dguiducci
178a38357e
Two changes developed together in one session; they share the same module
structure (db/mod.rs, the core lib root) and only compile together, so they
land as one commit.
## UserManager + per-user encryption (§9/§11)
New `users::UserManager`: owns the system.db pool plus a map
`userid -> SqlitePool` of unlocked databases. The pool *is* the unlock token —
its connect options carry the DEK as SQLCipher's raw key, so an open pool means
the key is in RAM until restart and dropping it re-locks (§9). Knows nothing
about cookies.
New `crypto` module: envelope encryption. A random 256-bit DEK encrypts
`{userid}.db`; `users.database_password` holds it sealed with AES-256-GCM under
`Argon2id(password, salt)`. The AEAD tag is the password verifier — one
derivation both authenticates and yields the key, so encrypted users store no
second hash. Cleartext users store the Argon2id output directly, compared in
constant time. Argon2 runs in spawn_blocking behind a 2-permit semaphore
(256 MiB per derivation).
- SQLCipher via `libsqlite3-sys` `bundled-sqlcipher-vendored-openssl`, pinned
<0.38 so it unifies with the one sqlx-sqlite links (a newer copy would apply
the feature to a SQLite sqlx never uses). OpenSSL is vendored and static, so
the binary stays self-contained.
- Schema split into `create_registry_tables` (instance-wide, no user key) and
`create_owner_tables` (one owner's content, identical in every file). No FK in
the owner bucket may reach the registry — enforced by a standalone test.
Dropped `chat_history.model_db_id` (write-only, and the only registry-crossing
key); moved `projects`/`project_tickets` into the owner bucket.
- Provisioning invariant: the file is written before the row, deleted after it,
so a crash leaves an orphan file, never a user without a database. `open_db`
never creates: a missing file is an error, not a silent empty database.
Not consumed yet: no login, call sites still use the shared system.db pool.
## Extract crates/skald-core
The headless core moves out of `src/` into its own crate; `skald` (server) and
the coming `skald-setup` are shells around it. Two dependencies on the shell
were inverted rather than dragged along, so the core names neither Tauri nor any
concrete plugin:
- `Plugin::tools(self: Arc<Self>)` — plugins contribute tools through this hook
(sibling of `http_router`), so the core no longer downcasts to
`MobileConnectorPlugin`.
- `tools::restart::set_restart_handler` — the desktop shell installs its
teardown-and-respawn; the core defaults to the supervisor exit code. The core
loses its `desktop` feature.
- `boot`'s stdout formatter moves to the binary (`src/boot_format.rs`); the core
only emits tracing events.
All 79 core tests pass; the binary boots and serves in a clean directory, and
the mobile-connector tools still register through the new hook.
83 lines
3.5 KiB
TOML
83 lines
3.5 KiB
TOML
[package]
|
|
name = "skald-core"
|
|
version = "0.1.0"
|
|
edition = "2024"
|
|
|
|
# The headless application core: database + crypto + identity, the LLM stack,
|
|
# tools, MCP, plugins-as-a-registry, sessions.
|
|
#
|
|
# Deliberately knows nothing about the process shell around it. No Tauri, no
|
|
# concrete plugin crates (it only ever sees `Arc<dyn Plugin>` from `core-api`),
|
|
# no `axum` server — `skald` and `skald-setup` are both consumers.
|
|
|
|
[dependencies]
|
|
axum = { version = "0.8", features = ["ws", "multipart"] }
|
|
tokio = { version = "1.52.3", features = ["full"] }
|
|
tokio-util = { version = "0.7", features = ["rt"] }
|
|
futures = "0.3"
|
|
serde = { version = "1", features = ["derive"] }
|
|
anyhow = "1"
|
|
sqlx = { version = "0.9.0", features = ["runtime-tokio", "sqlite"] }
|
|
# Per-user database encryption. `sqlx-sqlite` already builds `libsqlite3-sys`;
|
|
# naming it here only adds a feature, and Cargo's feature unification turns the
|
|
# one SQLite the process links into SQLCipher. A database opened without
|
|
# `PRAGMA key` still behaves as plain SQLite, so `system.db` is unaffected.
|
|
# `-vendored-openssl` compiles libcrypto from source instead of linking the
|
|
# system one, so the binary stays self-contained (see b08a13c). It costs a C
|
|
# build (perl + make) — the trade the blueprint §4 accepts explicitly.
|
|
#
|
|
# Pinned below 0.38 on purpose: `sqlx-sqlite` 0.9 requires ">=0.30.1, <0.38.0".
|
|
# A newer release would resolve to a *second* copy of the crate, and the
|
|
# SQLCipher feature would then apply to a SQLite that sqlx never links. 0.37.0
|
|
# is the newest version that still unifies.
|
|
libsqlite3-sys = { version = "0.37", features = ["bundled-sqlcipher-vendored-openssl"] }
|
|
# 0.6 is still a release candidate; stay on the stable line.
|
|
argon2 = "0.5"
|
|
# Held at 0.10 to match `skald-relay-common`, so the binary links one AES-GCM
|
|
# rather than two. Bumping to 0.11 means bumping the mobile E2E code with it.
|
|
aes-gcm = "0.10"
|
|
zeroize = { version = "1", features = ["derive"] }
|
|
subtle = "2"
|
|
uuid = { version = "1", features = ["v4"] }
|
|
reqwest = { version = "0.13.4", default-features = false, features = ["rustls-no-provider", "charset", "http2", "system-proxy", "json", "multipart"] }
|
|
async-trait = "0.1"
|
|
serde_json = "1"
|
|
indexmap = { version = "2", features = ["serde"] }
|
|
tracing = "0.1"
|
|
chrono = { version = "0.4", default-features = false, features = ["clock", "std"] }
|
|
chrono-tz = "0.10"
|
|
iana-time-zone = "0.1"
|
|
os_info = "3"
|
|
cron = "0.16"
|
|
rand = "0.10.1"
|
|
syn = { version = "2", features = ["full"] }
|
|
quote = "1"
|
|
proc-macro2 = { version = "1", features = ["span-locations"] }
|
|
tree-sitter = "0.26"
|
|
tree-sitter-python = "0.25"
|
|
tree-sitter-javascript = "0.25"
|
|
tree-sitter-typescript = "0.23"
|
|
tree-sitter-go = "0.25"
|
|
tree-sitter-java = "0.23"
|
|
tree-sitter-c = "0.24"
|
|
tree-sitter-cpp = "0.23"
|
|
tree-sitter-swift = "0.7"
|
|
tree-sitter-lua = "0.5"
|
|
tree-sitter-ruby = "0.23"
|
|
tree-sitter-bash = "0.25"
|
|
tree-sitter-elixir = "0.3"
|
|
tree-sitter-json = "0.24"
|
|
tree-sitter-yaml = "0.7"
|
|
tree-sitter-html = "0.23"
|
|
tree-sitter-css = "0.25"
|
|
regex = "1"
|
|
glob = "0.3"
|
|
libc = "0.2"
|
|
base64 = "0.22"
|
|
sha2 = "0.10"
|
|
notify = "8"
|
|
honcho-client = { path = "../honcho-client" }
|
|
llm-client = { path = "../llm-client" }
|
|
core-api = { path = "../core-api" }
|
|
mcp-client = { path = "../mcp-client" }
|