@cabane/cli 0.1.8 → 0.1.9

package/dist/cli.js

@@ -864,6 +864,7 @@ async function resolveToken(opts, config) {
 }
 function persistInstall(config, version) {
   if (!config.visionSecret) config.visionSecret = randomBytes(32).toString("hex");
+  if (!config.credentialKey) config.credentialKey = randomBytes(32).toString("base64");
   if (config.currentVersion && config.currentVersion !== version) {
     config.previousVersion = config.currentVersion;
   }
@@ -1004,6 +1005,7 @@ function composeServerEnv(opts) {
     WEB_DIST: "web",
     PUBLIC_BASE_URL: opts.publicBaseUrl?.replace(/\/$/, "") || `http://localhost:${opts.port}`,
     VISION_URL_SIGNING_SECRET: opts.visionSecret,
+    ...opts.credentialKey ? { CABANE_CREDENTIAL_KEY: opts.credentialKey } : {},
     // Runtime file-read overrides → the artifact's own data/ tree.
     CABANE_API_ROOT: join6(dataDir, "api"),
     CABANE_SKILLS_DIR: join6(dataDir, "skills"),
@@ -1131,6 +1133,7 @@ async function healthy2(port) {
 }
 
 // src/commands/up.ts
+import { randomBytes as randomBytes2 } from "crypto";
 import { spawn as spawn3 } from "child_process";
 import { existsSync as existsSync8, mkdirSync as mkdirSync4, openSync as openSync2, readFileSync as readFileSync6, rmSync as rmSync4, writeFileSync as writeFileSync3 } from "fs";
 import { join as join8 } from "path";
@@ -1287,6 +1290,10 @@ async function up(opts) {
   if (!config.visionSecret) {
     throw new Error("config has no vision secret \u2014 reinstall to generate one.");
   }
+  if (!config.credentialKey) {
+    config.credentialKey = randomBytes2(32).toString("base64");
+    saveConfig(config);
+  }
   if (await portInUse(config.port)) {
     throw new Error(
       `port ${config.port} is already in use. If cabane is running, use \`cabane down\`; otherwise a stale process is holding it \u2014 free it and retry.`
@@ -1360,6 +1367,7 @@ var Supervisor = class {
       databaseUrl: this.pg.databaseUrl,
       storageRoot: this.paths.storageRoot,
       visionSecret: config.visionSecret,
+      ...config.credentialKey ? { credentialKey: config.credentialKey } : {},
       ...config.publicUrl ? { publicBaseUrl: config.publicUrl } : {},
       // Persisted `cabane set-env` creds (generic server env) are layered beneath
       // the composed infra vars.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cabane/cli",
-  "version": "0.1.8",
+  "version": "0.1.9",
   "type": "module",
   "description": "The cabane CLI — install, run, and update a self-hosted Cabane on your own machine (server + embedded Postgres; agents run on a companion you pair).",
   "license": "UNLICENSED",