gitspace 0.2.0-rc.15 → 0.2.0-rc.17

package/bun.lock

@@ -39,10 +39,10 @@
         "typescript": "^5.9.3",
       },
       "optionalDependencies": {
-        "@gitspace/darwin-arm64": "0.2.0-rc.12",
-        "@gitspace/darwin-x64": "0.2.0-rc.12",
-        "@gitspace/linux-arm64": "0.2.0-rc.12",
-        "@gitspace/linux-x64": "0.2.0-rc.12",
+        "@gitspace/darwin-arm64": "0.2.0-rc.15",
+        "@gitspace/darwin-x64": "0.2.0-rc.15",
+        "@gitspace/linux-arm64": "0.2.0-rc.15",
+        "@gitspace/linux-x64": "0.2.0-rc.15",
       },
     },
   },
@@ -63,7 +63,7 @@
 
     "@eslint/js": ["@eslint/js@8.57.1", "", {}, "sha512-d9zaMRSTIKDLhctzH12MtXvJKSSUhaHcjV+2Z+GK+EEY7XKpP5yR4x+N3TAcHTcu963nIr+TMcCb4DBCYX1z6Q=="],
 
-    "@gitspace/darwin-arm64": ["@gitspace/darwin-arm64@0.2.0-rc.12", "", { "os": "darwin", "cpu": "arm64", "bin": { "gssh-darwin-arm64": "bin/gssh" } }, "sha512-FUCz7f6EThB1/epRZ+X3SV7wDq/m4mFRDy2AVXGurVK6OWAA+D8tddUYeGmxvYT9+PXEZDATu5ukBh2RKpr5OQ=="],
+    "@gitspace/darwin-arm64": ["@gitspace/darwin-arm64@0.2.0-rc.15", "", { "os": "darwin", "cpu": "arm64", "bin": { "gssh-darwin-arm64": "bin/gssh" } }, "sha512-gjqsRdz2f7cOOTbj97wmQ4Z0nh7jWUVN4Dxj1N/Ex4fp6dJ8qu2d5izbsCHWVIPX4uN+gK/qqzxuwLwCdaEqlQ=="],
 
     "@graphql-typed-document-node/core": ["@graphql-typed-document-node/core@3.2.0", "", { "peerDependencies": { "graphql": "^0.8.0 || ^0.9.0 || ^0.10.0 || ^0.11.0 || ^0.12.0 || ^0.13.0 || ^14.0.0 || ^15.0.0 || ^16.0.0 || ^17.0.0" } }, "sha512-mB9oAsNCm9aM3/SOv4YtBMqZbYj10R7dkq8byBqxGY/ncFwhf2oQzMV+LCRlWoDSEBJ3COiR1yeDvMtsoOsuFQ=="],
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gitspace",
-  "version": "0.2.0-rc.15",
+  "version": "0.2.0-rc.17",
   "description": "CLI for managing GitHub workspaces with git worktrees and secure remote terminal access",
   "bin": {
     "gssh": "./bin/gssh"
@@ -17,10 +17,10 @@
     "relay": "bun src/relay/index.ts"
   },
   "optionalDependencies": {
-    "@gitspace/darwin-arm64": "0.2.0-rc.15",
-    "@gitspace/darwin-x64": "0.2.0-rc.15",
-    "@gitspace/linux-x64": "0.2.0-rc.15",
-    "@gitspace/linux-arm64": "0.2.0-rc.15"
+    "@gitspace/darwin-arm64": "0.2.0-rc.17",
+    "@gitspace/darwin-x64": "0.2.0-rc.17",
+    "@gitspace/linux-x64": "0.2.0-rc.17",
+    "@gitspace/linux-arm64": "0.2.0-rc.17"
   },
   "keywords": [
     "cli",

