hezo/server/ at 67f6c5a1d55e92e962a8593b7fa7077c3721cd9f · burrito.space/hezo · Tangled

burrito.space / hezo

0

group conversations with models and local files

0

hezo / server

1 folder 6 files

at 67f6c5a1d55e92e962a8593b7fa7077c3721cd9f

dietrich ayala Cross-device sync: provider keys + project state 2mo ago

Cross-device sync: provider keys + project state Walking back the "per-device only" design for both provider keys and project content. Each device still has a local IndexedDB cache; server now also carries an encrypted blob (or fans out via outbox) so opening on a second device gets you the same view. Provider keys (Anthropic, OpenAI, etc.): - schemas v3 migration: ALTER TABLE users ADD wrapped_provider_keys. - server/auth.ts: getWrappedProviderKeys / setWrappedProviderKeys. - server/index.ts: GET/PUT /api/me/keys (auth required, opaque blob). - lib/crypto.ts: deriveProviderKeysWrapKey (domain-separated HKDF from the master secret), plus reusable aesGcmEncrypt/Decrypt helpers. - lib/keystore.ts: loadKeysSynced + saveKeysSynced. Local IDB stays as the offline cache; server is authoritative when reachable. - App.tsx: useEffect pulls from server on auth, push on every save. Project state across user's own devices: - ProjectStore.getRecipients now includes self. Outbox fans out to every connection of the user's id, so the other devices subscribed to the project receive the snapshot. Sender's own connection receives back; merge is a no-op since heads match. - ProjectStore.open: if local doc has any heads, push a fresh snapshot through the outbox right after subscribe. That way a brand-new device that comes online later picks up the snapshot from the outbox queue without needing the source device to mutate again.

2 months ago

Cross-device sync: provider keys + project state Walking back the "per-device only" design for both provider keys and project content. Each device still has a local IndexedDB cache; server now also carries an encrypted blob (or fans out via outbox) so opening on a second device gets you the same view. Provider keys (Anthropic, OpenAI, etc.): - schemas v3 migration: ALTER TABLE users ADD wrapped_provider_keys. - server/auth.ts: getWrappedProviderKeys / setWrappedProviderKeys. - server/index.ts: GET/PUT /api/me/keys (auth required, opaque blob). - lib/crypto.ts: deriveProviderKeysWrapKey (domain-separated HKDF from the master secret), plus reusable aesGcmEncrypt/Decrypt helpers. - lib/keystore.ts: loadKeysSynced + saveKeysSynced. Local IDB stays as the offline cache; server is authoritative when reachable. - App.tsx: useEffect pulls from server on auth, push on every save. Project state across user's own devices: - ProjectStore.getRecipients now includes self. Outbox fans out to every connection of the user's id, so the other devices subscribed to the project receive the snapshot. Sender's own connection receives back; merge is a no-op since heads match. - ProjectStore.open: if local doc has any heads, push a fresh snapshot through the outbox right after subscribe. That way a brand-new device that comes online later picks up the snapshot from the outbox queue without needing the source device to mutate again.

2 months ago

Phase 6: deploy v2, auto-wipe v1 data on first boot server/db.ts: on startup, detect a v1 (Centrosome-era) schema by checking for the `meta` and `users` tables without a v2-only `webauthn_credentials` table. When found, drop all tables and reapply the v2 migration. Also remove the legacy `projects/` directory of per-project SQLite files + blob dirs that v2 doesn't read. Without this, Railway's mounted /data volume would still hold the v1 schema_version=1 and the v2 migrations would skip themselves on the assumption that v1's schema = v2's v1. The detection is idempotent — once v2 has bootstrapped (webauthn_credentials exists), the check is a no-op on future boots. Deploy status: live at https://hezo.app. HEZO_RP_ID=hezo.app and HEZO_ORIGIN=https://hezo.app set on Railway so WebAuthn ceremonies work against the production origin.

2 months ago

Cross-device sync: provider keys + project state Walking back the "per-device only" design for both provider keys and project content. Each device still has a local IndexedDB cache; server now also carries an encrypted blob (or fans out via outbox) so opening on a second device gets you the same view. Provider keys (Anthropic, OpenAI, etc.): - schemas v3 migration: ALTER TABLE users ADD wrapped_provider_keys. - server/auth.ts: getWrappedProviderKeys / setWrappedProviderKeys. - server/index.ts: GET/PUT /api/me/keys (auth required, opaque blob). - lib/crypto.ts: deriveProviderKeysWrapKey (domain-separated HKDF from the master secret), plus reusable aesGcmEncrypt/Decrypt helpers. - lib/keystore.ts: loadKeysSynced + saveKeysSynced. Local IDB stays as the offline cache; server is authoritative when reachable. - App.tsx: useEffect pulls from server on auth, push on every save. Project state across user's own devices: - ProjectStore.getRecipients now includes self. Outbox fans out to every connection of the user's id, so the other devices subscribed to the project receive the snapshot. Sender's own connection receives back; merge is a no-op since heads match. - ProjectStore.open: if local doc has any heads, push a fresh snapshot through the outbox right after subscribe. That way a brand-new device that comes online later picks up the snapshot from the outbox queue without needing the source device to mutate again.

