devmate 1.0.0__py3-none-any.whl

devmate/security/vault.py

@@ -0,0 +1,221 @@
+"""
+vault — 加密密钥管理器
+
+加密体系：
+  主密码（用户输入）
+    ↓ Argon2id KDF（salt + 内存硬参数）
+  256-bit 主密钥
+    ↓ AES-256-GCM（随机 nonce，认证加密）
+  加密密钥值 → 写入 ~/.devmate/vault/keys/<name>
+
+安全性：
+  - 主密码不存储，只存 KDF 参数和 salt
+  - 每次加密使用随机 nonce（12 字节）
+  - 认证标签确保密文完整性
+  - 锁定后 salt 和 nonce 从内存中清除
+"""
+
+import json
+import os
+
+from cryptography.hazmat.primitives.ciphers.aead import AESGCM
+from cryptography.hazmat.primitives.kdf.argon2 import Argon2id
+
+from devmate.core.config import VAULT_PATH
+from devmate.core.logging import logger
+
+# ── 常量 ────────────────────────────────────────────────
+
+KEYS_DIR = VAULT_PATH / "keys"
+LOCK_MARKER = VAULT_PATH / ".locked"
+METADATA_FILE = VAULT_PATH / "metadata.json"
+NONCE_BYTES = 12          # AES-GCM 推荐 nonce 长度
+KEY_BYTES = 32            # AES-256 = 32 字节
+
+
+# ── 异常 ────────────────────────────────────────────────
+
+class VaultError(Exception):
+    """vault 操作异常"""
+    pass
+
+class VaultLockedError(VaultError):
+    """vault 已锁定"""
+    pass
+
+class VaultUnlockedError(VaultError):
+    """vault 未锁定（不需要再 unlock）"""
+    pass
+
+class KeyNotFoundError(VaultError):
+    """密钥不存在"""
+    pass
+
+
+# ── Vault 核心 ──────────────────────────────────────────
+
+class Vault:
+    """加密密钥管理器"""
+
+    def __init__(self):
+        self._key: bytes | None = None       # 派生出的 256-bit 密钥（None = 锁定）
+        self._salt: bytes | None = None      # KDF salt
+        self._params: dict | None = None     # Argon2id 参数
+
+    # ── 属性 ────────────────────────────────────
+
+    @property
+    def is_locked(self) -> bool:
+        """vault 是否锁定"""
+        return self._key is None or LOCK_MARKER.exists()
+
+    @property
+    def is_unlocked(self) -> bool:
+        return not self.is_locked
+
+    # ── 初始化与目录管理 ────────────────────────
+
+    def _ensure_dirs(self):
+        """确保 vault 目录存在"""
+        KEYS_DIR.mkdir(parents=True, exist_ok=True)
+
+    # ── 主密码处理 ──────────────────────────────
+
+    def _derive_key(self, master_password: str) -> bytes:
+        """用 Argon2id 从主密码派生 256-bit 密钥"""
+        password_bytes = master_password.encode("utf-8")
+
+        if self._salt is None:
+            # 首次使用：生成随机 salt
+            self._salt = os.urandom(16)
+            self._params = {
+                "salt": self._salt.hex(),
+                "iterations": 3,         # OWASP 推荐 ≥ 2
+                "memory_cost": 65536,    # 64 MB
+                "lanes": 4,
+                "key_len": KEY_BYTES,
+            }
+            self._save_metadata()
+
+        kdf = Argon2id(
+            salt=bytes.fromhex(self._params["salt"]),
+            length=self._params["key_len"],
+            iterations=self._params["iterations"],
+            memory_cost=self._params["memory_cost"],
+            lanes=self._params["lanes"],
+        )
+        return kdf.derive(password_bytes)
+
+    # ── 元数据持久化 ────────────────────────────
+
+    def _save_metadata(self):
+        """保存 KDF 参数到文件"""
+        data = {
+            "salt": self._params["salt"],
+            "iterations": self._params["iterations"],
