@sinch/cli 0.4.15 → 0.4.16

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sinch/cli",
-  "version": "0.4.15",
+  "version": "0.4.16",
   "description": "Official Sinch CLI - Manage all Sinch products from your terminal",
   "main": "bin/sinch",
   "bin": {

package/scripts/postinstall.js

@@ -14,7 +14,7 @@ const fs = require('fs');
 const path = require('path');
 const os = require('os');
 const https = require('https');
-const { spawn } = require('child_process');
+const { spawn, spawnSync } = require('child_process');
 const { getPlatformBinaryInfo } = require('../bin/platform-resolver');
 
 const SINCH_DIR = path.join(os.homedir(), '.sinch');
@@ -286,6 +286,27 @@ async function downloadBinary(version) {
   }
 }
 
+// Detect-only — never install. We deliberately do NOT shell out to apt/dnf/etc
+// here: needs sudo, distro-specific, and may trigger corporate EDR. The user
+// gets a one-shot hint at install time; from there it's their call.
+function warnIfLinuxKeychainMissing() {
+  if (process.platform !== 'linux') return;
+  try {
+    const probe = spawnSync('secret-tool', ['--version'], { stdio: 'ignore' });
+    if (probe.status === 0) return;
+  } catch {
+    // ENOENT → fall through to warning
+  }
+  process.stderr.write(
+    '\n  ⚠️  libsecret-tools is not installed. Sinch CLI needs `secret-tool` to store\n' +
+      '     credentials securely in the OS keyring on Linux. Without it, secrets will\n' +
+      '     be written to plaintext config (~/.sinch/profiles/<active>.json).\n\n' +
+      '     Debian/Ubuntu:  sudo apt install libsecret-tools gnome-keyring dbus-x11\n' +
+      '     Fedora/RHEL:    sudo dnf install libsecret gnome-keyring dbus-tools\n' +
+      '     Arch:           sudo pacman -S libsecret gnome-keyring dbus\n\n'
+  );
+}
+
 async function main() {
   if (process.env.npm_config_global !== 'true' && !process.env.SINCH_FORCE_POSTINSTALL) {
     return;
@@ -303,6 +324,8 @@ async function main() {
     } else {
       installBashZshCompletion();
     }
+
+    warnIfLinuxKeychainMissing();
   } catch {}
 }