Skip to content

chore(memory): bump yaad for at-rest encryption, wire opt-in key env #198

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Patel230 merged 1 commit into from
Aug 15, 2026
+29 −10
Merged

chore(memory): bump yaad for at-rest encryption, wire opt-in key env #198

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion external/yaad
Open in desktop
Submodule yaad updated 14 files
+3 −2 cmd/yaad-tui/go.mod
+8 −6 cmd/yaad-tui/go.sum
+3 −2 go.mod
+8 −6 go.sum
+5 −4 plans/PHASE1-SQLITE-HARDENING.md
+223 −0 storage/crypto.go
+466 −0 storage/crypto_test.go
+5 −0 storage/errors.go
+94 −0 storage/node_crypto.go
+1 −1 storage/prefix.go
+39 −5 storage/sqlite.go
+3 −3 storage/sqlite_edges.go
+122 −33 storage/sqlite_nodes.go
+29 −13 storage/sqlite_tx.go
6 changes: 3 additions & 3 deletions go.mod
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

12 changes: 6 additions & 6 deletions go.sum
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

19 changes: 19 additions & 0 deletions internal/intelligence/memory/yaad_bridge.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,13 @@ func NewYaadBridge() *YaadBridge {
return b
}

// yaadEncryptionKeyEnv names the environment variable supplying the
// at-rest encryption key for the yaad memory database. It is opt-in:
// without it, node content is stored in plaintext (the historical
// behaviour). Set it consistently on every process that opens the same
// database — content sealed without the key becomes unreadable.
const yaadEncryptionKeyEnv = "YAAD_ENCRYPTION_KEY"

func (b *YaadBridge) init() {
home, err := os.UserHomeDir()
if err != nil {
Expand All @@ -85,6 +92,18 @@ func (b *YaadBridge) init() {
return
}

// Opt-in at-rest encryption (PR yaad#59): when the key variable is set,
// node content is sealed with AES-256-GCM before writing. An invalid key
// disables the bridge entirely rather than silently storing plaintext
// the user did not ask for.
if v := strings.TrimSpace(os.Getenv(yaadEncryptionKeyEnv)); v != "" {
if err := store.EnableEncryption(storage.NewEnvKeyProvider(yaadEncryptionKeyEnv)); err != nil {
_ = store.Close()
slog.Warn("[hawk/memory] yaad encryption key invalid; memory disabled", "error", err)
return
}
}

g := yaadGraph.New(store, store.DB())
eng := yaadEngine.New(store, g)

Expand Down
Loading