@jeffusion/bungee 5.24.3 → 5.25.0

package/dist/index.js

@@ -2146,7 +2146,7 @@ var {
 } = exports_commander;
 
 // src/commands/recover.ts
-import { resolve as resolve4, join as join7 } from "node:path";
+import { resolve as resolve4, join as join8, dirname as dirname3 } from "node:path";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/config/paths.ts
@@ -2178,10 +2178,10 @@ class ConfigPaths {
 // src/daemon/manager.ts
 import fs2 from "node:fs";
 import { readFile as readFile3 } from "node:fs/promises";
-import { randomBytes as randomBytes2, randomUUID as randomUUID3 } from "node:crypto";
+import { randomBytes as randomBytes3, randomUUID as randomUUID3 } from "node:crypto";
 import { spawn as spawn2 } from "node:child_process";
 import { realpathSync as realpathSync2 } from "node:fs";
-import { basename as basename2, isAbsolute as isAbsolute4, join as join6 } from "node:path";
+import { basename as basename2, isAbsolute as isAbsolute4, join as join7 } from "node:path";
 import { isIP } from "node:net";
 
 // ../types/dist/daemon-control.js
@@ -3249,6 +3249,10 @@ function defaultWindowsAclAdapter(deadlineMs = WINDOWS_ACL_DEADLINE_MS) {
     }
   };
 }
+async function secureWindowsOwnerOnlyFileAcl(path, adapter = defaultWindowsAclAdapter()) {
+  await ensureWindowsAcl(path, adapter, "file");
+  await assertWindowsOwnerOnlyFileAcl(path, adapter);
+}
 async function assertWindowsOwnerOnlyFileAcl(path, adapter = defaultWindowsAclAdapter()) {
   const snapshot = await adapter.read(path);
   if (!canonicalSid(snapshot.ownerSid) || snapshot.ownerSid !== snapshot.currentSid)
@@ -3388,16 +3392,117 @@ async function createLaunchingDaemonMetadataFile(path, metadata, options) {
   }
 }
 
+// src/config/plugin-secrets-key.ts
+import { randomBytes } from "node:crypto";
+import { constants } from "node:fs";
+import { lstat as lstat2, mkdir as mkdir2, open as open2, unlink as unlink2 } from "node:fs/promises";
+import { dirname, join as join2 } from "node:path";
+var UNSAFE_FILE = "Plugin secrets key must be an owner-only regular file containing a canonical Base64 key for 32 bytes";
+function pluginSecretsKeyPath(configDbPath) {
+  return join2(dirname(configDbPath), "plugin-secrets.key");
+}
+function withPluginSecretsKey(environment, key) {
+  return {
+    ...Object.fromEntries(Object.entries(environment).filter(([name]) => name.toLowerCase() !== "bungee_plugin_secrets_key")),
+    BUNGEE_PLUGIN_SECRETS_KEY: key
+  };
+}
+function validateKey(value) {
+  const bytes = Buffer.from(value, "base64");
+  if (bytes.length !== 32 || bytes.toString("base64") !== value) {
+    throw new Error("Plugin secrets key must be canonical Base64 for 32 bytes");
+  }
+  return value;
+}
+async function readKeyFile(path, options) {
+  const platform = options.platform ?? process.platform;
+  const before = await lstat2(path);
+  if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1)
+    throw new Error(UNSAFE_FILE);
+  const file = await open2(path, constants.O_RDONLY | (platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK));
+  try {
+    const opened = await file.stat();
+    const verify = (item) => {
+      if (!item.isFile() || item.nlink !== 1 || item.dev !== before.dev || item.ino !== before.ino || item.size !== 44 || platform !== "win32" && ((item.mode & 511) !== 384 || process.geteuid && item.uid !== process.geteuid()))
+        throw new Error(UNSAFE_FILE);
+    };
+    verify(opened);
+    if (platform === "win32")
