Search end-to-end encrypted nodes through an encrypted local index

Browse Source

- Crypto backend: use native AES-GCM from `cryptography` when importable
  (~1.5 GiB/s), falling back to the pure-Python implementation with a
  byte-identical format and identical authentication failures.
- E2E shard: decrypted E2E text is indexed in an in-memory SQLite
  database, persisted only as serialize() -> AES-256-GCM with an HKDF key
  bound to the project and memory-secret identity, authenticated header,
  fresh nonce, 0600 atomic writes. It loads only while the project is
  unlocked; tampered, foreign, wrong-key or rotated shards fail closed and
  rebuild. Search merges shard hits (search_source local_e2e) and reports
  locked/unavailable/slow states explicitly.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

...

This commit is contained in:

HumbleTurtle

2026-09-28 22:56:38 -03:00

co-authored by Claude Opus 5.5

parent bf6acaacc8

commit d86610da8e

4 changed files with 1988 additions and 86 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

resources/scripts/napseer_mcp_server.py

+1337 -84

File diff suppressed because it is too large Load Diff