lsh-framework 1.7.3 → 1.8.0

package/dist/commands/init.js

@@ -257,8 +257,9 @@ async function saveConfiguration(config) {
             // File doesn't exist, start fresh
         }
         // Update or add configuration
-        // SECURITY: DO NOT save LSH_SECRETS_KEY to .env (circular encryption vulnerability)
-        const updates = {};
+        const updates = {
+            LSH_SECRETS_KEY: config.encryptionKey,
+        };
         if (config.storageType === 'supabase' && config.supabaseUrl && config.supabaseKey) {
             updates.SUPABASE_URL = config.supabaseUrl;
             updates.SUPABASE_ANON_KEY = config.supabaseKey;
@@ -326,23 +327,12 @@ function showSuccessMessage(config) {
     console.log(chalk.bold.green('✨ Setup complete!'));
     console.log(chalk.gray('━'.repeat(50)));
     console.log('');
-    // Show encryption key with shell profile instructions
-    console.log(chalk.yellow('🔑 Your encryption key (save this securely):'));
+    // Show encryption key
+    console.log(chalk.yellow('📝 Your encryption key (save this securely):'));
     console.log(chalk.cyan(`   ${config.encryptionKey}`));
     console.log('');
-    console.log(chalk.bold('⚠️  IMPORTANT: Add this to your shell profile, NOT to .env'));
-    console.log('');
-    console.log(chalk.gray('   Add to your shell profile:'));
-    console.log(chalk.cyan(`   echo 'export LSH_SECRETS_KEY="${config.encryptionKey}"' >> ~/.zshrc`));
-    console.log(chalk.cyan('   source ~/.zshrc'));
-    console.log('');
-    console.log(chalk.gray('   Then verify it\'s set:'));
-    console.log(chalk.cyan('   echo $LSH_SECRETS_KEY'));
-    console.log('');
-    console.log(chalk.gray('   Share this key securely with your team:'));
-    console.log(chalk.gray('   - Use 1Password, LastPass, or Bitwarden'));
-    console.log(chalk.gray('   - Send via encrypted email or Signal'));
-    console.log(chalk.gray('   - Never commit to git or post in public channels'));
+    console.log(chalk.gray('   This key is saved in your .env file.'));
+    console.log(chalk.gray('   Share it with your team to sync secrets.'));
     console.log('');
     // Storage info
     if (config.storageType === 'supabase') {

package/dist/lib/secrets-manager.js

@@ -159,8 +159,8 @@ export class SecretsManager {
         }
         message += `\nThis is likely unintentional and could break your application.\n\n`;
         message += `To proceed anyway, use the --force flag:\n`;
-        message += `  lsh lib secrets push --force\n`;
-        message += `  lsh lib secrets sync --force\n`;
+        message += `  lsh push --force\n`;
+        message += `  lsh sync --force\n`;
         return message;
     }
     /**
@@ -371,84 +371,45 @@ export class SecretsManager {
         return environment;
     }
     /**
-     * Ensure encryption key is set in environment
-     * SECURITY: Key must be in shell profile, NEVER in project .env
+     * Generate encryption key if not set
      */
     async ensureEncryptionKey() {
-        if (process.env.LSH_SECRETS_KEY || this.encryptionKey) {
-            return true; // Key already set (env or constructor)
-        }
-        // DO NOT AUTO-GENERATE - This is a security violation
-        console.log('');
-        logger.error('❌ LSH_SECRETS_KEY environment variable not set');
-        console.log('');
-        logger.error('🔒 For security, this key must be stored in your shell profile,');
-        logger.error('   NOT in your project\'s .env file.');
-        console.log('');
-        logger.error('📝 Quick setup:');
-        console.log('');
-        logger.error('   1. Generate a key:');
-        logger.error('      lsh key');
-        console.log('');
-        logger.error('   2. Add to your shell profile:');
-        logger.error('      echo "export LSH_SECRETS_KEY=\'your-key-here\'" >> ~/.zshrc');
-        logger.error('      source ~/.zshrc');
-        console.log('');
-        logger.error('   3. Verify it\'s set:');
-        logger.error('      echo $LSH_SECRETS_KEY');
-        console.log('');
-        logger.error('📖 See SECURITY.md for complete details and team sharing.');
-        console.log('');
-        throw new Error('LSH_SECRETS_KEY not set in environment');
-    }
-    /**
-     * Check if LSH_SECRETS_KEY is in .env file (security violation)
-     * SECURITY: Keys in .env files create circular encryption and expose secrets
-     */
-    checkForKeyInEnvFile() {
-        // Skip check in test environment
-        if (process.env.NODE_ENV === 'test' || process.env.JEST_WORKER_ID) {
-            return;
+        if (process.env.LSH_SECRETS_KEY) {
+            return true; // Key already set
         }
+        logger.warn('⚠️  No encryption key found. Generating a new key...');
+        const key = crypto.randomBytes(32).toString('hex');
+        // Try to add to .env file
         const envPath = path.join(process.cwd(), '.env');
-        if (!fs.existsSync(envPath)) {
-            return; // No .env file, nothing to check
-        }
         try {
-            const content = fs.readFileSync(envPath, 'utf8');
+            let content = '';
+            if (fs.existsSync(envPath)) {
+                content = fs.readFileSync(envPath, 'utf8');
+                if (!content.endsWith('\n')) {
