Function getDeviceSalt

browse/src/security.ts:337–360

()

let cachedSalt: string | null = null;

function getDeviceSalt(): string {
  if (cachedSalt) return cachedSalt;
  try {
    if (fs.existsSync(SALT_FILE)) {
      cachedSalt = fs.readFileSync(SALT_FILE, 'utf8').trim();
      return cachedSalt;
    }
  } catch {
    // fall through to generate
  }
  try {
    mkdirSecure(SECURITY_DIR);
  } catch {}
  cachedSalt = randomBytes(16).toString('hex');
  try {
    writeSecureFile(SALT_FILE, cachedSalt);
  } catch {
    // Can't persist (read-only fs, disk full). Keep the in-memory salt
    // for this process so cross-log correlation still works within a
    // session. Next process gets a new salt, but that's a degraded-mode
    // acceptable cost.
  }
  return cachedSalt;
}

export function hashPayload(payload: string): string {
  const salt = getDeviceSalt();