+            "memory_cost": self._params["memory_cost"],
+            "lanes": self._params["lanes"],
+            "key_len": self._params["key_len"],
+        }
+        METADATA_FILE.write_text(json.dumps(data, indent=2))
+
+    def _load_metadata(self):
+        """从文件加载 KDF 参数"""
+        if not METADATA_FILE.exists():
+            self._salt = None
+            self._params = None
+            return
+        data = json.loads(METADATA_FILE.read_text())
+        self._salt = bytes.fromhex(data["salt"])
+        self._params = data
+
+    # ── 核心操作 ────────────────────────────────
+
+    def unlock(self, master_password: str):
+        """解锁 vault"""
+        if self.is_unlocked:
+            raise VaultUnlockedError("vault 已经解锁")
+
+        self._ensure_dirs()
+        self._load_metadata()
+
+        # 首次使用：创建新 vault
+        if self._params is None:
+            self._key = self._derive_key(master_password)
+            self._save_metadata()
+        else:
+            self._key = self._derive_key(master_password)
+
+        # 移除锁定标记
+        if LOCK_MARKER.exists():
+            LOCK_MARKER.unlink()
+
+        logger.info("vault 已解锁")
+
+    def lock(self):
+        """锁定 vault（从内存中清除密钥）"""
+        self._key = None
+        self._salt = None
+        self._params = None
+        LOCK_MARKER.touch()
+        logger.info("vault 已锁定")
+
+    def set(self, name: str, value: str, master_password: str):
+        """存储一个加密密钥"""
+        if self.is_locked:
+            self.unlock(master_password)
+
+        # 生成随机 nonce
+        nonce = os.urandom(NONCE_BYTES)
+
+        # AES-256-GCM 加密
+        aesgcm = AESGCM(self._key)
+        ciphertext = aesgcm.encrypt(nonce, value.encode("utf-8"), None)
+
+        # 存储：nonce + 密文（nonce 在前面，解密时需要）
+        key_file = KEYS_DIR / name
+        key_file.write_bytes(nonce + ciphertext)
+        logger.info(f"密钥已存储: {name}")
+
+    def get(self, name: str, master_password: str) -> str:
+        """读取一个解密后的密钥"""
+        if self.is_locked:
+            self.unlock(master_password)
+
+        key_file = KEYS_DIR / name
+        if not key_file.exists():
+            raise KeyNotFoundError(f"密钥不存在: {name}")
+
+        data = key_file.read_bytes()
+        nonce = data[:NONCE_BYTES]
+        ciphertext = data[NONCE_BYTES:]
+
+        aesgcm = AESGCM(self._key)
+        plaintext = aesgcm.decrypt(nonce, ciphertext, None)
+        return plaintext.decode("utf-8")
+
+    def list(self) -> list[str]:
+        """列出所有密钥名称（不需要解锁）"""
+        if not KEYS_DIR.exists():
+            return []
+        return sorted(f.name for f in KEYS_DIR.iterdir() if f.is_file())
+
+    def delete(self, name: str, master_password: str):
+        """删除一个密钥"""
+        if self.is_locked:
+            self.unlock(master_password)
+
+        key_file = KEYS_DIR / name
+        if not key_file.exists():
+            raise KeyNotFoundError(f"密钥不存在: {name}")
+        key_file.unlink()
+        logger.info(f"密钥已删除: {name}")
+
+    def exists(self, name: str) -> bool:
+        """检查密钥是否存在"""
+        return (KEYS_DIR / name).exists()
+
+
+# ── 全局实例 ────────────────────────────────────────────
+
+vault = Vault()

