toon-memory 1.6.6 → 1.6.7

package/install.ps1

@@ -2,6 +2,9 @@
 # Usage: irm https://raw.githubusercontent.com/LuiggiVal08/toon-memory/main/install.ps1 | iex
 
 $TOON_VERSION = "1.0.9"
+# SHA-256 checksum of the tarball. Update on each release.
+# Generate with: certutil -hashfile toon-memory-$TOON_VERSION.tgz SHA256
+$TOON_CHECKSUM = "d5b2a8cbe0f3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9"
 
 Write-Host "🧠 toon-memory installer" -ForegroundColor Cyan
 Write-Host ""
@@ -32,6 +35,16 @@ if (Get-Command npm -ErrorAction SilentlyContinue) {
     $tgzPath = "$INSTALL_DIR\toon-memory.tgz"
     Invoke-WebRequest -Uri $url -OutFile $tgzPath
     
+    # Verify integrity
+    $actualHash = (Get-FileHash -Path $tgzPath -Algorithm SHA256).Hash.ToLower()
+    if ($actualHash -ne $TOON_CHECKSUM) {
+        Write-Host "❌ Checksum mismatch! Expected $TOON_CHECKSUM, got $actualHash" -ForegroundColor Red
+        Write-Host "The downloaded file may be corrupted or tampered with." -ForegroundColor Red
+        Remove-Item -Path $tgzPath -Force
+        exit 1
+    }
+    Write-Host "✅ Integrity verified" -ForegroundColor Green
+    
     # Extract
     cd $INSTALL_DIR
     tar xzf toon-memory.tgz

package/mcp/server.js

@@ -27648,6 +27648,7 @@ var MEMORY_DIR = join(process.cwd(), ".opencode", "memory");
 var MEMORY_FILE = join(MEMORY_DIR, "data.toon");
 var ARCHIVE_FILE = join(MEMORY_DIR, "archive.toon");
 var CONFIG_FILE = join(MEMORY_DIR, "config.json");
+var ENV_FILE = join(MEMORY_DIR, ".env");
 var ARCHIVE_DAYS = 30;
 var ALGORITHM = "aes-256-gcm";
 function loadConfig() {
@@ -27664,6 +27665,21 @@ function saveConfig(config2) {
   ensureMemoryDir();
   writeFileSync(CONFIG_FILE, JSON.stringify(config2, null, 2));
 }
+function readEnvKey() {
+  try {
+    if (!existsSync(ENV_FILE)) return void 0;
+    const content = readFileSync(ENV_FILE, "utf-8").trim();
+    const match = content.match(/^TOON_MEMORY_KEY=(.+)$/m);
+    return match ? match[1] : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function writeEnvKey(key) {
+  ensureMemoryDir();
+  writeFileSync(ENV_FILE, `TOON_MEMORY_KEY=${key}
+`);
+}
 function ensureMemoryDir() {
   if (!existsSync(MEMORY_DIR)) mkdirSync(MEMORY_DIR, { recursive: true });
 }
@@ -27700,9 +27716,11 @@ function readMemory() {
   ensureMemoryFile();
   const config2 = loadConfig();
   const data = readFileSync(MEMORY_FILE, "utf-8");
-  if (config2.encrypted && config2.key) {
+  if (config2.encrypted) {
+    const key = readEnvKey();
+    if (!key) return data;
     try {
-      return decrypt(data, config2.key);
+      return decrypt(data, key);
     } catch {
       return data;
     }
@@ -27712,12 +27730,15 @@ function readMemory() {
 function writeMemory(content) {
   ensureMemoryFile();
   const config2 = loadConfig();
-  if (config2.encrypted && config2.key) {
-    const encrypted = encrypt(content, config2.key);
-    writeFileSync(MEMORY_FILE, encrypted);
-  } else {
-    writeFileSync(MEMORY_FILE, content);
+  if (config2.encrypted) {
+    const key = readEnvKey();
+    if (key) {
+      const encrypted = encrypt(content, key);
+      writeFileSync(MEMORY_FILE, encrypted);
+      return;
+    }
   }
+  writeFileSync(MEMORY_FILE, content);
 }
 function generateId() {
   return randomBytes(4).toString("hex");
@@ -28022,7 +28043,8 @@ server.registerTool(
     const data = readFileSync(MEMORY_FILE, "utf-8");
     const encrypted = encrypt(data, key);
     writeFileSync(MEMORY_FILE, encrypted);
-    saveConfig({ encrypted: true, key });
+    saveConfig({ encrypted: true });
+    writeEnvKey(key);
     return {
       content: [{
         type: "text",
@@ -28047,9 +28069,13 @@ server.registerTool(
     if (!config2.encrypted) {
       return { content: [{ type: "text", text: "La encriptaci\xF3n no est\xE1 habilitada" }] };
     }
+    const resolvedKey = key || readEnvKey() || "";
+    if (!resolvedKey) {
+      return { content: [{ type: "text", text: "\u274C No hay clave. P\xE1sala como argumento o la del archivo .env" }] };
+    }
     try {
       const data = readFileSync(MEMORY_FILE, "utf-8");
-      const decrypted = decrypt(data, key);
+      const decrypted = decrypt(data, resolvedKey);
       writeFileSync(MEMORY_FILE, decrypted);
       saveConfig({ encrypted: false });
       return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toon-memory",
-  "version": "1.6.6",
+  "version": "1.6.7",
   "description": "Persistent memory system for AI coding agents using TOON format (40% fewer tokens than JSON)",
   "type": "module",
   "bin": {

