@rogatio/cli 5.2.0 → 5.2.2

package/dist/node/index.js

@@ -2,7 +2,7 @@
 
 // packages/cli/src/index.ts
 import { realpathSync } from "node:fs";
-import { basename as basename4, dirname as dirname7, resolve as resolve8 } from "node:path";
+import { basename as basename4, dirname as dirname8, resolve as resolve8 } from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // packages/runtime/dist/node/index.js
@@ -1176,6 +1176,7 @@ import { dirname as dirname3, join as join3 } from "node:path";
 import { join as posixJoin } from "node:path/posix";
 import { spawn as spawn2, spawnSync as spawnSync2 } from "node:child_process";
 import { accessSync as accessSync2, constants as constants3, mkdirSync, unlinkSync as unlinkSync2 } from "node:fs";
+import { dirname as dirname4 } from "node:path";
 import { join as posixJoin2 } from "node:path/posix";
 import { spawn as spawn3, spawnSync as spawnSync3 } from "node:child_process";
 import { accessSync as accessSync3, constants as constants4, unlinkSync as unlinkSync3, writeFileSync as writeFileSync2 } from "node:fs";
@@ -22021,20 +22022,22 @@ var darwinAdapter = {
   }
 };
 var darwin_default = darwinAdapter;
+var CA_DIR = "/usr/local/share/ca-certificates";
+var CERT_PATH = posixJoin2(CA_DIR, "rogatio-ca.crt");
+function hasSudo() {
+  const result = spawnSync2("sudo", ["-n", "true"], { timeout: 1e3 });
+  return result.status === 0;
+}
 var linuxAdapter = {
   platform: "linux",
   defaultManifestDir: () => {
     const home = process.env.HOME ?? "";
     return posixJoin2(home, ".config/google-chrome/NativeMessagingHosts");
   },
-  defaultCaInstallPath: () => {
-    const home = process.env.HOME ?? "";
-    return posixJoin2(home, ".local/share/ca-certificates");
-  },
+  defaultCaInstallPath: () => CA_DIR,
   detect() {
     const reasons = [];
     const manifestDir = this.defaultManifestDir();
-    const caDir = this.defaultCaInstallPath();
     const updateCa = spawnSync2("which", ["update-ca-certificates"], {
       timeout: 1e3
     });
@@ -22047,12 +22050,22 @@ var linuxAdapter = {
       reasons.push("manifest-dir-unwritable");
     }
     try {
-      accessSync2(caDir, constants3.W_OK);
-    } catch {
-      reasons.push("ca-store-unwritable");
+      accessSync2(CA_DIR, constants3.W_OK);
+    } catch (err) {
+      if (err?.code === "ENOENT") {
+        try {
+          accessSync2(dirname4(CA_DIR), constants3.W_OK);
+        } catch {
+          if (!hasSudo()) {
+            reasons.push("elevation-required");
+          }
+        }
+      } else if (!hasSudo()) {
+        reasons.push("elevation-required");
+      }
     }
     const manifest = !reasons.includes("tooling-missing") && !reasons.includes("manifest-dir-unwritable");
-    const caTrust = !reasons.includes("tooling-missing") && !reasons.includes("ca-store-unwritable");
+    const caTrust = !reasons.includes("tooling-missing") && !reasons.includes("elevation-required");
     return {
       manifest,
       caTrust,
@@ -22060,37 +22073,41 @@ var linuxAdapter = {
     };
   },
   async caTrustInstaller(certPem) {
-    const caDir = this.defaultCaInstallPath();
-    const certPath = posixJoin2(caDir, "rogatio-ca.crt");
     try {
-      mkdirSync(caDir, { recursive: true });
+      mkdirSync(CA_DIR, { recursive: true });
     } catch {
       throw new TrustError("trust.internal", "ca-store-unwritable", [
         "ca-store-unwritable"
       ]);
     }
-    try {
-      await new Promise((resolve22, reject) => {
-        const child = spawn2("sh", [
+    const certResult = await new Promise(
+      (resolve22) => {
+        const child = spawn2("sudo", [
+          "sh",
           "-c",
-          `cat > "${certPath}" << 'EOF'
+          `cat > "${CERT_PATH}" << 'EOF'
 ${certPem}
 EOF`
         ]);
-        child.on(
-          "close",
-          (code) => code === 0 ? resolve22() : reject(new Error(`exit code ${code}`))
-        );
-        child.on("error", reject);
-      });
-    } catch {
-      throw new TrustError("trust.internal", "ca-store-unwritable", [
-        "ca-store-unwritable"
-      ]);
+        let stderr = "";
+        child.stderr?.on("data", (data) => {
+          stderr += data.toString();
+        });
+        child.on("close", (code) => resolve22({ code: code ?? 1, stderr }));
+        child.on("error", (err) => resolve22({ code: 1, stderr: err.message }));
+      }
+    );
+    if (certResult.code !== 0) {
+      const stderr = certResult.stderr.toLowerCase();
+      let reason = "ca-store-unwritable";
+      if (stderr.includes("permission") || stderr.includes("not permitted") || stderr.includes("no tty") || stderr.includes("terminal")) {
+        reason = "elevation-required";
+      }
+      throw new TrustError("trust.internal", reason, [reason]);
     }
     const result = await new Promise(
       (resolve22) => {
-        const child = spawn2("update-ca-certificates");
+        const child = spawn2("sudo", ["update-ca-certificates"]);
         let stderr = "";
         child.stderr?.on("data", (data) => {
           stderr += data.toString();
@@ -22102,17 +22119,15 @@ EOF`
     if (result.code !== 0) {
       const stderr = result.stderr.toLowerCase();
       let reason = "ca-store-unwritable";
-      if (stderr.includes("permission") || stderr.includes("not permitted")) {
-        reason = "ca-store-unwritable";
+      if (stderr.includes("permission") || stderr.includes("not permitted") || stderr.includes("no tty") || stderr.includes("terminal")) {
+        reason = "elevation-required";
       }
       throw new TrustError("trust.internal", reason, [reason]);
     }
   },
   async caTrustRemover() {
-    const caDir = this.defaultCaInstallPath();
-    const certPath = posixJoin2(caDir, "rogatio-ca.crt");
     try {
-      unlinkSync2(certPath);
+      unlinkSync2(CERT_PATH);
     } catch {
     }
   }
@@ -23739,12 +23754,12 @@ function createRoutes(context) {
 }
 