package/src/app/session/useWorkspaceDeleteFlow.ts

@@ -0,0 +1,170 @@
+import { useCallback } from 'react';
+import type { UseFlowReturn } from '../../components/Flow.js';
+import type { DeleteWorkspaceParams } from '../../session/backend.js';
+
+export interface WorkspaceDeleteTarget {
+  projectName: string;
+  workspaceId: string;
+  workspaceName: string;
+}
+
+export interface WorkspaceDeleteContext {
+  target: WorkspaceDeleteTarget;
+  params: DeleteWorkspaceParams;
+  isRetry: boolean;
+}
+
+export interface WorkspaceDeleteErrorContext extends WorkspaceDeleteContext {
+  error: unknown;
+  message: string;
+}
+
+export interface UseWorkspaceDeleteFlowOptions {
+  flow: Pick<UseFlowReturn, 'showLoading' | 'showConfirm' | 'showMessage' | 'close'>;
+  deleteWorkspace: (
+    projectName: string,
+    workspaceId: string,
+    params?: DeleteWorkspaceParams
+  ) => Promise<void>;
+  onBeforeDelete?: (context: WorkspaceDeleteContext) => void | Promise<void>;
+  onDeleteSuccess?: (context: WorkspaceDeleteContext) => void | Promise<void>;
+  onDeleteCancelled?: (context: WorkspaceDeleteContext) => void | Promise<void>;
+  onDeleteError?: (context: WorkspaceDeleteErrorContext) => void | Promise<void>;
+  showLoadingDuringDelete?: boolean;
+}
+
+export interface UseWorkspaceDeleteFlowResult {
+  deleteWorkspaceWithPrompt: (target: WorkspaceDeleteTarget) => Promise<boolean>;
+}
+
+function getErrorCode(error: unknown): string | undefined {
+  if (!error || typeof error !== 'object') {
+    return undefined;
+  }
+
+  const candidate = error as { code?: unknown };
+  return typeof candidate.code === 'string' ? candidate.code : undefined;
+}
+
+function toErrorMessage(error: unknown): string {
+  if (error instanceof Error && error.message) {
+    return error.message;
+  }
+
+  if (typeof error === 'string' && error.length > 0) {
+    return error;
+  }
+
+  return 'Failed to delete workspace';
+}
+
+function promptRemoveScriptFailure(
+  flow: UseWorkspaceDeleteFlowOptions['flow'],
+  workspaceName: string,
+  message: string
+): Promise<boolean> {
+  return new Promise<boolean>((resolve) => {
+    flow.showConfirm({
+      title: 'Remove Scripts Failed',
+      message:
+        `Cleanup scripts failed for workspace "${workspaceName}".\n\n${message}\n\nRemove anyway and skip cleanup scripts?`,
+      variant: 'warning',
+      confirmLabel: 'Remove anyway',
+      cancelLabel: 'Keep workspace',
+      onConfirm: () => resolve(true),
+      onCancel: () => resolve(false),
+    });
+  });
+}
+
+export function useWorkspaceDeleteFlow(
+  options: UseWorkspaceDeleteFlowOptions
+): UseWorkspaceDeleteFlowResult {
+  const {
+    flow,
+    deleteWorkspace,
+    onBeforeDelete,
+    onDeleteSuccess,
+    onDeleteCancelled,
+    onDeleteError,
+    showLoadingDuringDelete = false,
+  } = options;
+
+  const executeDelete = useCallback(async (
+    target: WorkspaceDeleteTarget,
+    params: DeleteWorkspaceParams,
+    isRetry: boolean
+  ): Promise<boolean> => {
+    const context: WorkspaceDeleteContext = {
+      target,
+      params,
+      isRetry,
+    };
+
+    await onBeforeDelete?.(context);
+    if (showLoadingDuringDelete) {
+      flow.showLoading({
+        title: 'Deleting Workspace',
+        message:
+          params.scriptPolicy === 'skip'
+            ? 'Removing workspace without cleanup scripts...'
+            : `Running cleanup scripts for "${target.workspaceName}"...`,
+      });
+    } else {
+      flow.close();
+    }
+
+    try {
+      await deleteWorkspace(target.projectName, target.workspaceId, params);
+      flow.close();
+      await onDeleteSuccess?.(context);
+      return true;
+    } catch (error) {
+      const message = toErrorMessage(error);
+      const code = getErrorCode(error);
+
+      if (code === 'REMOVE_SCRIPT_FAILED' && params.scriptPolicy !== 'skip') {
+        const removeAnyway = await promptRemoveScriptFailure(flow, target.workspaceName, message);
+        if (!removeAnyway) {
+          await onDeleteCancelled?.(context);
+          return false;
+        }
+
+        return executeDelete(target, { scriptPolicy: 'skip' }, true);
+      }
+
+      flow.close();
+      if (onDeleteError) {
+        await onDeleteError({
+          ...context,
+          error,
+          message,
+        });
+      } else {
+        flow.showMessage({
+          title: 'Delete Failed',
+          message,
+          variant: 'error',
+        });
+      }
+
+      return false;
+    }
+  }, [
+    deleteWorkspace,
+    flow,
+    onBeforeDelete,
+    onDeleteCancelled,
+    onDeleteError,
+    onDeleteSuccess,
+    showLoadingDuringDelete,
+  ]);
+
+  const deleteWorkspaceWithPrompt = useCallback(async (target: WorkspaceDeleteTarget): Promise<boolean> => {
+    return executeDelete(target, { scriptPolicy: 'auto' }, false);
+  }, [executeDelete]);
+
+  return {
+    deleteWorkspaceWithPrompt,
+  };
+}

