lsh-framework 2.1.2 → 2.2.1

package/dist/commands/init.js

@@ -10,6 +10,7 @@ import * as crypto from 'crypto';
 import { createClient } from '@supabase/supabase-js';
 import ora from 'ora';
 import { getPlatformPaths } from '../lib/platform-utils.js';
+import { getGitRepoInfo } from '../lib/git-utils.js';
 /**
  * Register init commands
  */
@@ -101,9 +102,56 @@ async function runSetupWizard(options) {
         ]);
         storageType = storage;
     }
+    // Check if secrets already exist for this repo in the cloud
+    const cloudCheck = await checkCloudSecretsExist();
+    let encryptionKey;
+    if (cloudCheck.exists && cloudCheck.repoName) {
+        // Secrets found! This is an existing project
+        console.log(chalk.cyan(`\n✨ Found existing secrets for "${cloudCheck.repoName}" in cloud!`));
+        console.log(chalk.gray('This appears to be an existing project.'));
+        console.log('');
+        const { useExisting } = await inquirer.prompt([
+            {
+                type: 'confirm',
+                name: 'useExisting',
+                message: 'Pull existing secrets from another machine?',
+                default: true,
+            },
+        ]);
+        if (useExisting) {
+            // Prompt for existing encryption key
+            const { existingKey } = await inquirer.prompt([
+                {
+                    type: 'password',
+                    name: 'existingKey',
+                    message: 'Enter the encryption key from your other machine:',
+                    mask: '*',
+                    validate: (input) => {
+                        if (!input.trim())
+                            return 'Encryption key is required';
+                        if (input.length !== 64)
+                            return 'Key should be 64 characters (32 bytes hex)';
+                        if (!/^[0-9a-f]+$/i.test(input))
+                            return 'Key should be hexadecimal';
+                        return true;
+                    },
+                },
+            ]);
+            encryptionKey = existingKey.trim();
+        }
+        else {
+            // Generate new key (will overwrite existing)
+            console.log(chalk.yellow('\n⚠️  Generating new key will overwrite existing secrets!'));
+            encryptionKey = generateEncryptionKey();
+        }
+    }
+    else {
+        // No existing secrets - generate new key
+        encryptionKey = generateEncryptionKey();
+    }
     const config = {
         storageType,
-        encryptionKey: generateEncryptionKey(),
+        encryptionKey,
     };
     // Configure based on storage type
     if (storageType === 'storacha') {
@@ -118,6 +166,20 @@ async function runSetupWizard(options) {
     else {
         await configureLocal(config);
     }
+    // If using existing key and secrets exist, offer to pull them now
+    if (cloudCheck.exists && config.encryptionKey && cloudCheck.repoName) {
+        const { pullNow } = await inquirer.prompt([
+            {
+                type: 'confirm',
+                name: 'pullNow',
+                message: 'Pull secrets now?',
+                default: true,
+            },
+        ]);
+        if (pullNow) {
+            await pullSecretsAfterInit(config.encryptionKey, cloudCheck.repoName);
+        }
+    }
     // Save configuration
     await saveConfiguration(config);
     // Show success message
@@ -139,6 +201,78 @@ async function checkExistingConfig() {
         return false;
     }
 }
+/**
+ * Pull secrets after init is complete
+ */
+async function pullSecretsAfterInit(encryptionKey, repoName) {
+    const spinner = ora('Pulling secrets from cloud...').start();
+    try {
+        // Dynamically import SecretsManager to avoid circular dependencies
+        const { SecretsManager } = await import('../lib/secrets-manager.js');
+        const secretsManager = new SecretsManager();
+        // Pull secrets for this repo
+        await secretsManager.pull('.env', '', false);
+        spinner.succeed(chalk.green('✅ Secrets pulled successfully!'));
+    }
+    catch (error) {
+        spinner.fail(chalk.red('❌ Failed to pull secrets'));
+        const err = error;
+        console.log(chalk.yellow(`\n⚠️  ${err.message}`));
+        console.log(chalk.gray('\nYou can try pulling manually later with:'));
+        console.log(chalk.cyan(`   lsh pull`));
+    }
+}
+/**
+ * Check if secrets already exist in cloud for current repo
+ */
+async function checkCloudSecretsExist() {
+    try {
+        const gitInfo = getGitRepoInfo();
+        if (!gitInfo?.repoName) {
+            return { exists: false };
+        }
+        const repoName = gitInfo.repoName;
+        const environment = repoName; // Default environment for repo
+        // First check local metadata (fast path)
+        const paths = getPlatformPaths();
+        const metadataPath = path.join(paths.dataDir, 'secrets-metadata.json');
+        try {
+            const metadataContent = await fs.readFile(metadataPath, 'utf-8');
+            const metadata = JSON.parse(metadataContent);
+            // Check if any environment matches this repo name
+            const hasSecrets = Object.keys(metadata).some(env => env === repoName || env.startsWith(`${repoName}_`));
+            if (hasSecrets) {
+                return { exists: true, repoName, environment };
+            }
+        }
+        catch {
+            // Metadata file doesn't exist or can't be read - continue to network check
+        }
+        // Check Storacha network for registry file (works on new machines)
+        try {
+            const { getStorachaClient } = await import('../lib/storacha-client.js');
+            const storacha = getStorachaClient();
+            // Only check network if Storacha is enabled and authenticated
+            if (storacha.isEnabled() && await storacha.isAuthenticated()) {
+                const spinner = ora('Checking Storacha network for existing secrets...').start();
+                const registryExists = await storacha.checkRegistry(repoName);
+                spinner.stop();
+                if (registryExists) {
+                    return { exists: true, repoName, environment };
+                }
+            }
+        }
+        catch (error) {
+            // Network check failed, but that's okay - just means no secrets found
+            const err = error;
+            console.log(chalk.gray(`   (Network check skipped: ${err.message})`));
+        }
+        return { exists: false, repoName, environment };
+    }
+    catch {
+        return { exists: false };
+    }
+}
 /**
  * Configure Supabase
  */