+      await assertWindowsOwnerOnlyFileAcl(path, options.windowsAcl);
+    const value = await file.readFile("utf8");
+    verify(await file.stat());
+    const after = await lstat2(path);
+    verify(after);
+    return validateKey(value);
+  } finally {
+    await file.close();
+  }
+}
+async function readPluginSecretsKey(configDbPath, options = {}) {
+  try {
+    return await readKeyFile(pluginSecretsKeyPath(configDbPath), options);
+  } catch (error) {
+    if (error.code === "ENOENT")
+      throw new Error("Plugin secrets key is missing. Run bungee init first.");
+    throw error;
+  }
+}
+async function initializePluginSecretsKey(configDbPath, suppliedKey, options = {}) {
+  if (suppliedKey !== undefined)
+    validateKey(suppliedKey);
+  const path = pluginSecretsKeyPath(configDbPath);
+  try {
+    const existing = await readKeyFile(path, options);
+    if (suppliedKey !== undefined && suppliedKey !== existing)
+      throw new Error("Plugin secrets key is already initialized with a different key");
+    return existing;
+  } catch (error) {
+    if (error.code !== "ENOENT")
+      throw error;
+  }
+  if (suppliedKey === undefined) {
+    for (const database of [configDbPath, join2(dirname(configDbPath), "plugin-state.db")]) {
+      try {
+        await lstat2(database);
+        throw new Error("An existing database requires its original plugin secrets key when running bungee init");
+      } catch (error) {
+        if (error.code !== "ENOENT")
+          throw error;
+      }
+    }
+  }
+  const key = suppliedKey ?? randomBytes(32).toString("base64");
+  await mkdir2(dirname(path), { recursive: true, mode: 448 });
+  const file = await open2(path, "wx", 384);
+  const created = await file.stat();
+  try {
+    if ((options.platform ?? process.platform) === "win32")
+      await secureWindowsOwnerOnlyFileAcl(path, options.windowsAcl);
+    else
+      await file.chmod(384);
+    await file.writeFile(key);
+    await file.sync();
+  } catch (error) {
+    const current = await lstat2(path);
+    if (current.dev === created.dev && current.ino === created.ino)
+      await unlink2(path);
+    throw error;
+  } finally {
+    await file.close();
+  }
+  return readKeyFile(path, options);
+}
+
 // src/binary/manager.ts
 import { randomUUID as randomUUID2 } from "node:crypto";
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync, rmSync as rmSync2, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
-import { join as join3 } from "node:path";
+import { join as join4 } from "node:path";
 import { createInterface } from "node:readline";
 // package.json
 var package_default = {
   name: "@jeffusion/bungee",
-  version: "5.24.3",
+  version: "5.25.0",
   description: "High-performance reverse proxy server CLI",
   type: "module",
   bin: {
@@ -3453,7 +3558,7 @@ import {
   renameSync,
   rmSync
 } from "node:fs";
-import { basename, join as join2 } from "node:path";
+import { basename, join as join3 } from "node:path";
 function runTar(args) {
   const result = spawnSync("tar", args, { encoding: "utf8" });
   if (result.status !== 0) {
@@ -3483,8 +3588,8 @@ function validateListing(listing, binaryName) {
   }
 }
 function validateExtractedTree(directory, binaryName) {
-  const executable = join2(directory, binaryName);
-  const plugins = join2(directory, "plugins");
+  const executable = join3(directory, binaryName);
+  const plugins = join3(directory, "plugins");
   if (!lstatSync(executable).isFile() || !lstatSync(plugins).isDirectory()) {
