legionio 1.7.25 → 1.7.29

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d65ff77ca667361b558a97d1da1c3d5d2b1090bb4aad5559532406cd18e781a7
-  data.tar.gz: 7583822cc4cf804703b8a733be36bb711d1cae70724a49dc98cafea6583268ab
+  metadata.gz: 5af5e876210c79ae9fcc876fad3b8086a605f3a841c450793b4759711c5b0101
+  data.tar.gz: 43d1c51c4a52121654e1a1e426f5bbe9e6e1771a5a95a095eb12e87474632eec
 SHA512:
-  metadata.gz: 06f7712d8c9c6e944890ba2c55efbdf3463a6c39e906017cede6d3401215de9144e7c916c39c8b981e8f6ea6646a5439bcc10a399443fe7642b3ab06e3ef2c7a
-  data.tar.gz: 5e5819fc7973e9cb6de4b64e88c40b74d033fd666c4b9585726a3b1e87b9468f6cf4759fed226a9c3a7bc755a10b9267403dcd001d2c10f08b7aaf36e6264812
+  metadata.gz: af956fad95ae9de341f700fa1e03997bed9b889983dc69b96322ba72cb7871f584224b4d00112e17b2e580a9f37e1afff3fa96e9b5bb5e83a38cf487fad26b77
+  data.tar.gz: 6545603e7df04444096ae7763fcfde3ee4b970603554388ab04be50a088bd36ac1f77c0fc5ce02f04eeaf5396bb5620d38fc6416f5125b900225a3f79ecc773a

data/CHANGELOG.md

@@ -1,5 +1,31 @@
 # Legion Changelog
 
+## [1.7.29] - 2026-04-07
+
+### Changed
+- Skip secret resolution for all CLI commands that only need local settings: `config`, `mode`, `lex`, `doctor`, `auth`, `marketplace`, `debug`, `failover status` — eliminates noisy Vault/lease warnings on local-only operations
+
+## [1.7.28] - 2026-04-07
+
+### Fixed
+- `legionio setup` pack marker and packs.json writes now rescue `Errno::EPERM`/`EACCES`, fixing Homebrew post-install crash when sandbox blocks writes to `~/.legionio/`
+
+## [1.7.27] - 2026-04-07
+
+### Changed
+- `Connection.ensure_settings` accepts `resolve_secrets:` keyword (default `true`) to skip Vault/lease resolution for CLI commands that don't need infrastructure credentials
+- `legionio update` now skips secret resolution, eliminating noisy "Vault not connected" and "LeaseManager not available" warnings
+
+## [1.7.26] - 2026-04-07
+
+### Added
+- Phase 5 Credential Scoping — service.rb integration (§8 of `docs/plans/2026-04-07-credential-scoping-design.md`)
+- Boot: call `Legion::Crypt.fetch_bootstrap_rmq_creds` after `Crypt.start` to acquire short-lived bootstrap RMQ credentials from Vault before transport connects (no-op when `dynamic_rmq_creds: false`)
+- `setup_identity`: after identity resolves, call `Legion::Crypt.swap_to_identity_creds(mode:)` to swap from bootstrap to identity-scoped RMQ credentials — gated on `vault_connected? && dynamic_rmq_creds? && !lite?`; fallback identity still gets scoped creds
+- `shutdown`: call `Legion::Crypt.revoke_bootstrap_lease` before Crypt shutdown for defense-in-depth lease cleanup
+- `reload`: call `fetch_bootstrap_rmq_creds` after Crypt.start, `resolve_secrets!` after settings reload, and `setup_identity` (replacing static `mark_ready(:identity)`) so reloaded processes acquire identity-scoped credentials
+- Specs for all Phase 5 service.rb integration paths: boot credential fetch, identity swap per mode, vault/flag/lite guards, swap failure recovery, shutdown revocation, reload credential flow
+
 ## [1.7.25] - 2026-04-06
 
 ### Added

data/lib/legion/cli/auth_command.rb

@@ -20,7 +20,7 @@ module Legion
       method_option :scopes,     type: :string, desc: 'OAuth scopes to request'
       def teams
         out = formatter
-        Connection.ensure_settings
+        Connection.ensure_settings(resolve_secrets: false)
 
         port = begin
           Legion::Settings.dig(:api, :port) || 4567

data/lib/legion/cli/config_command.rb

@@ -18,7 +18,7 @@ module Legion
       def show
         out = formatter
         Connection.config_dir = options[:config_dir] if options[:config_dir]
-        Connection.ensure_settings
+        Connection.ensure_settings(resolve_secrets: false)
 
         settings = if Legion::Settings.respond_to?(:to_hash)
                      Legion::Settings.to_hash
@@ -110,7 +110,7 @@ module Legion
 
