Migrated from dkg-v9 issue #75
Context
Feedback item I-007 — Severity: Medium
What exists
Encrypted keystore module (packages/cli/src/keystore.ts) using AES-256-GCM with scrypt-derived passphrase — fully implemented and tested.
What remains
The original secret storage paths still write plaintext:
agent-wallet.ts:70-73 — binary master key written with mode 0o600 but no encryptionop-wallets.ts:44-46 — Ethereum private keys stored as plaintext JSONauth.ts:66-71 — bearer tokens written as plaintext
The keystore module is available but not wired into these paths.
Recommendation
Wire the existing keystore module into all secret storage paths.
Evidence
packages/agent/src/agent-wallet.ts:70-73packages/agent/src/op-wallets.ts:44-46packages/cli/src/auth.ts:66-71packages/cli/src/keystore.ts (available but unused by above)
Context
Feedback item I-007 — Severity: Medium
What exists
Encrypted keystore module (
packages/cli/src/keystore.ts) using AES-256-GCM with scrypt-derived passphrase — fully implemented and tested.What remains
The original secret storage paths still write plaintext:
agent-wallet.ts:70-73— binary master key written withmode 0o600but no encryptionop-wallets.ts:44-46— Ethereum private keys stored as plaintext JSONauth.ts:66-71— bearer tokens written as plaintextThe keystore module is available but not wired into these paths.
Recommendation
Wire the existing keystore module into all secret storage paths.
Evidence
packages/agent/src/agent-wallet.ts:70-73packages/agent/src/op-wallets.ts:44-46packages/cli/src/auth.ts:66-71packages/cli/src/keystore.ts(available but unused by above)