     throw new Error("Binary archive has an invalid root layout");
   }
@@ -3495,7 +3600,7 @@ function validateExtractedTree(directory, binaryName) {
   }
   const visit = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const target = join2(current, entry.name);
+      const target = join3(current, entry.name);
       if (entry.isSymbolicLink())
         throw new Error(`Binary archive contains a symlink: ${entry.name}`);
       if (entry.isDirectory())
@@ -3506,8 +3611,8 @@ function validateExtractedTree(directory, binaryName) {
   for (const plugin of readdirSync(plugins, { withFileTypes: true })) {
     if (!plugin.isDirectory())
       throw new Error(`Invalid plugin artifact: ${plugin.name}`);
-    const pluginDirectory = join2(plugins, plugin.name);
-    if (!existsSync2(join2(pluginDirectory, "manifest.json")) || !existsSync2(join2(pluginDirectory, "index.js"))) {
+    const pluginDirectory = join3(plugins, plugin.name);
+    if (!existsSync2(join3(pluginDirectory, "manifest.json")) || !existsSync2(join3(pluginDirectory, "index.js"))) {
       throw new Error(`Incomplete plugin artifact: ${plugin.name}`);
     }
   }
@@ -3517,15 +3622,15 @@ function installBinaryArchive(options) {
     throw new Error("Invalid binary install identity");
   }
   mkdirSync(options.installRoot, { recursive: true });
-  const target = join2(options.installRoot, options.version);
-  const staging = mkdtempSync(join2(options.installRoot, `${options.version}.staging-`));
+  const target = join3(options.installRoot, options.version);
+  const staging = mkdtempSync(join3(options.installRoot, `${options.version}.staging-`));
   const backup = `${target}.backup-${randomUUID()}`;
   let backedUp = false;
   try {
     validateListing(runTar(["-tzf", options.archivePath]), options.binaryName);
     runTar(["-xzf", options.archivePath, "-C", staging]);
     validateExtractedTree(staging, options.binaryName);
-    chmodSync(join2(staging, options.binaryName), 493);
+    chmodSync(join3(staging, options.binaryName), 493);
     if (existsSync2(target)) {
       renameSync(target, backup);
       backedUp = true;
@@ -3539,7 +3644,7 @@ function installBinaryArchive(options) {
     }
     if (backedUp)
       rmSync(backup, { recursive: true, force: true });
-    return join2(target, options.binaryName);
+    return join3(target, options.binaryName);
   } finally {
     rmSync(staging, { recursive: true, force: true });
   }
@@ -3573,8 +3678,8 @@ function getAssetName(binaryName = getBinaryName()) {
 
 // src/binary/manager.ts
 class BinaryManager {
-  static BINARY_DIR = join3(homedir(), ".bungee", "bin");
-  static VERSION_FILE = join3(homedir(), ".bungee", "version.txt");
+  static BINARY_DIR = join4(homedir(), ".bungee", "bin");
+  static VERSION_FILE = join4(homedir(), ".bungee", "version.txt");
   static GITHUB_REPO = "jeffusion/bungee";
   static getBinaryName() {
     return getBinaryName();
@@ -3583,7 +3688,7 @@ class BinaryManager {
     return getAssetName(this.getBinaryName());
   }
   static getLocalBinaryPath() {
-    return join3(this.BINARY_DIR, package_default.version, this.getBinaryName());
+    return join4(this.BINARY_DIR, package_default.version, this.getBinaryName());
   }
   static isBinaryInstalled() {
     return existsSync3(this.getLocalBinaryPath());
@@ -3596,7 +3701,7 @@ class BinaryManager {
     }
   }
   static saveVersion(version) {
-    mkdirSync2(join3(homedir(), ".bungee"), { recursive: true });
