@chriscode/hush 5.0.4 → 5.0.6

package/dist/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAmC,WAAW,EAAE,MAAM,aAAa,CAAC;AAkD5F,wBAAsB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA6GrF"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,UAAU,EAAmC,WAAW,EAAE,MAAM,aAAa,CAAC;AA4C5F,wBAAsB,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAmHrF"}

package/dist/commands/run.js

@@ -26,11 +26,7 @@ function getDecryptedSecrets(ctx, projectRoot, env, config) {
         varSources.push(parseEnvContent(content));
     }
     if (varSources.length === 0) {
-        throw new Error(`No encrypted files found at project root.\n` +
-            `  Expected: ${sharedEncrypted}\n` +
-            `  Project root: ${projectRoot}\n\n` +
-            `  If you haven't encrypted yet, run: npx hush encrypt\n` +
-            `  If running from a subdirectory, ensure hush.yaml exists at the project root.`);
+        return [];
     }
     const merged = mergeVars(...varSources);
     return interpolateVars(merged);
@@ -61,6 +57,10 @@ export async function runCommand(ctx, options) {
     const { projectRoot } = projectInfo;
     const config = ctx.config.loadConfig(projectRoot);
     const rootSecrets = getDecryptedSecrets(ctx, projectRoot, env, config);
+    if (rootSecrets.length === 0) {
+        ctx.logger.warn(pc.yellow('No encrypted files found. Running command without secrets.'));
+        ctx.logger.warn(pc.dim('  To encrypt secrets, run: npx hush encrypt'));
+    }
     const rootSecretsRecord = getRootSecretsAsRecord(rootSecrets);
     const localTemplate = loadLocalTemplates(contextDir, env, ctx.fs);
     // 1. Resolve Template Vars

package/dist/core/sops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/core/sops.ts"],"names":[],"mappings":"AA0BA,wBAAgB,eAAe,IAAI,OAAO,CAUzC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CA6BhD;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAsBnE;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAsB3C;AAED,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA+CzE"}
+{"version":3,"file":"sops.d.ts","sourceRoot":"","sources":["../../src/core/sops.ts"],"names":[],"mappings":"AA0DA,wBAAgB,eAAe,IAAI,OAAO,CAUzC;AAED,wBAAgB,kBAAkB,IAAI,OAAO,CAE5C;AAED,wBAAgB,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAkChD;AAED,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAsBnE;AAED,wBAAgB,IAAI,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAsB3C;AAED,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CA+CzE"}

package/dist/core/sops.js

@@ -2,10 +2,40 @@ import { execSync, spawnSync } from 'node:child_process';
 import { fs } from '../lib/fs.js';
 import { join } from 'node:path';
 import { tmpdir, homedir } from 'node:os';
+import { loadConfig, findProjectRoot } from '../config/loader.js';
+import { keyExists, keyPath } from '../lib/age.js';
+function getProjectIdentifier(root) {
+    const config = loadConfig(root);
+    if (config.project) {
+        return config.project;
+    }
+    const pkgPath = join(root, 'package.json');
+    if (fs.existsSync(pkgPath)) {
+        const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf-8'));
+        if (typeof pkg.repository === 'string') {
+            const match = pkg.repository.match(/github\.com[/:]([\w-]+\/[\w-]+)/);
+            if (match)
+                return match[1];
+        }
+        if (pkg.repository?.url) {
+            const match = pkg.repository.url.match(/github\.com[/:]([\w-]+\/[\w-]+)/);
+            if (match)
+                return match[1];
+        }
+    }
+    return undefined;
+}
 function getAgeKeyFile() {
     if (process.env.SOPS_AGE_KEY_FILE) {
         return process.env.SOPS_AGE_KEY_FILE;
     }
+    const projectRoot = findProjectRoot(process.cwd())?.projectRoot;
+    if (projectRoot) {
+        const project = getProjectIdentifier(projectRoot);
+        if (project && keyExists(project)) {
+            return keyPath(project);
+        }
+    }
     const defaultPath = join(homedir(), '.config', 'sops', 'age', 'key.txt');
     if (fs.existsSync(defaultPath)) {
         return defaultPath;
@@ -52,8 +82,13 @@ export function decrypt(filePath) {
     catch (error) {
         const err = error;
         if (err.stderr?.includes('No identity matched')) {
+            const projectRoot = findProjectRoot(process.cwd())?.projectRoot;
+            const project = projectRoot ? getProjectIdentifier(projectRoot) : undefined;
+            const keyLocation = project
+                ? `~/.config/sops/age/keys/${project.replace(/\//g, '-')}.txt`
+                : '~/.config/sops/age/key.txt';
             throw new Error('SOPS decryption failed: No matching age key found.\n' +
-                'Ensure your age key is at ~/.config/sops/age/key.txt');
+                `Ensure your age key is at ${keyLocation}`);
         }
         throw new Error(`SOPS decryption failed: ${err.stderr || err.message}`);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chriscode/hush",
-  "version": "5.0.4",
+  "version": "5.0.6",
   "description": "SOPS-based secrets management for monorepos. Encrypt once, decrypt everywhere.",
   "type": "module",
   "bin": {