conductor-bridge 1.0.0

package/dist/handoff/encryption.js

@@ -0,0 +1,308 @@
+/**
+ * Handoff Encryption Module
+ *
+ * Provides encryption for cross-agent handoffs using:
+ * - AES-256-GCM for symmetric encryption
+ * - Machine-bound keys derived from hardware identifiers
+ *
+ * Security model:
+ * - Handoffs are encrypted at rest
+ * - Machine-bound option prevents transfer to other machines
+ * - Keys are derived, not stored (stateless)
+ */
+import { createCipheriv, createDecipheriv, randomBytes, createHash, scryptSync, } from 'crypto';
+import { hostname, cpus, networkInterfaces } from 'os';
+// ============================================================================
+// Machine Identification
+// ============================================================================
+/**
+ * Generate a machine-specific identifier.
+ *
+ * Combines:
+ * - Hostname
+ * - CPU model
+ * - Smallest valid MAC address (lexicographically)
+ *
+ * DETERMINISM GUARANTEES (ThinkingMachines [He2025] compliance):
+ * - MAC addresses are sorted lexicographically, smallest is selected
+ * - Adding new interfaces (Docker, VPN, etc.) won't change ID unless
+ *   the new MAC is smaller than all existing MACs
+ * - This ensures batch-invariance: same hardware → same ID
+ *
+ * This is NOT cryptographically secure for authentication,
+ * but provides reasonable binding for local handoffs.
+ */
+export function getMachineId() {
+    const parts = [];
+    // Hostname (deterministic - OS provides consistent value)
+    parts.push(hostname());
+    // CPU model (deterministic - first CPU in fixed array order)
+    const cpuList = cpus();
+    if (cpuList.length > 0) {
+        parts.push(cpuList[0].model);
+    }
+    // Collect ALL valid MAC addresses, then sort and pick smallest
+    // ThinkingMachines [He2025] compliance: Fixed evaluation order
+    // Sorting by MAC (not interface name) ensures stability when
+    // virtual interfaces are added/removed
+    const validMacs = [];
+    const interfaces = networkInterfaces();
+    for (const name of Object.keys(interfaces)) {
+        const iface = interfaces[name];
+        if (iface) {
+            for (const info of iface) {
+                if (!info.internal && info.mac !== '00:00:00:00:00:00') {
+                    // Only add unique MACs (an interface may have multiple addresses)
+                    if (!validMacs.includes(info.mac)) {
+                        validMacs.push(info.mac);
+                    }
+                }
+            }
+        }
+    }
+    // Sort MACs lexicographically and use the smallest (most stable choice)
+    if (validMacs.length > 0) {
+        validMacs.sort();
+        parts.push(validMacs[0]);
+    }
+    // Hash the combined parts with deterministic separator
+    return createHash('sha256').update(parts.join('|')).digest('hex').slice(0, 16);
+}
+/**
+ * Verify machine ID matches current machine.
+ */
+export function verifyMachineId(expectedId) {
+    return getMachineId() === expectedId;
+}
+// ============================================================================
+// Key Derivation
+// ============================================================================
+/**
+ * Derive encryption key from passphrase and salt.
+ *
+ * Uses scrypt for key derivation (memory-hard, resistant to GPU attacks).
+ */
+function deriveKey(passphrase, salt) {
+    return scryptSync(passphrase, salt, 32, {
+        N: 16384, // CPU/memory cost
+        r: 8, // Block size
+        p: 1, // Parallelism
+    });
+}
+/**
+ * Get default passphrase for machine-bound encryption.
+ *
+ * For machine-bound encryption, we use the machine ID as part of the key.
+ * This means the data can only be decrypted on the same machine.
+ */
+function getMachineBoundPassphrase() {
+    return `conductor-handoff-${getMachineId()}`;
+}
+/**
+ * Environment variable name for custom encryption key.
+ * When set, this key is used instead of the default.
+ */
+const ENV_KEY_NAME = 'CONDUCTOR_HANDOFF_KEY';
+/**
+ * Minimum length for environment-provided keys.
+ */
+const MIN_KEY_LENGTH = 16;
+/**
+ * Track whether we've warned about default key usage (once per session).