         # Check settings load
         begin
-          Connection.ensure_settings
+          Connection.ensure_settings(resolve_secrets: false)
           out.success('Settings loaded successfully') unless options[:json]
         rescue StandardError => e
           issues << "Settings failed to load: #{e.message}"

data/lib/legion/cli/connection.rb

@@ -23,7 +23,7 @@ module Legion
           @logging_ready = true
         end
 
-        def ensure_settings
+        def ensure_settings(resolve_secrets: true)
           return if @settings_ready
 
           ensure_logging
@@ -31,7 +31,7 @@ module Legion
 
           dir = resolve_config_dir
           Legion::Settings.load(config_dir: dir)
-          Legion::Settings.resolve_secrets! if Legion::Settings.respond_to?(:resolve_secrets!)
+          Legion::Settings.resolve_secrets! if resolve_secrets && Legion::Settings.respond_to?(:resolve_secrets!)
           @settings_ready = true
         end
 

data/lib/legion/cli/debug_command.rb

@@ -98,7 +98,7 @@ module Legion
         def load_settings
           Connection.config_dir = options[:config_dir] if options[:config_dir]
           Connection.log_level = 'error'
-          Connection.ensure_settings
+          Connection.ensure_settings(resolve_secrets: false)
         rescue StandardError
           nil
         end

data/lib/legion/cli/doctor_command.rb

@@ -70,7 +70,7 @@ module Legion
       def diagnose
         out = formatter
         begin
-          Connection.ensure_settings
+          Connection.ensure_settings(resolve_secrets: false)
         rescue StandardError => e
           Legion::Logging.debug("Doctor#diagnose settings load failed: #{e.message}") if defined?(Legion::Logging)
         end

data/lib/legion/cli/failover_command.rb

@@ -72,7 +72,7 @@ module Legion
         private
 
         def ensure_settings
-          Connection.ensure_settings
+          Connection.ensure_settings(resolve_secrets: false)
         end
 
         def run_dry_run(out, target)

data/lib/legion/cli/lex_command.rb

@@ -160,7 +160,7 @@ module Legion
       desc 'enable NAME', 'Enable an extension in settings'
       def enable(name)
         out = formatter
-        Connection.ensure_settings
+        Connection.ensure_settings(resolve_secrets: false)
 
         extensions = Legion::Settings[:extensions] || {}
         if extensions.key?(name.to_sym)
@@ -176,7 +176,7 @@ module Legion
       desc 'disable NAME', 'Disable an extension in settings'
       def disable(name)
         out = formatter
-        Connection.ensure_settings
+        Connection.ensure_settings(resolve_secrets: false)
 
         extensions = Legion::Settings[:extensions] || {}
         if extensions.key?(name.to_sym)
@@ -349,7 +349,7 @@ module Legion
 
           # Load settings to check enabled/disabled state
           begin
-            Connection.ensure_settings
+            Connection.ensure_settings(resolve_secrets: false)
             ext_settings = Legion::Settings[:extensions] || {}
           rescue StandardError => e
             Legion::Logging.warn("LexCommand#discover_all settings load failed: #{e.message}") if defined?(Legion::Logging)

data/lib/legion/cli/marketplace_command.rb

@@ -248,7 +248,7 @@ module Legion
         end
 
         begin
-          Connection.ensure_settings
+          Connection.ensure_settings(resolve_secrets: false)
           Legion::Extensions::GemSource.setup!
         rescue StandardError => e
           Legion::Logging.debug("marketplace install: settings not available: #{e.message}") if defined?(Legion::Logging)

data/lib/legion/cli/mode_command.rb

@@ -31,7 +31,7 @@ module Legion
       desc 'show', 'Show current process role and extension profile'
       def show
         out = formatter
-        Connection.ensure_settings
+        Connection.ensure_settings(resolve_secrets: false)
 