+    mkdirSync2(join4(homedir(), ".bungee"), { recursive: true });
     writeFileSync(this.VERSION_FILE, version);
   }
   static checkVersion() {
@@ -3617,7 +3722,7 @@ class BinaryManager {
   static async downloadBinary(options = {}) {
     const url = options.assetUrl ?? this.getDownloadUrl();
     mkdirSync2(this.BINARY_DIR, { recursive: true });
-    const archivePath = join3(this.BINARY_DIR, `.download-${randomUUID2()}.tar.gz`);
+    const archivePath = join4(this.BINARY_DIR, `.download-${randomUUID2()}.tar.gz`);
     if (!options.silent) {
       console.log(`Downloading Bungee v${package_default.version} from ${url}`);
     }
@@ -3679,7 +3784,7 @@ class BinaryManager {
 }
 
 // src/daemon/runtime.ts
-import { isAbsolute as isAbsolute2, join as join4, resolve as resolve2 } from "node:path";
+import { isAbsolute as isAbsolute2, join as join5, resolve as resolve2 } from "node:path";
 function createDaemonRuntime(options) {
   if (!isAbsolute2(options.dataDirectory))
     throw new Error("Daemon data directory must be absolute");
@@ -3696,8 +3801,8 @@ function createDaemonRuntime(options) {
     cwd: options.dataDirectory,
     env: {
       ...inheritedEnvironment,
-      BUNGEE_CONFIG_DB_PATH: options.inheritedEnvironment?.BUNGEE_CONFIG_DB_PATH ? resolve2(options.inheritedEnvironment.BUNGEE_CONFIG_DB_PATH) : join4(options.dataDirectory, "bungee.db"),
-      BUNGEE_ACCESS_DB_PATH: join4(options.logsDirectory, "access.db"),
+      BUNGEE_CONFIG_DB_PATH: options.inheritedEnvironment?.BUNGEE_CONFIG_DB_PATH ? resolve2(options.inheritedEnvironment.BUNGEE_CONFIG_DB_PATH) : join5(options.dataDirectory, "bungee.db"),
+      BUNGEE_ACCESS_DB_PATH: join5(options.logsDirectory, "access.db"),
       WORKER_COUNT: options.workers ?? "2",
       DAEMON_MODE: "true",
       ...options.port === undefined ? {} : { PORT: options.port }
@@ -3707,9 +3812,9 @@ function createDaemonRuntime(options) {
 
 // src/daemon/pid-mirror.ts
 import { constants as fsConstants2 } from "node:fs";
-import { lstat as lstat2, open as open2, rename as rename2, unlink as unlink2 } from "node:fs/promises";
-import { dirname, isAbsolute as isAbsolute3, parse as parse2, resolve as resolve3 } from "node:path";
-import { randomBytes } from "node:crypto";
+import { lstat as lstat3, open as open3, rename as rename2, unlink as unlink3 } from "node:fs/promises";
+import { dirname as dirname2, isAbsolute as isAbsolute3, parse as parse2, resolve as resolve3 } from "node:path";
+import { randomBytes as randomBytes2 } from "node:crypto";
 var MAX_PID_BYTES = 64;
 var UNSUPPORTED_DIR_FSYNC = new Set(["EINVAL", "ENOTSUP", "EOPNOTSUPP", "ENOSYS", "EPERM", "EISDIR"]);
 function identity2(stat) {
@@ -3728,7 +3833,7 @@ async function rejectSymlinkComponents2(path) {
   for (const part of absolute.slice(root.length).split(/[\\/]+/).filter(Boolean)) {
     current = resolve3(current, part);
     try {
-      if ((await lstat2(current)).isSymbolicLink())
+      if ((await lstat3(current)).isSymbolicLink())
         throw new Error("PID mirror path contains a symlink");
     } catch (error) {
       if (error.code === "ENOENT")
@@ -3742,7 +3847,7 @@ async function syncDirectory(directory, platform) {
     return;
   let handle;
   try {
-    handle = await open2(directory, fsConstants2.O_RDONLY | (fsConstants2.O_DIRECTORY ?? 0));
+    handle = await open3(directory, fsConstants2.O_RDONLY | (fsConstants2.O_DIRECTORY ?? 0));
     await handle.sync();