+                    content += '\n';
+                }
+            }
+            // Check if LSH_SECRETS_KEY already exists (but empty)
             if (content.includes('LSH_SECRETS_KEY=')) {
-                console.log('');
-                logger.error('🚨 SECURITY ISSUE: LSH_SECRETS_KEY found in .env file!');
-                console.log('');
-                logger.error('⚠️  This is a critical security vulnerability:');
-                logger.error('   - Creates circular encryption (key encrypts itself)');
-                logger.error('   - Exposes key if .env is accidentally committed');
-                logger.error('   - Makes IPFS storage completely insecure');
-                console.log('');
-                logger.error('🔧 Fix this immediately:');
-                console.log('');
-                logger.error('   1. Copy the key value from .env');
-                logger.error('   2. Add to your shell profile:');
-                logger.error('      echo "export LSH_SECRETS_KEY=\'your-key\'" >> ~/.zshrc');
-                logger.error('      source ~/.zshrc');
-                console.log('');
-                logger.error('   3. Remove LSH_SECRETS_KEY line from .env:');
-                logger.error('      # Edit .env and DELETE the LSH_SECRETS_KEY= line');
-                console.log('');
-                logger.error('   4. Verify it\'s set correctly:');
-                logger.error('      echo $LSH_SECRETS_KEY');
-                console.log('');
-                logger.error('📖 See SECURITY.md for complete details.');
-                console.log('');
-                throw new Error('LSH_SECRETS_KEY must not be in .env file');
+                content = content.replace(/LSH_SECRETS_KEY=.*$/m, `LSH_SECRETS_KEY=${key}`);
+            }
+            else {
+                content += `\n# LSH Secrets Encryption Key (do not commit!)\nLSH_SECRETS_KEY=${key}\n`;
             }
+            fs.writeFileSync(envPath, content, 'utf8');
+            // Set in current process
+            process.env.LSH_SECRETS_KEY = key;
+            this.encryptionKey = key;
+            logger.info('✅ Generated and saved encryption key to .env');
+            logger.info('💡 Load it now: export LSH_SECRETS_KEY=' + key.substring(0, 8) + '...');
+            return true;
         }
         catch (error) {
-            // If we already threw our error, re-throw it
-            if (error.message === 'LSH_SECRETS_KEY must not be in .env file') {
-                throw error;
-            }
-            // Otherwise, ignore read errors
+            const _err = error;
+            logger.error(`Failed to save encryption key: ${_err.message}`);
+            logger.info('Please set it manually:');
+            logger.info(`export LSH_SECRETS_KEY=${key}`);
+            return false;
         }
     }
     /**
@@ -544,7 +505,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
      * Smart sync command - automatically set up and synchronize secrets
      * This is the new enhanced sync that does everything automatically
      */
-    async smartSync(envFilePath = '.env', environment = 'dev', autoExecute = true, loadMode = false, force = false) {
+    async smartSync(envFilePath = '.env', environment = 'dev', autoExecute = true, loadMode = false, force = false, forceRekey = false) {
         // In load mode, suppress all logger output to prevent zsh glob interpretation
         // Save original level and restore at the end
         const originalLogLevel = loadMode ? logger['config'].level : undefined;
@@ -567,19 +528,17 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 }
                 out();
             }
-            // Step 1: Check for security violations
-            this.checkForKeyInEnvFile(); // Must be BEFORE ensureEncryptionKey
-            // Step 2: Ensure encryption key exists
+            // Step 1: Ensure encryption key exists
             if (!process.env.LSH_SECRETS_KEY) {
                 logger.info('🔑 No encryption key found...');
                 await this.ensureEncryptionKey();
                 out();
             }
-            // Step 3: Ensure .gitignore includes .env
+            // Step 2: Ensure .gitignore includes .env
             if (this.gitInfo?.isGitRepo) {
                 ensureEnvInGitignore(process.cwd());
             }
-            // Step 4: Check current status
+            // Step 3: Check current status
             const status = await this.status(envFilePath, effectiveEnv);
             out('📊 Current Status:');
             out(`   Encryption key: ${status.keySet ? '✅' : '❌'}`);
@@ -589,14 +548,43 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 out(`   Key matches: ${status.keyMatches ? '✅' : '❌'}`);
             }
             out();
-            // Step 5: Determine action and execute if auto mode
+            // Step 4: Determine action and execute if auto mode
             let _action = 'in-sync';
             if (status.cloudExists && status.keyMatches === false) {
+                if (forceRekey) {
+                    // Force re-keying: push local secrets with current key
+                    _action = 'push';
+                    out('🔄 Force re-keying: Re-encrypting cloud secrets with current key...');
+                    if (autoExecute) {
