forge-openclaw-plugin 0.2.15 → 0.2.19

package/dist/server/managers/platform/secrets-manager.js

@@ -1,7 +1,15 @@
-import { createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { createCipheriv, createDecipheriv, createHash, randomBytes, timingSafeEqual } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
 import { AbstractManager } from "../base.js";
 export class SecretsManager extends AbstractManager {
     name = "SecretsManager";
+    rootDir = process.cwd();
+    cachedKey = null;
+    configure(rootDir) {
+        this.rootDir = rootDir ?? process.cwd();
+        this.cachedKey = null;
+    }
     createSecret(prefix) {
         return `${prefix}_${randomBytes(18).toString("hex")}`;
     }
@@ -16,4 +24,39 @@ export class SecretsManager extends AbstractManager {
         }
         return timingSafeEqual(leftBuffer, rightBuffer);
     }
+    sealJson(value) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.getEncryptionKey(), iv);
+        const plaintext = Buffer.from(JSON.stringify(value), "utf8");
+        const encrypted = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+        const tag = cipher.getAuthTag();
+        return [iv.toString("base64"), tag.toString("base64"), encrypted.toString("base64")].join(".");
+    }
+    openJson(cipherText) {
+        const [ivEncoded, tagEncoded, payloadEncoded] = cipherText.split(".");
+        if (!ivEncoded || !tagEncoded || !payloadEncoded) {
+            throw new Error("Malformed encrypted secret payload");
+        }
+        const decipher = createDecipheriv("aes-256-gcm", this.getEncryptionKey(), Buffer.from(ivEncoded, "base64"));
+        decipher.setAuthTag(Buffer.from(tagEncoded, "base64"));
+        const decrypted = Buffer.concat([
+            decipher.update(Buffer.from(payloadEncoded, "base64")),
+            decipher.final()
+        ]);
+        return JSON.parse(decrypted.toString("utf8"));
+    }
+    getEncryptionKey() {
+        if (this.cachedKey) {
+            return this.cachedKey;
+        }
+        const keyPath = path.join(this.rootDir, "data", ".forge-secrets.key");
+        mkdirSync(path.dirname(keyPath), { recursive: true });
+        if (!existsSync(keyPath)) {
+            writeFileSync(keyPath, randomBytes(32).toString("base64"), { encoding: "utf8", mode: 0o600 });
+        }
+        const encoded = readFileSync(keyPath, "utf8").trim();
+        const rawKey = Buffer.from(encoded, "base64");
+        this.cachedKey = rawKey.length === 32 ? rawKey : createHash("sha256").update(rawKey).digest();
+        return this.cachedKey;
+    }
 }

package/dist/server/managers/runtime.js

@@ -17,9 +17,11 @@ import { ExternalServiceManager } from "./platform/external-service-manager.js";
 import { SearchIndexManager } from "./platform/search-index-manager.js";
 export function createManagerRuntime(options = {}) {
     const configuration = new ConfigurationManager();
+    const runtimeConfig = configuration.readRuntimeConfig({ dataRoot: options.dataRoot });
     const database = new DatabaseManager();
-    database.configure(configuration.readRuntimeConfig({ dataRoot: options.dataRoot }).dataRoot);
+    database.configure(runtimeConfig.dataRoot);
     const secrets = new SecretsManager();
+    secrets.configure(runtimeConfig.dataRoot ?? process.cwd());
     const transaction = new TransactionManager();
     const migration = new MigrationManager();
     const storage = new StorageManager();