   } catch (error) {
     if (!UNSUPPORTED_DIR_FSYNC.has(error.code ?? ""))
@@ -3761,7 +3866,7 @@ async function syncDirectory(directory, platform) {
 async function readLegacyPidFile(path) {
   let listed;
   try {
-    listed = await lstat2(path);
+    listed = await lstat3(path);
   } catch (error) {
     const code = error.code;
     return code === "ENOENT" ? { kind: "absent" } : { kind: "unknown" };
@@ -3772,7 +3877,7 @@ async function readLegacyPidFile(path) {
   const noFollow = process.platform === "win32" ? 0 : fsConstants2.O_NOFOLLOW;
   let handle;
   try {
-    handle = await open2(path, fsConstants2.O_RDONLY | noFollow);
+    handle = await open3(path, fsConstants2.O_RDONLY | noFollow);
     const opened = await handle.stat();
     if (!regular(opened) || !sameIdentity2(expected, identity2(opened)))
       return { kind: "unsafe" };
@@ -3797,10 +3902,10 @@ async function readLegacyPidFile(path) {
 }
 async function deleteLegacyPidFile(path, expected) {
   try {
-    const current = await lstat2(path);
+    const current = await lstat3(path);
     if (!regular(current) || current.isSymbolicLink() || !sameIdentity2(identity2(current), expected))
       return false;
-    await unlink2(path);
+    await unlink3(path);
     return true;
   } catch {
     return false;
@@ -3810,10 +3915,10 @@ async function writeLegacyPidMirror(path, pid, options = {}) {
   if (!Number.isSafeInteger(pid) || pid <= 0 || !isAbsolute3(path) || path.includes("\x00"))
     throw new Error("invalid PID mirror target");
   const target = resolve3(path);
-  const directory = dirname(target);
+  const directory = dirname2(target);
   await rejectSymlinkComponents2(directory);
-  const temporary = `${target}.${process.pid}.${randomBytes(16).toString("hex")}.tmp`;
-  const handle = await open2(temporary, fsConstants2.O_WRONLY | fsConstants2.O_CREAT | fsConstants2.O_EXCL, 384);
+  const temporary = `${target}.${process.pid}.${randomBytes2(16).toString("hex")}.tmp`;
+  const handle = await open3(temporary, fsConstants2.O_WRONLY | fsConstants2.O_CREAT | fsConstants2.O_EXCL, 384);
   try {
     await handle.writeFile(String(pid));
     await handle.chmod(384);
@@ -3829,7 +3934,7 @@ async function writeLegacyPidMirror(path, pid, options = {}) {
       await handle.close();
     } catch {}
     try {
-      await unlink2(temporary);
+      await unlink3(temporary);
     } catch {}
     throw error;
   }
@@ -3837,7 +3942,7 @@ async function writeLegacyPidMirror(path, pid, options = {}) {
 
 // src/daemon/process-identity.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { lstat as lstat3, realpath as realpath2 } from "node:fs/promises";
+import { lstat as lstat4, realpath as realpath2 } from "node:fs/promises";
 import { readdir, readFile } from "node:fs/promises";
 import { execFile as nodeExecFile } from "node:child_process";
 import { promisify } from "node:util";
@@ -4108,7 +4213,7 @@ async function probeProcessAlive(pid, options = {}) {
     return "dead";
   if ((options.platform ?? process.platform) === "linux") {
     try {
-      await lstat3(`/proc/${pid}`);
+      await lstat4(`/proc/${pid}`);
       return "alive";
     } catch (error) {
       return error.code === "ENOENT" ? "dead" : "unknown";
@@ -4229,7 +4334,7 @@ async function findExactDaemonProcessDetailed(bootNonce, expectedOrOptions, opti
 // src/daemon/force-stop.ts
 import { execFile as nodeExecFile3 } from "node:child_process";
 import { realpathSync } from "node:fs";
