packup-cli 1.0.0 → 1.2.0

package/bin/packup.js

@@ -1,9 +1,12 @@
 #!/usr/bin/env node
 // bin/packup.js
-import { pack, unpack, info } from '../src/index.js';
+import { pack, unpack, info, isEncrypted } from '../src/index.js';
 import { readFileSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { createInterface } from 'node:readline';
+import { readClipboard } from '../src/clipboard.js';
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
@@ -22,13 +25,59 @@ Usage:
   ${NAME} info -i <file>               Show contents from file
 
 Pack options:
+  -e, --encrypt     Encrypt with password (AES-256-CBC)
   --include-deps    Include dependency dirs (node_modules, vendor, etc.)
 
+Environment:
+  PACKUP_PASSWORD   Password for encryption/decryption (skips prompt)
+
 General:
   -h, --help        Show this help
   -v, --version     Show version`);
 }
 
+// Get password from env var or prompt
+async function getPassword(confirm = false) {
+  // Use env var if set (AI agent friendly)
+  if (process.env.PACKUP_PASSWORD) {
+    return process.env.PACKUP_PASSWORD;
+  }
+  // Otherwise prompt interactively
+  return promptPassword('Password: ', confirm);
+}
+
+async function promptPassword(prompt, confirm = false) {
+  const question = (text) => new Promise((resolve) => {
+    const rl = createInterface({
+      input: process.stdin,
+      output: process.stderr,
+    });
+    rl.question(text, (answer) => {
+      rl.close();
+      resolve(answer);
+    });
+    // Hide input on TTY
+    rl._writeToOutput = () => {};
+  });
+
+  const pass1 = await question(prompt);
+  process.stderr.write('\n');
+
+  if (confirm) {
+    const pass2 = await question('Confirm password: ');
+    process.stderr.write('\n');
+    if (pass1 !== pass2) {
+      throw new Error('Passwords do not match');
+    }
+  }
+
+  if (!pass1) {
+    throw new Error('Password cannot be empty');
+  }
+
+  return pass1;
+}
+
 function humanSize(bytes) {
   if (bytes >= 1048576) return `${(bytes / 1048576).toFixed(1)} MB`;
   if (bytes >= 1024) return `${(bytes / 1024).toFixed(1)} KB`;
@@ -54,9 +103,11 @@ async function main() {
       let output = null;
       let folder = null;
       let includeDeps = false;
+      let encrypt = false;
 
       for (let i = 1; i < args.length; i++) {
         if (args[i] === '-o' || args[i] === '--output') { output = args[++i]; }
+        else if (args[i] === '-e' || args[i] === '--encrypt') { encrypt = true; }
         else if (args[i] === '--include-deps') { includeDeps = true; }
         else if (!args[i].startsWith('-')) { folder = args[i]; }
         else { console.error(`Error: Unknown option: ${args[i]}`); process.exit(1); }
@@ -64,14 +115,21 @@ async function main() {
 
       if (!folder) { console.error('Error: No folder specified.'); process.exit(1); }
 
+      let password;
+      if (encrypt) {
+        password = await getPassword(true);
+      }
+
       const result = await pack(folder, {
         clipboard: !output,
         output: output || undefined,
         includeDeps,
+        password,
       });
 
       const target = output || 'clipboard';
-      console.log(`Packed '${folder}' -> ${target} (${humanSize(result.zipSize)} zip, ${humanSize(result.stringSize)} string)`);
+      const encLabel = result.encrypted ? ' encrypted,' : '';
+      console.log(`Packed '${folder}' ->${encLabel} ${target} (${humanSize(result.zipSize)} zip, ${humanSize(result.stringSize)} string)`);
 
     } else if (command === 'unpack') {
       let inputFile = null;
@@ -83,10 +141,21 @@ async function main() {
         else { console.error(`Error: Unknown option: ${args[i]}`); process.exit(1); }
       }
 
-      const result = await unpack(null, dest, {
-        input: inputFile || undefined,
-        clipboard: !inputFile,
-      });
+      // Read input first to check if encrypted
+      let raw;
+      if (inputFile) {
+        raw = await readFile(inputFile, 'utf8');
+      } else {
+        raw = await readClipboard();
+      }
+
+      let password;
+      if (isEncrypted(raw)) {
+        console.log('Encrypted archive detected');
+        password = await getPassword(false);
+      }
+
+      const result = await unpack(raw, dest, { password });
 
       console.log('Integrity OK');
       console.log(`Files: ${result.fileCount}`);
@@ -100,12 +169,23 @@ async function main() {
         else { console.error(`Error: Unknown option: ${args[i]}`); process.exit(1); }
       }
 
