koishi-plugin-argus 0.1.0 → 0.2.0

package/lib/crypto.d.ts

@@ -0,0 +1,11 @@
+/**
+ * AES-256-GCM 加密。返回 base64(iv | tag | ciphertext)。
+ */
+export declare function encryptBuffer(plain: Buffer, token: string): string;
+/**
+ * 解密 encryptBuffer 的输出。token 不对 / 数据被改 / 格式不匹配都会抛错。
+ */
+export declare function decryptBuffer(payloadBase64: string, token: string): Buffer;
+/** 协议字段：标识 image 字段使用何种加密。当前只用一种。 */
+export declare const ENC_ALGO: "aes-256-gcm";
+export type EncAlgo = typeof ENC_ALGO;

package/lib/index.cjs

@@ -393,6 +393,37 @@ function formatRemaining(ms) {
 }
 __name(formatRemaining, "formatRemaining");
 
+// src/crypto.ts
+var import_node_crypto = require("node:crypto");
+var ALGO = "aes-256-gcm";
+var IV_LEN = 12;
+var TAG_LEN = 16;
+var KEY_LEN = 32;
+var SALT = Buffer.from("argus.peek.v1", "utf8");
+var keyCache = /* @__PURE__ */ new Map();
+function deriveKey(token) {
+  let key = keyCache.get(token);
+  if (key) return key;
+  key = (0, import_node_crypto.scryptSync)(token, SALT, KEY_LEN);
+  keyCache.set(token, key);
+  return key;
+}
+__name(deriveKey, "deriveKey");
+function decryptBuffer(payloadBase64, token) {
+  const buf = Buffer.from(payloadBase64, "base64");
+  if (buf.length < IV_LEN + TAG_LEN) {
+    throw new Error("ciphertext_too_short");
+  }
+  const iv = buf.subarray(0, IV_LEN);
+  const tag = buf.subarray(IV_LEN, IV_LEN + TAG_LEN);
+  const ct = buf.subarray(IV_LEN + TAG_LEN);
+  const key = deriveKey(token);
+  const decipher = (0, import_node_crypto.createDecipheriv)(ALGO, key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ct), decipher.final()]);
+}
+__name(decryptBuffer, "decryptBuffer");
+
 // src/commands.ts
 function applyCommands(ctx, server, config, cache) {
   const cmd = ctx.command(
@@ -449,7 +480,18 @@ function applyCommands(ctx, server, config, cache) {
         cache.set(cacheKey, { busy: response.frame });
         return formatBusy(session, client.name, response.frame);
       }
-      const buffer = Buffer.from(response.frame.image, "base64");
+      let buffer;
+      try {
+        buffer = decodeImagePayload(response.frame, config.token);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        ctx.logger.warn(
+          "argus decrypt failed for %s: %s",
+          client.name,
+          message
+        );
+        return session.text(".failed", ["decrypt_failed"]);
+      }
       const output = await blurImage(buffer, {
         radius,
         mode: config.blurMode
@@ -564,6 +606,16 @@ function range(start, end) {
   return out;
 }
 __name(range, "range");
+function decodeImagePayload(frame, token) {
+  if (!frame.enc || frame.enc === "none") {
+    return Buffer.from(frame.image, "base64");
+  }
+  if (frame.enc === "aes-256-gcm") {
+    return decryptBuffer(frame.image, token);
+  }
+  throw new Error(`unsupported_enc:${frame.enc}`);
+}
+__name(decodeImagePayload, "decodeImagePayload");
 
 // src/index.ts
 var name = "argus";

package/lib/index.mjs

@@ -370,6 +370,42 @@ function formatRemaining(ms) {
 }
 __name(formatRemaining, "formatRemaining");
 
