@wlfi-agent/cli 1.4.14 → 1.4.16

package/Cargo.lock

@@ -3799,6 +3799,7 @@ version = "0.1.0"
 dependencies = [
  "anyhow",
  "clap",
+ "core-foundation",
  "libc",
  "nix",
  "reqwest",

package/Cargo.toml

@@ -17,7 +17,7 @@ resolver = "2"
 edition = "2021"
 license = "MIT"
 version = "0.1.0"
-authors = ["WLFI Agent SDK Team"]
+authors = ["WLFI Agentic SDK Team"]
 
 [workspace.dependencies]
 alloy-primitives = "0.8"

package/README.md

@@ -1,6 +1,6 @@
-# WLFI Agent SDK
+# WLFI Agentic SDK
 
-WLFI Agent SDK is a root-managed local signing daemon with policy enforcement, a single `wlfi-agent` CLI, and an optional relay + web approval flow.
+WLFI Agentic SDK is a root-managed local signing daemon with policy enforcement, a single `wlfi-agent` CLI, and an optional relay + web approval flow.
 
 The main user path is:
 
@@ -43,12 +43,20 @@ User-facing examples below avoid shell env vars on purpose. Prefer prompts, conf
 
 ## Install
 
+### Prerequisites
+
+- macOS
+- Rust toolchain on `PATH` (`cargo`, `rustc`)
+- Xcode Command Line Tools (`xcode-select --install`)
+
 ### Install from npm
 
 ```bash
 npm i -g @wlfi-agent/cli
 ```
 
+`npm i -g @wlfi-agent/cli` builds the local Rust runtime during `postinstall`. If the prerequisites above are already installed, this is the normal one-step install path. If `cargo` or the macOS Command Line Tools are missing, installation fails immediately and tells you how to install the missing prerequisite before retrying.
+
 ### Work from this repo
 
 ```bash

package/crates/vault-cli-admin/src/main.rs

@@ -813,16 +813,25 @@ async fn main() -> Result<()> {
             if let Some(output) = tui::run_bootstrap_tui(
                 &shared_config.config,
                 args.print_agent_auth_token,
-                |params| {
+                |params, on_status| {
+                    let mut status_error = None;
                     tokio::task::block_in_place(|| {
                         tokio::runtime::Handle::current().block_on(execute_bootstrap(
                             daemon_api.clone(),
                             &vault_password,
                             &state_file_display,
                             params,
-                            |_| {},
+                            |message| {
+                                if status_error.is_none() {
+                                    status_error = on_status(message).err();
+                                }
+                            },
                         ))
                     })
+                    .and_then(|output| match status_error {
+                        Some(err) => Err(err),
+                        None => Ok(output),
+                    })
                 },
             )? {
                 print_status("bootstrap complete", output_format, cli.quiet);
@@ -3965,6 +3974,7 @@ mod tests {
     #[test]
     #[cfg(unix)]
     fn resolve_daemon_socket_path_rejects_non_root_owned_socket() {
+        use std::os::fd::AsRawFd;
         use std::os::unix::fs::PermissionsExt;
         use std::os::unix::net::UnixListener;
 
@@ -3979,6 +3989,15 @@ mod tests {
 
         let socket_path = root.join("daemon.sock");
         let listener = UnixListener::bind(&socket_path).expect("bind socket");
+        if unsafe { libc::geteuid() } == 0 {
+            let rc = unsafe { libc::fchown(listener.as_raw_fd(), 1, libc::gid_t::MAX) };
+            assert_eq!(
+                rc,
+                0,
+                "must set non-root owner for root-mode test: {}",
+                std::io::Error::last_os_error()
+            );
+        }
 
         let err = resolve_daemon_socket_path(Some(socket_path.clone())).expect_err("must reject");
         assert!(err.to_string().contains("must be owned by root"));