-import { join as join5, win32 as win323 } from "node:path";
+import { join as join6, win32 as win323 } from "node:path";
 import { promisify as promisify3 } from "node:util";
 
 // src/daemon/process-tree.ts
@@ -4540,7 +4645,7 @@ function canonicalTaskkillPath() {
       throw new Error("Windows SystemRoot is unavailable");
     }
   })();
-  const expected = join5(canonicalRoot, "System32", "taskkill.exe");
+  const expected = join6(canonicalRoot, "System32", "taskkill.exe");
   let actual;
   try {
     actual = realpathSync.native(expected);
@@ -5031,6 +5136,7 @@ class DaemonManager {
   findProcessDetailed;
   probePid;
   injectedLaunch;
+  readSecretsKey;
   writePidMirror;
   httpRequest;
   forceStop;
@@ -5052,7 +5158,8 @@ class DaemonManager {
     this.dataDirectory = dependencies.dataDirectory ?? ConfigPaths.DATA_DIR;
     this.logsDirectory = dependencies.logsDirectory ?? ConfigPaths.LOGS_DIR;
     this.inheritedEnvironment = dependencies.inheritedEnvironment ?? process.env;
-    this.metadataFile = join6(this.runtimeDirectory, "daemon.json");
+    this.readSecretsKey = dependencies.readPluginSecretsKey ?? readPluginSecretsKey;
+    this.metadataFile = join7(this.runtimeDirectory, "daemon.json");
     this.now = dependencies.now ?? (() => performance.now());
     this.sleep = dependencies.sleep ?? ((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)));
     this.currentPid = dependencies.currentPid ?? (() => process.pid);
@@ -5315,9 +5422,17 @@ class DaemonManager {
   }
   async start(options = {}) {
     await this.inspectExisting();
+    const runtime = createDaemonRuntime({
+      dataDirectory: this.dataDirectory,
+      logsDirectory: this.logsDirectory,
+      workers: options.workers,
+      port: options.port,
+      inheritedEnvironment: this.inheritedEnvironment
+    });
+    const key = await this.readSecretsKey(runtime.env.BUNGEE_CONFIG_DB_PATH);
     const descriptor = await this.launchDescriptor(options);
     const bootNonce = randomUUID3().toLowerCase();
-    const shutdownSecret = encodeDaemonShutdownSecret(randomBytes2(32));
+    const shutdownSecret = encodeDaemonShutdownSecret(randomBytes3(32));
     const launching = {
       schema: "bungee-daemon-metadata-v1",
       state: "launching",
@@ -5340,15 +5455,8 @@ class DaemonManager {
       }
       throw error;
     }
-    const runtime = createDaemonRuntime({
-      dataDirectory: this.dataDirectory,
-      logsDirectory: this.logsDirectory,
-      workers: options.workers,
-      port: options.port,
-      inheritedEnvironment: this.inheritedEnvironment
-    });
     const env = {
-      ...runtime.env,
+      ...withPluginSecretsKey(runtime.env, key),
       BUNGEE_ROLE: "master",
       BUNGEE_DAEMON_METADATA_PATH: this.metadataFile,
       BUNGEE_DAEMON_BOOT_NONCE: bootNonce,
@@ -5770,15 +5878,15 @@ class DaemonManager {
 }
 
 // src/commands/recovery-file.ts
-import { constants } from "node:fs";
-import { lstat as lstat4, open as open3 } from "node:fs/promises";
+import { constants as constants2 } from "node:fs";
+import { lstat as lstat5, open as open4 } from "node:fs/promises";
 var UNSAFE_INPUT = "Recovery input must be an owner-only regular file of at most 8192 bytes";
 async function openRecoveryInputFile(path, options = {}) {
   const platform = options.platform ?? process.platform;
-  const before = await lstat4(path);
+  const before = await lstat5(path);
   if (!before.isFile() || before.isSymbolicLink() || before.nlink !== 1)
