lsh-framework 2.2.0 → 2.2.2

package/dist/commands/init.js

@@ -233,7 +233,7 @@ async function checkCloudSecretsExist() {
         }
         const repoName = gitInfo.repoName;
         const environment = repoName; // Default environment for repo
-        // Check if metadata file exists with this repo's secrets
+        // First check local metadata (fast path)
         const paths = getPlatformPaths();
         const metadataPath = path.join(paths.dataDir, 'secrets-metadata.json');
         try {
@@ -246,7 +246,26 @@ async function checkCloudSecretsExist() {
             }
         }
         catch {
-            // Metadata file doesn't exist or can't be read
+            // Metadata file doesn't exist or can't be read - continue to network check
+        }
+        // Check Storacha network for registry file (works on new machines)
+        try {
+            const { getStorachaClient } = await import('../lib/storacha-client.js');
+            const storacha = getStorachaClient();
+            // Only check network if Storacha is enabled and authenticated
+            if (storacha.isEnabled() && await storacha.isAuthenticated()) {
+                const spinner = ora('Checking Storacha network for existing secrets...').start();
+                const registryExists = await storacha.checkRegistry(repoName);
+                spinner.stop();
+                if (registryExists) {
+                    return { exists: true, repoName, environment };
+                }
+            }
+        }
+        catch (error) {
+            // Network check failed, but that's okay - just means no secrets found
+            const err = error;
+            console.log(chalk.gray(`   (Network check skipped: ${err.message})`));
         }
         return { exists: false, repoName, environment };
     }

package/dist/lib/ipfs-secrets-storage.js

@@ -72,6 +72,20 @@ export class IPFSSecretsStorage {
                     // encryptedData is already a Buffer, pass it directly
                     await storacha.upload(Buffer.from(encryptedData), filename);
                     logger.info(`   ☁️  Synced to Storacha network`);
+                    // Upload registry file if this is a git repo
+                    // This allows detection on new machines without local metadata
+                    // Include the secrets CID so other hosts can fetch the latest version
+                    if (gitRepo) {
+                        try {
+                            await storacha.uploadRegistry(gitRepo, environment, cid);
+                            logger.debug(`   📝 Registry uploaded for ${gitRepo} (CID: ${cid})`);
+                        }
+                        catch (regError) {
+                            // Registry upload failed, but secrets are still uploaded
+                            const _regErr = regError;
+                            logger.debug(`   Registry upload failed: ${_regErr.message}`);
+                        }
+                    }
                 }
                 catch (error) {
                     const err = error;
@@ -93,10 +107,35 @@ export class IPFSSecretsStorage {
     async pull(environment, encryptionKey, gitRepo) {
         try {
             const metadataKey = this.getMetadataKey(gitRepo, environment);
-            const metadata = this.metadata[metadataKey];
+            let metadata = this.metadata[metadataKey];
             if (!metadata) {
                 throw new Error(`No secrets found for environment: ${environment}`);
             }
+            // Check if there's a newer version in the registry (for git repos)
+            if (gitRepo) {
+                try {
+                    const storacha = getStorachaClient();
+                    if (storacha.isEnabled() && await storacha.isAuthenticated()) {
+                        const latestCid = await storacha.getLatestCID(gitRepo);
+                        if (latestCid && latestCid !== metadata.cid) {
+                            logger.info(`   🔄 Found newer version in registry (CID: ${latestCid})`);
+                            // Update metadata with latest CID
+                            metadata = {
+                                ...metadata,
+                                cid: latestCid,
+                                timestamp: new Date().toISOString(),
+                            };
+                            this.metadata[metadataKey] = metadata;
+                            this.saveMetadata();
+                        }
+                    }
+                }
+                catch (error) {
+                    // Registry check failed, continue with local metadata
+                    const err = error;
+                    logger.debug(`   Registry check failed: ${err.message}`);
+                }
+            }
             // Try to load from local cache
             let cachedData = await this.loadLocally(metadata.cid);
             // If not in cache, try downloading from Storacha