package/dist/lib/ipfs-secrets-storage.js

@@ -72,6 +72,19 @@ export class IPFSSecretsStorage {
                     // encryptedData is already a Buffer, pass it directly
                     await storacha.upload(Buffer.from(encryptedData), filename);
                     logger.info(`   ☁️  Synced to Storacha network`);
+                    // Upload registry file if this is a git repo
+                    // This allows detection on new machines without local metadata
+                    if (gitRepo) {
+                        try {
+                            await storacha.uploadRegistry(gitRepo, environment);
+                            logger.debug(`   📝 Registry uploaded for ${gitRepo}`);
+                        }
+                        catch (regError) {
+                            // Registry upload failed, but secrets are still uploaded
+                            const _regErr = regError;
+                            logger.debug(`   Registry upload failed: ${_regErr.message}`);
+                        }
+                    }
                 }
                 catch (error) {
                     const err = error;

package/dist/lib/storacha-client.js

@@ -233,6 +233,102 @@ export class StorachaClient {
             throw new Error(`Failed to download from Storacha: ${err.message}`);
         }
     }
+    /**
+     * Upload registry file for a repo
+     * Registry files mark that secrets exist for a repo without exposing the secrets themselves
+     */
+    async uploadRegistry(repoName, environment) {
+        if (!this.isEnabled()) {
+            throw new Error('Storacha is not enabled');
+        }
+        if (!await this.isAuthenticated()) {
+            throw new Error('Not authenticated');
+        }
+        const registry = {
+            repoName,
+            environment,
+            timestamp: new Date().toISOString(),
+            version: '2.2.1',
+        };
+        const content = JSON.stringify(registry, null, 2);
+        const buffer = Buffer.from(content, 'utf-8');
+        const filename = `lsh-registry-${repoName}.json`;
+        const client = await this.getClient();
+        const uint8Array = new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const file = new File([uint8Array], filename, { type: 'application/json' });
+        const cid = await client.uploadFile(file);
+        logger.debug(`📝 Uploaded registry for ${repoName}: ${cid}`);
+        return cid.toString();
+    }
+    /**
+     * Check if registry exists for a repo by listing uploads
+     * Returns true if a registry file for this repo exists in Storacha
+     *
+     * NOTE: This is optimized to check only recent small files (likely registry files)
+     * to avoid downloading large encrypted secret files.
+     */
+    async checkRegistry(repoName) {
+        if (!this.isEnabled()) {
+            return false;
+        }
+        if (!await this.isAuthenticated()) {
+            return false;
+        }
+        try {
+            const client = await this.getClient();
+            // Only check recent uploads (limit to 20 for performance)
+            const pageSize = 20;
+            // Get first page of uploads
+            const results = await client.capability.upload.list({
+                cursor: '',
+                size: pageSize,
+            });
+            // Track checked count for logging
+            let checked = 0;
+            let skipped = 0;
+            // Check if any uploads match our registry pattern
+            // Registry files are small JSON files (~200 bytes)
+            // Skip large files (encrypted secrets are much larger)
+            for (const upload of results.results) {
+                try {
+                    const cid = upload.root.toString();
+                    // Quick heuristic: registry files are tiny (<1KB)
+                    // Skip if this looks like a large encrypted file based on CID
+                    // We'll attempt download with a timeout
+                    const downloadPromise = this.download(cid);
+                    const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 5000) // 5s timeout per file
+                    );
+                    const content = await Promise.race([downloadPromise, timeoutPromise]);
+                    // Skip large files (registry should be < 1KB)
+                    if (content.length > 1024) {
+                        skipped++;
+                        continue;
+                    }
+                    checked++;
+                    // Try to parse as JSON
+                    const json = JSON.parse(content.toString('utf-8'));
+                    // Check if it's an LSH registry file for our repo
+                    if (json.repoName === repoName && json.version) {
+                        logger.debug(`✅ Found registry for ${repoName} at CID: ${cid} (checked ${checked} files, skipped ${skipped})`);
+                        return true;
+                    }
+                }
+                catch {
+                    // Not an LSH registry file, timed out, or failed to download - continue
+                    skipped++;
+                }
+            }
+            // No registry found
+            logger.debug(`❌ No registry found for ${repoName} (checked ${checked} files, skipped ${skipped})`);
+            return false;
+        }
+        catch (error) {
+            const err = error;
+            logger.debug(`Failed to check registry: ${err.message}`);
+            return false;
+        }
+    }
     /**
      * Enable Storacha network sync
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lsh-framework",
-  "version": "2.1.2",
+  "version": "2.2.1",
   "description": "Simple, cross-platform encrypted secrets manager with automatic sync, IPFS audit logs, and multi-environment support. Just run lsh sync and start managing your secrets.",
   "main": "dist/app.js",
   "bin": {