-      const details = await info(null, {
-        input: inputFile || undefined,
-        clipboard: !inputFile,
-      });
+      // Read input first to check if encrypted
+      let raw;
+      if (inputFile) {
+        raw = await readFile(inputFile, 'utf8');
+      } else {
+        raw = await readClipboard();
+      }
+
+      let password;
+      if (isEncrypted(raw)) {
+        password = await getPassword(false);
+      }
+
+      const details = await info(raw, { password });
 
-      console.log(`${NAME} v${details.version} — integrity OK`);
+      const encLabel = details.encrypted ? ' (encrypted)' : '';
+      console.log(`${NAME} v${details.version}${encLabel} — integrity OK`);
       console.log(`  Source: ${details.source}/`);
       console.log(`  Files:  ${details.fileCount}`);
       console.log(`  Size:   ${humanSize(details.compressedSize)} (compressed)`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "packup-cli",
-  "version": "1.0.0",
+  "version": "1.2.0",
   "description": "Pack folders into portable, integrity-verified strings",
   "type": "module",
   "bin": {

package/src/crypto.js

@@ -0,0 +1,51 @@
+// src/crypto.js
+import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from 'node:crypto';
+
+const ALGORITHM = 'aes-256-cbc';
+const KEY_LENGTH = 32;
+const IV_LENGTH = 16;
+const SALT_LENGTH = 8;  // OpenSSL uses 8-byte salt
+const ITERATIONS = 100000;
+const DIGEST = 'sha256';
+
+// OpenSSL-compatible format: "Salted__" (8 bytes) + salt (8 bytes) + ciphertext
+const OPENSSL_MAGIC = Buffer.from('Salted__');
+
+function deriveKey(password, salt) {
+  return pbkdf2Sync(password, salt, ITERATIONS, KEY_LENGTH + IV_LENGTH, DIGEST);
+}
+
+export function encrypt(data, password) {
+  const salt = randomBytes(SALT_LENGTH);
+  const derived = deriveKey(password, salt);
+  const key = derived.slice(0, KEY_LENGTH);
+  const iv = derived.slice(KEY_LENGTH, KEY_LENGTH + IV_LENGTH);
+
+  const cipher = createCipheriv(ALGORITHM, key, iv);
+  const encrypted = Buffer.concat([cipher.update(data), cipher.final()]);
+
+  // OpenSSL-compatible format
+  return Buffer.concat([OPENSSL_MAGIC, salt, encrypted]);
+}
+
+export function decrypt(data, password) {
+  // Verify OpenSSL magic
+  const magic = data.slice(0, 8);
+  if (!magic.equals(OPENSSL_MAGIC)) {
+    throw new Error('Invalid encrypted data format');
+  }
+
+  const salt = data.slice(8, 8 + SALT_LENGTH);
+  const ciphertext = data.slice(8 + SALT_LENGTH);
+
+  const derived = deriveKey(password, salt);
+  const key = derived.slice(0, KEY_LENGTH);
+  const iv = derived.slice(KEY_LENGTH, KEY_LENGTH + IV_LENGTH);
+
+  const decipher = createDecipheriv(ALGORITHM, key, iv);
+  try {
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]);
+  } catch (err) {
+    throw new Error('Decryption failed. Wrong password or corrupted data.');
+  }
+}

package/src/format.js

@@ -1,11 +1,13 @@
 import { createHash, timingSafeEqual } from 'node:crypto';
 
 const PREFIX = 'PACKUP';
-const VERSION = 1;
+const VERSION_PLAIN = 1;
+const VERSION_ENCRYPTED = 2;
 
-export function buildString(base64Data) {
+export function buildString(base64Data, encrypted = false) {
   const hash = createHash('sha256').update(base64Data).digest('hex');
-  return `${PREFIX}:${VERSION}:${hash}:${base64Data}`;
+  const version = encrypted ? VERSION_ENCRYPTED : VERSION_PLAIN;
+  return `${PREFIX}:${version}:${hash}:${base64Data}`;
 }
 
 export function parseString(raw) {
@@ -25,7 +27,7 @@ export function parseString(raw) {
   const hash = raw.slice(secondColon + 1, thirdColon);
   const data = raw.slice(thirdColon + 1);
 
-  if (version !== VERSION) {
+  if (version !== VERSION_PLAIN && version !== VERSION_ENCRYPTED) {
     throw new Error(`Unsupported packup version: ${version}`);
   }
 
