@inceptionstack/roundhouse 0.3.4 → 0.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@inceptionstack/roundhouse",
-  "version": "0.3.4",
+  "version": "0.3.6",
   "type": "module",
   "description": "Multi-platform chat gateway that routes messages through a configured AI agent",
   "license": "MIT",

package/src/cli/cli.ts

@@ -609,12 +609,23 @@ const commands: Record<string, () => void | Promise<void>> = {
   agent: cmdAgent,
 };
 
-const fn = command ? commands[command] : undefined;
-if (fn) {
-  Promise.resolve(fn()).catch((err) => {
-    console.error(`[roundhouse] ${command} failed:`, err);
-    process.exit(1);
-  });
+if (command === "--version" || command === "-v") {
+  try {
+    const pkg = JSON.parse(
+      await readFile(resolve(__dirname, "..", "..", "package.json"), "utf8")
+    );
+    console.log(pkg.version);
+  } catch {
+    console.log("unknown");
+  }
 } else {
-  printHelp();
+  const fn = command ? commands[command] : undefined;
+  if (fn) {
+    Promise.resolve(fn()).catch((err) => {
+      console.error(`[roundhouse] ${command} failed:`, err);
+      process.exit(1);
+    });
+  } else {
+    printHelp();
+  }
 }

package/src/cli/setup.ts

@@ -407,6 +407,9 @@ async function stepInstallPackages(opts: SetupOptions): Promise<void> {
         ok("psst vault initialized");
       } catch (err: any) {
         warn(`psst vault init failed: ${err.stderr?.trim() || err.message}`);
+        // Clean up orphan password file
+        try { await unlink(resolve(ROUNDHOUSE_DIR, ".psst-password")); } catch {}
+        delete process.env.PSST_PASSWORD;
         opts.psst = false;
       }
     }
@@ -568,7 +571,10 @@ async function stepConfigure(
     envLines.push(`ALLOWED_USERS=${envQuote(opts.users.join(","))}`);
   }
 
-  // If psst uses a generated password (headless), include it in env for systemd
+  // If psst uses a generated password (headless), include it in env for systemd.
+  // Threat model tradeoff: the vault key is plaintext in a 0600 file, but this is
+  // unavoidable on headless servers with no keychain. The benefit is that individual
+  // secrets are still managed centrally via psst and injected at runtime.
   if (opts.psst) {
     const pwFile = resolve(ROUNDHOUSE_DIR, ".psst-password");
     if (await fileExists(pwFile)) {