cowork-os 0.3.21

package/dist/electron/electron/database/SecureSettingsRepository.js

@@ -0,0 +1,444 @@
+"use strict";
+/**
+ * SecureSettingsRepository
+ *
+ * Stores all application settings in an encrypted format in the database.
+ * Uses Electron's safeStorage API which leverages the OS keychain:
+ * - macOS: Keychain
+ * - Windows: DPAPI (Data Protection API)
+ * - Linux: libsecret
+ *
+ * This ensures settings can ONLY be accessed by this app.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecureSettingsRepository = void 0;
+const electron_1 = require("electron");
+const uuid_1 = require("uuid");
+const crypto = __importStar(require("crypto"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/** Machine ID file name - persisted for stable key derivation */
+const MACHINE_ID_FILE = '.cowork-machine-id';
+/**
+ * Repository for securely storing encrypted settings in the database
+ */
+class SecureSettingsRepository {
+    constructor(db) {
+        this.db = db;
+        this.machineId = null;
+        this.encryptionAvailable = electron_1.safeStorage.isEncryptionAvailable();
+        if (!this.encryptionAvailable) {
+            console.warn('[SecureSettingsRepository] OS encryption not available. Settings will be stored with app-level encryption only.');
+        }
+        // Initialize stable machine ID for fallback encryption
+        this.initializeMachineId();
+        // Set as singleton instance
+        SecureSettingsRepository.instance = this;
+    }
+    /**
+     * Initialize or load the stable machine ID
+     * This ID persists across hostname changes, making fallback encryption stable
+     */
+    initializeMachineId() {
+        try {
+            const userDataPath = electron_1.app.getPath('userData');
+            const machineIdPath = path.join(userDataPath, MACHINE_ID_FILE);
+            if (fs.existsSync(machineIdPath)) {
+                this.machineId = fs.readFileSync(machineIdPath, 'utf-8').trim();
+                console.log('[SecureSettingsRepository] Loaded existing machine ID');
+            }
+            else {
+                // Generate a new stable machine ID
+                this.machineId = (0, uuid_1.v4)();
+                // Write with restrictive permissions (owner read/write only)
+                fs.writeFileSync(machineIdPath, this.machineId, { mode: 0o600 });
+                console.log('[SecureSettingsRepository] Generated new machine ID');
+            }
+        }
+        catch (error) {
+            console.warn('[SecureSettingsRepository] Failed to initialize machine ID, using fallback:', error);
+            // Fallback to old method if file operations fail
+            this.machineId = null;
+        }
+    }
+    /**
+     * Get the singleton instance of SecureSettingsRepository.
+     * Must be called after the instance has been created.
+     */
+    static getInstance() {
+        if (!SecureSettingsRepository.instance) {
+            throw new Error('SecureSettingsRepository has not been initialized. Initialize it in main.ts first.');
+        }
+        return SecureSettingsRepository.instance;
+    }
+    /**
+     * Check if the repository has been initialized
+     */
+    static isInitialized() {
+        return SecureSettingsRepository.instance !== null;
+    }
+    /**
+     * Save settings for a category (creates or updates)
+     */
+    save(category, settings) {
+        const now = Date.now();
+        const jsonData = JSON.stringify(settings);
+        const encryptedData = this.encrypt(jsonData);
+        const checksum = this.computeChecksum(jsonData);
+        const existing = this.findByCategory(category);
+        if (existing) {
+            // Update existing
+            const stmt = this.db.prepare(`
+        UPDATE secure_settings
+        SET encrypted_data = ?, checksum = ?, updated_at = ?
+        WHERE category = ?
+      `);
+            stmt.run(encryptedData, checksum, now, category);
+        }
+        else {
+            // Insert new
+            const stmt = this.db.prepare(`
+        INSERT INTO secure_settings (id, category, encrypted_data, checksum, created_at, updated_at)
+        VALUES (?, ?, ?, ?, ?, ?)
