openmates 0.27.0-alpha.62 → 0.27.0-alpha.64

package/dist/{chunk-5SFXCJJ4.js → chunk-Q6PGA2B3.js}

@@ -205,6 +205,40 @@ function decryptWithMachineKey(encryptedB64) {
 // src/storage.ts
 var PROFILE_NAME_PATTERN = /^[a-z0-9][a-z0-9-]{0,63}$/;
 var TRUSTED_ACCOUNT_FILE = "trusted_account.json";
+var DIRECT_CHAT_ACCOUNT_KEY_FILE = "direct_chat_account_key.json";
+function storedSessionMatches(session, apiUrl) {
+  const saved = readJsonFile(join(getStateDir(), "session.json"));
+  return Boolean(saved && saved.apiUrl.replace(/\/$/, "") === apiUrl.replace(/\/$/, "") && session.apiUrl.replace(/\/$/, "") === apiUrl.replace(/\/$/, "") && saved.sessionId === session.sessionId && saved.hashedEmail === session.hashedEmail && saved.createdAt === session.createdAt && (typeof saved.pairedSessionExpiresAt !== "number" || saved.pairedSessionExpiresAt > Date.now()));
+}
+function loadCachedDirectChatAccountKey(session, apiUrl) {
+  const trustedAccountId = loadTrustedAccountId();
+  if (process.env.OPENMATES_ACCOUNT_GUARD === "required" && !trustedAccountId || !storedSessionMatches(session, apiUrl)) return null;
+  const cached = readJsonFile(join(getStateDir(), DIRECT_CHAT_ACCOUNT_KEY_FILE));
+  if (!cached || typeof cached.accountId !== "string" || !cached.accountId.trim() || cached.accountId !== cached.accountId.trim() || trustedAccountId && cached.accountId !== trustedAccountId || cached.apiUrl !== apiUrl.replace(/\/$/, "") || cached.sessionId !== session.sessionId || cached.hashedEmail !== session.hashedEmail || cached.sessionCreatedAt !== session.createdAt || !cached.record || cached.record.version !== 1 || cached.record.algorithm !== "x25519-xsalsa20poly1305" || typeof cached.record.key_id !== "string" || typeof cached.record.public_key !== "string" || typeof cached.record.encrypted_private_key !== "string") return null;
+  return { accountId: cached.accountId, record: cached.record };
+}
+function saveCachedDirectChatAccountKey(session, apiUrl, accountId, record) {
+  withSessionWriteLock(() => {
+    const trustedAccountId = loadTrustedAccountId();
+    if (typeof accountId !== "string" || !accountId.trim() || accountId !== accountId.trim() || process.env.OPENMATES_ACCOUNT_GUARD === "required" && !trustedAccountId || trustedAccountId && trustedAccountId !== accountId || !storedSessionMatches(session, apiUrl)) {
+      throw new Error("Direct chat key owner changed before local backup.");
+    }
+    writeJsonFile(join(ensureStateDir(), DIRECT_CHAT_ACCOUNT_KEY_FILE), {
+      accountId,
+      apiUrl: apiUrl.replace(/\/$/, ""),
+      sessionId: session.sessionId,
+      hashedEmail: session.hashedEmail,
+      sessionCreatedAt: session.createdAt,
+      record: {
+        version: record.version,
+        algorithm: record.algorithm,
+        key_id: record.key_id,
+        public_key: record.public_key,
+        encrypted_private_key: record.encrypted_private_key
+      }
+    });
+  });
+}
 function resolveStateDir(options = {}) {
   const homeDir = options.homeDir ?? homedir2();
   const stateDir = options.stateDir ?? process.env.OPENMATES_STATE_DIR?.trim();
@@ -304,6 +338,9 @@ function saveSession(session, options = {}) {
   withSessionWriteLock(() => {
     const path = join(ensureStateDir(), "session.json");
     const current = readJsonFile(path);
+    if (current && options.replace && (current.sessionId !== session.sessionId || current.hashedEmail !== session.hashedEmail || current.apiUrl !== session.apiUrl || current.createdAt !== session.createdAt)) {
+      rmSync(join(getStateDir(), DIRECT_CHAT_ACCOUNT_KEY_FILE), { force: true });
+    }
     if (!current && options.expectedRefreshToken !== void 0) {
       throw new Error("Login session was removed. Retry using the current profile.");
     }
@@ -477,6 +514,7 @@ function clearSessionLocked() {
   }
   rmSync(join(getStateDir(), "tui_workspace_cache.json"), { force: true });
   rmSync(join(getStateDir(), "chat_model_preferences.json"), { force: true });
+  rmSync(join(getStateDir(), DIRECT_CHAT_ACCOUNT_KEY_FILE), { force: true });
   if (cleanupError) throw cleanupError;
 }
 function purgeLocalPrivateData() {
@@ -490,6 +528,7 @@ function purgeLocalPrivateData() {
   } catch (error) {
     cleanupError = error;
   }
+  rmSync(join(stateDir, DIRECT_CHAT_ACCOUNT_KEY_FILE), { force: true });
   try {
     purgeLocalTeamKeys(hashedEmail);
   } catch (error) {
@@ -1186,6 +1225,8 @@ async function runPrivacyDaemon() {
 }
 
 export {
+  loadCachedDirectChatAccountKey,
+  saveCachedDirectChatAccountKey,
   resolveStateDir,
   loadAnonymousId,
   saveAnonymousId,