create-op-node 0.10.0 → 0.10.2

package/dist/cli.js

@@ -289,7 +289,7 @@ async function saveSecret(coords, value) {
     return {
       written: false,
       updated,
-      reason: `security add-generic-password failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
+      reason: `security add-generic-password failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}${formatKeychainHint(res.exitCode)}`
     };
   }
   return { written: true, updated };
@@ -309,6 +309,47 @@ async function readSecret(coords) {
   const value = res.stdout.trim();
   return value.length > 0 ? value : null;
 }
+var ERR_SEC_INTERACTION_NOT_ALLOWED = 36;
+function formatKeychainHint(exitCode) {
+  if (exitCode === ERR_SEC_INTERACTION_NOT_ALLOWED) {
+    return `
+Hint: the login keychain is locked (SSH sessions don't auto-unlock it).
+Run \`security unlock-keychain ~/Library/Keychains/login.keychain-db\` and re-run bootstrap.`;
+  }
+  return "";
+}
+async function isKeychainLocked() {
+  const res = await safeExeca("security", [
+    "find-generic-password",
+    "-s",
+    `${SERVICE_PREFIX}.__op_node_lock_probe__`,
+    "-a",
+    "__nothing_here__"
+  ]);
+  if (res === null) return false;
+  return res.exitCode === ERR_SEC_INTERACTION_NOT_ALLOWED;
+}
+async function unlockKeychain(password3) {
+  const res = await safeExeca("security", [
+    "unlock-keychain",
+    "-p",
+    password3,
+    // Default keychain path — same as the operator's GUI login keychain
+    // on a stock macOS install. Lets us avoid a homedir lookup here.
+    `${process.env["HOME"] ?? ""}/Library/Keychains/login.keychain-db`
+  ]);
+  if (res === null) return { ok: false, reason: "`security` CLI not on PATH" };
+  if (res.exitCode !== 0) {
+    return {
+      ok: false,
+      reason: `security unlock-keychain failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
+    };
+  }
+  return { ok: true };
+}
+function isSshSession(env = process.env) {
+  return Boolean(env["SSH_CONNECTION"] ?? env["SSH_TTY"]);
+}
 function unwrap(value) {
   if (p3.isCancel(value)) {
     p3.cancel("Cancelled.");
@@ -1452,20 +1493,72 @@ set -euo pipefail
 
 SVC="org.opuspopuli.${input.region}"
 
+# macOS \`security\` exit codes:
+#   0  = success
+#   36 = errSecInteractionNotAllowed (keychain is locked)
+#   44 = errSecItemNotFound (entry doesn't exist)
+# Earlier wrapper versions conflated 36 and 44 into a generic "missing"
+# message, which sent operators down the wrong path (re-bootstrap when
+# the real fix was \`security unlock-keychain\`).
 require_secret() {
   local account="$1"
   local value
-  if ! value=$(security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null); then
-    echo "op-compose: missing Keychain entry '$account' under service '$SVC'." >&2
-    echo "Run: create-op-node bootstrap --region ${input.region}" >&2
-    exit 1
-  fi
-  printf '%s' "$value"
+  local rc=0
+  value=$(security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null) || rc=$?
+  case "$rc" in
+    0)
+      printf '%s' "$value"
+      return 0
+      ;;
+    36)
+      cat >&2 <<EOM
+op-compose: keychain is LOCKED \u2014 could not read entry '$account'.
+SSH sessions don't auto-unlock the login keychain. Unlock with:
+  security unlock-keychain ~/Library/Keychains/login.keychain-db
+Then re-run this command.
+EOM
+      exit 1
+      ;;
+    44)
+      cat >&2 <<EOM
+op-compose: keychain entry '$account' is MISSING under service '$SVC'.
+Run: create-op-node bootstrap --region ${input.region}
+EOM
+      exit 1
+      ;;
+    *)
+      echo "op-compose: \`security\` failed reading '$account' (exit $rc)." >&2
+      exit 1
+      ;;
+  esac
 }
 
+# Used for entries that may legitimately not exist (TUNNEL_TOKEN in
+# local-only mode, prompt-service secrets when colocation isn't active).
+# Treats exit 44 (missing) as a silent OK \u2014 returns empty string.
+# Treats exit 36 (locked) as a hard error, since the require_secret calls
+# at the top of the wrapper would have caught this first in normal use;
+# reaching this path means something else bypassed the lock check.
 optional_secret() {
   local account="$1"
-  security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null || true
+  local value
+  local rc=0
+  value=$(security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null) || rc=$?
+  case "$rc" in
+    0) printf '%s' "$value" ;;
+    44) ;; # legitimately absent \u2014 empty string is correct
+    36)
+      cat >&2 <<EOM
+op-compose: keychain is LOCKED \u2014 could not probe optional entry '$account'.
+Unlock with: security unlock-keychain ~/Library/Keychains/login.keychain-db
+EOM
+      exit 1
+      ;;
+    *)
+      echo "op-compose: \`security\` failed reading '$account' (exit $rc)." >&2
+      exit 1
+      ;;
+  esac
 }
 
 # Bootstrap-critical: Postgres + Supabase admin credentials.
@@ -2093,6 +2186,31 @@ var bootstrapCommand = new Command("bootstrap").description(
     );
     process.exit(1);
   }
+  if (isSshSession() && await isKeychainLocked()) {
+    p3.note(
+      [
+        "SSH session detected with a locked login keychain.",
+        "macOS keychain operations require an unlocked keychain \u2014 your",
+        "login password will be used once to unlock it for this session.",
+        "The keychain remains unlocked until the session ends or it",
+        "idle-locks. To skip and unlock manually, press Ctrl+C and run",
+        "`security unlock-keychain` yourself."
+      ].join("\n"),
+      "Keychain unlock required"
+    );
+    const pw = unwrap(
+      await p3.password({
+        message: "macOS login password (for `security unlock-keychain`):",
+        validate: (v) => v && v.length > 0 ? void 0 : "password required"
+      })
+    );
+    const unlock = await unlockKeychain(pw);
+    if (!unlock.ok) {
+      p3.cancel(unlock.reason ?? "security unlock-keychain failed.");
+      process.exit(1);
+    }
+    p3.note(`${pc2.green("\u2713")} Keychain unlocked for this session.`, "Keychain");
+  }
   const pgsodiumKey = await loadSecret({
     region,
     account: "pgsodium-root-key",
@@ -4334,7 +4452,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.10.0";
+var VERSION = "0.10.2";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."