@codedology/code-forge 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -6,6 +6,13 @@ waits on a second real consumer (plan §10.4, Q17).
 
 ## [Unreleased]
 
+## [0.2.3] — 2026-10-01
+
+### Fixed
+
+- 1Password: code-forge prints a line before each call that may make 1Password ask for approval, and waits 60 s instead
+  of 20 s, so a Touch ID or password prompt no longer times out while you look for it.
+
 ## [0.2.2] — 2026-10-01
 
 ### Added

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@codedology/code-forge",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Plan/harden/code/review orchestration CLI and Agent Skill for cross-model, parallel, evidence-gated feature delivery.",
   "repository": {
     "type": "git",

package/skill/scripts/forge

@@ -10,7 +10,7 @@
 #      copied install with no package next to it); `test/skill/shim.test.mjs` asserts the pin
 #      equals package.json's version.
 # The shim holds no logic of its own: every verb, flag and message is the CLI's.
-PINNED_VERSION="0.2.2"
+PINNED_VERSION="0.2.3"
 set -eu
 
 self="$0"

package/src/cli/keys.mjs

@@ -16,7 +16,7 @@
  */
 
 import { writeSafe } from '../util/redact.mjs';
-import { describeOpItem, isOpRef, OP_MESSAGES, opItemIdFromInput, toOpRef } from '../keys/onepassword.mjs';
+import { describeOpItem, isOpRef, OP_APPROVE_NOTE, OP_MESSAGES, opItemIdFromInput, toOpRef } from '../keys/onepassword.mjs';
 import { assertKeyName, createDefaultKeyStore, parseRef, readOpAndCache, resolveKey } from '../keys/store.mjs';
 
 const USAGE = 'usage: code-forge keys list | set <name> [--op <item-id|link|op://ref>] | test <name> [--ref <ref>] | remove <name>\n';
@@ -109,6 +109,7 @@ export async function runKeys(args, { store, stdout = process.stdout, stderr = p
     err(`${name}: --op must be a 1Password item ID, item link or op://vault/item/field reference\n`);
     return 2;
   }
+  if (flagArg !== undefined && (itemId !== null || fullRef)) err(`${OP_APPROVE_NOTE}\n`);
   // A 1Password item ID or link becomes a full op:// reference before any store call (B25).
   if (flagArg !== undefined && itemId !== null) {
     /** @type {Awaited<ReturnType<typeof toOpRef>>} */

package/src/install/wizard/run.mjs

@@ -26,7 +26,7 @@ import { parse as parseYAML } from 'yaml';
 import { DEFAULT_CONFIG_FILENAME, loadConfigFile } from '../../config/load.mjs';
 import { refreshFromCliCaches } from '../../config/refresh.mjs';
 import { validateConfig } from '../../config/validate.mjs';
-import { describeOpItem, isOpRef, OP_MESSAGES, toOpRef } from '../../keys/onepassword.mjs';
+import { describeOpItem, isOpRef, OP_APPROVE_NOTE, OP_MESSAGES, opItemIdFromInput, toOpRef } from '../../keys/onepassword.mjs';
 import { createDefaultKeyStore, resolveKey } from '../../keys/store.mjs';
 import { exec } from '../../util/exec.mjs';
 import { redact } from '../../util/redact.mjs';
@@ -261,7 +261,12 @@ export async function runInit(args, deps = {}) {
     const missing = [];
     let jevRef = null;
     let jevSource = 'none';
-    const resolveOp = (/** @type {string} */ input) => toOpRef(input, deps.opExec ? { exec: deps.opExec } : {});
+    const resolveOp = (/** @type {string} */ input) => {
+      // printed at once (stderr), not buffered: the approval prompt appears while op waits
+      // only when op will really be called: an item ID or a 1Password link (an op:// ref is kept as is)
+      if (opItemIdFromInput(String(input ?? '')) !== null) stderr.write(`${OP_APPROVE_NOTE}\n`);
+      return toOpRef(input, deps.opExec ? { exec: deps.opExec } : {});
+    };
     /** @param {import('./steps.mjs').JevAnswer} a */
     const takeAnswer = (a) => {
       jevRef = a.ref;

package/src/keys/onepassword.mjs

@@ -13,7 +13,11 @@
 
 import { exec as realExec } from '../util/exec.mjs';
 
-export const OP_TIMEOUT_MS = 20_000;
+// Long enough for a person to see and approve the 1Password prompt (Touch ID or password).
+export const OP_TIMEOUT_MS = 60_000;
+
+/** Shown just before a call that may make 1Password ask for approval. */
+export const OP_APPROVE_NOTE = '1Password may ask you to approve access: check the 1Password window (Touch ID or password).';
 
 /** The 1Password failure kinds; agent JSON carries the kind. */
 export const OP_ERROR_KINDS = Object.freeze(['op_missing', 'op_locked', 'op_timeout', 'op_not_found', 'op_bad_output', 'op_no_field', 'op_bad_input', 'op_failed']);