+ */
+let warnedAboutDefaultKey = false;
+/**
+ * Get passphrase for encryption.
+ *
+ * Priority order:
+ * 1. Custom passphrase (explicitly provided)
+ * 2. Machine-bound passphrase (if machineBound=true)
+ * 3. Environment variable CONDUCTOR_HANDOFF_KEY
+ * 4. Default key (with security warning)
+ *
+ * @param machineBound If true, use machine-specific passphrase
+ * @param customPassphrase Optional custom passphrase
+ */
+function getPassphrase(machineBound, customPassphrase) {
+    // 1. Explicit custom passphrase takes priority
+    if (customPassphrase) {
+        return customPassphrase;
+    }
+    // 2. Machine-bound uses hardware-derived key
+    if (machineBound) {
+        return getMachineBoundPassphrase();
+    }
+    // 3. Check environment variable
+    const envKey = process.env[ENV_KEY_NAME];
+    if (envKey && envKey.length >= MIN_KEY_LENGTH) {
+        return envKey;
+    }
+    // 4. Fall back to default key with warning
+    if (!warnedAboutDefaultKey) {
+        console.warn(`[SECURITY WARNING] Using default encryption key for handoffs. ` +
+            `For production use, set the ${ENV_KEY_NAME} environment variable ` +
+            `to a secure key (minimum ${MIN_KEY_LENGTH} characters).`);
+        warnedAboutDefaultKey = true;
+    }
+    return 'conductor-handoff-default-key-v1';
+}
+// ============================================================================
+// Encryption
+// ============================================================================
+/**
+ * Encrypt data using AES-256-GCM.
+ */
+export function encrypt(data, config, expiresInHours = 24, customPassphrase) {
+    if (config.algorithm === 'none') {
+        // No encryption - just base64 encode
+        return {
+            algorithm: 'none',
+            machineBound: false,
+            ciphertext: Buffer.from(data).toString('base64'),
+            iv: '',
+            authTag: '',
+            createdAt: new Date().toISOString(),
+            expiresAt: new Date(Date.now() + expiresInHours * 60 * 60 * 1000).toISOString(),
+        };
+    }
+    // Generate random IV (12 bytes for GCM)
+    const iv = randomBytes(12);
+    // Generate random salt for key derivation
+    const salt = randomBytes(16);
+    // Derive key
+    const passphrase = getPassphrase(config.machineBound, customPassphrase);
+    const key = deriveKey(passphrase, salt);
+    // Create cipher
+    const cipher = createCipheriv('aes-256-gcm', key, iv);
+    // Encrypt
+    const encrypted = Buffer.concat([
+        cipher.update(data, 'utf8'),
+        cipher.final(),
+    ]);
+    // Get auth tag
+    const authTag = cipher.getAuthTag();
+    // Combine salt + ciphertext
+    const combined = Buffer.concat([salt, encrypted]);
+    const now = new Date();
+    const expiresAt = new Date(now.getTime() + expiresInHours * 60 * 60 * 1000);
+    return {
+        algorithm: 'aes-256-gcm',
+        machineBound: config.machineBound,
+        machineId: config.machineBound ? getMachineId() : undefined,
+        iv: iv.toString('base64'),
+        authTag: authTag.toString('base64'),
+        ciphertext: combined.toString('base64'),
+        createdAt: now.toISOString(),
+        expiresAt: expiresAt.toISOString(),
+    };
+}
+// ============================================================================
+// Decryption
+// ============================================================================
+/**
+ * Decrypt an encrypted payload.
