@sharedenv/cli 1.1.0 → 1.1.1

package/bin/sharedenv.js

@@ -164,7 +164,16 @@ async function cmdLogin({ values }) {
   const client = createClient({ baseUrl, cookies, userAgent: USER_AGENT });
   const otp = async () => process.env.SHAREDENV_OTP || (await ask('Two-factor code: '));
   await login(client, { identifier, password, otp });
-  const account = await unlockAccount(client, password); // the vault opens: only then is anything kept
+  // The vault opens: only then is anything kept. The server just accepted this password,
+  // so a vault it does not open was sealed under the one before a reset.
+  const account = await unlockAccount(client, password).catch((err) => {
+    if (err.code !== 'VAULT_SEALED') throw err;
+    throw new Error(
+      'your password was reset, and the vault is still sealed under the old one. Sign in ' +
+        'once on the web app and enter your recovery code: the vault then opens with the new ' +
+        'password, here too'
+    );
+  });
   store.writeSession({ baseUrl, cookies: client.cookies() });
   note(`Signed in to ${baseUrl}.`);
   await watchOwnKey(client, account);

package/lib/auth.js

@@ -64,7 +64,12 @@ export async function unlockAccount(client, password) {
   try {
     privateKey = unwrapPrivateKey(keyring.encPrivateKey, password, keyring.kdf);
   } catch {
-    throw new Error('wrong password — could not unlock the vault');
+    const err = new Error(
+      'this password does not unlock the vault. If you reset it, the vault is still sealed ' +
+        'under the old one: sign in once on the web app and enter your recovery code there'
+    );
+    err.code = 'VAULT_SEALED';
+    throw err;
   }
   // The directory must name the key we hold: a row naming another public key would let
   // the server choose who receives what is sealed to "us".

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sharedenv/cli",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "type": "module",
   "description": "sharedenv CLI — pull and run with your zero-knowledge secrets, decrypted locally.",
   "license": "Apache-2.0",