 // packages/cli/src/utils/asset-paths.ts
-import { dirname as dirname4, resolve as resolve3 } from "node:path";
+import { dirname as dirname5, resolve as resolve3 } from "node:path";
 import { fileURLToPath } from "node:url";
-function isDistBuild(here = dirname4(fileURLToPath(import.meta.url))) {
+function isDistBuild(here = dirname5(fileURLToPath(import.meta.url))) {
   return here.includes("/dist/") || here.includes("\\dist\\");
 }
-function editorAssetPaths(here = dirname4(fileURLToPath(import.meta.url))) {
+function editorAssetPaths(here = dirname5(fileURLToPath(import.meta.url))) {
   const editorRoot = isDistBuild(here) ? resolve3(here, "..", "editor") : resolve3(here, "..", "..", "..", "editor", "dist", "browser");
   return {
     bundle: resolve3(editorRoot, "index.js"),
@@ -23811,7 +23826,7 @@ async function launchBrowser(url) {
 // packages/cli/src/utils/file.ts
 import { randomBytes as randomBytes4 } from "node:crypto";
 import { mkdir as mkdir3, readFile as readFile5, rename as rename2, writeFile as writeFile3 } from "node:fs/promises";
-import { basename as basename3, dirname as dirname5, join as join5 } from "node:path";
+import { basename as basename3, dirname as dirname6, join as join5 } from "node:path";
 var ProjectFileError = class extends Error {
   code;
   path;
@@ -23861,10 +23876,10 @@ async function readProject(path2) {
   }
 }
 async function writeProject(path2, data) {
-  const tempName = `.${basename3(dirname5(path2))}.${randomBytes4(8).toString("hex")}.tmp`;
-  const tempPath = join5(dirname5(path2), tempName);
+  const tempName = `.${basename3(dirname6(path2))}.${randomBytes4(8).toString("hex")}.tmp`;
+  const tempPath = join5(dirname6(path2), tempName);
   try {
-    await mkdir3(dirname5(path2), { recursive: true });
+    await mkdir3(dirname6(path2), { recursive: true });
     await writeFile3(tempPath, JSON.stringify(data, null, 2), "utf-8");
     await rename2(tempPath, path2);
   } catch (e) {
@@ -24227,7 +24242,7 @@ function generateEditorHtml(apiBase, csrfToken, filePath, aiConfigured) {
 }
 