+      `);
+            stmt.run((0, uuid_1.v4)(), category, encryptedData, checksum, now, now);
+        }
+        console.log(`[SecureSettingsRepository] Saved settings for category: ${category}`);
+    }
+    /**
+     * Load settings for a category
+     * Returns undefined if no settings exist or if decryption fails
+     */
+    load(category) {
+        const result = this.loadWithStatus(category);
+        return result.data;
+    }
+    /**
+     * Load settings with detailed status information
+     * Use this when you need to distinguish between "not found" vs "corrupted" vs "decryption failed"
+     */
+    loadWithStatus(category) {
+        const row = this.findByCategory(category);
+        if (!row) {
+            return { status: 'not_found' };
+        }
+        try {
+            const decrypted = this.decrypt(row.encrypted_data);
+            // Verify checksum to detect tampering
+            const checksum = this.computeChecksum(decrypted);
+            if (checksum !== row.checksum) {
+                console.error(`[SecureSettingsRepository] Checksum mismatch for category: ${category}. Data may be corrupted.`);
+                return {
+                    status: 'checksum_mismatch',
+                    error: 'Data integrity check failed. Settings may be corrupted.',
+                };
+            }
+            return {
+                status: 'success',
+                data: JSON.parse(decrypted),
+            };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            console.error(`[SecureSettingsRepository] Failed to decrypt settings for category: ${category}`, error);
+            // Detect specific failure modes
+            if (errorMessage.includes('OS encryption was used but is no longer available')) {
+                return {
+                    status: 'os_encryption_unavailable',
+                    error: 'Settings were encrypted with OS keychain which is no longer accessible. You may need to re-enter your credentials.',
+                };
+            }
+            return {
+                status: 'decryption_failed',
+                error: errorMessage,
+            };
+        }
+    }
+    /**
+     * Check if settings can be decrypted (health check)
+     * Returns the status without exposing the actual data
+     */
+    checkHealth(category) {
+        return this.loadWithStatus(category).status;
+    }
+    /**
+     * Delete settings for a category
+     */
+    delete(category) {
+        const stmt = this.db.prepare('DELETE FROM secure_settings WHERE category = ?');
+        const result = stmt.run(category);
+        return result.changes > 0;
+    }
+    /**
+     * Check if settings exist for a category
+     */
+    exists(category) {
+        const stmt = this.db.prepare('SELECT 1 FROM secure_settings WHERE category = ? LIMIT 1');
+        const row = stmt.get(category);
+        return row !== undefined;
+    }
+    /**
+     * Get all categories that have settings stored
+     */
+    listCategories() {
+        const stmt = this.db.prepare('SELECT category FROM secure_settings ORDER BY category');
+        const rows = stmt.all();
+        return rows.map((r) => r.category);
+    }
+    /**
+     * Get metadata about stored settings (without decrypting)
+     */
+    getMetadata(category) {
+        const stmt = this.db.prepare('SELECT created_at, updated_at FROM secure_settings WHERE category = ?');
+        const row = stmt.get(category);
+        return row ? { createdAt: row.created_at, updatedAt: row.updated_at } : undefined;
+    }
+    // ============ Backup & Recovery ============
+    /**
+     * Create an encrypted backup of all settings to a file
+     * The backup is encrypted with OS keychain when available
+     */
+    createBackup(backupPath) {
+        try {
+            const categories = this.listCategories();
+            const backupData = {};
+            for (const category of categories) {
+                const result = this.loadWithStatus(category);
+                if (result.status === 'success' && result.data) {
+                    backupData[category] = result.data;
+                }
+            }
+            const jsonData = JSON.stringify({
+                version: 1,
+                timestamp: Date.now(),
+                categories: backupData,
+            });
+            // Encrypt the backup
+            const encryptedBackup = this.encrypt(jsonData);
+            fs.writeFileSync(backupPath, encryptedBackup, { mode: 0o600 });
+            console.log(`[SecureSettingsRepository] Created backup with ${categories.length} categories`);
+            return { success: true, categoriesBackedUp: categories };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            console.error('[SecureSettingsRepository] Backup failed:', error);
+            return { success: false, categoriesBackedUp: [], error: errorMessage };
+        }
+    }
+    /**
+     * Restore settings from an encrypted backup file
+     * @param backupPath Path to the backup file
+     * @param overwrite Whether to overwrite existing settings (default: false)
+     */
+    restoreBackup(backupPath, overwrite = false) {
+        try {
+            if (!fs.existsSync(backupPath)) {
+                return { success: false, categoriesRestored: [], error: 'Backup file not found' };
+            }
+            const encryptedBackup = fs.readFileSync(backupPath, 'utf-8');
+            const jsonData = this.decrypt(encryptedBackup);
+            const backup = JSON.parse(jsonData);
+            if (!backup.version || !backup.categories) {
+                return { success: false, categoriesRestored: [], error: 'Invalid backup format' };
+            }
+            const categoriesRestored = [];
+            for (const [category, data] of Object.entries(backup.categories)) {
+                const existingStatus = this.checkHealth(category);
+                // Skip if exists and not overwriting
+                if (existingStatus === 'success' && !overwrite) {