+                        if (!status.localExists) {
+                            out('❌ Cannot re-key: No local .env file found');
+                            out(`💡 Pull with original key first, or create new .env`);
+                            return;
+                        }
+                        out('   Pushing to cloud with new key...');
+                        await this.push(envFilePath, effectiveEnv, true); // Force push
+                        out();
+                        out('✅ Re-keying complete! Cloud secrets now encrypted with current key.');
+                    }
+                    else {
+                        out('💡 Run: lsh push -f ${envFilePath} -e ${environment}');
+                    }
+                    out();
+                    // Output export commands in load mode
+                    if (loadMode && fs.existsSync(envFilePath)) {
+                        console.log(this.generateExportCommands(envFilePath));
+                    }
+                    return;
+                }
+                // No force-rekey: show error and options
                 _action = 'key-mismatch';
                 out('⚠️  Encryption key mismatch!');
                 out('   The local key does not match the cloud storage.');
-                out('   Please use the original key or push new secrets with:');
-                out(`   lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+                out();
+                out('   Options:');
+                out(`   1. Use the original key (recommended if you have it)`);
+                out(`   2. Re-encrypt with current key: lsh push -f ${envFilePath} -e ${environment}`);
+                out(`   3. Re-key during sync: lsh sync --force-rekey -f ${envFilePath} -e ${environment}`);
                 out();
                 return;
             }
@@ -612,7 +600,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                     out('✅ Setup complete! Edit your .env and run sync again to update.');
                 }
                 else {
-                    out('💡 Run: lsh lib secrets create && lsh lib secrets push');
+                    out('💡 Run: lsh create && lsh push');
                 }
                 out();
                 // Output export commands in load mode
@@ -630,7 +618,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                     out('✅ Secrets pushed to cloud!');
                 }
                 else {
-                    out(`💡 Run: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+                    out(`💡 Run: lsh push -f ${envFilePath} -e ${environment}`);
                 }
                 out();
                 // Output export commands in load mode
@@ -648,7 +636,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                     out('✅ Secrets pulled from cloud!');
                 }
                 else {
-                    out(`💡 Run: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+                    out(`💡 Run: lsh pull -f ${envFilePath} -e ${environment}`);
                 }
                 out();
                 // Output export commands in load mode
@@ -685,7 +673,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                             out('✅ Secrets synced to cloud!');
                         }
                         else {
-                            out(`💡 Run: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+                            out(`💡 Run: lsh push -f ${envFilePath} -e ${environment}`);
                         }
                     }
                     else {
@@ -699,7 +687,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                             out('✅ Secrets synced from cloud!');
                         }
                         else {
-                            out(`💡 Run: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+                            out(`💡 Run: lsh pull -f ${envFilePath} -e ${environment}`);
                         }
                     }
                     out();
@@ -764,22 +752,22 @@ LSH_SECRETS_KEY=${this.encryptionKey}
         const suggestions = [];
         if (!status.keySet) {
             suggestions.push('⚠️  No encryption key set!');
-            suggestions.push('   Generate a key: lsh lib secrets key');
+            suggestions.push('   Generate a key: lsh key');
             suggestions.push('   Add it to .env: LSH_SECRETS_KEY=<your-key>');
             suggestions.push('   Load it: export $(cat .env | xargs)');
         }
         if (status.cloudExists && status.keyMatches === false) {
             suggestions.push('⚠️  Encryption key does not match cloud storage!');
             suggestions.push('   Either use the original key, or push new secrets:');
-            suggestions.push(`   lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+            suggestions.push(`   lsh push -f ${envFilePath} -e ${environment}`);
         }
         if (!status.localExists && status.cloudExists && status.keyMatches) {
             suggestions.push('💡 Cloud secrets available but no local file');
-            suggestions.push(`   Pull from cloud: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+            suggestions.push(`   Pull from cloud: lsh pull -f ${envFilePath} -e ${environment}`);