 // packages/cli/src/commands/runtime.ts
-import { dirname as dirname6, isAbsolute, join as join6, relative, resolve as resolve5, sep as sep2 } from "node:path";
+import { dirname as dirname7, isAbsolute, join as join6, relative, resolve as resolve5, sep as sep2 } from "node:path";
 function showRuntimeHelp() {
   console.log(`Usage: rogatio runtime <command> [options]
        rogatio runtime host [path]
@@ -24238,7 +24253,9 @@ consolidated native-messaging host (spec REQ-001..REQ-005).
 
 Request-body trust commands:
   install   Install the native-messaging host manifest and (on capable
-            platforms) provision the device-local CA (requires --extension-id)
+            platforms) provision the device-local CA (requires --extension-id).
+            CA trust requires root/admin: Linux (sudo), macOS (keychain
+            password), Windows (Administrator).
   uninstall Remove the native-messaging host manifest and the device-local CA trust (idempotent)
 
 Native host command:
@@ -24329,9 +24346,9 @@ function reportTrust(subcommand, result, okMessage) {
     const hints = {
       "tooling-missing": "Hint: install required tooling (macOS: security; Linux: update-ca-certificates; Windows: certutil is built-in)",
       "manifest-dir-unwritable": "Hint: check permissions on Chrome NativeMessagingHosts directory or run with appropriate access",
-      "keychain-unwritable": "Hint: macOS login keychain not writable; try running with appropriate keychain access or use sudo for system keychain (future slice)",
-      "ca-store-unwritable": "Hint: ~/.local/share/ca-certificates not writable; check permissions",
-      "elevation-required": "Hint: Windows system certificate store requires Administrator; re-run in elevated terminal (future slice)"
+      "keychain-unwritable": "Hint: macOS login keychain not writable; try running with appropriate keychain access or use sudo for system keychain",
+      "ca-store-unwritable": "Hint: /usr/local/share/ca-certificates not writable; check directory permissions",
+      "elevation-required": "Hint: device-local CA trust requires root (Linux: sudo, macOS: keychain password, Windows: Administrator). Re-run with elevated privileges"
     };
     for (const reason of reasons) {
       const hint = hints[reason];
@@ -24452,7 +24469,7 @@ async function runtimeHostCommand(args) {
     }
     return 1;
   }
-  const rootDir = root ?? (inputPath === "-" ? process.cwd() : dirname6(filePath));
+  const rootDir = root ?? (inputPath === "-" ? process.cwd() : dirname7(filePath));
   const mocksResult = buildMockConfigs(compileResult.operations, rootDir);
   if (!mocksResult.ok) {
     console.error(`Error: ${mocksResult.message}`);
@@ -24918,7 +24935,7 @@ async function verifyCommand(args, stdinInput, captureOutput = false) {
 }
 
 // packages/cli/src/index.ts
-var __dirname = dirname7(fileURLToPath2(import.meta.url));
+var __dirname = dirname8(fileURLToPath2(import.meta.url));
 var packageJsonPath = resolve8(
   __dirname,
   isDistBuild(__dirname) ? "../../package.json" : "../package.json"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "5.2.0",
+  "version": "5.2.2",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",