keisei/KeiSeiKit-1.0
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
KeiSeiKit-1.0/_primitives
History
Parfii-bot 4435564d3d feat(kei-buddy): provision_decrypt — VPS-side blob decryption 
Mirrors keisei-marketplace/src/lib/crypto-box.ts::sealBoxToVps.

Two new subcommands on kei-buddy bin:
  - genkeys --key <path>          → writes PKCS#8 PEM x25519 priv,
                                    prints standard-base64 pub (44 char)
  - decrypt-and-export --vps-key <pem> --blob <json> --env-out <env>
                                  → ECDH(vps_priv, ephPub) → HKDF-SHA256
                                    info=keibuddy-token-v1 → XChaCha20-Poly1305
                                    decrypt → append BOT_TOKEN/TELEGRAM_BOT_TOKEN
                                    to env file (replaces stale, keeps other lines)

Cloud-init in hetzner.ts already calls these. Without this commit the
VPS could decode its own pubkey but had no way to recover the sealed
bot-token blob — the bot would never log into Telegram.

Crypto stack (mirror of @noble in TS):
  - x25519-dalek 2 (static_secrets feature)
  - chacha20poly1305 0.10 (XChaCha20Poly1305)
  - hkdf 0.12, sha2 0.10
  - base64 0.22 (accepts URL_SAFE_NO_PAD + STANDARD)
  - zeroize 1 for priv-key wipe

Tests (6/6 pass):
  - roundtrip_seal_then_decrypt — re-implement marketplace sealing in Rust,
    verify our decryption recovers plaintext
  - decrypt_and_export_writes_env_file — full e2e through CLI surface
  - decrypt_and_export_replaces_existing_token — stale BOT_TOKEN replaced,
    other env lines preserved
  - decrypt_rejects_wrong_key — XChaCha20 AEAD tag fails on wrong key
  - pem_roundtrip — write_pkcs8 + parse_pkcs8 round-trip
  - b64decode_accepts_urlsafe_and_standard — handles both encodings

Cross-verified end-to-end:
  $ node marketplace_seal.mjs <pub> <token>  →  /tmp/blob.json
  $ kei-buddy decrypt-and-export --vps-key ... → BOT_TOKEN matches input

Constructor Pattern: 1 file (provision_decrypt.rs, 344 LOC), 1 module,
1 responsibility (token-blob decryption + key generation).

=== STATUS-TRUTH MARKER ===
shipped: functional
stubs: 0
cargo-check: PASS
behaviour-verified: yes (e2e marketplace-seal → kei-buddy-decrypt round-trip)
follow-up-required:
  - none
2026-05-15 17:49:59 +08:00
..
_rust feat(kei-buddy): provision_decrypt — VPS-side blob decryption 2026-05-15 17:49:59 +08:00
templates fix(kei-conflict-scan): close 3 backlog bugs + Phase C draft emission 2026-05-12 18:30:01 +08:00
design-scrape.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
figma-tokens.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
frontend-inspect.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
harden-base.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-ci-lint.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-docs-scaffold.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-doctor.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-sleep-queue.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-sleep-setup.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
kei-sleep-sync.sh feat(sleep-sync): mirror time-metrics + ledger snapshots, surface in Phase B report 2026-05-02 04:02:28 +08:00
live-preview.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
log-ship.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
MANIFEST.toml feat(install): add profile=buddy for marketplace 1-click bot provisioning 2026-05-13 10:29:40 +08:00
metrics-scrape.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
provision-hetzner.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
provision-vultr.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
README.md KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
screenshot-decode.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00
tomd.sh KeiSeiKit-public — clean state 2026-05-01 12:09:03 +08:00

README.md

_primitives — first-class building blocks

_primitives/ holds standalone utilities that agents, hooks, and skills (including /compose-solution) depend on. Unlike _blocks/ (behavioral markdown) or _manifests/ (agent TOML), primitives are executable shell programs installed at $HOME/.claude/agents/_primitives/ by install.sh.

Current primitives

Primitive Purpose Invocation
tomd.sh Universal non-native-format → markdown converter (PDF, DOCX, XLSX, PPTX, CSV, images, code). ~/.claude/agents/_primitives/tomd.sh <file>

tomd.sh is a first-class primitive. Universal non-native-format → markdown converter with configurable cache directory (KEISEI_TOMD_CACHE) and KeiSeiKit-style error tags ([tomd]).

Hook integration

hooks/tomd-preread.sh is a PreToolUse(Read) hook that auto-redirects Claude to the converted markdown when a Read targets .docx / .doc / .xlsx / .pptx / .csv. Cached under $KEISEI_TOMD_CACHE (default /tmp/keisei-tomd-cache).

/compose-solution discovery

Phase 3 prior-art sweep greps _primitives/ alongside _blocks/, _manifests/, skills/, _bridges/, hooks/. If a user task involves file-format parsing, the meta-composer surfaces tomd automatically — reuse over rewrite (RULE "No Patching").