otoro-cli 1.1.0 → 1.2.0

package/lib/config.js

@@ -6,10 +6,39 @@ const readline = require('readline')
 const https = require('https')
 const http = require('http')
 
+const crypto = require('crypto')
+
 const CONFIG_DIR = path.join(os.homedir(), '.otoro')
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json')
 const PROJECT_FILE = '.otoro.json'
 
+// Encryption for API key storage — key derived from machine ID
+const ENCRYPTION_KEY = crypto
+  .createHash('sha256')
+  .update(os.hostname() + os.userInfo().username + '__otoro_seal__')
+  .digest()
+
+function encrypt(text) {
+  const iv = crypto.randomBytes(16)
+  const cipher = crypto.createCipheriv('aes-256-cbc', ENCRYPTION_KEY, iv)
+  let encrypted = cipher.update(text, 'utf8', 'hex')
+  encrypted += cipher.final('hex')
+  return iv.toString('hex') + ':' + encrypted
+}
+
+function decrypt(data) {
+  try {
+    const [ivHex, encrypted] = data.split(':')
+    const iv = Buffer.from(ivHex, 'hex')
+    const decipher = crypto.createDecipheriv('aes-256-cbc', ENCRYPTION_KEY, iv)
+    let decrypted = decipher.update(encrypted, 'hex', 'utf8')
+    decrypted += decipher.final('utf8')
+    return decrypted
+  } catch {
+    return '' // corrupted or wrong machine
+  }
+}
+
 const DEFAULT_CONFIG = {
   api_url: 'https://otoroagi.com/api/otoro',
   gpu_url: '',
@@ -23,7 +52,13 @@ const DEFAULT_CONFIG = {
 function getConfig() {
   try {
     if (fs.existsSync(CONFIG_FILE)) {
-      return { ...DEFAULT_CONFIG, ...JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8')) }
+      const raw = JSON.parse(fs.readFileSync(CONFIG_FILE, 'utf8'))
+      // Decrypt API key if encrypted
+      if (raw._api_key_enc) {
+        raw.api_key = decrypt(raw._api_key_enc)
+        delete raw._api_key_enc
+      }
+      return { ...DEFAULT_CONFIG, ...raw }
     }
   } catch {}
   return DEFAULT_CONFIG
@@ -31,7 +66,13 @@ function getConfig() {
 
 function saveConfig(config) {
   fs.mkdirSync(CONFIG_DIR, { recursive: true })
-  fs.writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), { mode: 0o600 })
+  // Encrypt the API key before saving
+  const toSave = { ...config }
+  if (toSave.api_key) {
+    toSave._api_key_enc = encrypt(toSave.api_key)
+    delete toSave.api_key
+  }
+  fs.writeFileSync(CONFIG_FILE, JSON.stringify(toSave, null, 2), { mode: 0o600 })
 }
 
 function isLoggedIn() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "otoro-cli",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Otoro AGI — AI coding assistant for your terminal. Code, generate images, execute tasks, and control your projects remotely.",
   "main": "index.js",
   "bin": {