create-op-node 0.2.0 → 0.3.0

package/README.md

@@ -13,8 +13,8 @@ That's it. The wizard walks you through:
 2. **GitHub** — creates your region's node repo from the [`OpusPopuli/opuspopuli-node`](https://github.com/OpusPopuli/opuspopuli-node) template via the GitHub API. Seeds the 5 required GitHub Secrets (Cloudflare token, account ID, zone ID, Terraform Cloud token, TFC org) for you.
 3. **Terraform Cloud** — verifies your TFC token, prepares the workspace.
 4. **First PR** — writes `environments/prod.tfvars` from your answers, commits, opens the first PR. The node repo's `cloudflare-infra.yml` workflow runs `terraform plan` against the PR; on merge to `main` it applies — Tunnel, DNS, R2 buckets, and Pages project come up automatically.
-5. **pgsodium master key** — generates a fresh 64-hex root key, stores it in 1Password (via the `op` CLI if available, otherwise prompts you to paste it once).
-6. **Tunnel token retrieval** — after `terraform apply` lands, fetches the Tunnel token from Terraform Cloud outputs and stores it in 1Password alongside the pgsodium key.
+5. **pgsodium master key** — generates a fresh 64-hex root key, stores it in your **macOS login Keychain** as `org.opuspopuli.<region>/pgsodium-root-key`. No third-party password manager required.
+6. **Tunnel token retrieval** — after `terraform apply` lands, fetches the Tunnel token from Terraform Cloud outputs and stores it alongside the pgsodium key in your Keychain.
 
 Then on the Mac Studio itself:
 
@@ -22,7 +22,17 @@ Then on the Mac Studio itself:
 npx create-op-node bootstrap
 ```
 
-Configures macOS power settings, installs Homebrew + the CLI tool list, sets up Docker Desktop + Tailscale + Ollama, clones the node repo you created, materializes the pgsodium key from 1Password, writes the LaunchAgent plist, logs into ghcr.io, pulls + warms the LLM model, and finally `docker compose pull && up -d` brings the whole stack online. Health-check loop waits until all 10 containers are `(healthy)`.
+Configures macOS power settings, installs Homebrew + the CLI tool list, sets up Docker Desktop + Tailscale + Ollama, clones the node repo you created, reads the pgsodium key + Tunnel token from the Studio's Keychain (or prompts you to paste them once, then persists for re-runs), writes the LaunchAgent plist, logs into ghcr.io, pulls + warms the LLM model, and finally `docker compose pull && up -d` brings the whole stack online. Health-check loop waits until all 10 containers are `(healthy)`.
+
+> **Secret transport between laptop and Studio**
+>
+> The macOS `security` CLI writes to the local login keychain — items
+> don't sync to iCloud Keychain automatically. On the Studio's first
+> bootstrap, the operator pastes the pgsodium key + Tunnel token once
+> (from the laptop's Keychain Access, or wherever you copied them); the
+> Studio bootstrap validates the format and persists locally so re-runs
+> read straight through. Use AirDrop / `security find-generic-password`
+> output / Tailscale `scp` to ferry the values.
 
 ## Resetting the Studio
 
@@ -52,7 +62,10 @@ with `bootstrap` without losing data.
    those need separate cleanup.
 
 Reset does **not** touch cloud-side state: the Cloudflare resources,
-the GitHub repo, the TFC workspace, and the 1Password items remain.
+the GitHub repo, and the TFC workspace remain. Keychain items on the
+Studio are also left in place — `security delete-generic-password -s
+org.opuspopuli.<region> -a pgsodium-root-key` etc. if you want them
+gone.
 `init` is idempotent against existing cloud setup, so re-running it
 won't duplicate anything.
 
@@ -280,13 +293,63 @@ rather than in the regions repo itself:
   green run here, as the real signal. If the two ever disagree, the schema
   wins and this command needs updating.
 
+## What lands where
+
+`create-op-node` touches several secret stores. Here's the full map of
+what we own (the two macOS Keychain items) vs. what we just route to its
+destination.
+
+### Stored by `create-op-node` in macOS Keychain
+
+Two items per region, both generic-password class
+(`kSecClassGenericPassword`). Visible in **Keychain Access.app**
+(`/System/Applications/Utilities/Keychain Access.app`) — **not** in the
+new Passwords.app, which is filtered to website-login items only.
