create-op-node 0.10.1 → 0.10.3

package/README.md

@@ -532,7 +532,7 @@ The CLI itself never holds any credentials beyond the scope of a single command
 - [`zod`](https://github.com/colinhacks/zod) for runtime validation
 - [`vitest`](https://vitest.dev) for tests
 - [`tsup`](https://tsup.egoist.dev) for the single-file ESM build
-- `oxlint` (fast, Rust-based) for pre-commit lint; ESLint v9 flat config for the full CI pass
+- ESLint v9 flat config for linting: a base pass (`pnpm lint`) plus a separate SonarJS pass (`pnpm lint:sonar`) for cognitive-complexity and hot-spot rules, mirroring the `@opuspopuli/regions` setup
 
 ## Contributing
 
@@ -541,6 +541,7 @@ This is a young project against the still-stabilizing `opuspopuli-node` template
 ```bash
 pnpm install
 pnpm dev -- --help          # run from source
+pnpm lint                   # eslint base pass
 pnpm test                   # vitest
 pnpm build                  # tsup → dist/
 node dist/cli.js --help     # test the built binary

package/dist/cli.js

@@ -1143,7 +1143,7 @@ var TUNNEL_TOKEN_RE = /^[A-Za-z0-9_\-.=]+$/;
 var SAFE_PATH_RE = /^[A-Za-z0-9_\-./ ]+$/;
 var SAFE_LAUNCHCTL_VALUE_RE = /^[A-Za-z0-9+/=._-]+$/;
 var URL_SAFE_PASSWORD_RE = /^[A-Za-z0-9_-]+$/;
-var SAFE_URL_RE = /^[A-Za-z0-9:/_.\-]+$/;
+var SAFE_URL_RE = /^[A-Za-z0-9:/_.-]+$/;
 var VERIFY_NETWORK_TIMEOUT_MS = 1e4;
 var BODY_PREVIEW_MAX = 200;
 
@@ -1493,20 +1493,72 @@ set -euo pipefail
 
 SVC="org.opuspopuli.${input.region}"
 
+# macOS \`security\` exit codes:
+#   0  = success
+#   36 = errSecInteractionNotAllowed (keychain is locked)
+#   44 = errSecItemNotFound (entry doesn't exist)
+# Earlier wrapper versions conflated 36 and 44 into a generic "missing"
+# message, which sent operators down the wrong path (re-bootstrap when
+# the real fix was \`security unlock-keychain\`).
 require_secret() {
   local account="$1"
   local value
-  if ! value=$(security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null); then
-    echo "op-compose: missing Keychain entry '$account' under service '$SVC'." >&2
-    echo "Run: create-op-node bootstrap --region ${input.region}" >&2
-    exit 1
-  fi
-  printf '%s' "$value"
+  local rc=0
+  value=$(security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null) || rc=$?
+  case "$rc" in
+    0)
+      printf '%s' "$value"
+      return 0
+      ;;
+    36)
+      cat >&2 <<EOM
+op-compose: keychain is LOCKED \u2014 could not read entry '$account'.
+SSH sessions don't auto-unlock the login keychain. Unlock with:
+  security unlock-keychain ~/Library/Keychains/login.keychain-db
+Then re-run this command.
+EOM
+      exit 1
+      ;;
+    44)
+      cat >&2 <<EOM
+op-compose: keychain entry '$account' is MISSING under service '$SVC'.
+Run: create-op-node bootstrap --region ${input.region}
+EOM
+      exit 1
+      ;;
+    *)
+      echo "op-compose: \`security\` failed reading '$account' (exit $rc)." >&2
+      exit 1
+      ;;
+  esac
 }
 
+# Used for entries that may legitimately not exist (TUNNEL_TOKEN in
+# local-only mode, prompt-service secrets when colocation isn't active).
+# Treats exit 44 (missing) as a silent OK \u2014 returns empty string.
+# Treats exit 36 (locked) as a hard error, since the require_secret calls
+# at the top of the wrapper would have caught this first in normal use;
+# reaching this path means something else bypassed the lock check.
 optional_secret() {
   local account="$1"
-  security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null || true
+  local value
+  local rc=0
+  value=$(security find-generic-password -s "$SVC" -a "$account" -w 2>/dev/null) || rc=$?
+  case "$rc" in
+    0) printf '%s' "$value" ;;
+    44) ;; # legitimately absent \u2014 empty string is correct
+    36)
+      cat >&2 <<EOM
+op-compose: keychain is LOCKED \u2014 could not probe optional entry '$account'.
+Unlock with: security unlock-keychain ~/Library/Keychains/login.keychain-db
+EOM
+      exit 1
+      ;;
+    *)
+      echo "op-compose: \`security\` failed reading '$account' (exit $rc)." >&2
+      exit 1
+      ;;
+  esac
 }
 
 # Bootstrap-critical: Postgres + Supabase admin credentials.
@@ -4400,7 +4452,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.10.1";
+var VERSION = "0.10.3";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."