@inceptionstack/roundhouse 0.3.4 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inceptionstack/roundhouse",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "type": "module",
   "description": "Multi-platform chat gateway that routes messages through a configured AI agent",
   "license": "MIT",

package/src/cli/setup.ts

@@ -407,6 +407,9 @@ async function stepInstallPackages(opts: SetupOptions): Promise<void> {
         ok("psst vault initialized");
       } catch (err: any) {
         warn(`psst vault init failed: ${err.stderr?.trim() || err.message}`);
+        // Clean up orphan password file
+        try { await unlink(resolve(ROUNDHOUSE_DIR, ".psst-password")); } catch {}
+        delete process.env.PSST_PASSWORD;
         opts.psst = false;
       }
     }
@@ -568,7 +571,10 @@ async function stepConfigure(
     envLines.push(`ALLOWED_USERS=${envQuote(opts.users.join(","))}`);
   }
 
-  // If psst uses a generated password (headless), include it in env for systemd
+  // If psst uses a generated password (headless), include it in env for systemd.
+  // Threat model tradeoff: the vault key is plaintext in a 0600 file, but this is
+  // unavoidable on headless servers with no keychain. The benefit is that individual
+  // secrets are still managed centrally via psst and injected at runtime.
   if (opts.psst) {
     const pwFile = resolve(ROUNDHOUSE_DIR, ".psst-password");
     if (await fileExists(pwFile)) {