+
+| # | Service | Account | Label (GUI display)                                              | Value format               | Written by                       | Read by                  |
+|---|---|---|---|---|---|---|
+| 1 | `org.opuspopuli.<region>` | `pgsodium-root-key` | `Opus Populi (<region>) — pgsodium root key`             | 64 lowercase hex chars     | `init` on laptop                 | `bootstrap` on Studio    |
+| 2 | `org.opuspopuli.<region>` | `tunnel-token`      | `Opus Populi (<region>) — Cloudflare Tunnel token`       | JWT-style base64url string | `init` on laptop (after TFC apply) | `bootstrap` on Studio    |
+
+Both items also carry `-D 'Opus Populi secret'` (the "Kind" column in
+Keychain Access) so you can filter for them at a glance.
+
+Inspect from a shell:
+
+```bash
+# Metadata only (safe to share output):
+security find-generic-password -s org.opuspopuli.us-ca -a pgsodium-root-key
+
+# Reveal the value (you'll be prompted to allow access on first call):
+security find-generic-password -s org.opuspopuli.us-ca -a pgsodium-root-key -w
+```
+
+### Stored elsewhere (we don't put these in Keychain)
+
+Everything else flows through transiently or lives in its destination
+system's own credential store.
+
+| Secret                              | Where it lives                                                                          | Why not in Keychain                                                                                                              |
+|---|---|---|
+| Cloudflare API token                | Pasted into `init` prompt → forwarded to **GitHub Secrets** + **Terraform Cloud** vars  | One-shot during init. Re-runs prompt again. We could store it; adds risk vs benefit.                                             |
+| Cloudflare account ID, zone ID      | Same as above                                                                            | Not really a "secret" but flow alongside the token                                                                              |
+| Terraform Cloud token               | Pasted, used to verify + poll runs                                                       | Same one-shot pattern                                                                                                            |
+| GitHub PAT                          | Read from `gh auth token` if available, else pasted                                      | `gh` already manages it                                                                                                          |
+| pgsodium key (Studio runtime form)  | `~/.config/opuspopuli/pgsodium_root_key` (mode `0400`)                                  | LaunchAgent reads it at every login → interpolates into the `PGSODIUM_ROOT_KEY` env var. Same value as in Keychain; file is runtime form. |
+| Cloudflare Tunnel token (Studio runtime form) | Baked into `~/Library/LaunchAgents/org.opuspopuli.envloader.plist` (mode `0600`) | launchd's `launchctl setenv TUNNEL_TOKEN` injects it into the session at every boot. Same value as in Keychain; plist is runtime form. |
+| ghcr.io credentials                 | `~/.docker/config.json` or `docker-credential-osxkeychain`                              | Docker manages its own credential store — it actually saves the ghcr token to a separate Keychain item under service `ghcr.io`. We just call `docker login`. |
+
+Per region, the **only** persistent secrets `create-op-node` owns are
+the two Keychain items above. Everything else is either transient
+(prompted, used, forgotten) or lives in its destination system.
+
 ## Why this exists
 
 Each Opus Populi region is operated independently by a local maintainer — its own Cloudflare account, its own Mac Studio, its own domain. The full bootstrap is a few hours of manual steps across Cloudflare, GitHub, Terraform Cloud, macOS Setup Assistant, Docker Desktop, Tailscale, Ollama, and the node's own Docker Compose stack. Doable from the runbook, but error-prone.
 
 This CLI exists to make that bootstrap **foolproof** — every prompt validates immediately, every secret is retrieved from a secure source (never echoed, never written to disk in plaintext), and every step has an explicit "what happens next" message. The goal is zero documentation reading required to get a node running.
 
-The CLI itself never holds any credentials beyond the scope of a single command — secrets flow from your 1Password vault → through the CLI → directly into the destination (GitHub Secrets, Terraform Cloud workspace variables, Mac Studio LaunchAgent). Nothing persists in this process.
+The CLI itself never holds any credentials beyond the scope of a single command — secrets flow from your macOS Keychain → through the CLI → directly into the destination (GitHub Secrets, Terraform Cloud workspace variables, Mac Studio LaunchAgent). Nothing persists in this process.
 
 ## Architecture
 
@@ -322,9 +385,9 @@ The CLI itself never holds any credentials beyond the scope of a single command
 
 ## Status
 
-**`init` — fully wired.** Full Phase 1 of the runbook: prompts → Cloudflare 5-scope probe → Terraform Cloud verify → GitHub template clone → 5 repo secrets seeded → branch + prod.tfvars committed → PR opened → pgsodium key generated → (after operator merges PR) Terraform apply polled → Tunnel token retrieved + saved to 1Password.