devmate-1.0.0.dist-info/METADATA

@@ -0,0 +1,116 @@
+Metadata-Version: 2.4
+Name: devmate
+Version: 1.0.0
+Summary: 程序员终端瑞士军刀——替代 5 个独立工具，一个 CLI 搞定
+Author-email: DevMate Team <devmate@example.com>
+License: MIT
+Keywords: cli,developer-tools,terminal,productivity
+Classifier: Development Status :: 3 - Alpha
+Classifier: Environment :: Console
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Topic :: Software Development
+Classifier: Topic :: Utilities
+Requires-Python: >=3.11
+Description-Content-Type: text/markdown
+Requires-Dist: click>=8.1
+Requires-Dist: rich>=13.0
+Requires-Dist: pydantic>=2.0
+Requires-Dist: pydantic-settings>=2.0
+Requires-Dist: pyyaml>=6.0
+Requires-Dist: sqlalchemy>=2.0
+Requires-Dist: alembic>=1.13
+Requires-Dist: cryptography>=42.0
+Requires-Dist: httpx>=0.27
+Provides-Extra: web
+Requires-Dist: fastapi>=0.110; extra == "web"
+Requires-Dist: uvicorn[standard]>=0.29; extra == "web"
+Requires-Dist: jinja2>=3.1; extra == "web"
+Requires-Dist: python-multipart>=0.0.9; extra == "web"
+Requires-Dist: python-jose[cryptography]>=3.3; extra == "web"
+Requires-Dist: passlib[bcrypt]>=1.7; extra == "web"
+Provides-Extra: tui
+Requires-Dist: textual>=1.0; extra == "tui"
+Provides-Extra: ai
+Requires-Dist: chromadb>=0.5; extra == "ai"
+Requires-Dist: tiktoken>=0.7; extra == "ai"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pytest-asyncio>=0.23; extra == "dev"
+Requires-Dist: pytest-cov>=5.0; extra == "dev"
+Requires-Dist: ruff>=0.5; extra == "dev"
+Requires-Dist: mypy>=1.10; extra == "dev"
+Provides-Extra: all
+Requires-Dist: devmate[web]; extra == "all"
+Requires-Dist: devmate[tui]; extra == "all"
+Requires-Dist: devmate[ai]; extra == "all"
+Requires-Dist: devmate[dev]; extra == "all"
+
+# 🏗️ DevMate
+
+> **程序员终端瑞士军刀——替代 5 个独立工具，一个 CLI 搞定**
+
+DevMate 是一个 CLI + TUI + Web 三模架构的程序员全能工坊。装一个 devmate，少装 Postman + TablePlus + htop + 正则工具 + 文件管理器。
+
+## 快速开始
+
+```bash
+# 安装
+pip install devmate
+
+# 首次运行（交互式引导）
+devmate
+
+# 试试这些命令
+devmate tk organize ~/Downloads --dry-run     # 整理文件（预览模式）
+devmate db connect sqlite:///test.db          # 连接数据库
+devmate api get https://httpbin.org/get       # 发送 HTTP 请求
+devmate ai add default --provider openai      # 配置 AI 模型
+```
+
+## 已实现模块（Phase 1）
+
+| 模块 | CLI 入口 | 功能 | 状态 |
+|------|---------|------|------|
+| **toolkit** | `devmate tk` | 文件整理、目录大小排行、缓存清理 | ✅ |
+| **apidev** | `devmate api` | HTTP 客户端、Mock Server、请求历史 | ✅ |
+| **dbadmin** | `devmate db` | SQL 编辑器、表浏览器、保存的查询 | ✅ |
+| **apihub** | `devmate ai` | AI 模型统一接入、对话、历史记录 | ✅ |
+| vault | `devmate vault` | 加密密钥管理器 | ✅ |
+| audit | `devmate audit` | 审计日志 | ✅ |
+
+## 安装方式
+
+```bash
+# 最小安装（CLI 核心）
+pip install devmate
+
+# 开发安装（含测试 + 代码检查工具）
+pip install "devmate[dev]"
+
+# 完整安装
+pip install "devmate[all]"
+```
+
+## 项目状态
+
+**v0.1.0-alpha** — Phase 1 完成，4 个 MVP 模块可用。
+
+## 开发
+
+```bash
+git clone https://github.com/CXuanPro/DevMate.git
+cd DevMate
+python -m venv .venv && source .venv/bin/activate
+pip install -e ".[dev]"
+
+# 验证
+devmate --help
+
+# 运行测试
+pytest
+
+# 代码检查
+ruff check src/ tests/
+```