package/dist/lib/storacha-client.js

@@ -233,6 +233,157 @@ export class StorachaClient {
             throw new Error(`Failed to download from Storacha: ${err.message}`);
         }
     }
+    /**
+     * Upload registry file for a repo
+     * Registry files mark that secrets exist and include the latest secrets CID
+     */
+    async uploadRegistry(repoName, environment, secretsCid) {
+        if (!this.isEnabled()) {
+            throw new Error('Storacha is not enabled');
+        }
+        if (!await this.isAuthenticated()) {
+            throw new Error('Not authenticated');
+        }
+        const registry = {
+            repoName,
+            environment,
+            cid: secretsCid, // Include the secrets CID
+            timestamp: new Date().toISOString(),
+            version: '2.2.2',
+        };
+        const content = JSON.stringify(registry, null, 2);
+        const buffer = Buffer.from(content, 'utf-8');
+        const filename = `lsh-registry-${repoName}.json`;
+        const client = await this.getClient();
+        const uint8Array = new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const file = new File([uint8Array], filename, { type: 'application/json' });
+        const cid = await client.uploadFile(file);
+        logger.debug(`📝 Uploaded registry for ${repoName} (secrets CID: ${secretsCid}): ${cid}`);
+        return cid.toString();
+    }
+    /**
+     * Get the latest secrets CID from registry
+     * Returns the CID of the latest secrets if registry exists, null otherwise
+     */
+    async getLatestCID(repoName) {
+        if (!this.isEnabled()) {
+            return null;
+        }
+        if (!await this.isAuthenticated()) {
+            return null;
+        }
+        try {
+            const client = await this.getClient();
+            // Only check recent uploads (limit to 20 for performance)
+            const pageSize = 20;
+            // Get first page of uploads
+            const results = await client.capability.upload.list({
+                cursor: '',
+                size: pageSize,
+            });
+            // Check recent uploads for registry file
+            for (const upload of results.results) {
+                try {
+                    const cid = upload.root.toString();
+                    // Download with timeout
+                    const downloadPromise = this.download(cid);
+                    const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 5000));
+                    const content = await Promise.race([downloadPromise, timeoutPromise]);
+                    // Skip large files (registry should be < 1KB)
+                    if (content.length > 1024) {
+                        continue;
+                    }
+                    // Try to parse as JSON
+                    const json = JSON.parse(content.toString('utf-8'));
+                    // Check if it's an LSH registry file for our repo
+                    if (json.repoName === repoName && json.version && json.cid) {
+                        logger.debug(`✅ Found latest CID for ${repoName}: ${json.cid}`);
+                        return json.cid;
+                    }
+                }
+                catch {
+                    // Not an LSH registry file or failed to download
+                    continue;
+                }
+            }
+            // No registry found
+            return null;
+        }
+        catch (error) {
+            const err = error;
+            logger.debug(`Failed to get latest CID: ${err.message}`);
+            return null;
+        }
+    }
+    /**
+     * Check if registry exists for a repo by listing uploads
+     * Returns true if a registry file for this repo exists in Storacha
+     *
+     * NOTE: This is optimized to check only recent small files (likely registry files)
+     * to avoid downloading large encrypted secret files.
+     */
+    async checkRegistry(repoName) {
+        if (!this.isEnabled()) {
+            return false;
+        }
+        if (!await this.isAuthenticated()) {
+            return false;
+        }
+        try {
+            const client = await this.getClient();
+            // Only check recent uploads (limit to 20 for performance)
+            const pageSize = 20;
+            // Get first page of uploads
+            const results = await client.capability.upload.list({
+                cursor: '',
+                size: pageSize,
+            });
+            // Track checked count for logging
+            let checked = 0;
+            let skipped = 0;
+            // Check if any uploads match our registry pattern
+            // Registry files are small JSON files (~200 bytes)
+            // Skip large files (encrypted secrets are much larger)
+            for (const upload of results.results) {
+                try {
+                    const cid = upload.root.toString();
+                    // Quick heuristic: registry files are tiny (<1KB)
+                    // Skip if this looks like a large encrypted file based on CID
+                    // We'll attempt download with a timeout
+                    const downloadPromise = this.download(cid);
+                    const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 5000) // 5s timeout per file
+                    );
+                    const content = await Promise.race([downloadPromise, timeoutPromise]);
+                    // Skip large files (registry should be < 1KB)
+                    if (content.length > 1024) {
+                        skipped++;
+                        continue;
+                    }
+                    checked++;
+                    // Try to parse as JSON
+                    const json = JSON.parse(content.toString('utf-8'));
+                    // Check if it's an LSH registry file for our repo
+                    if (json.repoName === repoName && json.version) {
+                        logger.debug(`✅ Found registry for ${repoName} at CID: ${cid} (checked ${checked} files, skipped ${skipped})`);
+                        return true;
+                    }
+                }
+                catch {
+                    // Not an LSH registry file, timed out, or failed to download - continue
+                    skipped++;
+                }
+            }
+            // No registry found
+            logger.debug(`❌ No registry found for ${repoName} (checked ${checked} files, skipped ${skipped})`);
+            return false;
+        }
+        catch (error) {
+            const err = error;
+            logger.debug(`Failed to check registry: ${err.message}`);
+            return false;
+        }
+    }
     /**
      * Enable Storacha network sync
      */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lsh-framework",
-  "version": "2.2.0",
+  "version": "2.2.2",
   "description": "Simple, cross-platform encrypted secrets manager with automatic sync, IPFS audit logs, and multi-environment support. Just run lsh sync and start managing your secrets.",
   "main": "dist/app.js",
   "bin": {