package/src/app.tui.tsx

@@ -86,6 +86,11 @@ import { useLocalSession } from './hooks/useLocalSession.tui.js';
 import { useUserActivity } from './hooks/index.js';
 import { useBundleRefreshAttachFlow } from './session/index.js';
 import { useAttachController } from './app/session/useAttachController.js';
+import { useWorkspaceDeleteFlow } from './app/session/useWorkspaceDeleteFlow.js';
+import {
+  consumeLegacyCleanupReminderForTui,
+  initializeSecretRuntime,
+} from './core/secret-runtime.js';
 import {
   resolveInboxCommand,
   resolveMachineListCommand,
@@ -438,6 +443,27 @@ function App({ relayConfig, onQuit }: AppProps) {
     },
   });
 
+  const { deleteWorkspaceWithPrompt } = useWorkspaceDeleteFlow({
+    flow,
+    deleteWorkspace: deleteLocalWorkspace,
+    onBeforeDelete: ({ target }) => {
+      setScriptWorkspaceName(target.workspaceName);
+      dispatch({ type: 'SET_VIEW', view: 'scripts' });
+    },
+    onDeleteSuccess: async () => {
+      dispatch({ type: 'SET_VIEW', view: 'projects' });
+      await refreshWorkspaces();
+    },
+    onDeleteError: async ({ message }) => {
+      dispatch({ type: 'SET_VIEW', view: 'projects' });
+      flow.showMessage({
+        title: 'Delete Failed',
+        message,
+        variant: 'error',
+      });
+    },
+  });
+
   // Daemon status hook (tmux-lite and serve)
   const { status: daemonStatus } = useDaemonStatus({ pollInterval: 5000 });
 
@@ -600,26 +626,14 @@ function App({ relayConfig, onQuit }: AppProps) {
       warning: workspace.sessionCount > 0 ? `This will kill ${workspace.sessionCount} active session(s)!` : undefined,
       onConfirm: async () => {
         if (!currentProject) return;
-        flow.showLoading({ title: 'Deleting', message: 'Preparing...' });
-
-        try {
-          await deleteLocalWorkspace(currentProject, workspace.id);
-        } catch (error) {
-          console.error('[tui] Failed to delete workspace:', error);
-          flow.close();
-          flow.showMessage({
-            title: 'Delete Failed',
-            message: error instanceof Error ? error.message : `Failed to delete workspace "${workspace.name}".`,
-            variant: 'error',
-          });
-          return;
-        }
-
-        flow.close();
-        await refreshWorkspaces();
+        await deleteWorkspaceWithPrompt({
+          projectName: currentProject,
+          workspaceId: workspace.id,
+          workspaceName: workspace.name,
+        });
       },
     });
-  }, [currentProject, flow, refreshWorkspaces]);
+  }, [currentProject, flow, deleteWorkspaceWithPrompt]);
 
