feat(credentials): encrypt the vault at rest

[ralyodio]

Replaces #120, which GitHub auto-closed when its base branch (fix/one-vault-xdg) was deleted on merging #119. Same commit, rebased onto master; base is master this time so nothing can strand it again.

Why

The vault holds the target's prior values so a bad rotation can be undone — the one place raw credentials touch disk. It was written as plain JSON:

{ "STRIPE_LIVE_KEY": "sk_live_…", "DATABASE_URL": "postgres://user:pass@…" }

…protected by nothing but mode 0600. A permission bit stops another user on the same box. It does nothing about a backup, a synced home directory, a lifted disk, or any process running as the owner — which are the cases where a credential store is worth reading.

What

Each run is sealed to this machine's identity:

• fresh DEK per write, payload sealed with it
• DEK sealed to the identity public key (crypto_box_seal)
• opens with the secret key in identity.json and nothing else

{ "version": 2, "wrappedKey": "…", "sealed": { "nonce": "…", "ciphertext": "…" } }

Key names are inside the ciphertext too. Knowing an endpoint holds STRIPE_LIVE_KEY is worth something on its own, so the whole bag is sealed, not just the values.

A DEK per run, not one per store. Reusing a key would make a single compromise open every rollback ever captured, and there is nothing to gain — the wrapped DEK travels in the file.

Compatibility

• Plaintext vaults still open. Refusing them would strand the rollback data they exist to hold. version: 2 distinguishes them.
• The store's vault methods become async. All three callers were already inside async functions in engine.ts, so this is three awaits.
• A missing identity gives a real error — "restore <path> to roll this run back" — rather than a decode failure out of libsodium.

The tradeoff, stated plainly

The vault is now only as recoverable as identity.json. Lose that file and old rollback data is unreadable. That is the point — it is what makes a copied file useless — but it makes the identity key load-bearing for rollback, not just for team vault access.

Tests

src/vault-encryption.test.ts, 7 tests. Against the pre-encryption tree, 3 fail — including the one that matters, "does not write the secret to disk in the clear". The other 4 are guards that must hold either way (round-trip, 0600, legacy plaintext, missing-vault).

plugin-credential-sharing 52 pass · cli 44 pass · npm run build:cli clean, all re-run on this rebase.

🤖 Generated with Claude Code

[github-actions]

vu1nz Security Review

0 finding(s) in PR #?

No security issues found.