+                    console.log(`[SecureSettingsRepository] Skipping ${category} (exists, overwrite=false)`);
+                    continue;
+                }
+                this.save(category, data);
+                categoriesRestored.push(category);
+            }
+            console.log(`[SecureSettingsRepository] Restored ${categoriesRestored.length} categories from backup`);
+            return { success: true, categoriesRestored };
+        }
+        catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            console.error('[SecureSettingsRepository] Restore failed:', error);
+            return { success: false, categoriesRestored: [], error: errorMessage };
+        }
+    }
+    /**
+     * Delete corrupted settings for a category
+     * Use this when checkHealth returns 'checksum_mismatch' or 'decryption_failed'
+     * to allow the user to start fresh
+     */
+    deleteCorrupted(category) {
+        const status = this.checkHealth(category);
+        if (status === 'success' || status === 'not_found') {
+            console.warn(`[SecureSettingsRepository] Category ${category} is not corrupted, not deleting`);
+            return false;
+        }
+        console.log(`[SecureSettingsRepository] Deleting corrupted settings for ${category} (status: ${status})`);
+        return this.delete(category);
+    }
+    /**
+     * Re-encrypt all settings with current encryption method
+     * Useful after OS keychain becomes available or for migration
+     */
+    reEncryptAll() {
+        const categories = this.listCategories();
+        const processed = [];
+        const errors = [];
+        for (const category of categories) {
+            try {
+                const result = this.loadWithStatus(category);
+                if (result.status === 'success' && result.data) {
+                    // Re-save with current encryption method
+                    this.save(category, result.data);
+                    processed.push(category);
+                }
+                else {
+                    errors.push(`${category}: ${result.error || result.status}`);
+                }
+            }
+            catch (error) {
+                errors.push(`${category}: ${error instanceof Error ? error.message : String(error)}`);
+            }
+        }
+        console.log(`[SecureSettingsRepository] Re-encrypted ${processed.length}/${categories.length} categories`);
+        return { success: errors.length === 0, categoriesProcessed: processed, errors };
+    }
+    // ============ Private Methods ============
+    findByCategory(category) {
+        const stmt = this.db.prepare('SELECT * FROM secure_settings WHERE category = ?');
+        return stmt.get(category);
+    }
+    /**
+     * Encrypt data using OS keychain (safeStorage) when available,
+     * otherwise use app-level encryption with a derived key
+     */
+    encrypt(data) {
+        if (this.encryptionAvailable) {
+            // Use OS keychain encryption
+            const encryptedBuffer = electron_1.safeStorage.encryptString(data);
+            return 'os:' + encryptedBuffer.toString('base64');
+        }
+        else {
+            // Fallback: Use app-level AES encryption
+            // The key is derived from a combination of app identity and machine-specific data
+            const key = this.deriveAppKey();
+            const iv = crypto.randomBytes(16);
+            const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+            let encrypted = cipher.update(data, 'utf8', 'base64');
+            encrypted += cipher.final('base64');
+            const authTag = cipher.getAuthTag();
+            // Format: app:<iv>:<authTag>:<encrypted>
+            return `app:${iv.toString('base64')}:${authTag.toString('base64')}:${encrypted}`;
+        }
+    }
+    /**
+     * Decrypt data using the appropriate method based on prefix
+     */
+    decrypt(encryptedData) {
+        if (encryptedData.startsWith('os:')) {
+            // OS keychain decryption
+            if (!this.encryptionAvailable) {
+                throw new Error('OS encryption was used but is no longer available');
+            }
+            const base64Data = encryptedData.slice(3);
+            const encryptedBuffer = Buffer.from(base64Data, 'base64');
+            return electron_1.safeStorage.decryptString(encryptedBuffer);
+        }
+        else if (encryptedData.startsWith('app:')) {
+            // App-level AES decryption
+            const parts = encryptedData.slice(4).split(':');
+            if (parts.length !== 3) {
+                throw new Error('Invalid encrypted data format');
+            }
+            const [ivBase64, authTagBase64, encrypted] = parts;
+            const key = this.deriveAppKey();
+            const iv = Buffer.from(ivBase64, 'base64');
+            const authTag = Buffer.from(authTagBase64, 'base64');
+            const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
+            decipher.setAuthTag(authTag);
+            let decrypted = decipher.update(encrypted, 'base64', 'utf8');
+            decrypted += decipher.final('utf8');
+            return decrypted;
+        }
+        else {
+            // Legacy unencrypted data (shouldn't happen, but handle gracefully)
+            console.warn('[SecureSettingsRepository] Found unencrypted data, returning as-is');
+            return encryptedData;
+        }
+    }
+    /**
+     * Derive an app-specific encryption key
+     * This key is deterministic per machine but not stored anywhere
+     */
+    deriveAppKey() {
+        // Use a combination of:
+        // 1. App identifier (hardcoded, same for all installations)
+        // 2. Process info (changes per machine but is consistent)
+        const appSalt = 'cowork-os-secure-settings-v1';
+        const machineId = this.getMachineIdentifier();
+        // Derive a 256-bit key using PBKDF2
+        return crypto.pbkdf2Sync(appSalt, machineId, 100000, 32, 'sha512');
+    }
+    /**
+     * Get a machine-specific identifier for key derivation
+     * Uses a stable persistent ID to survive hostname changes, user renames, etc.