+ */
+export function decrypt(payload, customPassphrase) {
+    // Check expiry
+    const expiresAt = new Date(payload.expiresAt);
+    if (expiresAt < new Date()) {
+        return {
+            success: false,
+            expired: true,
+            error: 'Handoff has expired',
+        };
+    }
+    // Check machine binding
+    if (payload.machineBound && payload.machineId) {
+        if (!verifyMachineId(payload.machineId)) {
+            return {
+                success: false,
+                machineMismatch: true,
+                error: 'Handoff is bound to a different machine',
+            };
+        }
+    }
+    if (payload.algorithm === 'none') {
+        // No encryption - just base64 decode
+        try {
+            const data = Buffer.from(payload.ciphertext, 'base64').toString('utf8');
+            return { success: true, data };
+        }
+        catch (error) {
+            return {
+                success: false,
+                error: `Failed to decode: ${error instanceof Error ? error.message : String(error)}`,
+            };
+        }
+    }
+    try {
+        // Decode components
+        const iv = Buffer.from(payload.iv, 'base64');
+        const authTag = Buffer.from(payload.authTag, 'base64');
+        const combined = Buffer.from(payload.ciphertext, 'base64');
+        // Extract salt and ciphertext
+        const salt = combined.subarray(0, 16);
+        const ciphertext = combined.subarray(16);
+        // Derive key
+        const passphrase = getPassphrase(payload.machineBound, customPassphrase);
+        const key = deriveKey(passphrase, salt);
+        // Create decipher
+        const decipher = createDecipheriv('aes-256-gcm', key, iv);
+        decipher.setAuthTag(authTag);
+        // Decrypt
+        const decrypted = Buffer.concat([
+            decipher.update(ciphertext),
+            decipher.final(),
+        ]);
+        return {
+            success: true,
+            data: decrypted.toString('utf8'),
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: `Decryption failed: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}
+// ============================================================================
+// Utility Functions
+// ============================================================================
+/**
+ * Check if a payload is expired.
+ */
+export function isExpired(payload) {
+    return new Date(payload.expiresAt) < new Date();
+}
+/**
+ * Get time until expiry.
+ */
+export function getTimeUntilExpiry(payload) {
+    const expiresAt = new Date(payload.expiresAt);
+    const now = new Date();
+    const diffMs = expiresAt.getTime() - now.getTime();
+    if (diffMs <= 0) {
+        return { expired: true, hours: 0, minutes: 0, formatted: 'Expired' };
+    }
+    const hours = Math.floor(diffMs / (1000 * 60 * 60));
+    const minutes = Math.floor((diffMs % (1000 * 60 * 60)) / (1000 * 60));
+    let formatted;
+    if (hours > 0) {
+        formatted = `${hours}h ${minutes}m`;
+    }
+    else {
+        formatted = `${minutes}m`;
+    }
+    return { expired: false, hours, minutes, formatted };
+}
+/**
+ * Create encryption config from options.
+ */
+export function createEncryptionConfig(options = {}) {
+    return {
+        algorithm: options.encrypt !== false ? 'aes-256-gcm' : 'none',
+        machineBound: options.machineBound ?? false,
+    };
+}
+//# sourceMappingURL=encryption.js.map

package/dist/handoff/encryption.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"encryption.js","sourceRoot":"","sources":["../../src/handoff/encryption.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,UAAU,GACX,MAAM,QAAQ,CAAC;AAChB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AAgCvD,+EAA+E;AAC/E,yBAAyB;AACzB,+EAA+E;AAE/E;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,0DAA0D;IAC1D,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAEvB,6DAA6D;IAC7D,MAAM,OAAO,GAAG,IAAI,EAAE,CAAC;IACvB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,+DAA+D;IAC/D,+DAA+D;IAC/D,6DAA6D;IAC7D,uCAAuC;IACvC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;IAEvC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,KAAK,mBAAmB,EAAE,CAAC;oBACvD,kEAAkE;oBAClE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;wBAClC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;oBAC3B,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,SAAS,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAE,CAAC,CAAC;IAC5B,CAAC;IAED,uDAAuD;IACvD,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACjF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,OAAO,YAAY,EAAE,KAAK,UAAU,CAAC;AACvC,CAAC;AAED,+EAA+E;AAC/E,iBAAiB;AACjB,+EAA+E;AAE/E;;;;GAIG;AACH,SAAS,SAAS,CAAC,UAAkB,EAAE,IAAY;IACjD,OAAO,UAAU,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,EAAE;QACtC,CAAC,EAAE,KAAK,EAAE,kBAAkB;QAC5B,CAAC,EAAE,CAAC,EAAE,aAAa;QACnB,CAAC,EAAE,CAAC,EAAE,cAAc;KACrB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB;IAChC,OAAO,qBAAqB,YAAY,EAAE,