         }
         if (status.localExists && !status.cloudExists) {
             suggestions.push('💡 Local .env exists but not in cloud');
-            suggestions.push(`   Push to cloud: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+            suggestions.push(`   Push to cloud: lsh push -f ${envFilePath} -e ${environment}`);
         }
         if (status.localExists && status.cloudExists && status.keyMatches) {
             if (status.localModified && status.cloudModified) {
@@ -788,11 +776,11 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 const daysDiff = Math.floor(timeDiff / (1000 * 60 * 60 * 24));
                 if (localNewer && daysDiff > 0) {
                     suggestions.push('💡 Local file is newer than cloud');
-                    suggestions.push(`   Push to cloud: lsh lib secrets push -f ${envFilePath} -e ${environment}`);
+                    suggestions.push(`   Push to cloud: lsh push -f ${envFilePath} -e ${environment}`);
                 }
                 else if (!localNewer && daysDiff > 0) {
                     suggestions.push('💡 Cloud is newer than local file');
-                    suggestions.push(`   Pull from cloud: lsh lib secrets pull -f ${envFilePath} -e ${environment}`);
+                    suggestions.push(`   Pull from cloud: lsh pull -f ${envFilePath} -e ${environment}`);
                 }
                 else {
                     suggestions.push('✅ Local and cloud are in sync!');

package/dist/services/secrets/secrets.js

@@ -7,7 +7,6 @@ import * as fs from 'fs';
 import * as path from 'path';
 import * as readline from 'readline';
 import { getGitRepoInfo } from '../../lib/git-utils.js';
-import chalk from 'chalk';
 export async function init_secrets(program) {
     // Push secrets to cloud
     program
@@ -198,27 +197,11 @@ export async function init_secrets(program) {
         }
         else {
             // Interactive output with tips
-            console.log('');
-            console.log('🔑 New encryption key generated!\n');
-            console.log(chalk.cyan(`   ${key}`));
-            console.log('');
-            console.log(chalk.bold('⚠️  IMPORTANT: Add to your shell profile, NOT to .env'));
-            console.log('');
-            console.log(chalk.gray('   1. Add to your shell profile:'));
-            console.log(chalk.cyan(`      echo 'export LSH_SECRETS_KEY="${key}"' >> ~/.zshrc`));
-            console.log(chalk.cyan('      source ~/.zshrc'));
-            console.log('');
-            console.log(chalk.gray('   2. Verify it\'s set:'));
-            console.log(chalk.cyan('      echo $LSH_SECRETS_KEY'));
-            console.log('');
-            console.log(chalk.gray('   3. Share securely with your team:'));
-            console.log(chalk.gray('      - Use 1Password, LastPass, or Bitwarden'));
-            console.log(chalk.gray('      - Send via encrypted email or Signal'));
-            console.log(chalk.gray('      - NEVER commit to git or .env file'));
-            console.log('');
-            console.log(chalk.gray('💡 Quick load: eval "$(lsh key --export)"'));
-            console.log(chalk.gray('📖 Details: See SECURITY.md'));
-            console.log('');
+            console.log('\n🔑 New encryption key (add to your .env):\n');
+            console.log(`export LSH_SECRETS_KEY='${key}'\n`);
+            console.log('💡 Tip: Share this key securely with your team to sync secrets.');
+            console.log('    Never commit it to git!\n');
+            console.log('💡 To load immediately: eval "$(lsh key --export)"\n');
         }
     });
     // Create .env file
@@ -267,7 +250,7 @@ API_KEY=
             console.log('');
             console.log('Next steps:');
             console.log(`  1. Edit the file: ${options.file}`);
-            console.log(`  2. Push to cloud: lsh lib secrets push -f ${options.file}`);
+            console.log(`  2. Push to cloud: lsh push -f ${options.file}`);
             console.log('');
         }
         catch (error) {
@@ -286,6 +269,7 @@ API_KEY=
         .option('--legacy', 'Use legacy sync mode (suggestions only)')
         .option('--load', 'Output eval-able export commands for loading secrets')
         .option('--force', 'Force sync even if destructive changes detected')
+        .option('--force-rekey', 'Re-encrypt cloud secrets with current local key (use when key mismatch)')
         .action(async (options) => {
         const manager = new SecretsManager();
         try {
@@ -295,7 +279,7 @@ API_KEY=
             }
             else {
                 // Use new smart sync (auto-execute)
-                await manager.smartSync(options.file, options.env, !options.dryRun, options.load, options.force);
+                await manager.smartSync(options.file, options.env, !options.dryRun, options.load, options.force, options.forceRekey);
             }
         }
         catch (error) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lsh-framework",
-  "version": "1.7.3",
+  "version": "1.8.0",
   "description": "Simple, cross-platform encrypted secrets manager with automatic sync, IPFS audit logs, and multi-environment support. Just run lsh sync and start managing your secrets.",
   "main": "dist/app.js",
   "bin": {