[WIP] Sqlcipher encryption

[kenforthewin]

No description provided.

[greptile-apps]

Greptile Summary

This PR introduces SQLCipher AES-256 at-rest encryption for atomic's SQLite backend (registry and all knowledge-base databases). The key architectural change is a deferred-initialization mode for DatabaseManager: when the server starts and detects an encrypted database but has no passphrase, it enters a locked state and serves a new /api/setup/unlock endpoint instead of crashing. Once the correct passphrase is provided through the web UI, the manager is fully initialized and normal operation resumes. The frontend gains an UnlockScreen component, passphrase entry during first-time setup, and a pre-connect check that routes returning users to the unlock flow automatically.

Key changes:

• bundled → bundled-sqlcipher in atomic-core/Cargo.toml; apply_connection_pragmas() helper ensures PRAGMA key is the very first statement on every new connection across write, read-pool, temp, and new_connection paths.
• DatabaseManager::registry changed from Arc<Registry> to RwLock<Option<Arc<Registry>>>, with initialize() holding the write lock for the full check-and-set to prevent the previously-flagged TOCTOU race.
• DatabaseManager::registry() now returns Result instead of &Arc, and middleware/routes guard with is_initialized() returning HTTP 503 to avoid misleading 401s.
• create_manager in main.rs correctly distinguishes SQLITE_NOTADB (encrypted) from other errors and exits on genuine corruption.
• isServerInitialized() in HttpTransport.connect() prevents noisy WebSocket reconnect loops during the locked/setup window.

Two issues worth addressing before removing the WIP tag:

• Startup recovery tasks (stuck-atom reset, legacy token migration) run only once at startup under an is_initialized() guard; they are permanently skipped for encrypted restarts because the guard is false at startup and never re-evaluated after unlock_instance fires.
• unlock_instance returns HTTP 401 for all initialize() failures, including I/O errors and lock poisoning, with the hint "Check your passphrase and try again" — which is actively misleading for infrastructure failures.

Confidence Score: 5/5

Safe to merge with caveats noted — the WIP tag should stay until startup-task and unlock-error-mapping gaps are addressed.

All remaining findings are P2: the startup-tasks gap only affects encrypted restarts with pre-existing stuck atoms (an unlikely combination for most deployments), and the misleading 401 hint is a UX rough edge rather than a data-safety issue. The core concerns from previous review rounds — TOCTOU race, panic on registry access, silent error swallowing — are all addressed. The encryption implementation itself (PRAGMA key ordering, pool propagation, passphrase storage) is correct.

crates/atomic-server/src/main.rs (startup task gap) and crates/atomic-server/src/routes/setup.rs (unlock 401 for all errors)

Important Files Changed

Filename	Overview
crates/atomic-core/src/db.rs	Adds apply_connection_pragmas helper that applies PRAGMA key before base PRAGMAs across all connection types. Passphrase stored in struct so overflow connections use it correctly. Clean and correct implementation.
crates/atomic-core/src/manager.rs	Major refactor: registry changed from Arc to RwLock<Option<Arc>> supporting deferred mode. TOCTOU fix from previous review is applied. Gap: startup recovery tasks aren't triggered after deferred unlock.
crates/atomic-core/src/registry.rs	Passphrase added to Registry struct; PRAGMA key applied before WAL/NORMAL pragmas in both open_or_create_encrypted and new_connection. Unencrypted path delegates to encrypted path with None.
crates/atomic-server/src/main.rs	create_manager now detects encrypted databases by checking for SQLITE_NOTADB error messages and starts in deferred mode. Startup tasks correctly guarded with is_initialized(). Gap: tasks aren't re-run after deferred unlock.
crates/atomic-server/src/routes/setup.rs	New unlock_instance endpoint; setup_status correctly distinguishes fresh install vs encrypted locked via registry.db existence. All initialize() errors return HTTP 401 with wrong passphrase hint regardless of actual error type.
src/components/onboarding/UnlockScreen.tsx	New standalone unlock screen component; Enter-key handler, loading state, and error display all implemented correctly.
src/components/layout/Layout.tsx	Adds needs_unlock state and pre-checks saved server config for encrypted restart before falling through to onboarding. handleUnlockComplete correctly re-initializes transport and rechecks provider config.

Sequence Diagram

sequenceDiagram
    participant S as Server startup
    participant DB as SQLCipher
    participant C as Browser
    participant UI as UnlockScreen

    S->>DB: open_or_create_encrypted(data_dir, passphrase=None)
    DB-->>S: Err - file is not a database
    S->>S: new_deferred(data_dir)
    Note over S: is_initialized = false
    Note over S: Startup tasks SKIPPED

    C->>S: GET /api/setup/status
    S-->>C: needs_unlock true

    C->>UI: Show UnlockScreen
    UI-->>C: User enters passphrase

    C->>S: POST /api/setup/unlock
    S->>DB: PRAGMA key + base PRAGMAs
    DB-->>S: OK
    S->>S: is_initialized = true
    S-->>C: status unlocked

    C->>C: switchTransport with saved config
    C->>S: WebSocket connect
    S-->>C: Connected

    Note over S: Recovery tasks still not run

Loading

_{Reviews (4): Last reviewed commit: "fix: keep unlock button disabled while t..." | Re-trigger Greptile}

[kenforthewin]

@greptileai

[kenforthewin]

@greptileai

[kenforthewin]

@greptileai