@@ -40,5 +42,6 @@ export function parseString(raw) {
     throw new Error('Integrity check FAILED (hash mismatch). Data may be corrupted or tampered with.');
   }
 
-  return { version, hash, data };
+  const encrypted = version === VERSION_ENCRYPTED;
+  return { version, hash, data, encrypted };
 }

package/src/index.js

@@ -3,6 +3,7 @@ import { createZipBuffer } from './compress.js';
 import { extractZipBuffer, listZipEntries } from './decompress.js';
 import { buildString, parseString } from './format.js';
 import { readClipboard, writeClipboard } from './clipboard.js';
+import { encrypt, decrypt } from './crypto.js';
 import { readFile, writeFile } from 'node:fs/promises';
 import { gzip, gunzip } from 'node:zlib';
 import { promisify } from 'node:util';
@@ -10,11 +11,19 @@ import { promisify } from 'node:util';
 const gzipAsync = promisify(gzip);
 const gunzipAsync = promisify(gunzip);
 
-export async function pack(folder, { clipboard = false, output, includeDeps = false } = {}) {
+export async function pack(folder, { clipboard = false, output, includeDeps = false, password } = {}) {
   const zipBuffer = await createZipBuffer(folder, { includeDeps });
   const gzipped = await gzipAsync(zipBuffer, { level: 9 });
-  const base64Data = gzipped.toString('base64');
-  const packupString = buildString(base64Data);
+
+  let dataToEncode = gzipped;
+  const isEncrypted = Boolean(password);
+
+  if (isEncrypted) {
+    dataToEncode = encrypt(gzipped, password);
+  }
+
+  const base64Data = dataToEncode.toString('base64');
+  const packupString = buildString(base64Data, isEncrypted);
 
   const fileCount = listZipEntries(zipBuffer).length;
   const result = {
@@ -22,6 +31,7 @@ export async function pack(folder, { clipboard = false, output, includeDeps = fa
     zipSize: zipBuffer.length,
     stringSize: packupString.length,
     fileCount,
+    encrypted: isEncrypted,
   };
 
   if (output) {
@@ -49,11 +59,22 @@ export async function unpack(input, dest = '.', options = {}) {
   }
 
   const parsed = parseString(raw);
-  const gzipped = Buffer.from(parsed.data, 'base64');
-  const zipBuffer = await gunzipAsync(gzipped, { maxOutputLength: 500 * 1024 * 1024 });
+  let dataBuffer = Buffer.from(parsed.data, 'base64');
+
+  // Decrypt if encrypted
+  if (parsed.encrypted) {
+    if (!options.password) {
+      const error = new Error('Encrypted archive requires password');
+      error.encrypted = true;
+      throw error;
+    }
+    dataBuffer = decrypt(dataBuffer, options.password);
+  }
+
+  const zipBuffer = await gunzipAsync(dataBuffer, { maxOutputLength: 500 * 1024 * 1024 });
 
   const result = await extractZipBuffer(zipBuffer, dest);
-  return { fileCount: result.fileCount, dest };
+  return { fileCount: result.fileCount, dest, encrypted: parsed.encrypted };
 }
 
 export async function info(input, options = {}) {
@@ -70,8 +91,19 @@ export async function info(input, options = {}) {
   }
 
   const parsed = parseString(raw);
-  const gzipped = Buffer.from(parsed.data, 'base64');
-  const zipBuffer = await gunzipAsync(gzipped, { maxOutputLength: 500 * 1024 * 1024 });
+  let dataBuffer = Buffer.from(parsed.data, 'base64');
+
+  // Decrypt if encrypted
+  if (parsed.encrypted) {
+    if (!options.password) {
+      const error = new Error('Encrypted archive requires password');
+      error.encrypted = true;
+      throw error;
+    }
+    dataBuffer = decrypt(dataBuffer, options.password);
+  }
+
+  const zipBuffer = await gunzipAsync(dataBuffer, { maxOutputLength: 500 * 1024 * 1024 });
 
   const entries = listZipEntries(zipBuffer);
   const source = entries.length > 0 ? entries[0].split('/')[0] : 'unknown';
@@ -83,5 +115,16 @@ export async function info(input, options = {}) {
     fileCount: entries.length,
     compressedSize: zipBuffer.length,
     entries,
+    encrypted: parsed.encrypted,
   };
 }
+
+// Helper to check if archive is encrypted without full parsing
+export function isEncrypted(raw) {
+  try {
+    const parsed = parseString(raw);
+    return parsed.encrypted;
+  } catch {
+    return false;
+  }
+}