2 months ago

Phase 1: server slim-down for v2 Wholesale server rewrite per NEXT-PLAN.md. The server is now identity + signaling + ephemeral outbox; it holds no chat content. - New v2 schema (server/schemas/index.ts): users (with identity_pub), webauthn_credentials, webauthn_challenges, sessions, projects, project_members (with wrapped_project_key BLOB), invites, outbox. v1 schema entirely dropped; no migration from v1 — wipe + re-seed. - server/db.ts: single global SQLite, no per-project DBs, no LRU pool. Periodic TTL sweep on outbox + webauthn_challenges. - server/auth.ts: WebAuthn register + authenticate ceremonies via @simplewebauthn/server. PRF extension input passed as base64url for the browser to decode. First-ever signup is founder; subsequent requires invite token. - server/outbox.ts: stage / pendingFor / ack. Opaque ciphertext rows per (recipient_user_id, project_id). - server/projects.ts: project + member CRUD, accepts wrapped_project_key from owner / invitee. - server/ws.ts: outbox WS gateway. Subscribe → flush pending. Send → fanout via outbox.stage to each recipient, live-deliver to subscribed peers. Ack → delete. - server/index.ts: slim Fastify entry wiring the new routes. - server/snapshot.ts: deleted (was for per-project SQLite snapshots). - src/shared/schema.ts: slimmed to v2 types only — Identity, ProjectMeta, Member, OutboxEntry, WsClientEvent, WsServerEvent. Conversation/Turn/ ProjectFile move to the client CRDT layer (later phases). Frontend is intentionally broken after this commit (it still imports Conversation/Turn/etc. from the shared schema). Phase 2+ will rewire the browser side. Server typecheck + boot + /health + /api/auth/ register/begin all verified.

2 months ago

Phase 1: server slim-down for v2 Wholesale server rewrite per NEXT-PLAN.md. The server is now identity + signaling + ephemeral outbox; it holds no chat content. - New v2 schema (server/schemas/index.ts): users (with identity_pub), webauthn_credentials, webauthn_challenges, sessions, projects, project_members (with wrapped_project_key BLOB), invites, outbox. v1 schema entirely dropped; no migration from v1 — wipe + re-seed. - server/db.ts: single global SQLite, no per-project DBs, no LRU pool. Periodic TTL sweep on outbox + webauthn_challenges. - server/auth.ts: WebAuthn register + authenticate ceremonies via @simplewebauthn/server. PRF extension input passed as base64url for the browser to decode. First-ever signup is founder; subsequent requires invite token. - server/outbox.ts: stage / pendingFor / ack. Opaque ciphertext rows per (recipient_user_id, project_id). - server/projects.ts: project + member CRUD, accepts wrapped_project_key from owner / invitee. - server/ws.ts: outbox WS gateway. Subscribe → flush pending. Send → fanout via outbox.stage to each recipient, live-deliver to subscribed peers. Ack → delete. - server/index.ts: slim Fastify entry wiring the new routes. - server/snapshot.ts: deleted (was for per-project SQLite snapshots). - src/shared/schema.ts: slimmed to v2 types only — Identity, ProjectMeta, Member, OutboxEntry, WsClientEvent, WsServerEvent. Conversation/Turn/ ProjectFile move to the client CRDT layer (later phases). Frontend is intentionally broken after this commit (it still imports Conversation/Turn/etc. from the shared schema). Phase 2+ will rewire the browser side. Server typecheck + boot + /health + /api/auth/ register/begin all verified.

2 months ago

Phase 1: server slim-down for v2 Wholesale server rewrite per NEXT-PLAN.md. The server is now identity + signaling + ephemeral outbox; it holds no chat content. - New v2 schema (server/schemas/index.ts): users (with identity_pub), webauthn_credentials, webauthn_challenges, sessions, projects, project_members (with wrapped_project_key BLOB), invites, outbox. v1 schema entirely dropped; no migration from v1 — wipe + re-seed. - server/db.ts: single global SQLite, no per-project DBs, no LRU pool. Periodic TTL sweep on outbox + webauthn_challenges. - server/auth.ts: WebAuthn register + authenticate ceremonies via @simplewebauthn/server. PRF extension input passed as base64url for the browser to decode. First-ever signup is founder; subsequent requires invite token. - server/outbox.ts: stage / pendingFor / ack. Opaque ciphertext rows per (recipient_user_id, project_id). - server/projects.ts: project + member CRUD, accepts wrapped_project_key from owner / invitee. - server/ws.ts: outbox WS gateway. Subscribe → flush pending. Send → fanout via outbox.stage to each recipient, live-deliver to subscribed peers. Ack → delete. - server/index.ts: slim Fastify entry wiring the new routes. - server/snapshot.ts: deleted (was for per-project SQLite snapshots). - src/shared/schema.ts: slimmed to v2 types only — Identity, ProjectMeta, Member, OutboxEntry, WsClientEvent, WsServerEvent. Conversation/Turn/ ProjectFile move to the client CRDT layer (later phases). Frontend is intentionally broken after this commit (it still imports Conversation/Turn/etc. from the shared schema). Phase 2+ will rewire the browser side. Server typecheck + boot + /health + /api/auth/ register/begin all verified.

2 months ago