+**`init` — fully wired.** Full Phase 1 of the runbook: prompts → Cloudflare 5-scope probe → Terraform Cloud verify → GitHub template clone → 5 repo secrets seeded → branch + prod.tfvars committed → PR opened → pgsodium key generated → (after operator merges PR) Terraform apply polled → Tunnel token retrieved + saved to the macOS Keychain.
 
-**`bootstrap` — fully wired.** Phase 2 on the Mac Studio: macOS sanity (auto-restart, disk sleep), Homebrew + tool installs (gh, pnpm, jq, cloudflared, rclone, ollama, docker, tailscale), GitHub + Tailscale signin prompts, pgsodium key + Tunnel token read from 1Password, LaunchAgent written + loaded, ghcr.io login, Ollama models pulled + warmed, region repo located or cloned, `docker compose pull && up -d`, health-check loop until everything reports `(healthy)`.
+**`bootstrap` — fully wired.** Phase 2 on the Mac Studio: macOS sanity (auto-restart, disk sleep), Homebrew + tool installs (gh, pnpm, jq, cloudflared, rclone, ollama, docker, tailscale), GitHub + Tailscale signin prompts, pgsodium key + Tunnel token read from the Studio's Keychain (or pasted in once if first run on that machine, then persisted), LaunchAgent written + loaded, ghcr.io login, Ollama models pulled + warmed, region repo located or cloned, `docker compose pull && up -d`, health-check loop until everything reports `(healthy)`.
 
 **`verify` — scaffold stub.** Type-safe argument parsing only; prints a roadmap-style message and exits.
 

package/dist/cli.js

@@ -225,81 +225,75 @@ async function safeExeca(cmd, args, options) {
   }
 }
 
-// src/lib/onepassword.ts
-async function detectOp() {
-  const version = await safeExeca("op", ["--version"]);
-  if (version === null) {
-    return { installed: false, signedIn: false };
-  }
-  const installed = true;
-  const whoami = await safeExeca("op", ["whoami", "--format=json"]);
-  if (whoami === null || whoami.exitCode !== 0) {
-    return { installed, signedIn: false };
-  }
-  let email;
-  try {
-    const parsed = JSON.parse(whoami.stdout);
-    email = parsed.email;
-  } catch {
-  }
-  return {
-    installed,
-    signedIn: true,
-    ...email ? { email } : {}
-  };
+// src/lib/keychain.ts
+var SERVICE_PREFIX = "org.opuspopuli";
+function serviceFor(region) {
+  return `${SERVICE_PREFIX}.${region}`;
+}
+function labelFor(coords) {
+  const friendly = coords.account === "pgsodium-root-key" ? "pgsodium root key" : "Cloudflare Tunnel token";
+  return `Opus Populi (${coords.region}) \u2014 ${friendly}`;
 }
-async function saveSecretToOp(input) {
-  const vaultArg = input.vault ? ["--vault", input.vault] : [];
-  const existing = await safeExeca("op", ["item", "get", input.title, ...vaultArg, "--format=json"]);
-  if (existing === null) {
+async function detectKeychain() {
+  const res = await safeExeca("security", ["-h"]);
+  if (res === null) {
     return {
-      written: false,
-      alreadyExisted: false,
-      reason: "`op` CLI not installed"
+      available: false,
+      reason: "`security` CLI not on PATH (Keychain requires macOS)"
     };
   }
-  if (existing.exitCode === 0) {
-    if (!input.overwrite) {
-      return { written: false, alreadyExisted: true };
-    }
-    const edit = await safeExeca(
-      "op",
-      ["item", "edit", input.title, ...vaultArg, `notesPlain=${input.value}`]
-    );
-    if (edit === null || edit.exitCode !== 0) {
-      return {
-        written: false,
-        alreadyExisted: true,
-        reason: `op item edit failed: ${edit?.stderr || edit?.stdout || "`op` not installed"}`
-      };
-    }
-    return { written: true, alreadyExisted: true };
-  }
-  const create = await safeExeca("op", [
-    "item",
-    "create",
-    "--category",
-    "Secure Note",
-    "--title",
-    input.title,
-    ...vaultArg,
-    `notesPlain=${input.value}`
+  return { available: true };
+}
+async function saveSecret(coords, value) {
+  const service = serviceFor(coords.region);
+  const label = labelFor(coords);
+  const existing = await safeExeca("security", [
+    "find-generic-password",
+    "-s",
+    service,
+    "-a",
+    coords.account
+  ]);
+  const updated = existing !== null && existing.exitCode === 0;
+  const res = await safeExeca("security", [
+    "add-generic-password",
+    "-U",
+    // upsert
+    "-s",
+    service,
+    "-a",
+    coords.account,
+    "-l",
+    label,
+    "-D",
+    "Opus Populi secret",
+    "-w",
+    value
