CommandCenter

Overview

CommandCenter is a secure dev scripts clipboard app built on Electron. It lives in staging/ and functions as a snippet store for developer workflows. Its defining feature is at-rest encryption of stored snippets using Node.js built-in cryptography — zero third-party crypto dependencies.

See also: 3-scanner-security-architecture, cryptographic-key-exchange

Tech Stack

Component	Technology
Language	JavaScript
Framework	Electron
Testing	node:test
CI/CD	GitHub Actions (security.yml)
Zone	staging/

Architecture and Key Decisions

Snippet Store Encryption

Decision: scrypt key derivation + AES-256-GCM encryption via Node.js built-in crypto module. No new dependencies introduced.

Key parameters:

• scrypt: N=16384, r=8, p=1 (OWASP minimum for interactive use)
• 32-byte random salt per encrypt call — no salt reuse across saves
• 12-byte IV (GCM standard) — random per call
• Auth tag stored in envelope — GCM integrity check rejects wrong passphrase
• Passphrase held in vaultPassphrase (in-memory only, never written to disk)

File envelope format v1: { version, salt, iv, tag, ciphertext } — all hex-encoded. Version field present for future algorithm migration without breaking existing stores.

Migration Strategy

isEncrypted() check on load enables zero-migration-script upgrades: plaintext snippet files display correctly and get encrypted on next save. No forced migration step.

Renderer Security

The passphrase overlay is built with DOM APIs (createElement/textContent), not innerHTML, to eliminate XSS injection surface and satisfy the pre-commit security hook.

Compliance

Phase 2 ops-core compliance deployed 2026-03-13:

• Security CI: TruffleHog + Trivy + Semgrep in calibration mode (through 2026-04-13)
• SECURITY.md, PR template, CODEOWNERS in place
• Calibration mode establishes baseline before switching to enforcing

Current Status

Zone: staging/ (evaluation) Updated: 2026-03-13

Completed:

• src/main/crypto.js — scrypt key derivation + AES-256-GCM encrypt/decrypt
• Vault IPC handlers: vault:unlock, vault:lock, vault:status
• Passphrase prompt overlay on startup
• Lock Vault button in view actions
• Migration-safe load: plaintext snippets readable, encrypted on next save
• 13/13 smoke tests passing (6 new crypto tests added)

Known gaps:

• Test coverage below 60% target (remediation planned)
• General CI/CD lint+test pipeline pending (security.yml deployed; general CI next)

Lessons Learned

• All new staging repos start in calibration mode. Establish a security baseline before switching CI to enforcing mode — this avoids false-positive blocks on legitimate code.
• Zero-dependency crypto is viable. Node.js built-in crypto covers scrypt + AES-256-GCM without pulling in external packages. The envelope format’s version field future-proofs algorithm migrations.
• DOM API over innerHTML for security overlays. When building passphrase prompts in Electron renderer processes, use createElement/textContent to satisfy XSS hooks and avoid injection surfaces.