   // Delete session
   const handleDeleteSession = useCallback((sessionId: string, sessionName: string) => {
@@ -1311,9 +1325,13 @@ function App({ relayConfig, onQuit }: AppProps) {
   // ========== Keyboard Handlers ==========
 
   useKeyboard(async (key) => {
+    const localScriptTerminalRunning =
+      state.view === 'scripts' &&
+      (localScriptState?.isRunning ?? true);
+
     // Handle flow modals FIRST - even in terminal view
     // This ensures y/n work in confirmation modals when terminal is underneath
-    if (flow.isOpen) {
+    if (flow.isOpen && !localScriptTerminalRunning) {
       // Handle confirm modal with y/n shortcuts
       if (flow.flow.type === 'confirm') {
         if (key.raw === 'y' || key.name === 'return') {
@@ -2048,7 +2066,7 @@ function App({ relayConfig, onQuit }: AppProps) {
           error={localScriptState?.error}
           exitCode={localScriptState?.exitCode}
         />
-        <FlowTUI flow={flow} />
+        {!isRunning && <FlowTUI flow={flow} />}
         <StatusBar hint={isRunning ? '[Running scripts...]' : '[Esc/n] Back to workspaces'} />
       </Fragment>
     );
@@ -2561,7 +2579,14 @@ function StatusBar({ hint }: { hint: string }) {
 /** @deprecated Use RelayConfig instead */
 export type TUIRelayConfig = RelayConfig;
 
-export async function launchTUI(relayConfig?: RelayConfig): Promise<void> {
+export async function launchTUI(
+  relayConfig?: RelayConfig,
+  options: { ignoreKeychainAndSkipSecrets?: boolean } = {}
+): Promise<void> {
+  await initializeSecretRuntime({
+    ignoreKeychainAndSkipSecrets: options.ignoreKeychainAndSkipSecrets,
+  });
+
   const renderer = await createCliRenderer({
     exitOnCtrlC: false,
     targetFps: 30,
@@ -2572,6 +2597,12 @@ export async function launchTUI(relayConfig?: RelayConfig): Promise<void> {
   // Clean exit handler
   const handleQuit = () => {
     renderer.destroy();
+
+    const legacyReminder = consumeLegacyCleanupReminderForTui();
+    if (legacyReminder) {
+      logger.warning(legacyReminder);
+    }
+
     process.exit(0);
   };
 

package/src/app.web.tsx

@@ -18,6 +18,7 @@ import { applyDeviceClasses, isMobileLayout, isTouchDevice } from "./utils/devic
 import { useUserActivity } from "./hooks/index.js";
 import { useBundleRefreshAttachFlow } from './session/useBundleRefreshAttachFlow.js';
 import { useAttachController } from './app/session/useAttachController.js';
+import { useWorkspaceDeleteFlow } from './app/session/useWorkspaceDeleteFlow.js';
 
 // Import shared components and hooks
 import {
@@ -49,6 +50,13 @@ type View = "machines" | "terminal";
 
 const PAGE_UP = '\x1b[5~';
 const PAGE_DOWN = '\x1b[6~';
+const DELETE_ERROR_CODES = new Set([
+  'REMOVE_SCRIPT_FAILED',
+  'DELETE_FAILED',
+  'WORKSPACE_NOT_FOUND',
+  'RESOURCE_NOT_FOUND',
+  'NOT_FOUND',
+]);
 
 export default function App() {
   const [view, setView] = useState<View>("machines");
@@ -71,6 +79,7 @@ export default function App() {
   const terminalRef = useRef<SessionTerminalHandle>(null);
   const lastScriptErrorRef = useRef<string | null>(null);
   const lastCommandErrorRef = useRef<string | null>(null);
+  const suppressDeleteScriptFailureModalRef = useRef(false);
 
