@keydris/cli 0.1.8 → 0.1.10

package/README.md

@@ -15,6 +15,10 @@ implementation remains in the native binary.
 Do not install with `--omit=optional`; that omits the platform binary. A global
 installation is recommended when using the long-running `keydris proxy`.
 
-This package performs no privileged work during installation. Trust-store
-changes happen only when explicitly requested through
-`keydris init --trust-store`.
+The install writes the channel defaults to `~/.keydris.toml`, backing up an
+existing file as `~/.keydris.toml.bak`. Stable releases use the stable config;
+prereleases use the dev config. Set `KEYDRIS_NO_CONFIG=1` to leave an existing
+config unchanged. npm's `--ignore-scripts` option skips this config step.
+
+The package performs no privileged work during installation. Trust-store changes
+happen only when explicitly requested through `keydris init --trust-store`.

package/config/dev.toml

@@ -0,0 +1,19 @@
+# Keydris dev-channel defaults. npm prereleases install this to ~/.keydris.toml.
+#
+# Lowest-precedence config: override any value with an environment variable.
+# Project-local .env/.keydris.toml files require KEYDRIS_TRUST_PROJECT_CONFIG=1.
+# Each key maps to KEYDRIS_<UPPER(KEY)>.
+
+[keydris]
+# `keydris upgrade` reads this to stay on the channel this install came from.
+channel = "dev"
+
+control_url      = "https://dev.api.keydris.com"
+control_mtls_url = "https://dev.api.keydris.com:8443"
+trust_domain     = "keydris.local"
+
+oidc_issuer        = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_Hjh0EehFH"
+cognito_domain     = "keydris-dev.auth.us-east-1.amazoncognito.com"
+oauth_client_id    = "791bq13e9aijdu8cspi851mv5u"
+oauth_scopes       = "openid email"
+oauth_redirect_url = "http://localhost:3000/callback"

package/config/stable.toml

@@ -0,0 +1,19 @@
+# Keydris stable-channel defaults. npm installs this to ~/.keydris.toml.
+#
+# Lowest-precedence config: override any value with an environment variable.
+# Project-local .env/.keydris.toml files require KEYDRIS_TRUST_PROJECT_CONFIG=1.
+# Each key maps to KEYDRIS_<UPPER(KEY)>.
+
+[keydris]
+# `keydris upgrade` reads this to stay on the channel this install came from.
+channel = "stable"
+
+control_url      = "https://api.keydris.com"
+control_mtls_url = "https://api.keydris.com:8443"
+trust_domain     = "keydris.local"
+
+oidc_issuer        = "https://cognito-idp.us-east-1.amazonaws.com/us-east-1_ft2ArrhS7"
+cognito_domain     = "https://auth.keydris.com"
+oauth_client_id    = "6rll39d1l5hq1irjag9o4cu8m2"
+oauth_scopes       = "openid email"
+oauth_redirect_url = "http://localhost:3000/callback"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@keydris/cli",
-  "version": "0.1.8",
+  "version": "0.1.10",
   "description": "Governed, per-session identity and brokered egress for AI agents",
   "type": "module",
   "bin": {
@@ -8,21 +8,24 @@
   },
   "files": [
     "bin",
+    "config",
+    "scripts",
     "README.md"
   ],
   "engines": {
     "node": ">=20"
   },
   "scripts": {
+    "postinstall": "node scripts/install-config.mjs",
     "prepublishOnly": "node ../../scripts/prepublish-check.mjs"
   },
   "optionalDependencies": {
-    "@keydris/cli-win32-x64": "0.1.8",
-    "@keydris/cli-win32-arm64": "0.1.8",
-    "@keydris/cli-darwin-x64": "0.1.8",
-    "@keydris/cli-darwin-arm64": "0.1.8",
-    "@keydris/cli-linux-x64": "0.1.8",
-    "@keydris/cli-linux-arm64": "0.1.8"
+    "@keydris/cli-win32-x64": "0.1.10",
+    "@keydris/cli-win32-arm64": "0.1.10",
+    "@keydris/cli-darwin-x64": "0.1.10",
+    "@keydris/cli-darwin-arm64": "0.1.10",
+    "@keydris/cli-linux-x64": "0.1.10",
+    "@keydris/cli-linux-arm64": "0.1.10"
   },
   "keywords": [
     "ai",

package/scripts/install-config.mjs

@@ -0,0 +1,54 @@
+import { copyFile, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+
+async function installConfig() {
+  const home = homedir();
+  if (!home) {
+    throw new Error("could not resolve the user's home directory");
+  }
+
+  const manifest = JSON.parse(
+    await readFile(new URL("../package.json", import.meta.url), "utf8")
+  );
+  const channel = manifest.version.includes("-") ? "dev" : "stable";
+  const source = new URL(`../config/${channel}.toml`, import.meta.url);
+  const data = await readFile(source);
+  const destination = path.join(home, ".keydris.toml");
+
+  if (process.env.KEYDRIS_NO_CONFIG === "1") {
+    console.log(
+      `keydris: KEYDRIS_NO_CONFIG=1; leaving ${destination} unchanged`
+    );
+    return;
+  }
+
+  let existing;
+  try {
+    existing = await readFile(destination);
+  } catch (error) {
+    if (error.code !== "ENOENT") {
+      throw error;
+    }
+  }
+
+  if (existing?.equals(data)) {
+    console.log(`keydris: ${channel} config already up to date at ${destination}`);
+    return;
+  }
+
+  if (existing) {
+    const backup = `${destination}.bak`;
+    await copyFile(destination, backup);
+    console.log(`keydris: backed up existing config to ${backup}`);
+  }
+
+  await writeFile(destination, data, { mode: 0o644 });
+  console.log(`keydris: wrote ${channel} config to ${destination}`);
+}
+
+try {
+  await installConfig();
+} catch (error) {
+  console.warn(`keydris: WARNING: could not install ~/.keydris.toml: ${error.message}`);
+}