     throw new Error(UNSAFE_INPUT);
-  const file = await open3(path, constants.O_RDONLY | (platform === "win32" ? 0 : constants.O_NOFOLLOW | constants.O_NONBLOCK));
+  const file = await open4(path, constants2.O_RDONLY | (platform === "win32" ? 0 : constants2.O_NOFOLLOW | constants2.O_NONBLOCK));
   try {
     const opened = await file.stat();
     if (!opened.isFile() || opened.nlink !== 1 || opened.dev !== before.dev || opened.ino !== before.ino || opened.size > 8192)
@@ -5787,7 +5895,7 @@ async function openRecoveryInputFile(path, options = {}) {
       await assertWindowsOwnerOnlyFileAcl(path, options.windowsAcl);
     else if ((opened.mode & 511) !== 384 || process.getuid && opened.uid !== process.getuid())
       throw new Error(UNSAFE_INPUT);
-    const after = await lstat4(path);
+    const after = await lstat5(path);
     const final = await file.stat();
     if (!after.isFile() || after.isSymbolicLink() || after.nlink !== 1 || after.dev !== opened.dev || after.ino !== opened.ino || final.nlink !== 1 || final.size > 8192 || final.size !== opened.size || platform !== "win32" && ((final.mode & 511) !== 384 || process.getuid && final.uid !== process.getuid()))
       throw new Error(UNSAFE_INPUT);
@@ -5800,15 +5908,16 @@ async function openRecoveryInputFile(path, options = {}) {
 
 // src/commands/recover.ts
 async function recoverCommand(options = {}) {
-  const launch = await resolveCoreLaunchDescriptor(options);
-  const db = resolve4(process.env.BUNGEE_CONFIG_DB_PATH ?? join7(ConfigPaths.DATA_DIR, "bungee.db"));
+  const db = resolve4(process.env.BUNGEE_CONFIG_DB_PATH ?? join8(ConfigPaths.DATA_DIR, "bungee.db"));
   let file;
   try {
     if (options.file) {
       file = await openRecoveryInputFile(options.file);
     }
+    const key = await readPluginSecretsKey(db);
+    const launch = await resolveCoreLaunchDescriptor(options);
     await new Promise((accept, reject) => {
-      const child = spawn3(launch.executable, [...launch.entrypoint === null ? [] : [launch.entrypoint], "--recover", db], { cwd: ConfigPaths.DATA_DIR, stdio: [file?.fd ?? "inherit", "inherit", "inherit"], env: { ...process.env, BUNGEE_ROLE: "master", BUNGEE_ACCESS_DB_PATH: process.env.BUNGEE_ACCESS_DB_PATH ?? join7(ConfigPaths.LOGS_DIR, "access.db") } });
+      const child = spawn3(launch.executable, [...launch.entrypoint === null ? [] : [launch.entrypoint], "--recover", db], { cwd: dirname3(db), stdio: [file?.fd ?? "inherit", "inherit", "inherit"], env: { ...withPluginSecretsKey(process.env, key), BUNGEE_ROLE: "master", BUNGEE_ACCESS_DB_PATH: process.env.BUNGEE_ACCESS_DB_PATH ?? join8(ConfigPaths.LOGS_DIR, "access.db") } });
       child.once("error", reject);
       child.once("exit", (code) => code === 0 ? accept() : reject(new Error("Offline recovery failed")));
     });
@@ -5818,22 +5927,25 @@ async function recoverCommand(options = {}) {
 }
 
 // src/commands/init.ts
-import { resolve as resolve5, join as join8, dirname as dirname2 } from "node:path";
+import { resolve as resolve5, join as join9, dirname as dirname4 } from "node:path";
 import { spawn as spawn4 } from "node:child_process";
+import { mkdir as mkdir3 } from "node:fs/promises";
 async function initCommand(options = {}) {
-  ConfigPaths.ensureDataDir();
-  ConfigPaths.ensureLogsDir();
-  const configDbPath = resolve5(process.env.BUNGEE_CONFIG_DB_PATH ?? join8(ConfigPaths.DATA_DIR, "bungee.db"));
