maiass 5.9.5 → 5.9.6

package/lib/secure-storage.js

@@ -1,11 +1,67 @@
 // Secure storage functionality for nodemaiass
 // Uses OS keychain (macOS) or secret-tool (Linux) for sensitive data storage
+// Windows uses encrypted file storage in AppData
 // Compatible with bashmaiass approach but uses NODEMAIASS service names
 
 import { execSync } from 'child_process';
 import os from 'os';
+import fs from 'fs';
+import path from 'path';
+import crypto from 'crypto';
 import { log, logger } from './logger.js';
 
+/**
+ * Encryption key derivation for Windows storage
+ * Uses machine-specific data to create a unique encryption key
+ * @returns {Buffer} Encryption key
+ */
+function getEncryptionKey() {
+  // Use machine-specific data to derive a key
+  // This provides basic protection while being deterministic per machine
+  const machineId = os.hostname() + os.userInfo().username;
+  return crypto.createHash('sha256').update(machineId).digest();
+}
+
+/**
+ * Encrypt data for Windows storage
+ * @param {string} data - Data to encrypt
+ * @returns {string} Encrypted data (base64)
+ */
+function encryptData(data) {
+  const key = getEncryptionKey();
+  const iv = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+  
+  let encrypted = cipher.update(data, 'utf8', 'base64');
+  encrypted += cipher.final('base64');
+  
+  // Prepend IV to encrypted data
+  return iv.toString('base64') + ':' + encrypted;
+}
+
+/**
+ * Decrypt data from Windows storage
+ * @param {string} encryptedData - Encrypted data (base64 with IV)
+ * @returns {string} Decrypted data
+ */
+function decryptData(encryptedData) {
+  const key = getEncryptionKey();
+  const parts = encryptedData.split(':');
+  
+  if (parts.length !== 2) {
+    throw new Error('Invalid encrypted data format');
+  }
+  
+  const iv = Buffer.from(parts[0], 'base64');
+  const encrypted = parts[1];
+  
+  const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+  let decrypted = decipher.update(encrypted, 'base64', 'utf8');
+  decrypted += decipher.final('utf8');
+  
+  return decrypted;
+}
+
 /**
  * Get environment-specific service name for secure storage
  * Uses NODEMAIASS prefix to differentiate from bashmaiass
@@ -46,6 +102,42 @@ export function storeSecureVariable(varName, varValue) {
       execSync(`security add-generic-password -U -s "${serviceName}" -a "${varName}" -w "${varValue}"`, {
         stdio: 'pipe'
       });
+    } else if (os.platform() === 'win32') {
+      // Windows: Use encrypted file storage in AppData
+      // cmdkey doesn't support password retrieval, so we use a file-based approach
+      const storageDir = path.join(os.homedir(), 'AppData', 'Local', 'maiass');
+      const storageFile = path.join(storageDir, `${serviceName}.dat`);
+      
+      // Create directory if it doesn't exist
+      if (!fs.existsSync(storageDir)) {
+        fs.mkdirSync(storageDir, { recursive: true, mode: 0o700 });
+      }
+      
+      // Read existing data or create new
+      let data = {};
+      if (fs.existsSync(storageFile)) {
+        try {
+          const encrypted = fs.readFileSync(storageFile, 'utf8');
+          const decrypted = decryptData(encrypted);
+          data = JSON.parse(decrypted);
+        } catch (error) {
+          // If decryption fails, start fresh
+          if (debugMode) {
+            logger.debug(`Could not read existing storage file: ${error.message}`);
+          }
+        }
+      }
+      
+      // Update the value
+      data[varName] = varValue;
+      
+      // Encrypt and save
+      const encrypted = encryptData(JSON.stringify(data));
+      fs.writeFileSync(storageFile, encrypted, { mode: 0o600 });
+      
+      if (debugMode) {
+        logger.debug(`Stored ${varName} in Windows secure storage (encrypted file)`);
+      }
     } else {
       // Linux: Use secret-tool if available
       try {
@@ -96,6 +188,33 @@ export function retrieveSecureVariable(varName) {
         stdio: 'pipe',
         encoding: 'utf8'
       }).trim();
+    } else if (os.platform() === 'win32') {
+      // Windows: Read from encrypted file storage
+      const storageDir = path.join(os.homedir(), 'AppData', 'Local', 'maiass');
+      const storageFile = path.join(storageDir, `${serviceName}.dat`);
+      
+      if (!fs.existsSync(storageFile)) {
+        if (debugMode) {
+          logger.debug(`Storage file does not exist: ${storageFile}`);
+        }
+        return null;
+      }
+      
+      try {
+        const encrypted = fs.readFileSync(storageFile, 'utf8');
+        const decrypted = decryptData(encrypted);
+        const data = JSON.parse(decrypted);
+        value = data[varName] || null;
+        
+        if (debugMode && value) {
+          logger.debug(`Retrieved ${varName} from Windows secure storage (encrypted file)`);
+        }
+      } catch (error) {
+        if (debugMode) {
+          logger.debug(`Could not retrieve ${varName}: ${error.message}`);
+        }
+        return null;
+      }
     } else {
       // Linux: Use secret-tool if available
       try {
@@ -144,6 +263,44 @@ export function removeSecureVariable(varName) {
       execSync(`security delete-generic-password -s "${serviceName}" -a "${varName}"`, {
         stdio: 'pipe'
       });
+    } else if (os.platform() === 'win32') {
+      // Windows: Remove from encrypted file storage
+      const storageDir = path.join(os.homedir(), 'AppData', 'Local', 'maiass');
+      const storageFile = path.join(storageDir, `${serviceName}.dat`);
+      
+      if (!fs.existsSync(storageFile)) {
+        // File doesn't exist, nothing to remove
+        if (debugMode) {
+          logger.debug(`Storage file does not exist, nothing to remove`);
+        }
+        return true;
+      }
+      
+      try {
+        const encrypted = fs.readFileSync(storageFile, 'utf8');
+        const decrypted = decryptData(encrypted);
+        const data = JSON.parse(decrypted);
+        
+        // Remove the variable
+        delete data[varName];
+        
+        // If no more data, delete the file
+        if (Object.keys(data).length === 0) {
+          fs.unlinkSync(storageFile);
+          if (debugMode) {
+            logger.debug(`Removed storage file (no more credentials)`);
+          }
+        } else {
+          // Save updated data
+          const newEncrypted = encryptData(JSON.stringify(data));
+          fs.writeFileSync(storageFile, newEncrypted, { mode: 0o600 });
+        }
+      } catch (error) {
+        if (debugMode) {
+          logger.debug(`Error removing ${varName}: ${error.message}`);
+        }
+        return false;
+      }
     } else {
       // Linux: secret-tool doesn't have direct delete, but we can try to clear it
       try {
@@ -236,7 +393,11 @@ export function isSecureStorageAvailable() {
     if (os.platform() === 'darwin') {
       execSync('which security', { stdio: 'pipe' });
       return true;
+    } else if (os.platform() === 'win32') {
+      // Windows: Always available (uses encrypted file storage)
+      return true;
     } else {
+      // Linux: Check for secret-tool
       execSync('which secret-tool', { stdio: 'pipe' });
       return true;
     }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "maiass",
   "type": "module",
-  "version": "5.9.5",
+  "version": "5.9.6",
   "description": "MAIASS - Modular AI-Augmented Semantic Scribe - Intelligent Git workflow automation",
   "main": "maiass.mjs",
   "bin": {