@moxxy/cli 0.1.3 → 0.1.5

package/dist/bin.js

@@ -90305,14 +90305,14 @@ function randomCode(digits = 6) {
 }
 
 // ../plugin-vault/dist/keysource.js
-var KEYTAR_SERVICE = "moxxy";
-var KEYTAR_ACCOUNT = "vault-master-key";
+var KEYCHAIN_SERVICE = "moxxy";
+var KEYCHAIN_ACCOUNT = "vault-master-key";
 function createCombinedKeySource(opts) {
   let resolvedName = "unknown";
   const diskPath = resolveDiskPath(opts.diskKeyPath);
   const persistKey = async (keyB64) => {
     if (!opts.disableKeytar)
-      await tryKeytarSet(keyB64);
+      await tryKeychainSet(keyB64);
     if (diskPath)
       await tryDiskSet(diskPath, keyB64);
   };
@@ -90328,9 +90328,9 @@ function createCombinedKeySource(opts) {
         return deriveKey(envValue, salt);
       }
       if (!opts.disableKeytar) {
-        const fromKeychain = await tryKeytarGet();
+        const fromKeychain = await tryKeychainGet();
         if (fromKeychain) {
-          resolvedName = "keytar";
+          resolvedName = "keychain";
           if (diskPath)
             void tryDiskSet(diskPath, fromKeychain);
           return Buffer.from(fromKeychain, "base64");
@@ -90341,7 +90341,7 @@ function createCombinedKeySource(opts) {
         if (fromDisk) {
           resolvedName = `file:${diskPath}`;
           if (!opts.disableKeytar)
-            void tryKeytarSet(fromDisk);
+            void tryKeychainSet(fromDisk);
           return Buffer.from(fromDisk, "base64");
         }
       }
@@ -90377,24 +90377,22 @@ async function tryDiskSet(filePath, value) {
   } catch {
   }
 }
-async function tryKeytarGet() {
+async function tryKeychainGet() {
   try {
-    const mod = await import('keytar');
-    const fn = mod.getPassword ?? mod.default?.getPassword;
-    if (!fn)
+    const mod = await import('@napi-rs/keyring');
+    if (!mod.Entry)
       return null;
-    return await fn(KEYTAR_SERVICE, KEYTAR_ACCOUNT);
+    return new mod.Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT).getPassword() || null;
   } catch {
     return null;
   }
 }
-async function tryKeytarSet(value) {
+async function tryKeychainSet(value) {
   try {
-    const mod = await import('keytar');
-    const fn = mod.setPassword ?? mod.default?.setPassword;
-    if (!fn)
+    const mod = await import('@napi-rs/keyring');
+    if (!mod.Entry)
       return;
-    await fn(KEYTAR_SERVICE, KEYTAR_ACCOUNT, value);
+    new mod.Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT).setPassword(value);
   } catch {
   }
 }
@@ -90405,7 +90403,7 @@ var VaultPassphraseError = class extends Error {
     super(`Wrong vault passphrase for ${filePath}.
   If you've forgotten it, wipe the vault and key cache, then re-run \`moxxy init\`:
     rm ${filePath} ~/.moxxy/vault.key
-  (If keytar is installed, also clear the entry: \`security delete-generic-password -s moxxy\` on macOS.)
+  (If the OS keychain holds a cached key, also clear it: \`security delete-generic-password -s moxxy\` on macOS.)
   Or set MOXXY_VAULT_PASSPHRASE to a known value to skip the prompt entirely.`);
     this.filePath = filePath;
     this.name = "VaultPassphraseError";
@@ -118363,7 +118361,10 @@ async function setupSessionWithConfig(opts) {
     skipUser: opts.skipUserConfig
   });
   progress({ kind: "config-loaded", sources: sources.length });
-  const { plugin: vaultPlugin, vault } = buildVaultPlugin({ disableKeytar: opts.disableKeytar });
+  const { plugin: vaultPlugin, vault } = buildVaultPlugin({
+    disableKeytar: opts.disableKeytar,
+    ...opts.passphrasePrompt ? { passphrasePrompt: opts.passphrasePrompt } : {}
+  });
   const config = await resolveConfigPlaceholders(rawConfig, vault, logger);
   const session = await buildSession({
     cwd: opts.cwd,
@@ -120075,15 +120076,17 @@ function renderLogo(width = process.stdout.columns ?? 80, opts = {}) {
   return "\n" + body + "\n\n";
 }
 async function runInitCommand(argv) {
+  const interactive = Boolean(process.stdin.isTTY);
   const { session, vault } = await bootSessionWithConfig(argv, {
     skipKeyPrompt: true,
-    skipProviderActivation: true
+    skipProviderActivation: true,
+    ...interactive ? { passphrasePrompt: promptVaultPassphrase } : {}
   });
-  if (!process.stdin.isTTY) {
+  if (!interactive) {
     return await runHeadlessInit(session, vault);
   }
-  await vault.open();
   process.stdout.write(renderLogo());
+  await vault.open();
   const providerDefs = session.providers.list();
   const defsByName = new Map(providerDefs.map((d2) => [d2.name, d2]));
   const providers = providerDefs.map((p3) => {
@@ -120171,6 +120174,26 @@ async function runHeadlessInit(session, vault) {
 `);
   return 0;
 }
+async function promptVaultPassphrase() {
+  Se2(
+    [
+      "moxxy keeps your API keys in a local encrypted vault.",
+      "Choose a passphrase to protect it \u2014 it's cached in your OS keychain",
+      `(or ${colors.dim("~/.moxxy/vault.key")}) so you won't be asked again.`,
+      `Tip: set ${colors.bold("MOXXY_VAULT_PASSPHRASE")} to skip this prompt.`
+    ].join("\n"),
+    "Step 0 \u2014 Vault passphrase"
+  );
+  const value = await Ce2({
+    message: "Set a vault passphrase",
+    validate: (v3) => v3 && v3.trim().length > 0 ? void 0 : "Enter a passphrase (esc to cancel)."
+  });
+  if (q2(value)) {
+    me2("Setup cancelled. Run `moxxy init` again when you are ready.");
+    process.exit(1);
+  }
+  return value.trim();
+}
 function providerAuthKind(def) {
   return def.auth?.kind === "oauth" ? "oauth" : "apiKey";
 }
@@ -123343,7 +123366,10 @@ async function runServeStatus(except, all) {
   return 0;
 }
 async function runServeForeground(argv, except, all) {
-  const setup = await bootSessionWithConfig(argv, { skipKeyPrompt: true });
+  const setup = await bootSessionWithConfig(argv, {
+    skipKeyPrompt: true,
+    tolerateNoProvider: true
+  });
   const { session, vault, config, scheduler, webhooks } = setup;
   const setupHandle = { scheduler, webhooks };
   let runnerServer;