+// src/crypto.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+  scryptSync
+} from "node:crypto";
+var ALGO = "aes-256-gcm";
+var IV_LEN = 12;
+var TAG_LEN = 16;
+var KEY_LEN = 32;
+var SALT = Buffer.from("argus.peek.v1", "utf8");
+var keyCache = /* @__PURE__ */ new Map();
+function deriveKey(token) {
+  let key = keyCache.get(token);
+  if (key) return key;
+  key = scryptSync(token, SALT, KEY_LEN);
+  keyCache.set(token, key);
+  return key;
+}
+__name(deriveKey, "deriveKey");
+function decryptBuffer(payloadBase64, token) {
+  const buf = Buffer.from(payloadBase64, "base64");
+  if (buf.length < IV_LEN + TAG_LEN) {
+    throw new Error("ciphertext_too_short");
+  }
+  const iv = buf.subarray(0, IV_LEN);
+  const tag = buf.subarray(IV_LEN, IV_LEN + TAG_LEN);
+  const ct = buf.subarray(IV_LEN + TAG_LEN);
+  const key = deriveKey(token);
+  const decipher = createDecipheriv(ALGO, key, iv);
+  decipher.setAuthTag(tag);
+  return Buffer.concat([decipher.update(ct), decipher.final()]);
+}
+__name(decryptBuffer, "decryptBuffer");
+
 // src/commands.ts
 function applyCommands(ctx, server, config, cache) {
   const cmd = ctx.command(
@@ -426,7 +462,18 @@ function applyCommands(ctx, server, config, cache) {
         cache.set(cacheKey, { busy: response.frame });
         return formatBusy(session, client.name, response.frame);
       }
-      const buffer = Buffer.from(response.frame.image, "base64");
+      let buffer;
+      try {
+        buffer = decodeImagePayload(response.frame, config.token);
+      } catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        ctx.logger.warn(
+          "argus decrypt failed for %s: %s",
+          client.name,
+          message
+        );
+        return session.text(".failed", ["decrypt_failed"]);
+      }
       const output = await blurImage(buffer, {
         radius,
         mode: config.blurMode
@@ -541,6 +588,16 @@ function range(start, end) {
   return out;
 }
 __name(range, "range");
+function decodeImagePayload(frame, token) {
+  if (!frame.enc || frame.enc === "none") {
+    return Buffer.from(frame.image, "base64");
+  }
+  if (frame.enc === "aes-256-gcm") {
+    return decryptBuffer(frame.image, token);
+  }
+  throw new Error(`unsupported_enc:${frame.enc}`);
+}
+__name(decodeImagePayload, "decodeImagePayload");
 
 // src/index.ts
 var name = "argus";

package/lib/types.d.ts

@@ -30,8 +30,14 @@ export interface PeekRequestFrame {
 export interface PeekResultFrame {
     type: 'peek_result';
     id: string;
-    /** PNG/JPEG base64（不带 data: 前缀）。*/
+    /**
+     * 图片 buffer，base64 编码。
+     * `enc` 为 `aes-256-gcm` 时为 base64(iv|tag|ciphertext)，token 派生 key 解密。
+     * `enc` 缺省 / 为 `none` 时为图片原始字节的 base64（向后兼容旧 CLI）。
+     */
     image: string;
+    /** 加密算法。新版客户端始终发 `aes-256-gcm`。 */
+    enc?: 'aes-256-gcm' | 'none';
     mime?: string;
     width?: number;
     height?: number;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "koishi-plugin-argus",
   "description": "百眼巨人 Argus：让群友通过 /peek 命令偷窥你电脑屏幕的 Koishi 插件。",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "main": "lib/index.cjs",
   "module": "lib/index.mjs",
   "typings": "lib/index.d.ts",

package/readme.md

@@ -5,6 +5,14 @@
 插件本体作为 WebSocket 服务，配套 CLI 客户端 [`argus-eye`](https://www.npmjs.com/package/argus-eye)
 连接上来后，群里就能通过命令拉取实时模糊截图。
 
+## 安全说明
+
+- 客户端连接时必须带 `token`，错的直接踢。
+- 截图 buffer 在 CLI 端用 `AES-256-GCM` 加密后才上 WebSocket，
+  key 由 token 通过 scrypt 派生，IV 每帧随机。换句话说**抓包只能拿到密文**，
+  插件这边解出来再做模糊处理。token 写错或者被改包都会被 GCM 校验拒绝。
+- 默认 `authority: 1`，可调高到只允许特定群友 peek。
+
 ## 安装
 
 ```bash