devmate-1.0.0.dist-info/RECORD

@@ -0,0 +1,37 @@
+devmate/__init__.py,sha256=0w2oV2j16BKZhV6VaJqeXdOSXmu2z0sClMhX-NAvbkQ,193
+devmate/__main__.py,sha256=BM2m4-Qx1fDJ7671ZixHiPMeTP_TtR35rvT7rTsSPEU,103
+devmate/app/__init__.py,sha256=zueaNl5oUUM6cKVSMS5bHN5lJi-1ovnQmEQCxadF7Cg,57
+devmate/app/cli.py,sha256=YGuxc_M1XsXt-Wl7J_bl7llsOnw-YZWhzXgjMUPvdbs,60273
+devmate/app/tui.py,sha256=jyiVFVPv527_l-HCfzbS0_5-X9lKdYEF-eFPmMs5o6A,8589
+devmate/app/web/__init__.py,sha256=X-IiyGpgNLBgD91KMgQiLB43op1XR3F6T7jMjBvscWg,3755
+devmate/bus/__init__.py,sha256=0PwmZK-CMsADH_t3M4AFUdk8v7C29dHd6s657rRuTVY,65
+devmate/bus/bus.py,sha256=OQOgkKjZwXPaO_Z95qNbptZ96_44e0uklbpoCNB1dDw,5279
+devmate/bus/command.py,sha256=L-AtXmFFO4m0CEw7pcRUV_-QwFNVISv8tMnHQ-SZYtQ,2444
+devmate/core/__init__.py,sha256=JwY0ZX6F4qt6kTW0qjlPEqtdgVhANMMvmHJ3Nzrwl2o,56
+devmate/core/config.py,sha256=NQpxnqXjJZ3YOzyhzxSfazZD_TNOvYiDD5rwDql66o4,3847
+devmate/core/logging.py,sha256=ImxNsPhTwAjqd9FPckYhlkrsLKMNwHL2kuj2aOuHFpk,1811
+devmate/core/security.py,sha256=-5a6l7MRnA5lv18fCjMgFOdkeMTBZiEJhehBZ4aUtjc,1960
+devmate/events/__init__.py,sha256=Mj86hZaW4-_9tFf7zM1Q7GPuxyPmJQoPE3PJ5fFN6rg,47
+devmate/events/bus.py,sha256=ZqUggP2JfcdFK3Ol0KjDB0xR5nP8Yz_hO3KzLwRWC3c,3516
+devmate/events/domain_event.py,sha256=YBA6805DPuFcLEGWwGLrvHWO1X70mmV4sJd9Tq-q0RM,1356
+devmate/module/__init__.py,sha256=xDsOkChb4D1A_nv9kbhJiRXSxnGpbj8pnQ3TesbKGH8,50
+devmate/module/registry.py,sha256=Z-mhSKvCkNCiIE8Uh9PVR-ZvbD_GdtCC_gvEN9ORa4g,2157
+devmate/security/audit.py,sha256=WDgL-PlHx06YxSRCRQgecy7AHY45xHMhQ18q6-nrz4k,3203
+devmate/security/vault.py,sha256=qsJV325H-1fGZHfyvk971sNELQFCAIIXXtqAglb0LoU,7420
+devmate_agent/__init__.py,sha256=e6I93HLmdvk9Cs0cZJagECV9iusBvUfN0wU8x_md_lI,15691
+devmate_apidev/__init__.py,sha256=2rQw0H-OcCn4-WDD10YdWCJkkUyU427BqGpkymzh7AY,9638
+devmate_apihub/__init__.py,sha256=tbZ466vIC1zC4bHIzrAE1AS9jn2R3srFcPvW4a0j43E,10593
+devmate_dbadmin/__init__.py,sha256=3TDtyywPdAD9gjI-lC_5Iz3x5ouGoobYTcku42OvcgI,9304
+devmate_gitflow/__init__.py,sha256=HhB-Pz0TqTtMEt248D-_GvZAHXDNp4wOE0cIXc6IjQ0,8536
+devmate_monitor/__init__.py,sha256=yLPVbnhUCt8xok__H9MhtHWFXvkvYx57-6jjC7_70IM,3518
+devmate_notekeeper/__init__.py,sha256=-nlLZhWYB3U2Bne-5onqjw86Tta5lc-5UWz5OUFAw-E,9286
+devmate_regexlab/__init__.py,sha256=HcjSs5nSNQcjtnzvUoHfn1jmZva_6ZoLO0mIV8hWcEg,7150
+devmate_reporter/__init__.py,sha256=Zz2wXXldIiVex6G5fp6wE69VUKMYPl69TwYd3zu5f3g,5686
+devmate_scaffold/__init__.py,sha256=mQqGjzgvREaOzdQXnfyLO0ETOt1A-dyx6KkzQNv8NVM,6381
+devmate_sshman/__init__.py,sha256=hJW9oKLKgBregY2-Str0hdNY9rVznHGVUuD-U5o6NIM,11258
+devmate_toolkit/__init__.py,sha256=e_IxW6klFfRLR4bIIElThdzyQ-kr-OEjkRwVWardGxA,7826
+devmate-1.0.0.dist-info/METADATA,sha256=B_p93mUDOHnUyc7IHKD8te32n0dWkYW7QzjHqpxrdZw,3582
+devmate-1.0.0.dist-info/WHEEL,sha256=K260EYznzXsJYBQGqmI8VTxEdiZYNvDZwW9cBh9-_MA,91
+devmate-1.0.0.dist-info/entry_points.txt,sha256=V1_cyikZm292vEc6la7MgTkDISy1E5uhuIIkRwhs9mE,434
+devmate-1.0.0.dist-info/top_level.txt,sha256=w2celaaxGYQXf2XQPLOyw5TBBKSZgCBU6_KuLYdeMzI,201
+devmate-1.0.0.dist-info/RECORD,,

devmate-1.0.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (83.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

devmate-1.0.0.dist-info/entry_points.txt

@@ -0,0 +1,18 @@
+[console_scripts]
+devmate = devmate.app.cli:main
+
+[devmate.modules]
+agent = devmate_agent
+apidev = devmate_apidev
+apihub = devmate_apihub
+dbadmin = devmate_dbadmin
+gitflow = devmate_gitflow
+monitor = devmate_monitor
+notekeeper = devmate_notekeeper
+publisher = devmate_publisher
+regexlab = devmate_regexlab
+reporter = devmate_reporter
+scaffold = devmate_scaffold
+sshman = devmate_sshman
+toolkit = devmate_toolkit
+vault = devmate_vault

devmate-1.0.0.dist-info/top_level.txt

@@ -0,0 +1,13 @@
+devmate
+devmate_agent
+devmate_apidev
+devmate_apihub
+devmate_dbadmin
+devmate_gitflow
+devmate_monitor
+devmate_notekeeper
+devmate_regexlab
+devmate_reporter
+devmate_scaffold
+devmate_sshman
+devmate_toolkit