+     */
+    getMachineIdentifier() {
+        // Use stable machine ID if available (generated at first launch)
+        if (this.machineId) {
+            return this.machineId;
+        }
+        // Fallback: Combine system properties (less stable, for backwards compatibility)
+        // This path is only taken if machine ID file operations failed
+        const os = require('os');
+        const factors = [
+            os.hostname(),
+            os.platform(),
+            os.arch(),
+            os.homedir(),
+            process.env.USER || process.env.USERNAME || 'default-user',
+        ];
+        console.warn('[SecureSettingsRepository] Using volatile machine identifier as fallback');
+        return factors.join(':');
+    }
+    /**
+     * Compute a SHA-256 checksum for integrity verification
+     */
+    computeChecksum(data) {
+        return crypto.createHash('sha256').update(data).digest('hex');
+    }
+}
+exports.SecureSettingsRepository = SecureSettingsRepository;
+SecureSettingsRepository.instance = null;

package/dist/electron/electron/database/TaskLabelRepository.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TaskLabelRepository = void 0;
+const uuid_1 = require("uuid");
+const DEFAULT_LABEL_COLOR = '#6366f1';
+/**
+ * Repository for managing task labels in the database
+ */
+class TaskLabelRepository {
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Create a new task label
+     */
+    create(request) {
+        const now = Date.now();
+        const label = {
+            id: (0, uuid_1.v4)(),
+            workspaceId: request.workspaceId,
+            name: request.name,
+            color: request.color || DEFAULT_LABEL_COLOR,
+            createdAt: now,
+        };
+        const stmt = this.db.prepare(`
+      INSERT INTO task_labels (id, workspace_id, name, color, created_at)
+      VALUES (?, ?, ?, ?, ?)
+    `);
+        stmt.run(label.id, label.workspaceId, label.name, label.color, label.createdAt);
+        return label;
+    }
+    /**
+     * Find a task label by ID
+     */
+    findById(id) {
+        const stmt = this.db.prepare('SELECT * FROM task_labels WHERE id = ?');
+        const row = stmt.get(id);
+        return row ? this.mapRowToLabel(row) : undefined;
+    }
+    /**
+     * Find a task label by name within a workspace
+     */
+    findByName(workspaceId, name) {
+        const stmt = this.db.prepare('SELECT * FROM task_labels WHERE workspace_id = ? AND name = ?');
+        const row = stmt.get(workspaceId, name);
+        return row ? this.mapRowToLabel(row) : undefined;
+    }
+    /**
+     * List all labels for a workspace
+     */
+    list(query) {
+        const stmt = this.db.prepare('SELECT * FROM task_labels WHERE workspace_id = ? ORDER BY name ASC');
+        const rows = stmt.all(query.workspaceId);
+        return rows.map((row) => this.mapRowToLabel(row));
+    }
+    /**
+     * Update a task label
+     */
+    update(id, request) {
+        const existing = this.findById(id);
+        if (!existing)
+            return undefined;
+        const updates = [];
+        const params = [];
+        if (request.name !== undefined) {
+            updates.push('name = ?');
+            params.push(request.name);
+        }
+        if (request.color !== undefined) {
+            updates.push('color = ?');
+            params.push(request.color);
+        }
+        if (updates.length === 0)
+            return existing;
+        params.push(id);
+        const stmt = this.db.prepare(`UPDATE task_labels SET ${updates.join(', ')} WHERE id = ?`);
+        stmt.run(...params);
+        return this.findById(id);
+    }
+    /**
+     * Delete a task label
+     */
+    delete(id) {
+        const stmt = this.db.prepare('DELETE FROM task_labels WHERE id = ?');
+        const result = stmt.run(id);
+        return result.changes > 0;
+    }
+    /**
+     * Delete all labels for a workspace
+     */
+    deleteByWorkspace(workspaceId) {
+        const stmt = this.db.prepare('DELETE FROM task_labels WHERE workspace_id = ?');
+        const result = stmt.run(workspaceId);
+        return result.changes;
+    }
+    /**
+     * Get multiple labels by IDs
+     */
+    getByIds(ids) {
+        if (ids.length === 0)
+            return [];
+        const placeholders = ids.map(() => '?').join(', ');
+        const stmt = this.db.prepare(`SELECT * FROM task_labels WHERE id IN (${placeholders})`);
+        const rows = stmt.all(...ids);
+        return rows.map((row) => this.mapRowToLabel(row));
+    }
+    /**
+     * Map database row to TaskLabel object
+     */
+    mapRowToLabel(row) {
+        return {
+            id: row.id,
+            workspaceId: row.workspace_id,
+            name: row.name,
+            color: row.color,
+            createdAt: row.created_at,
+        };
+    }
+}
+exports.TaskLabelRepository = TaskLabelRepository;