   // Invite params from URL
   const [inviteParams, setInviteParams] = useState<{
@@ -174,6 +183,36 @@ export default function App() {
     },
   });
 
+  const { deleteWorkspaceWithPrompt } = useWorkspaceDeleteFlow({
+    flow,
+    deleteWorkspace: terminal.deleteWorkspace,
+    onBeforeDelete: ({ target }) => {
+      suppressDeleteScriptFailureModalRef.current = true;
+      setShowInbox(false);
+      setScriptWorkspaceName(target.workspaceName);
+      setShowScriptTerminal(true);
+    },
+    onDeleteSuccess: async () => {
+      suppressDeleteScriptFailureModalRef.current = false;
+      setShowScriptTerminal(false);
+      terminal.requestWorkspaces();
+      terminal.requestSessions();
+    },
+    onDeleteCancelled: async () => {
+      suppressDeleteScriptFailureModalRef.current = false;
+      setShowScriptTerminal(false);
+    },
+    onDeleteError: async ({ message }) => {
+      suppressDeleteScriptFailureModalRef.current = false;
+      setShowScriptTerminal(false);
+      flow.showMessage({
+        title: 'Delete Failed',
+        message,
+        variant: 'error',
+      });
+    },
+  });
+
   useEffect(() => {
     let mounted = true;
     void browserPreferencesService.getNotificationConfig().then((config) => {
@@ -235,6 +274,11 @@ export default function App() {
       return;
     }
 
+    if (suppressDeleteScriptFailureModalRef.current) {
+      lastScriptErrorRef.current = scriptError;
+      return;
+    }
+
     if (lastScriptErrorRef.current === scriptError) {
       return;
     }
@@ -259,11 +303,20 @@ export default function App() {
     }
     lastCommandErrorRef.current = key;
 
+    if (
+      suppressDeleteScriptFailureModalRef.current &&
+      terminal.commandError.code &&
+      DELETE_ERROR_CODES.has(terminal.commandError.code)
+    ) {
+      return;
+    }
+
     const isScriptFailure =
       terminal.commandError.code === 'SCRIPT_FAILED' ||
       terminal.commandError.code === 'PRE_SCRIPT_FAILED' ||
       terminal.commandError.code === 'SETUP_SCRIPT_FAILED' ||
-      terminal.commandError.code === 'SELECT_SCRIPT_FAILED';
+      terminal.commandError.code === 'SELECT_SCRIPT_FAILED' ||
+      terminal.commandError.code === 'REMOVE_SCRIPT_FAILED';
 
     if (isScriptFailure) {
       if (!terminal.scriptState) {
@@ -370,12 +423,10 @@ export default function App() {
   const spacesBrowserProps = useSpacesBrowser({
     workspaces: terminal.workspaces,
     sessions: terminal.sessions,
-    onRequestSessions: terminal.requestSessions,
+    onRequestSessions: () => terminal.requestSessions(),
     onAttachSession: handleAttachSession,
     onRefresh: terminal.requestWorkspaces,
-    onRefreshSessions: (workspaceIds) => {
-      workspaceIds.forEach(id => terminal.requestSessions(id));
-    },
+    onRefreshSessions: () => terminal.requestSessions(),
     onBack: handleBackToMachines,
     machineName: selectedMachine?.label || selectedMachine?.machineId,
   });
@@ -446,6 +497,7 @@ export default function App() {
     if (view === "terminal" && terminal.status === "established" && terminal.mode === "browsing") {
       terminal.requestProjects();
       terminal.requestWorkspaces();
+      terminal.requestSessions();
       terminal.requestNotificationConfig();
     }
   }, [
@@ -454,6 +506,7 @@ export default function App() {
     terminal.mode,
     terminal.requestProjects,
     terminal.requestWorkspaces,
+    terminal.requestSessions,
     terminal.requestNotificationConfig,
   ]);
 
