create-op-node 0.10.0 → 0.10.1

package/dist/cli.js

@@ -289,7 +289,7 @@ async function saveSecret(coords, value) {
     return {
       written: false,
       updated,
-      reason: `security add-generic-password failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
+      reason: `security add-generic-password failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}${formatKeychainHint(res.exitCode)}`
     };
   }
   return { written: true, updated };
@@ -309,6 +309,47 @@ async function readSecret(coords) {
   const value = res.stdout.trim();
   return value.length > 0 ? value : null;
 }
+var ERR_SEC_INTERACTION_NOT_ALLOWED = 36;
+function formatKeychainHint(exitCode) {
+  if (exitCode === ERR_SEC_INTERACTION_NOT_ALLOWED) {
+    return `
+Hint: the login keychain is locked (SSH sessions don't auto-unlock it).
+Run \`security unlock-keychain ~/Library/Keychains/login.keychain-db\` and re-run bootstrap.`;
+  }
+  return "";
+}
+async function isKeychainLocked() {
+  const res = await safeExeca("security", [
+    "find-generic-password",
+    "-s",
+    `${SERVICE_PREFIX}.__op_node_lock_probe__`,
+    "-a",
+    "__nothing_here__"
+  ]);
+  if (res === null) return false;
+  return res.exitCode === ERR_SEC_INTERACTION_NOT_ALLOWED;
+}
+async function unlockKeychain(password3) {
+  const res = await safeExeca("security", [
+    "unlock-keychain",
+    "-p",
+    password3,
+    // Default keychain path — same as the operator's GUI login keychain
+    // on a stock macOS install. Lets us avoid a homedir lookup here.
+    `${process.env["HOME"] ?? ""}/Library/Keychains/login.keychain-db`
+  ]);
+  if (res === null) return { ok: false, reason: "`security` CLI not on PATH" };
+  if (res.exitCode !== 0) {
+    return {
+      ok: false,
+      reason: `security unlock-keychain failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
+    };
+  }
+  return { ok: true };
+}
+function isSshSession(env = process.env) {
+  return Boolean(env["SSH_CONNECTION"] ?? env["SSH_TTY"]);
+}
 function unwrap(value) {
   if (p3.isCancel(value)) {
     p3.cancel("Cancelled.");
@@ -2093,6 +2134,31 @@ var bootstrapCommand = new Command("bootstrap").description(
     );
     process.exit(1);
   }
+  if (isSshSession() && await isKeychainLocked()) {
+    p3.note(
+      [
+        "SSH session detected with a locked login keychain.",
+        "macOS keychain operations require an unlocked keychain \u2014 your",
+        "login password will be used once to unlock it for this session.",
+        "The keychain remains unlocked until the session ends or it",
+        "idle-locks. To skip and unlock manually, press Ctrl+C and run",
+        "`security unlock-keychain` yourself."
+      ].join("\n"),
+      "Keychain unlock required"
+    );
+    const pw = unwrap(
+      await p3.password({
+        message: "macOS login password (for `security unlock-keychain`):",
+        validate: (v) => v && v.length > 0 ? void 0 : "password required"
+      })
+    );
+    const unlock = await unlockKeychain(pw);
+    if (!unlock.ok) {
+      p3.cancel(unlock.reason ?? "security unlock-keychain failed.");
+      process.exit(1);
+    }
+    p3.note(`${pc2.green("\u2713")} Keychain unlocked for this session.`, "Keychain");
+  }
   const pgsodiumKey = await loadSecret({
     region,
     account: "pgsodium-root-key",
@@ -4334,7 +4400,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.10.0";
+var VERSION = "0.10.1";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."