+  const configDbPath = resolve5(process.env.BUNGEE_CONFIG_DB_PATH ?? join9(ConfigPaths.DATA_DIR, "bungee.db"));
+  const accessDbPath = resolve5(process.env.BUNGEE_ACCESS_DB_PATH ?? join9(ConfigPaths.LOGS_DIR, "access.db"));
+  const key = await initializePluginSecretsKey(configDbPath, options.pluginSecretsKey ?? process.env.BUNGEE_PLUGIN_SECRETS_KEY);
+  await mkdir3(dirname4(accessDbPath), { recursive: true });
   const launch = await resolveCoreLaunchDescriptor(options);
   await new Promise((accept, reject) => {
-    const child = spawn4(launch.executable, [...launch.entrypoint === null ? [] : [launch.entrypoint], "--initialize-config", configDbPath], { cwd: ConfigPaths.DATA_DIR, stdio: "inherit", env: { ...process.env, BUNGEE_ROLE: "master", BUNGEE_ACCESS_DB_PATH: process.env.BUNGEE_ACCESS_DB_PATH ?? join8(ConfigPaths.LOGS_DIR, "access.db") } });
+    const child = spawn4(launch.executable, [...launch.entrypoint === null ? [] : [launch.entrypoint], "--initialize-config", configDbPath], { cwd: dirname4(configDbPath), stdio: "inherit", env: { ...withPluginSecretsKey(process.env, key), BUNGEE_ROLE: "master", BUNGEE_ACCESS_DB_PATH: accessDbPath } });
     child.once("error", reject);
     child.once("exit", (code) => code === 0 ? accept() : reject(new Error(`Configuration initialization failed (${code})`)));
   });
-  console.log(`Bungee data directory initialized at: ${ConfigPaths.DATA_DIR}`);
+  console.log(`Bungee data directory initialized at: ${dirname4(configDbPath)}`);
   console.log(`Configuration database: ${configDbPath}`);
-  console.log(`Plugin state database: ${join8(dirname2(configDbPath), "plugin-state.db")}`);
-  console.log(`Telemetry database: ${ConfigPaths.LOGS_DIR}/access.db`);
+  console.log(`Plugin state database: ${join9(dirname4(configDbPath), "plugin-state.db")}`);
+  console.log(`Plugin secrets key file: ${pluginSecretsKeyPath(configDbPath)}`);
+  console.log(`Telemetry database: ${accessDbPath}`);
   console.log("Start Bungee with: bungee start");
 }
 
@@ -6154,7 +6266,7 @@ function createProgram() {
       process.exitCode = 1;
     }
   });
-  program.command("init").description("Initialize the Bungee SQLite data directory").action(initCommand);
+  program.command("init").description("Initialize the Bungee SQLite data directory and persistent plugin secrets key").option("--plugin-secrets-key <base64>", "Initialize with a canonical Base64 key for 32 bytes (otherwise use BUNGEE_PLUGIN_SECRETS_KEY or generate one)").action(initCommand);
   program.command("recover").description("Recover a stopped instance using bounded JSON from stdin or a 0600 file").option("--file <path>", "Owner-only 0600 recovery JSON input file").addHelpText("after", `
 Stop the instance first. Supply one JSON object via stdin or bungee recover --file recovery.json (chmod 600).
 Administrator identity: {"kind":"identity","plugin":"local-accounts","payload":{"username":"admin","password":"<new password, 15-128 characters>","reason":"Lost credentials"}}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jeffusion/bungee",
-  "version": "5.24.3",
+  "version": "5.25.0",
   "description": "High-performance reverse proxy server CLI",
   "type": "module",
   "bin": {
@@ -13,8 +13,8 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@jeffusion/bungee-core": "^5.24.3",
-    "@jeffusion/bungee-types": "^5.24.3",
+    "@jeffusion/bungee-core": "^5.25.0",
+    "@jeffusion/bungee-types": "^5.25.0",
     "cli-progress": "^3.12.0",
     "commander": "^14.0.1"
   },