package/src/mcp/server.ts

@@ -20,6 +20,9 @@ const ARCHIVE_FILE = join(MEMORY_DIR, "archive.toon")
 /** Configuration file for encryption settings */
 const CONFIG_FILE = join(MEMORY_DIR, "config.json")
 
+/** Env file storing the encryption key (gitignored via .opencode/) */
+const ENV_FILE = join(MEMORY_DIR, ".env")
+
 /** Maximum active entries before auto-archive */
 const MAX_ENTRIES = 100
 
@@ -33,8 +36,6 @@ const ALGORITHM = "aes-256-gcm"
 interface MemoryConfig {
   /** Whether encryption is enabled */
   encrypted: boolean
-  /** Encryption key (hex-encoded, 64 chars for AES-256) */
-  key?: string
 }
 
 /**
@@ -71,6 +72,32 @@ function saveConfig(config: MemoryConfig): void {
   writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2))
 }
 
+/**
+ * Read the encryption key from .env file.
+ * 
+ * @returns The key string, or undefined if not set
+ */
+function readEnvKey(): string | undefined {
+  try {
+    if (!existsSync(ENV_FILE)) return undefined
+    const content = readFileSync(ENV_FILE, "utf-8").trim()
+    const match = content.match(/^TOON_MEMORY_KEY=(.+)$/m)
+    return match ? match[1] : undefined
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Write the encryption key to .env file.
+ * 
+ * @param key - Hex-encoded encryption key
+ */
+function writeEnvKey(key: string): void {
+  ensureMemoryDir()
+  writeFileSync(ENV_FILE, `TOON_MEMORY_KEY=${key}\n`)
+}
+
 /**
  * Ensure memory directory exists, creating it if necessary.
  */
@@ -148,6 +175,7 @@ function generateKey(): string {
 
 /**
  * Read memory file, decrypting if encryption is enabled.
+ * Key is read from TOON_MEMORY_KEY env var.
  * 
  * @returns Memory content as string (TOON format)
  */
@@ -156,9 +184,11 @@ function readMemory(): string {
   const config = loadConfig()
   const data = readFileSync(MEMORY_FILE, "utf-8")
   
-  if (config.encrypted && config.key) {
+  if (config.encrypted) {
+    const key = readEnvKey()
+    if (!key) return data
     try {
-      return decrypt(data, config.key)
+      return decrypt(data, key)
     } catch {
       return data
     }
@@ -169,6 +199,7 @@ function readMemory(): string {
 
 /**
  * Write content to memory file, encrypting if encryption is enabled.
+ * Key is read from TOON_MEMORY_KEY env var.
  * 
  * @param content - Memory content to write (TOON format)
  */
@@ -176,12 +207,16 @@ function writeMemory(content: string): void {
   ensureMemoryFile()
   const config = loadConfig()
   
-  if (config.encrypted && config.key) {
-    const encrypted = encrypt(content, config.key)
-    writeFileSync(MEMORY_FILE, encrypted)
-  } else {
-    writeFileSync(MEMORY_FILE, content)
+  if (config.encrypted) {
+    const key = readEnvKey()
+    if (key) {
+      const encrypted = encrypt(content, key)
+      writeFileSync(MEMORY_FILE, encrypted)
+      return
+    }
   }
+  
+  writeFileSync(MEMORY_FILE, content)
 }
 
 /**
@@ -648,7 +683,8 @@ server.registerTool(
     const encrypted = encrypt(data, key)
     writeFileSync(MEMORY_FILE, encrypted)
     
-    saveConfig({ encrypted: true, key })
+    saveConfig({ encrypted: true })
+    writeEnvKey(key)
     
     return {
       content: [{ 
@@ -685,9 +721,14 @@ server.registerTool(
       return { content: [{ type: "text" as const, text: "La encriptación no está habilitada" }] }
     }
     
+    const resolvedKey = key || readEnvKey() || ""
+    if (!resolvedKey) {
+      return { content: [{ type: "text" as const, text: "❌ No hay clave. Pásala como argumento o la del archivo .env" }] }
+    }
+    
     try {
       const data = readFileSync(MEMORY_FILE, "utf-8")
-      const decrypted = decrypt(data, key)
+      const decrypted = decrypt(data, resolvedKey)
       
       writeFileSync(MEMORY_FILE, decrypted)
       saveConfig({ encrypted: false })