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAE7C;;GAEG;AACH,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B;;GAEG;AACH,IAAI,qBAAqB,GAAG,KAAK,CAAC;AAElC;;;;;;;;;;;GAWG;AACH,SAAS,aAAa,CAAC,YAAqB,EAAE,gBAAyB;IACrE,+CAA+C;IAC/C,IAAI,gBAAgB,EAAE,CAAC;QACrB,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,6CAA6C;IAC7C,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,yBAAyB,EAAE,CAAC;IACrC,CAAC;IAED,gCAAgC;IAChC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACzC,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,IAAI,cAAc,EAAE,CAAC;QAC9C,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2CAA2C;IAC3C,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CACV,gEAAgE;YAChE,+BAA+B,YAAY,wBAAwB;YACnE,4BAA4B,cAAc,eAAe,CAC1D,CAAC;QACF,qBAAqB,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,OAAO,kCAAkC,CAAC;AAC5C,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,OAAO,CACrB,IAAY,EACZ,MAAwB,EACxB,iBAAyB,EAAE,EAC3B,gBAAyB;IAEzB,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAChC,qCAAqC;QACrC,OAAO;YACL,SAAS,EAAE,MAAM;YACjB,YAAY,EAAE,KAAK;YACnB,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAChD,EAAE,EAAE,EAAE;YACN,OAAO,EAAE,EAAE;YACX,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;SAChF,CAAC;IACJ,CAAC;IAED,wCAAwC;IACxC,MAAM,EAAE,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAE3B,0CAA0C;IAC1C,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC;IAE7B,aAAa;IACb,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;IACxE,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;IAExC,gBAAgB;IAChB,MAAM,MAAM,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;IAEtD,UAAU;IACV,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC;QAC3B,MAAM,CAAC,KAAK,EAAE;KACf,CAAC,CAAC;IAEH,eAAe;IACf,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;IAEpC,4BAA4B;IAC5B,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;IAElD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE5E,OAAO;QACL,SAAS,EAAE,aAAa;QACxB,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,SAAS,EAAE,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS;QAC3D,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACzB,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACnC,UAAU,EAAE,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACvC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,aAAa;AACb,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,OAAO,CACrB,OAAyB,EACzB,gBAAyB;IAEzB,eAAe;IACf,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QAC3B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,qBAAqB;SAC7B,CAAC;IACJ,CAAC;IAED,wBAAwB;IACxB,IAAI,OAAO,CAAC,YAAY,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QAC9C,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YACxC,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,eAAe,EAAE,IAAI;gBACrB,KAAK,EAAE,yCAAyC;aACjD,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,OAAO,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACjC,qCAAqC;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACxE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,KAAK,EAAE,qBAAqB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aACrF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,oBAAoB;QACpB,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAE3D,8BAA8B;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,MAAM,UAAU,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAEzC,aAAa;QACb,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,YAAY,EAAE,gBAAgB,CAAC,CAAC;QACzE,MAAM,GAAG,GAAG,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;QAExC,kBAAkB;QAClB,MAAM,QAAQ,GAAG,gBAAgB,CAAC,aAAa,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC1D,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,UAAU;QACV,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC;YAC9B,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,IAAI,EAAE,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;SACjC,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO;YACL,OAAO,EAAE,KAAK;YACd,KAAK,EAAE,sBAAsB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;SACtF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAyB;IACjD,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,IAAI,IAAI,EAAE,CAAC;AAClD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAM1D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAEnD,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC;IAEtE,IAAI,SAAiB,CAAC;IACtB,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,SAAS,GAAG,GAAG,KAAK,KAAK,OAAO,GAAG,CAAC;IACtC,CAAC;SAAM,CAAC;QACN,SAAS,GAAG,GAAG,OAAO,GAAG,CAAC;IAC5B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACvD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,UAGI,EAAE;IAEN,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM;QAC7D,YAAY,EAAE,OAAO,CAAC,YAAY,IAAI,KAAK;KAC5C,CAAC;AACJ,CAAC"}

package/dist/handoff/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Handoff Module Exports
+ *
+ * Cross-agent handoff functionality for the Mycelium Arc pattern.
