create-op-node 0.11.0 → 0.11.1

package/dist/cli.js

@@ -1509,7 +1509,11 @@ function validatePlistInput(input) {
 }
 function buildSetenvCommand(input) {
   return [
-    `launchctl setenv PGSODIUM_ROOT_KEY "$(cat ${input.keyFilePath})"`,
+    // Quote the path inside `cat` so a space-containing keyFilePath (allowed by
+    // SAFE_PATH_RE) doesn't word-split and leave PGSODIUM_ROOT_KEY empty. The
+    // regex rejects `"`/`$`/backticks, so the inner quotes can't be broken out
+    // of — this is word-split safety, not new injection surface. (#36)
+    `launchctl setenv PGSODIUM_ROOT_KEY "$(cat "${input.keyFilePath}")"`,
     ...input.tunnelToken !== void 0 ? [`launchctl setenv TUNNEL_TOKEN "${input.tunnelToken}"`] : [],
     ...input.llmModel !== void 0 ? [`launchctl setenv LLM_MODEL "${input.llmModel}"`] : [],
     ...input.embeddingModel !== void 0 ? [`launchctl setenv EMBEDDINGS_MODEL "${input.embeddingModel}"`] : [],
@@ -1586,7 +1590,7 @@ async function teardownLaunchAgent(paths, opts = {}) {
   const unload = await safeExeca("launchctl", ["unload", paths.plistFile]);
   steps.push({
     step: "unload",
-    ok: true,
+    ok: unload !== null,
     ...unload === null ? { reason: "`launchctl` not on PATH" } : {}
   });
   try {
@@ -4963,8 +4967,18 @@ async function looksLikeRegionsRepo(dir) {
   return hasSchema && hasRegions;
 }
 
+// src/lib/cli-args.ts
+var GLOBAL_FLAGS = /* @__PURE__ */ new Set(["-v", "--version", "-h", "--help"]);
+function withDefaultSubcommand(argv, known) {
+  const first2 = argv[2];
+  if (first2 !== void 0 && (known.includes(first2) || GLOBAL_FLAGS.has(first2))) {
+    return argv;
+  }
+  return [...argv.slice(0, 2), "init", ...argv.slice(2)];
+}
+
 // src/cli.ts
-var VERSION = "0.11.0";
+var VERSION = "0.11.1";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."
@@ -4974,9 +4988,10 @@ program.addCommand(bootstrapCommand);
 program.addCommand(resetCommand);
 program.addCommand(verifyCommand);
 program.addCommand(regionCommand);
-if (process.argv.length === 2) {
-  process.argv.push("init");
-}
+process.argv = withDefaultSubcommand(
+  process.argv,
+  program.commands.map((c) => c.name())
+);
 await program.parseAsync(process.argv).catch((err) => {
   const msg = err instanceof Error ? err.message : String(err);
   console.error(`