@rogatio/cli 5.2.1 → 5.2.2

package/dist/node/index.js

@@ -22022,20 +22022,22 @@ var darwinAdapter = {
   }
 };
 var darwin_default = darwinAdapter;
+var CA_DIR = "/usr/local/share/ca-certificates";
+var CERT_PATH = posixJoin2(CA_DIR, "rogatio-ca.crt");
+function hasSudo() {
+  const result = spawnSync2("sudo", ["-n", "true"], { timeout: 1e3 });
+  return result.status === 0;
+}
 var linuxAdapter = {
   platform: "linux",
   defaultManifestDir: () => {
     const home = process.env.HOME ?? "";
     return posixJoin2(home, ".config/google-chrome/NativeMessagingHosts");
   },
-  defaultCaInstallPath: () => {
-    const home = process.env.HOME ?? "";
-    return posixJoin2(home, ".local/share/ca-certificates");
-  },
+  defaultCaInstallPath: () => CA_DIR,
   detect() {
     const reasons = [];
     const manifestDir = this.defaultManifestDir();
-    const caDir = this.defaultCaInstallPath();
     const updateCa = spawnSync2("which", ["update-ca-certificates"], {
       timeout: 1e3
     });
@@ -22048,20 +22050,22 @@ var linuxAdapter = {
       reasons.push("manifest-dir-unwritable");
     }
     try {
-      accessSync2(caDir, constants3.W_OK);
+      accessSync2(CA_DIR, constants3.W_OK);
     } catch (err) {
       if (err?.code === "ENOENT") {
         try {
-          accessSync2(dirname4(caDir), constants3.W_OK);
+          accessSync2(dirname4(CA_DIR), constants3.W_OK);
         } catch {
-          reasons.push("ca-store-unwritable");
+          if (!hasSudo()) {
+            reasons.push("elevation-required");
+          }
         }
-      } else {
-        reasons.push("ca-store-unwritable");
+      } else if (!hasSudo()) {
+        reasons.push("elevation-required");
       }
     }
     const manifest = !reasons.includes("tooling-missing") && !reasons.includes("manifest-dir-unwritable");
-    const caTrust = !reasons.includes("tooling-missing") && !reasons.includes("ca-store-unwritable");
+    const caTrust = !reasons.includes("tooling-missing") && !reasons.includes("elevation-required");
     return {
       manifest,
       caTrust,
@@ -22069,37 +22073,41 @@ var linuxAdapter = {
     };
   },
   async caTrustInstaller(certPem) {
-    const caDir = this.defaultCaInstallPath();
-    const certPath = posixJoin2(caDir, "rogatio-ca.crt");
     try {
-      mkdirSync(caDir, { recursive: true });
+      mkdirSync(CA_DIR, { recursive: true });
     } catch {
       throw new TrustError("trust.internal", "ca-store-unwritable", [
         "ca-store-unwritable"
       ]);
     }
-    try {
-      await new Promise((resolve22, reject) => {
-        const child = spawn2("sh", [
+    const certResult = await new Promise(
+      (resolve22) => {
+        const child = spawn2("sudo", [
+          "sh",
           "-c",
-          `cat > "${certPath}" << 'EOF'
+          `cat > "${CERT_PATH}" << 'EOF'
 ${certPem}
 EOF`
         ]);
-        child.on(
-          "close",
-          (code) => code === 0 ? resolve22() : reject(new Error(`exit code ${code}`))
-        );
-        child.on("error", reject);
-      });
-    } catch {
-      throw new TrustError("trust.internal", "ca-store-unwritable", [
-        "ca-store-unwritable"
-      ]);
+        let stderr = "";
+        child.stderr?.on("data", (data) => {
+          stderr += data.toString();
+        });
+        child.on("close", (code) => resolve22({ code: code ?? 1, stderr }));
+        child.on("error", (err) => resolve22({ code: 1, stderr: err.message }));
+      }
+    );
+    if (certResult.code !== 0) {
+      const stderr = certResult.stderr.toLowerCase();
+      let reason = "ca-store-unwritable";
+      if (stderr.includes("permission") || stderr.includes("not permitted") || stderr.includes("no tty") || stderr.includes("terminal")) {
+        reason = "elevation-required";
+      }
+      throw new TrustError("trust.internal", reason, [reason]);
     }
     const result = await new Promise(
       (resolve22) => {
-        const child = spawn2("update-ca-certificates");
+        const child = spawn2("sudo", ["update-ca-certificates"]);
         let stderr = "";
         child.stderr?.on("data", (data) => {
           stderr += data.toString();
@@ -22111,17 +22119,15 @@ EOF`
     if (result.code !== 0) {
       const stderr = result.stderr.toLowerCase();
       let reason = "ca-store-unwritable";
-      if (stderr.includes("permission") || stderr.includes("not permitted")) {
-        reason = "ca-store-unwritable";
+      if (stderr.includes("permission") || stderr.includes("not permitted") || stderr.includes("no tty") || stderr.includes("terminal")) {
+        reason = "elevation-required";
       }
       throw new TrustError("trust.internal", reason, [reason]);
     }
   },
   async caTrustRemover() {
-    const caDir = this.defaultCaInstallPath();
-    const certPath = posixJoin2(caDir, "rogatio-ca.crt");
     try {
-      unlinkSync2(certPath);
+      unlinkSync2(CERT_PATH);
     } catch {
     }
   }
@@ -24247,7 +24253,9 @@ consolidated native-messaging host (spec REQ-001..REQ-005).
 
 Request-body trust commands:
   install   Install the native-messaging host manifest and (on capable
-            platforms) provision the device-local CA (requires --extension-id)
+            platforms) provision the device-local CA (requires --extension-id).
+            CA trust requires root/admin: Linux (sudo), macOS (keychain
+            password), Windows (Administrator).
   uninstall Remove the native-messaging host manifest and the device-local CA trust (idempotent)
 
 Native host command:
@@ -24338,9 +24346,9 @@ function reportTrust(subcommand, result, okMessage) {
     const hints = {
       "tooling-missing": "Hint: install required tooling (macOS: security; Linux: update-ca-certificates; Windows: certutil is built-in)",
       "manifest-dir-unwritable": "Hint: check permissions on Chrome NativeMessagingHosts directory or run with appropriate access",
-      "keychain-unwritable": "Hint: macOS login keychain not writable; try running with appropriate keychain access or use sudo for system keychain (future slice)",
-      "ca-store-unwritable": "Hint: ~/.local/share/ca-certificates not writable; check permissions",
-      "elevation-required": "Hint: Windows system certificate store requires Administrator; re-run in elevated terminal (future slice)"
+      "keychain-unwritable": "Hint: macOS login keychain not writable; try running with appropriate keychain access or use sudo for system keychain",
+      "ca-store-unwritable": "Hint: /usr/local/share/ca-certificates not writable; check directory permissions",
+      "elevation-required": "Hint: device-local CA trust requires root (Linux: sudo, macOS: keychain password, Windows: Administrator). Re-run with elevated privileges"
     };
     for (const reason of reasons) {
       const hint = hints[reason];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rogatio/cli",
-  "version": "5.2.1",
+  "version": "5.2.2",
   "private": false,
   "type": "module",
   "description": "Local-first browser request and response rules — editor host, file verification, test runner, and runtime dispatch.",