+ */
+export { encrypt, decrypt, getMachineId, verifyMachineId, isExpired, getTimeUntilExpiry, createEncryptionConfig, type EncryptionAlgorithm, type EncryptionConfig, type EncryptedPayload, type DecryptionResult, } from './encryption.js';
+export { createHandoff, receiveHandoff, getHandoffStatus, createMinimalSnapshot, calculateMomentumPenalty, applyMomentumPenalty, type AgentType, type MomentumPhase, type BurnoutLevel, type EnergyLevel, type TaskContext, type CognitiveSnapshot, type HandoffMetadata, type MyceliumArc, type HandoffOptions, type CreateHandoffResult, type ReceiveHandoffResult, } from './mycelium-arc.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/handoff/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/handoff/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,OAAO,EACP,OAAO,EACP,YAAY,EACZ,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,sBAAsB,EACtB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,GAC1B,MAAM,mBAAmB,CAAC"}

package/dist/handoff/index.js

@@ -0,0 +1,10 @@
+/**
+ * Handoff Module Exports
+ *
+ * Cross-agent handoff functionality for the Mycelium Arc pattern.
+ */
+// Encryption
+export { encrypt, decrypt, getMachineId, verifyMachineId, isExpired, getTimeUntilExpiry, createEncryptionConfig, } from './encryption.js';
+// Mycelium Arc
+export { createHandoff, receiveHandoff, getHandoffStatus, createMinimalSnapshot, calculateMomentumPenalty, applyMomentumPenalty, } from './mycelium-arc.js';
+//# sourceMappingURL=index.js.map

package/dist/handoff/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/handoff/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,aAAa;AACb,OAAO,EACL,OAAO,EACP,OAAO,EACP,YAAY,EACZ,eAAe,EACf,SAAS,EACT,kBAAkB,EAClB,sBAAsB,GAKvB,MAAM,iBAAiB,CAAC;AAEzB,eAAe;AACf,OAAO,EACL,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,GAYrB,MAAM,mBAAmB,CAAC"}

package/dist/handoff/mycelium-arc.d.ts

@@ -0,0 +1,116 @@
+/**
+ * Mycelium Arc - Cross-Agent Handoff Module
+ *
+ * Packages cognitive state for transfer between AI agents (Claude ↔ Gemini).
+ *
+ * Features:
+ * - Momentum preservation with break penalty calculation
+ * - ADHD-friendly resume summaries
+ * - Safety constraints (never persist RED burnout)
+ * - 24h auto-expiry
+ * - Optional machine-bound encryption
+ */
+export type AgentType = 'claude-code' | 'gemini-cli' | 'claude-desktop' | 'other';
+export type MomentumPhase = 'cold_start' | 'building' | 'rolling' | 'peak' | 'declining' | 'crashed';
+export type BurnoutLevel = 'GREEN' | 'YELLOW' | 'ORANGE' | 'RED';
+export type EnergyLevel = 'high' | 'medium' | 'low' | 'depleted';
+export interface TaskContext {
+    id: string;
+    description: string;
+    status: 'pending' | 'in_progress' | 'completed' | 'blocked';
+    priority?: number;
+    notes?: string;
+}
+export interface CognitiveSnapshot {
+    sessionId: string;
+    timestamp: string;
+    activeMode: string;
+    activeParadigm: 'Cortex' | 'Mycelium';
+    energyLevel: EnergyLevel;
+    burnoutLevel: BurnoutLevel;
+    momentumPhase: MomentumPhase;
+    currentGoal?: string;
+    activeTasks: TaskContext[];
+    completedTasks: TaskContext[];
+    convergenceAttractor?: string;
+    epistemicTension?: number;
+    keyInsights?: string[];
+    blockers?: string[];
+    decisions?: string[];
+}
+export interface HandoffMetadata {
+    handoffId: string;
+    createdAt: string;
+    expiresAt: string;
+    sourceAgent: AgentType;
+    targetAgent?: AgentType;
+    sourceMachineId?: string;
+    version: string;
+}
+export interface MyceliumArc {
+    metadata: HandoffMetadata;
+    cognitive: CognitiveSnapshot;
+    resumeSummary: string;
+    momentumPenalty: number;
+    adjustedMomentum: MomentumPhase;
+}
+export interface HandoffOptions {
+    targetAgent?: AgentType;
+    encrypt?: boolean;
+    machineBound?: boolean;
+    expiresInHours?: number;
+    customPassphrase?: string;
+}
+export interface CreateHandoffResult {
+    success: boolean;
+    handoffId: string;
+    encrypted: boolean;
+    expiresAt: string;
+    payload: string;
+    error?: string;
+}
+export interface ReceiveHandoffResult {
+    success: boolean;
+    arc?: MyceliumArc;
+    error?: string;
+    expired?: boolean;
+    machineMismatch?: boolean;
+}
+/**
+ * Calculate momentum penalty based on break duration.