         process_role = Legion::ProcessRole.current
         profile = Legion::Settings.dig(:role, :profile)&.to_s || '(none — all extensions load)'
@@ -55,7 +55,7 @@ module Legion
       desc 'list', 'List available extension profiles and process roles'
       def list
         out = formatter
-        Connection.ensure_settings
+        Connection.ensure_settings(resolve_secrets: false)
 
         if options[:json]
           out.json({ profiles: PROFILE_DESCRIPTIONS, process_roles: Legion::ProcessRole::ROLES.keys })
@@ -95,7 +95,7 @@ module Legion
       option :reload,       type: :boolean, default: false, desc: 'Trigger daemon reload after writing config'
       def set(profile = nil)
         out = formatter
-        Connection.ensure_settings
+        Connection.ensure_settings(resolve_secrets: false)
 
         validate_inputs!(out, profile)
 

data/lib/legion/cli/setup_command.rb

@@ -304,6 +304,8 @@ module Legion
           marker = File.join(marker_dir, pack_name.to_s)
           File.write(marker, '') unless File.exist?(marker)
           update_packs_setting(pack_name)
+        rescue Errno::EPERM, Errno::EACCES => e
+          Legion::Logging.warn("Could not write pack marker: #{e.message}") if defined?(Legion::Logging)
         end
 
         def update_packs_setting(pack_name)
@@ -318,6 +320,8 @@ module Legion
           data['packs'] = packs.sort
           FileUtils.mkdir_p(File.dirname(settings_file))
           File.write(settings_file, ::JSON.pretty_generate(data))
+        rescue Errno::EPERM, Errno::EACCES => e
+          Legion::Logging.warn("Could not update packs setting: #{e.message}") if defined?(Legion::Logging)
         rescue ::JSON::ParserError
           data = { 'packs' => [pack_name.to_s] }
           File.write(settings_file, ::JSON.pretty_generate(data))

data/lib/legion/cli/update_command.rb

@@ -31,7 +31,7 @@ module Legion
           raise SystemExit, 1
         end
 
-        Connection.ensure_settings
+        Connection.ensure_settings(resolve_secrets: false)
         Legion::Extensions::GemSource.setup!
 
         target_gems = discover_legion_gems

data/lib/legion/service.rb

@@ -56,6 +56,9 @@ module Legion
         Legion::Crypt.start
         Legion::Readiness.mark_ready(:crypt)
         setup_mtls_rotation
+        # Phase 5: fetch short-lived bootstrap RMQ creds from Vault before transport connects.
+        # Service is the authoritative gate (vault_connected? + dynamic_rmq_creds?).
+        fetch_phase5_bootstrap_creds unless Legion::Mode.respond_to?(:lite?) && Legion::Mode.lite?
       end
 
       Legion::Settings.resolve_secrets!
@@ -480,7 +483,7 @@ module Legion
       log.info 'Legion::Transport connected'
     end
 
-    def setup_identity
+    def setup_identity # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
       require_relative 'identity/process'
       require_relative 'identity/broker'
       require_relative 'identity/lease'
@@ -495,6 +498,18 @@ module Legion
         log.info "[Identity] fallback identity: #{Legion::Identity::Process.canonical_name}"
       end
 
+      # Phase 5: Swap from bootstrap RMQ credentials to identity-scoped credentials.
+      # Gate on vault_connected? + dynamic_rmq_creds? — NOT on resolved? (fallback identity
+      # still needs scoped creds via the mode-based role).
+      if defined?(Legion::Crypt) &&
+         Legion::Crypt.respond_to?(:vault_connected?) && Legion::Crypt.vault_connected? &&
+         Legion::Crypt.respond_to?(:dynamic_rmq_creds?) && Legion::Crypt.dynamic_rmq_creds? &&
+         Legion::Crypt.respond_to?(:swap_to_identity_creds) &&
+         !Legion::Mode.lite?
+        log.info '[Identity] swapping to identity-scoped RMQ credentials'
+        Legion::Crypt.swap_to_identity_creds(mode: Legion::Mode.current)
+      end
+
       # Re-resolve secrets for any identity-scoped lease:// refs (task 2.25)
       Legion::Settings.resolve_secrets! if Legion::Settings.respond_to?(:resolve_secrets!)
 