@@ -594,8 +647,12 @@ export default function App() {
             message: `Are you sure you want to delete workspace "${selected.workspace.name}"?`,
             confirmText: selected.workspace.name,
             warning: sessionCount > 0 ? `This will kill ${sessionCount} active session(s)!` : undefined,
-            onConfirm: () => {
-              terminal.deleteWorkspace(selected.workspace.projectName, selected.workspace.id);
+            onConfirm: async () => {
+              await deleteWorkspaceWithPrompt({
+                projectName: selected.workspace.projectName,
+                workspaceId: selected.workspace.id,
+                workspaceName: selected.workspace.name,
+              });
             },
           });
         }
@@ -607,7 +664,16 @@ export default function App() {
 
     window.addEventListener("keydown", handleKeyDown);
     return () => window.removeEventListener("keydown", handleKeyDown);
-  }, [view, terminal.status, terminal.mode, showInbox, showScriptTerminal, spacesBrowserProps, flow]);
+  }, [
+    view,
+    terminal.status,
+    terminal.mode,
+    showInbox,
+    showScriptTerminal,
+    spacesBrowserProps,
+    flow,
+    deleteWorkspaceWithPrompt,
+  ]);
 
   // Attached terminal mode keyboard handler (Ctrl+Esc to detach)
   useEffect(() => {
@@ -681,18 +747,19 @@ export default function App() {
     terminal.mode === 'browsing' &&
     showScriptTerminal
   ) {
+    const isRunning = terminal.scriptState?.isRunning ?? true;
     return (
       <>
         <ScriptTerminal
           phase={terminal.scriptState?.phase ?? 'pre'}
           workspaceName={scriptWorkspaceName}
-          isRunning={terminal.scriptState?.isRunning ?? true}
+          isRunning={isRunning}
           error={terminal.scriptState?.error}
           exitCode={terminal.scriptState?.exitCode}
           setWriteCallback={terminal.setWriteCallback}
           onBack={() => setShowScriptTerminal(false)}
         />
-        <FlowWeb flow={flow} />
+        {!isRunning && <FlowWeb flow={flow} />}
         <Toaster theme="dark" position="top-right" richColors />
       </>
     );

package/src/commands/migrate.ts

@@ -0,0 +1,52 @@
+import { getSecretMigrationInputs } from '../core/secret-runtime.js';
+import { logger } from '../utils/logger.js';
+import { promptConfirm } from '../utils/prompts.js';
+import { cleanupLegacySecretEntries, preloadAllSecrets } from '../utils/secrets.js';
+
+export interface CleanupLegacyOptions {
+  yes?: boolean;
+}
+
+export async function migrateCleanupLegacy(
+  options: CleanupLegacyOptions = {}
+): Promise<void> {
+  const migrationInputs = getSecretMigrationInputs();
+
+  if (!options.yes) {
+    const confirmed = await promptConfirm(
+      'Delete legacy keychain entries (project:*, global, and old per-key entries)? Unified secrets are kept.',
+      false
+    );
+
+    if (!confirmed) {
+      logger.info('Cancelled');
+      return;
+    }
+  }
+
+  // Ensure legacy entries are copied into unified storage before cleanup.
+  await preloadAllSecrets(migrationInputs.projectNames, {
+    projectLegacyKeys: migrationInputs.projectSecretKeys,
+    globalLegacyKeys: migrationInputs.globalSecretKeys,
+  });
+
+  const result = await cleanupLegacySecretEntries(migrationInputs.projectNames, {
+    projectLegacyKeys: migrationInputs.projectSecretKeys,
+    globalLegacyKeys: migrationInputs.globalSecretKeys,
+  });
+
+  if (result.errors.length > 0) {
+    logger.warning(`Legacy cleanup completed with ${result.errors.length} error(s).`);
+    for (const error of result.errors) {
+      logger.error(`  ${error}`);
+    }
+    logger.info(
+      `Legacy cleanup finished with issues. Deleted ${result.deleted} entries (${result.missing} already absent).`
+    );
+    return;
+  }
+
+  logger.success(
+    `Legacy cleanup complete. Deleted ${result.deleted} entries (${result.missing} already absent).`
+  );
+}