+ */
+export declare function calculateMomentumPenalty(breakDurationMs: number): number;
+/**
+ * Apply momentum penalty and return adjusted phase.
+ */
+export declare function applyMomentumPenalty(currentPhase: MomentumPhase, penalty: number): MomentumPhase;
+/**
+ * Create a handoff package from cognitive state.
+ */
+export declare function createHandoff(cognitive: CognitiveSnapshot, sourceAgent: AgentType, options?: HandoffOptions): CreateHandoffResult;
+/**
+ * Receive and unpack a handoff.
+ */
+export declare function receiveHandoff(payload: string, customPassphrase?: string): ReceiveHandoffResult;
+/**
+ * Get handoff status for display.
+ */
+export declare function getHandoffStatus(payload: string): {
+    valid: boolean;
+    encrypted: boolean;
+    expired: boolean;
+    timeRemaining?: string;
+    handoffId?: string;
+    sourceAgent?: string;
+    error?: string;
+};
+/**
+ * Create a minimal cognitive snapshot for quick handoffs.
+ */
+export declare function createMinimalSnapshot(goal: string, options?: {
+    energyLevel?: EnergyLevel;
+    burnoutLevel?: BurnoutLevel;
+    momentumPhase?: MomentumPhase;
+    insights?: string[];
+}): CognitiveSnapshot;
+//# sourceMappingURL=mycelium-arc.d.ts.map

package/dist/handoff/mycelium-arc.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mycelium-arc.d.ts","sourceRoot":"","sources":["../../src/handoff/mycelium-arc.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAkBH,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,YAAY,GAAG,gBAAgB,GAAG,OAAO,CAAC;AAElF,MAAM,MAAM,aAAa,GACrB,YAAY,GACZ,UAAU,GACV,SAAS,GACT,MAAM,GACN,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,KAAK,CAAC;AAEjE,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,UAAU,CAAC;AAEjE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAEhC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAGlB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,QAAQ,GAAG,UAAU,CAAC;IACtC,WAAW,EAAE,WAAW,CAAC;IACzB,YAAY,EAAE,YAAY,CAAC;IAC3B,aAAa,EAAE,aAAa,CAAC;IAG7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,WAAW,EAAE,CAAC;IAC3B,cAAc,EAAE,WAAW,EAAE,CAAC;IAG9B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,SAAS,CAAC;IACvB,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,eAAe,CAAC;IAC1B,SAAS,EAAE,iBAAiB,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,aAAa,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,CAAC,EAAE,SAAS,CAAC;IACxB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,WAAW,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA4DD;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,eAAe,EAAE,MAAM,GAAG,MAAM,CAOxE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,YAAY,EAAE,aAAa,EAC3B,OAAO,EAAE,MAAM,GACd,aAAa,CAWf;AA+FD;;GAEG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,iBAAiB,EAC5B,WAAW,EAAE,SAAS,EACtB,OAAO,GAAE,cAAmB,GAC3B,mBAAmB,CAmFrB;AAMD;;GAEG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,gBAAgB,CAAC,EAAE,MAAM,GACxB,oBAAoB,CAgDtB;AAiDD;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;IACjD,KAAK,EAAE,OAAO,CAAC;IACf,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAuDA;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CAChB,GACL,iBAAiB,CAcnB"}