+    // argv-exposure caveat, see file header
   ]);
-  if (create === null || create.exitCode !== 0) {
+  if (res === null) {
+    return { written: false, updated: false, reason: "`security` CLI not on PATH" };
+  }
+  if (res.exitCode !== 0) {
     return {
       written: false,
-      alreadyExisted: false,
-      reason: `op item create failed: ${create?.stderr || create?.stdout || "`op` not installed"}`
+      updated,
+      reason: `security add-generic-password failed (${res.exitCode ?? "signal"}): ${res.stderr || res.stdout}`
     };
   }
-  return { written: true, alreadyExisted: false };
-}
-async function readSecretFromOp(input) {
-  const vaultArg = input.vault ? ["--vault", input.vault] : [];
-  const res = await safeExeca(
-    "op",
-    ["item", "get", input.title, ...vaultArg, "--fields", "notesPlain", "--reveal"]
-  );
+  return { written: true, updated };
+}
+async function readSecret(coords) {
+  const service = serviceFor(coords.region);
+  const res = await safeExeca("security", [
+    "find-generic-password",
+    "-s",
+    service,
+    "-a",
+    coords.account,
+    "-w"
+    // print the password to stdout (final flag = read mode)
+  ]);
   if (res === null || res.exitCode !== 0) return null;
   const value = res.stdout.trim();
   return value.length > 0 ? value : null;
@@ -532,10 +526,10 @@ var initCommand = new Command("init").description(
   new Option("--template <owner/repo>", "Template repo to clone from").default(
     "OpusPopuli/opuspopuli-node"
   )
-).addOption(new Option("--project <name>", "tfvars project prefix").default("opuspopuli")).addOption(new Option("--cf-token <token>", "Cloudflare Account API token").env("CF_TOKEN")).addOption(new Option("--cf-account <id>", "Cloudflare account ID").env("CF_ACCOUNT")).addOption(new Option("--cf-zone <id>", "Cloudflare zone ID for your domain").env("CF_ZONE")).addOption(new Option("--tf-token <token>", "Terraform Cloud user/team token").env("TF_API_TOKEN")).addOption(new Option("--tf-org <org>", "Terraform Cloud organization").env("TF_CLOUD_ORGANIZATION")).addOption(new Option("--gh-token <token>", "GitHub Personal Access Token (else gh CLI)").env("GH_TOKEN")).addOption(new Option("--vault <vault>", "1Password vault for secrets").default("Private")).addOption(
+).addOption(new Option("--project <name>", "tfvars project prefix").default("opuspopuli")).addOption(new Option("--cf-token <token>", "Cloudflare Account API token").env("CF_TOKEN")).addOption(new Option("--cf-account <id>", "Cloudflare account ID").env("CF_ACCOUNT")).addOption(new Option("--cf-zone <id>", "Cloudflare zone ID for your domain").env("CF_ZONE")).addOption(new Option("--tf-token <token>", "Terraform Cloud user/team token").env("TF_API_TOKEN")).addOption(new Option("--tf-org <org>", "Terraform Cloud organization").env("TF_CLOUD_ORGANIZATION")).addOption(new Option("--gh-token <token>", "GitHub Personal Access Token (else gh CLI)").env("GH_TOKEN")).addOption(
   new Option(
     "--overwrite",
-    "Overwrite existing 1Password items (pgsodium key, Tunnel token) on a re-run"
+    "Overwrite existing Keychain items (pgsodium key, Tunnel token) on a re-run"
   ).default(false)
 ).addOption(
   new Option(
@@ -556,7 +550,7 @@ var initCommand = new Command("init").description(
   );
   const region = opts.region ? opts.region : unwrap(
     await p3.text({
-      message: "Short region label (used as a prefix in 1Password + R2)?",
+      message: "Short region label (used as the Keychain service suffix + R2 prefix)?",
       placeholder: "us-ca",
       validate: (v) => /^[a-z0-9-]{2,32}$/.test(v ?? "") ? void 0 : "lowercase letters, digits, hyphens; 2\u201332 chars"
     })
@@ -637,9 +631,10 @@ var initCommand = new Command("init").description(
       "github"
     );
   }
-  const op = await detectOp();
-  const opNote = op.installed ? op.signedIn ? `\u2713 1Password CLI signed in${op.email ? ` (${op.email})` : ""} \u2014 pgsodium key + Tunnel token will be saved automatically.` : `\u26A0 1Password CLI installed but not signed in. Run \`op signin\` in another shell, or you'll be prompted to paste secrets.` : `\u26A0 1Password CLI not installed. Secrets will be printed for you to paste into 1Password by hand.`;
-  p3.note(opNote, "1Password");
+  const keychain = await detectKeychain();
+  const kcNote = keychain.available ? `\u2713 macOS Keychain available \u2014 pgsodium key + Tunnel token will be saved to your login keychain.
