVal;
+            }
+          }
+          if (vaultRefs.length > 0) {
+            const { openSealedKey: openSealedKey2, decryptFile: decryptFile2 } = await Promise.resolve().then(() => (init_file_crypto(), exports_file_crypto));
+            const { ensureSodium: ensureSodium2 } = await Promise.resolve().then(() => (init_keypair(), exports_keypair));
+            const sodium2 = await ensureSodium2();
+            const keys = vaultRefs.map((r) => r.vaultKey);
+            const encryptedEntries = await client2.vaultGet(keys);
+            for (const ref of vaultRefs) {
+              const entry = encryptedEntries.find((e) => e.key === ref.vaultKey);
+              if (!entry)
+                return text(`mesh_mcp_deploy: vault key "${ref.vaultKey}" not found. Use vault_set first.`, true);
+              const kf = await openSealedKey2(entry.sealed_key, client2.getMeshPubkey(), client2.getMeshSecretKey());
+              if (!kf)
+                return text(`mesh_mcp_deploy: failed to decrypt vault key "${ref.vaultKey}" — wrong keypair?`, true);
+              const ciphertextBytes = sodium2.from_base64(entry.ciphertext, sodium2.base64_variants.ORIGINAL);
+              const plainBytes = await decryptFile2(ciphertextBytes, entry.nonce, kf);
+              if (!plainBytes)
+                return text(`mesh_mcp_deploy: failed to decrypt vault entry "${ref.vaultKey}" — corrupted?`, true);
+              if (ref.isFile && ref.mountPath) {
+                resolvedEnv[ref.envKey] = `__vault_file__:${ref.mountPath}:${sodium2.to_base64(plainBytes, sodium2.base64_variants.ORIGINAL)}`;
+              } else {
+                resolvedEnv[ref.envKey] = new TextDecoder().decode(plainBytes);
+              }
+              vaultResolved.push(ref.vaultKey);
+            }
+          }
+        }
         const config3 = {};
-        if (deployEnv)
-          config3.env = deployEnv;
+        if (Object.keys(resolvedEnv).length > 0 || deployEnv && Object.keys(deployEnv).length > 0) {
+          config3.env = Object.keys(resolvedEnv).length > 0 ? resolvedEnv : deployEnv;
+        }
         if (runtime)
           config3.runtime = runtime;
         if (memory_mb)
@@ -51059,12 +51134,18 @@ ${lines.join(`
         const result = await client2.mcpDeploy(server_name, source, Object.keys(config3).length > 0 ? config3 : undefined, scope);
         const toolList = result.tools?.map((t) => `  - ${t.name}: ${t.description}`).join(`
 `) ?? "  (pending)";
+        let vaultNote = "";
+        if (vaultResolved.length > 0) {
+          vaultNote = `
+
+Vault keys resolved: ${vaultResolved.join(", ")} (decrypted client-side, sent over TLS)`;
+        }
         return text(`Deployed "${server_name}" (status: ${result.status}).
 
 Tools:
 ${toolList}
 
-Default scope: peer (private). Use mesh_mcp_scope to share.`);
+Default scope: peer (private). Use mesh_mcp_scope to share.${vaultNote}`);
       }
       case "mesh_mcp_undeploy": {
         const { server_name } = args ?? {};
@@ -52522,7 +52603,7 @@ init_config();
 // package.json
 var package_default = {
   name: "claudemesh-cli",
-  version: "0.8.3",
+  version: "0.8.5",
   description: "Claude Code MCP client for claudemesh — peer mesh messaging between Claude sessions.",
   keywords: [
     "claude-code",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claudemesh-cli",
-  "version": "0.8.3",
+  "version": "0.8.5",
   "description": "Claude Code MCP client for claudemesh — peer mesh messaging between Claude sessions.",
   "keywords": [
     "claude-code",
@@ -49,8 +49,8 @@
     "typescript": "5.9.3",
     "vitest": "4.0.14",
     "@turbostarter/tsconfig": "0.1.0",
-    "@turbostarter/prettier-config": "0.1.0",
     "@turbostarter/eslint-config": "0.1.0",
+    "@turbostarter/prettier-config": "0.1.0",
     "@turbostarter/vitest-config": "0.1.0"
   },
   "scripts": {