@@ -702,7 +717,7 @@ module Legion
       handle_exception(e, level: :warn, operation: 'service.shutdown_api')
     end
 
-    def shutdown # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity
+    def shutdown # rubocop:disable Metrics/CyclomaticComplexity, Metrics/PerceivedComplexity, Metrics/AbcSize, Metrics/MethodLength
       log.info('Legion::Service.shutdown was called')
       @shutdown = true
       Legion::Settings[:client][:shutting_down] = true
@@ -767,7 +782,12 @@ module Legion
       Legion::Readiness.mark_not_ready(:transport)
 
       shutdown_mtls_rotation
-      shutdown_component('Crypt') { Legion::Crypt.shutdown }
+      # Phase 5: Revoke bootstrap RMQ lease on clean shutdown (defense-in-depth;
+      # lease expires naturally if process crashes before identity swap).
+      shutdown_component('Crypt bootstrap lease') do
+        Legion::Crypt.revoke_bootstrap_lease if defined?(Legion::Crypt) && Legion::Crypt.respond_to?(:revoke_bootstrap_lease)
+      end
+      shutdown_component('Crypt') { Legion::Crypt.shutdown if defined?(Legion::Crypt) }
       Legion::Readiness.mark_not_ready(:crypt)
 
       Legion::Settings[:client][:ready] = false
@@ -807,7 +827,7 @@ module Legion
       shutdown_component('Transport') { Legion::Transport::Connection.shutdown }
       Legion::Readiness.mark_not_ready(:transport)
 
-      shutdown_component('Crypt') { Legion::Crypt.shutdown }
+      shutdown_component('Crypt') { Legion::Crypt.shutdown if defined?(Legion::Crypt) }
       Legion::Readiness.mark_not_ready(:crypt)
 
       Legion::Readiness.wait_until_not_ready(:transport, :data, :cache, :crypt)
@@ -816,7 +836,12 @@ module Legion
       Legion::Readiness.mark_ready(:settings)
 
       Legion::Crypt.start if defined?(Legion::Crypt)
-      Legion::Readiness.mark_ready(:crypt)
+      Legion::Readiness.mark_ready(:crypt) if defined?(Legion::Crypt)
+      # Phase 5: fetch bootstrap RMQ creds after Vault reconnects on reload.
+      fetch_phase5_bootstrap_creds unless Legion::Mode.lite?
+
+      # Resolve lease:// URIs with freshly loaded settings + new Vault token.
+      Legion::Settings.resolve_secrets! if Legion::Settings.respond_to?(:resolve_secrets!)
 
       setup_transport
       Legion::Readiness.mark_ready(:transport)
@@ -858,7 +883,9 @@ module Legion
         Legion::Readiness.mark_skipped(:gaia)
       end
 
-      Legion::Readiness.mark_ready(:identity)
+      # Phase 5: re-run identity resolution + credential swap so the reloaded
+      # process gets identity-scoped RMQ creds (not stale bootstrap creds).
+      setup_identity
 
       setup_supervision
       load_extensions
@@ -868,7 +895,7 @@ module Legion
 
       register_core_tools
 
-      Legion::Crypt.cs
+      Legion::Crypt.cs if defined?(Legion::Crypt)
       setup_apm if @api_enabled
       setup_api if @api_enabled
 
@@ -1027,6 +1054,18 @@ module Legion
 
     private
 
+    # Phase 5: fetch short-lived bootstrap RMQ credentials from Vault.
+    # Called after Crypt.start (boot) and after Crypt.start (reload).
+    # Service owns the gate so Crypt.fetch_bootstrap_rmq_creds can be unconditional.
+    def fetch_phase5_bootstrap_creds
+      return unless defined?(Legion::Crypt)
+      return unless Legion::Crypt.respond_to?(:fetch_bootstrap_rmq_creds)
+      return unless Legion::Crypt.respond_to?(:vault_connected?) && Legion::Crypt.vault_connected?
+      return unless Legion::Crypt.respond_to?(:dynamic_rmq_creds?) && Legion::Crypt.dynamic_rmq_creds?
+
+      Legion::Crypt.fetch_bootstrap_rmq_creds
+    end
+
     def resolve_identity_providers
       # Phase 4 adds lex-identity-* providers. For now, check if any are loaded.
       return false unless defined?(Legion::Extensions)

data/lib/legion/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Legion
-  VERSION = '1.7.25'
+  VERSION = '1.7.29'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legionio
 version: !ruby/object:Gem::Version
-  version: 1.7.25
+  version: 1.7.29
 platform: ruby
 authors:
 - Esity