+` + pc2.dim("Note: items don't sync to iCloud Keychain via the security CLI.\n") + pc2.dim("On the Studio, bootstrap will read locally and prompt you to paste if missing.") : `\u26A0 ${keychain.reason ?? "Keychain unavailable"}. Secrets will be printed for manual stash.`;
+  p3.note(kcNote, "Secret store");
   p3.note(
     [
       `Region label:        ${pc2.cyan(region)}`,
@@ -786,40 +781,30 @@ var initCommand = new Command("init").description(
     process.exit(1);
   }
   prSpin.stop(pc2.green(`\u2713 Opened PR #${pr.number}`));
-  const keyTitle = `opuspopuli-${region}-pgsodium-root-key`;
-  const vaultArg = opts.vault ? { vault: opts.vault } : {};
-  if (op.installed && op.signedIn) {
-    const existing = opts.overwrite ? null : await readSecretFromOp({ title: keyTitle, ...vaultArg });
+  const pgsodiumCoords = { region, account: "pgsodium-root-key" };
+  const keyLabel = `org.opuspopuli.${region}/pgsodium-root-key`;
+  if (keychain.available) {
+    const existing = opts.overwrite ? null : await readSecret(pgsodiumCoords);
     if (existing && /^[a-f0-9]{64}$/.test(existing)) {
       p3.note(
-        `${pc2.green("\u2713")} Re-using existing pgsodium master key from 1Password (${pc2.cyan(keyTitle)}). Pass --overwrite to rotate.`,
+        `${pc2.green("\u2713")} Re-using existing pgsodium master key from Keychain (${pc2.cyan(keyLabel)}). Pass --overwrite to rotate.`,
         "Secret"
       );
     } else {
       const fresh = generatePgsodiumRootKey();
-      const r = await saveSecretToOp({
-        title: keyTitle,
-        value: fresh,
-        overwrite: opts.overwrite ?? false,
-        ...vaultArg
-      });
+      const r = await saveSecret(pgsodiumCoords, fresh);
       if (r.written) {
         p3.note(
-          `${pc2.green("\u2713")} pgsodium master key${r.alreadyExisted ? " rotated" : " saved"} to 1Password as ${pc2.cyan(keyTitle)}.`,
-          "Secret"
-        );
-      } else if (r.alreadyExisted) {
-        p3.note(
-          `${pc2.yellow("!")} 1Password has an item titled ${pc2.cyan(keyTitle)} but its value is NOT a 64-hex pgsodium key. Inspect it in 1Password; re-run with --overwrite to replace.`,
+          `${pc2.green("\u2713")} pgsodium master key${r.updated ? " rotated" : " saved"} to Keychain as ${pc2.cyan(keyLabel)}.`,
           "Secret"
         );
       } else {
-        await printKeyForManualSave(fresh, keyTitle, r.reason);
+        await printKeyForManualSave(fresh, keyLabel, r.reason);
       }
     }
   } else {
     const fresh = generatePgsodiumRootKey();
-    await printKeyForManualSave(fresh, keyTitle);
+    await printKeyForManualSave(fresh, keyLabel);
   }
   if (opts.skipWait) {
     p3.outro(
@@ -870,24 +855,20 @@ var initCommand = new Command("init").description(
     );
     process.exit(1);
   }
-  const tunnelTitle = `opuspopuli-${region}-tunnel-token`;
-  if (op.installed && op.signedIn) {
-    const r = await saveSecretToOp({
-      title: tunnelTitle,
-      value: tunnelToken,
-      ...opts.vault ? { vault: opts.vault } : {},
-      overwrite: true
-    });
+  const tunnelCoords = { region, account: "tunnel-token" };
+  const tunnelLabel = `org.opuspopuli.${region}/tunnel-token`;
+  if (keychain.available) {
