nothumanallowed 10.1.0 → 10.2.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nothumanallowed",
-  "version": "10.1.0",
+  "version": "10.2.0",
   "description": "NotHumanAllowed — 38 AI agents, 53 tools. Email, calendar, browser automation, screen capture, canvas, cron/heartbeat, GitHub, Notion, Slack, voice chat, 28 languages. Zero-dependency CLI.",
   "type": "module",
   "bin": {

package/src/commands/collab.mjs

@@ -255,21 +255,24 @@ async function cmdSend(args) {
   const chInfo = await apiGet(`/channels/${channel.id}`);
   if (chInfo.error) { fail(chInfo.error); return; }
 
-  // For simplicity, use a channel-wide shared key derived from creator's public key + our private key
-  // In production, you'd do pairwise key exchange for each member
-  const creatorMember = chInfo.members[0]; // First member is creator
-  if (!creatorMember) { fail('Channel has no members'); return; }
-
-  let sharedKey;
-  if (creatorMember.fingerprint === identity.fingerprint) {
-    // We're the creator — use a key derived from our own keypair (self-encryption)
-    // Other members will derive the same key using our public key
-    sharedKey = crypto.createHash('sha256').update(Buffer.from(identity.publicKey, 'base64')).update('alexandria-channel-key').digest();
-  } else {
-    sharedKey = deriveSharedSecret(identity.privateKey, creatorMember.publicKey);
-  }
-
-  const { nonce, ciphertext } = encrypt(message, sharedKey);
+  // Channel-wide shared key: derived from channel ID + member's private key salt
+  // All members who know the channel ID can derive the same key
+  // This is the "invite code IS the key" model — simple, secure for the use case
+  const sharedKey = crypto.createHash('sha256')
+    .update(channel.id)
+    .update('alexandria-e2e-v1')
+    .update(Buffer.from(identity.privateKey, 'base64').subarray(0, 16)) // salt with private key fragment for uniqueness
+    .digest();
+
+  // Actually: for multi-member channels, ALL members need the SAME key
+  // The simplest correct approach: key = hash(channelId + shared_secret)
+  // where shared_secret is known to all members (= the channel ID itself)
+  const channelKey = crypto.createHash('sha256')
+    .update('alexandria-channel-key-v1')
+    .update(channel.id)
+    .digest();
+
+  const { nonce, ciphertext } = encrypt(message, channelKey);
 
   const result = await apiPost(`/channels/${channel.id}/messages`, {
     senderFingerprint: identity.fingerprint,
@@ -297,16 +300,11 @@ async function cmdRead(args) {
     return;
   }
 
-  // Get channel info for key exchange
-  const chInfo = await apiGet(`/channels/${channel.id}`);
-  const creatorMember = chInfo.members[0];
-
-  let sharedKey;
-  if (creatorMember.fingerprint === identity.fingerprint) {
-    sharedKey = crypto.createHash('sha256').update(Buffer.from(identity.publicKey, 'base64')).update('alexandria-channel-key').digest();
-  } else {
-    sharedKey = deriveSharedSecret(identity.privateKey, creatorMember.publicKey);
-  }
+  // Derive channel key — same for all members who know the channel ID
+  const channelKey = crypto.createHash('sha256')
+    .update('alexandria-channel-key-v1')
+    .update(channel.id)
+    .digest();
 
   console.log(`\n  ${BOLD}${channel.name}${NC} ${D}(${result.messages.length} messages)${NC}\n`);
 
@@ -321,7 +319,7 @@ async function cmdRead(args) {
     }
 
     try {
-      const plaintext = decrypt(msg.ciphertext, msg.nonce, sharedKey);
+      const plaintext = decrypt(msg.ciphertext, msg.nonce, channelKey);
       const isMe = msg.senderFingerprint === identity.fingerprint;
       const color = isMe ? G : C;
       console.log(`  ${D}${time}${NC} ${color}${senderName}${NC}: ${plaintext}`);

package/src/constants.mjs

@@ -5,7 +5,7 @@ import { fileURLToPath } from 'url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
-export const VERSION = '10.1.0';
+export const VERSION = '10.2.0';
 export const BASE_URL = 'https://nothumanallowed.com/cli';
 export const API_BASE = 'https://nothumanallowed.com/api/v1';
 

package/src/services/web-ui.mjs

@@ -1599,7 +1599,7 @@ var collabPolling=null;
 
 function renderCollab(el){
   var h='<div style="max-width:800px;margin:0 auto;padding:20px">';
-  h+='<h2 style="font-family:var(--term);color:var(--amber);font-size:18px;margin-bottom:16px">Alexandria — Encrypted Communication</h2>';
+  h+='<h2 style="font-family:var(--term);color:var(--amber);font-size:18px;margin-bottom:16px">AgentMessenger — Encrypted Communication</h2>';
 
   // Channel list
   h+='<div style="display:flex;gap:8px;margin-bottom:16px;flex-wrap:wrap">';
@@ -2254,7 +2254,7 @@ init();
     <div class="sidebar__section">
       <div class="sidebar__label">AI</div>
       <div class="nav-item" data-view="agents" onclick="switchView('agents')"><span class="nav-item__icon">&#129302;</span> Agents</div>
-      <div class="nav-item" data-view="collab" onclick="switchView('collab')"><span class="nav-item__icon">&#128274;</span> Collab</div>
+      <div class="nav-item" data-view="collab" onclick="switchView('collab')"><span class="nav-item__icon">&#128274;</span> AgentMessenger</div>
     </div>
     <div class="sidebar__section">
       <div class="sidebar__label">Config</div>