feat: client-side envelope encryption of binaries, flow zips & env vars

[riglar]

Client-side envelope encryption of every sensitive input the CLI uploads — the app binary (APK/IPA), the Maestro flow zip, and the injected --env secrets — so the platform only ever stores ciphertext at rest. Opt-in and off by default: uploads are byte-for-byte unchanged unless you pass --encrypt (or set DCD_ENCRYPT=1), so this is safe to ship dormant.

Companion to the platform (API + simulator) decrypt halves, which are backward-compatible — anything without an enc marker is treated as plaintext and passes through untouched.

How it works

• Per-upload DEK — each artifact gets its own random 256-bit key. The binary and flow zip are chunked AES-256-GCM containers (streamed / constant memory, per-segment tags); the env map is a single-segment inline blob.
• KEK — one long-lived X25519 keypair per environment. The public half is pinned in this CLI; the private half lives only on the platform API and is never shipped here. Each DEK is wrapped to the public key with an X25519 sealed box.
• Where the envelope rides:
  • binary → binaries.metadata.enc = { v, kek, wrapped_key }
  • flow zip → uploads.metadata.enc (same shape; its own DEK)
  • env vars → results.env.enc = { v, kek, wrapped_key, ciphertext } (ciphertext inline)
• The sha sent to the API is the ciphertext hash for binary and flow, so dedup / caching / range logic operate on ciphertext unchanged.

Pinned public keys

src/config/environments.ts pins the dev and prod KEK public keys (version 1). These are X25519 public keys — safe to embed in a public release, like the Supabase anon keys already here. Rotation is a versioned map: a new keypair gets a new version + pinned public key; old uploads keep decrypting under their original version with no re-encryption. DCD_BINARY_KEK_PUBLIC=<version>:<base64> overrides the pin for testing.

Implementation

• src/utils/envelope.ts — encryptToContainer (in-memory DCDE twin of the streaming file encryptor), encryptFlowBuffer, encryptEnv, and a shared isEncryptionEnabled(). Byte-compatible with the platform decrypt half.
• src/services/test-submission.service.ts is the single seam for flow + env: when encrypting, the flow zip becomes ciphertext (fields.sha = ciphertext hash), the flow envelope rides fields.enc as a JSON string (so both the JSON submitFlowTest body and the legacy multipart form carry it identically), and the env map becomes an { enc } envelope. Both the cloud command and the MCP tool get this via buildTestPayload.
• --encrypt / DCD_ENCRYPT=1 now gate all three; DCD_ENCRYPT_BINARIES=1 stays as an alias.

Verification

• Round-trip tests decrypt CLI-produced ciphertext (binary, flow, env) through a mirror of the platform decrypt path — incl. a 15 MB fixture, tamper/truncation rejection, DEK wrap/unwrap, and that flow + env get distinct DEKs. Pinned keys asserted to resolve to the expected version + key.
• pnpm lint (0 errors) · pnpm build clean · unit suite green (178 passing).
• Cross-checked byte-for-byte against the platform API envelope implementation.

Rollout

Ships dormant. Enabling --encrypt for an environment requires that environment's KEK private key to be provisioned on the platform API, and the flow/env decrypt halves deployed (the platform-side flow submit must accept the flow enc field). Until then, leave the flag off; legacy plaintext uploads are unaffected.

🤖 Generated with Claude Code

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.