+    const r = await saveSecret(tunnelCoords, tunnelToken);
     if (r.written) {
       p3.note(
-        `${pc2.green("\u2713")} Tunnel token saved to 1Password as ${pc2.cyan(tunnelTitle)}.`,
+        `${pc2.green("\u2713")} Tunnel token saved to Keychain as ${pc2.cyan(tunnelLabel)}.`,
         "Secret"
       );
     } else {
-      await printKeyForManualSave(tunnelToken, tunnelTitle, r.reason);
+      await printKeyForManualSave(tunnelToken, tunnelLabel, r.reason);
     }
   } else {
-    await printKeyForManualSave(tunnelToken, tunnelTitle);
+    await printKeyForManualSave(tunnelToken, tunnelLabel);
   }
   p3.outro(
     pc2.cyan(
@@ -923,21 +904,22 @@ async function collectId(preset, message) {
   );
   return v;
 }
-async function printKeyForManualSave(value, title, reason) {
+async function printKeyForManualSave(value, label, reason) {
   p3.note(
     [
       reason ? `${pc2.red("\u2717")} ${reason}` : "",
-      `Save this value to 1Password as ${pc2.cyan(title)}:`,
+      `Save this value to your secret store as ${pc2.cyan(label)}:`,
       "",
       pc2.yellow(value),
       "",
-      pc2.dim("It will not be shown again.")
+      pc2.dim("It will not be shown again."),
+      pc2.dim("On the Studio, bootstrap will prompt you to paste it back.")
     ].filter((line) => line.length > 0).join("\n"),
     "Manual save"
   );
   unwrap(
     await p3.confirm({
-      message: "Value stashed in 1Password?",
+      message: "Value stashed?",
       initialValue: true
     })
   );
@@ -1563,7 +1545,7 @@ async function locateOrCloneRepo(input) {
 // src/commands/bootstrap.ts
 var bootstrapCommand = new Command("bootstrap").description(
   "Configure the Mac Studio and bring the stack up. Run this on the Studio itself, after `init` has finished on your laptop."
-).addOption(new Option("--region <slug>", "Region label set during init (e.g. us-ca)")).addOption(new Option("--owner <owner>", "GitHub owner for the node repo").default("OpusPopuli")).addOption(new Option("--vault <vault>", "1Password vault to read secrets from").default("Private")).addOption(new Option("--repo-dir <path>", "Explicit path to a checked-out node repo (overrides cwd + clone)")).addOption(
+).addOption(new Option("--region <slug>", "Region label set during init (e.g. us-ca)")).addOption(new Option("--owner <owner>", "GitHub owner for the node repo").default("OpusPopuli")).addOption(new Option("--repo-dir <path>", "Explicit path to a checked-out node repo (overrides cwd + clone)")).addOption(
   new Option(
     "--compose-file <path>",
     "Repeatable. Compose file relative to repo root. Default: docker-compose-prod.yml + docker-compose-backup.yml"
@@ -1693,37 +1675,27 @@ var bootstrapCommand = new Command("bootstrap").description(
   repoSpin.stop(
     located.kind === "cloned" ? pc2.green(`\u2713 Cloned ${owner}/${repoName} to ${repoPath}`) : pc2.green(`\u2713 Found region repo at ${repoPath}`)
   );
-  const op = await detectOp();
-  if (!op.installed || !op.signedIn) {
+  const keychain = await detectKeychain();
+  if (!keychain.available) {
     p3.cancel(
-      "1Password CLI not installed or not signed in. Run `op signin` and re-run bootstrap. (Or paste pgsodium key + Tunnel token by hand \u2014 manual path not in v0.1.)"