package/src/commands/remove.ts

@@ -114,10 +114,32 @@ export async function removeWorkspace(
 
 	// Delegate to core deletion logic (interactive mode for CLI)
 	logger.info('Removing workspace...')
-	const result = await deleteWorkspaceCore(currentProject, workspaceName, {
-		nonInteractive: false, // CLI is interactive
-		keepBranch: options.keepBranch,
-	})
+	const runDelete = async (scriptPolicy: 'enforce' | 'skip') => {
+		return deleteWorkspaceCore(currentProject, workspaceName, {
+			nonInteractive: false, // CLI is interactive
+			keepBranch: options.keepBranch,
+			removeScriptPolicy: scriptPolicy,
+		})
+	}
+
+	let result = await runDelete('enforce')
+
+	if (!result.success && result.errorCode === 'REMOVE_SCRIPT_FAILED') {
+		logger.warning(result.error || 'Remove scripts failed')
+		const removeAnyway = options.force
+			? true
+			: await promptConfirm(
+				`Remove workspace "${workspaceName}" anyway and skip cleanup scripts?`,
+				false
+			)
+
+		if (!removeAnyway) {
+			logger.info('Cancelled')
+			return
+		}
+
+		result = await runDelete('skip')
+	}
 
 	if (!result.success) {
 		throw new SpacesError(

package/src/commands/serve.ts

@@ -61,6 +61,7 @@ import {
   ensureServeDaemonDir,
   type StatusResponse,
 } from '../serve/daemon.js';
+import { initializeSecretRuntime } from '../core/secret-runtime.js';
 
 /** Package version for daemon status */
 const PACKAGE_VERSION = '1.0.0';
@@ -463,6 +464,7 @@ function stopCloudflared(): void {
 export async function serve(options: {
   relay?: string;
   relayPubkey?: string;
+  ignoreKeychainAndSkipSecrets?: boolean;
 } = {}): Promise<void> {
   // Step 1: Load machine identity
   if (!keypairExists()) {
@@ -503,6 +505,10 @@ export async function serve(options: {
   const entries = readAccessList();
   accessList.import(entries);
 
+  await initializeSecretRuntime({
+    ignoreKeychainAndSkipSecrets: options.ignoreKeychainAndSkipSecrets,
+  });
+
   // Step 3: Check for gitspace.sh hosting or explicit relay
   const hostConfig = readHostConfig();
   const relayUrl = options.relay; // No default - must use hosting or explicit --relay
@@ -1156,6 +1162,7 @@ export async function serveStart(options: {
   relayPubkey?: string;
   passwordStdin?: boolean;
   foreground?: boolean;
+  ignoreKeychainAndSkipSecrets?: boolean;
 } = {}): Promise<void> {
   // Check if already running
   if (isServeRunning()) {
@@ -1234,6 +1241,9 @@ export async function serveStart(options: {
     const serveArgs = ['serve', 'start', '--foreground'];
     if (options.relay) serveArgs.push('--relay', options.relay);
     if (options.relayPubkey) serveArgs.push('--relay-pubkey', options.relayPubkey);
+    if (options.ignoreKeychainAndSkipSecrets) {
+      serveArgs.push('--ignore-keychain-and-skip-secrets');
+    }
     serveArgs.push('--password-stdin');
 
     // Build command: compiled binary runs directly, dev mode uses bun
@@ -1294,6 +1304,16 @@ export async function serveStart(options: {
   const entries = readAccessList();
   accessList.import(entries);
 
+  try {
+    await initializeSecretRuntime({
+      ignoreKeychainAndSkipSecrets: options.ignoreKeychainAndSkipSecrets,
+    });
+  } catch (error) {
+    stopStatusServer();
+    cleanupServeFiles();
+    throw error;
+  }
+
   // Get config
   const machineIdentity = readMachineIdentity();
   const machineId = machineIdentity?.machineId ?? identity.id;