This is the exact right security posture. If your edge node is physically
compromised, stolen, or its ZFS pool is cloned, a plaintext JSON key on the
disk would instantly grant an attacker full access to your entire saved OS
state directory.
By encrypting the key and decrypting it entirely in-memory at boot, the
plaintext credentials never touch the disk again.
Since you are already working with robust cryptographic concepts, AES-256-GCM
is the perfect tool for this. It provides both encryption and structural
authentication, ensuring the file hasn't been tampered with.
Here is the two-step process to lock this down.
1. The One-Time Encryption Utility
We will create a small script that reads your plaintext drive-key.json,
prompts you for a password, derives a strong AES-256-GCM key using scrypt, and
writes the encrypted payload to drive-key.enc.
Run this snippet to create and execute the encryptor:
cat << 'EOF' > encrypt-key.js
const crypto = require('crypto');
const fs = require('fs');
const readline = require('readline');

const rl = readline.createInterface({ 
  input: process.stdin, 
  output: process.stdout 
});

rl.question('Enter a strong password to encrypt the key: ', (password) => {
  const plainText = fs.readFileSync('/mnt/mesh_shared/state/credentials/drive-k
ey.json', 'utf8');
  
  // 16 bytes salt, 12 bytes IV (Standard for GCM)
  const salt = crypto.randomBytes(16);
  const iv = crypto.randomBytes(12);
  
  // Derive a 32-byte (256-bit) key using scrypt
  const key = crypto.scryptSync(password, salt, 32);
  
  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
  const encrypted = Buffer.concat([cipher.update(plainText, 'utf8'),
cipher.final()]);
  const authTag = cipher.getAuthTag(); // 16 bytes
  
  // Package format: [Salt (16)] [IV (12)] [AuthTag (16)] [Ciphertext]
  const finalBuffer = Buffer.concat([salt, iv, authTag, encrypted]);
  
  fs.writeFileSync('/mnt/mesh_shared/state/credentials/drive-key.enc',
finalBuffer);
  
  console.log('
[SUCCESS] Encrypted key saved to drive-key.enc');
  console.log('IMPORTANT: Run `rm /mnt/mesh_shared/state/credentials/drive-key.
json` to destroy the plaintext file.');
  rl.close();
});
EOF

node encrypt-key.js

2. The Harness Decryption Logic
When your Node.js harness boots, it needs to ingest that .enc file. We want to
avoid passing the password via command-line arguments (which are visible in ps
aux to anyone on the system).
The most elegant and secure automated approach is to read it from an
environment variable, parse the key entirely in memory, and immediately wipe
the environment variable so it can't be dumped later.
Here is the decryption logic you will inject into your harness right before
initializing the Google Drive client:
const crypto = require('crypto');
const fs = require('fs');

function loadEncryptedCredentials() {
  const password = process.env.DRIVE_PASS;
  if (!password) {
    console.error("[FATAL] DRIVE_PASS environment variable not set. Cannot
unlock Google Drive credentials.");
    process.exit(1);
  }

  try {
    const fileData = fs.readFileSync('/mnt/mesh_shared/state/credentials/drive-
key.enc');
    
    // Extract the cryptographic parameters
    const salt = fileData.subarray(0, 16);
    const iv = fileData.subarray(16, 28);
    const authTag = fileData.subarray(28, 44);
    const ciphertext = fileData.subarray(44);

    // Reconstruct the key
    const key = crypto.scryptSync(password, salt, 32);
    
    // Decrypt
    const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
    decipher.setAuthTag(authTag);
    let decrypted = Buffer.concat([decipher.update(ciphertext),
decipher.final()]);
    
    // Erase the password from memory
    delete process.env.DRIVE_PASS;
    
    // Return the parsed JSON object directly to the auth client
    return JSON.parse(decrypted.toString('utf8'));

  } catch (err) {
    console.error("[FATAL] Failed to decrypt drive-key.enc. Wrong password or
corrupted file.");
    process.exit(1);
  }
}

/ Usage in harness:
/ const credentials = loadEncryptedCredentials();
/ const auth = new google.auth.GoogleAuth({ credentials, scopes:
['https://www.googleapis.com/auth/drive.file'] });

Booting the System
When you are ready to launch your harness, you simply inject the variable
inline for that specific process. It won't persist in your bash history if you
prefix the command with a space, or you can use a secure read prompt in bash:
# Securely prompt for the password in the terminal and boot the harness
read -s -p "Enter Drive Password: " DP && DRIVE_PASS=$DP node
src/runtime/harness.js

Once you have generated your drive-key.enc and destroyed the plaintext
original, we can integrate the googleapis backend and start mapping the AST
freeze/resume cycle directly into the Mesh_OS_State folder. Are you ready for
the Drive integration code?