+      `${keychain.reason ?? "Keychain unavailable"}. Bootstrap requires the macOS Keychain.`
     );
     process.exit(1);
   }
-  const keyTitle = `opuspopuli-${region}-pgsodium-root-key`;
-  const tunnelTitle = `opuspopuli-${region}-tunnel-token`;
-  const vaultArg = opts.vault ? { vault: opts.vault } : {};
-  const opSpin = p3.spinner();
-  opSpin.start("Reading pgsodium key + Tunnel token from 1Password\u2026");
-  const pgsodiumKey = await readSecretFromOp({ title: keyTitle, ...vaultArg });
-  const tunnelToken = await readSecretFromOp({ title: tunnelTitle, ...vaultArg });
-  if (!pgsodiumKey || !tunnelToken) {
-    opSpin.stop(pc2.red("\u2717 Required 1Password items missing."));
-    const missing = [
-      pgsodiumKey ? null : keyTitle,
-      tunnelToken ? null : tunnelTitle
-    ].filter(Boolean);
-    p3.cancel(
-      `Missing in 1Password (vault: ${opts.vault ?? "Private"}): ${missing.join(", ")}. Run \`create-op-node init\` first, or pass --vault if your items live elsewhere.`
-    );
-    process.exit(1);
-  }
-  if (!PGSODIUM_KEY_RE.test(pgsodiumKey)) {
-    opSpin.stop(pc2.red("\u2717 pgsodium item exists but isn't a 64-hex key."));
-    p3.cancel("Inspect the item in 1Password; it should be 64 lowercase hex characters.");
-    process.exit(1);
-  }
-  opSpin.stop(pc2.green("\u2713 Secrets read from 1Password."));
+  const pgsodiumKey = await loadOrPromptSecret({
+    region,
+    account: "pgsodium-root-key",
+    label: "pgsodium master key",
+    placeholder: "64 lowercase hex characters",
+    validate: (v) => PGSODIUM_KEY_RE.test(v) ? void 0 : "must be exactly 64 lowercase hex characters"
+  });
+  const tunnelToken = await loadOrPromptSecret({
+    region,
+    account: "tunnel-token",
+    label: "Cloudflare Tunnel token",
+    placeholder: "JWT-style base64url string from `terraform output tunnel_token`",
+    validate: (v) => TUNNEL_TOKEN_RE.test(v) ? void 0 : "tunnel token must be a base64-url JWT"
+  });
   if (!opts.skipLaunchAgent) {
     const laSpin = p3.spinner();
     laSpin.start("Writing pgsodium key file + LaunchAgent plist\u2026");
@@ -1958,6 +1930,32 @@ async function promptTailscaleSignin() {
   );
   unwrap(await p3.confirm({ message: "Tailscale signed in (or skipped)?", initialValue: true }));
 }
+async function loadOrPromptSecret(input) {
+  const coords = { region: input.region, account: input.account };
+  const spin = p3.spinner();
+  spin.start(`Reading ${input.label} from Keychain\u2026`);
+  const existing = await readSecret(coords);
+  if (existing && input.validate(existing) === void 0) {
+    spin.stop(pc2.green(`\u2713 ${input.label} read from Keychain.`));
+    return existing;
+  }
+  spin.stop(
+    existing ? pc2.yellow(`\u26A0 ${input.label} in Keychain failed validation \u2014 will re-prompt.`) : pc2.dim(`\xB7 ${input.label} not in Keychain \u2014 will prompt.`)
+  );
+  const pasted = unwrap(
+    await p3.password({
+      message: `Paste the ${input.label} for region ${input.region}:`,
+      validate: (v) => input.validate(v ?? "")
+    })
+  );
+  const save = await saveSecret(coords, pasted);
+  if (!save.written) {
+    p3.note(`${pc2.yellow("\u26A0")} Couldn't persist to Keychain: ${save.reason ?? "unknown"}. Continuing anyway.`, "Keychain");
+  } else {
+    p3.note(`${pc2.green("\u2713")} Stored ${input.label} in Keychain for re-runs.`, "Keychain");
+  }
+  return pasted;
+}
 var REGION_RE = /^[a-z0-9-]{2,32}$/;
 var RESET_PHASES = {
   STOP_STACK: "Stop stack",
@@ -3665,7 +3663,7 @@ async function looksLikeRegionsRepo(dir) {
 }
 
 // src/cli.ts
-var VERSION = "0.2.0";
+var VERSION = "0.3.0";
 var program = new Command();
 program.name("create-op-node").description(
   "Interactive bootstrap for an Opus Populi federation node.\nCloudflare infrastructure \u2192 Mac Studio \u2192 live public API."