lsh-framework 2.2.5 → 2.3.1

package/dist/lib/lsh-config.js

@@ -0,0 +1,139 @@
+/**
+ * LSH Configuration Manager
+ *
+ * Manages encryption keys and configuration for different repositories.
+ * Keys are stored in ~/.lsh/config.json separate from the .env files being synced.
+ *
+ * This prevents sync conflicts where different hosts overwrite each other's keys.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { logger } from './logger.js';
+export class LshConfigManager {
+    configPath;
+    config;
+    constructor(configPath) {
+        this.configPath = configPath || path.join(os.homedir(), '.lsh', 'config.json');
+        this.config = this.loadConfig();
+    }
+    /**
+     * Load config from disk, or create default if it doesn't exist
+     */
+    loadConfig() {
+        try {
+            if (fs.existsSync(this.configPath)) {
+                const data = fs.readFileSync(this.configPath, 'utf-8');
+                return JSON.parse(data);
+            }
+        }
+        catch (error) {
+            const err = error;
+            logger.warn(`Failed to load config: ${err.message}`);
+        }
+        // Return default config
+        return {
+            version: '1.0.0',
+            keys: {},
+        };
+    }
+    /**
+     * Save config to disk
+     */
+    saveConfig() {
+        try {
+            const dir = path.dirname(this.configPath);
+            if (!fs.existsSync(dir)) {
+                fs.mkdirSync(dir, { recursive: true });
+            }
+            fs.writeFileSync(this.configPath, JSON.stringify(this.config, null, 2), 'utf-8');
+        }
+        catch (error) {
+            const err = error;
+            logger.error(`Failed to save config: ${err.message}`);
+            throw error;
+        }
+    }
+    /**
+     * Get encryption key for a specific repository
+     */
+    getKey(repoName) {
+        // Check config file first
+        if (this.config.keys[repoName]) {
+            // Update last used timestamp
+            this.config.keys[repoName].lastUsed = new Date().toISOString();
+            this.saveConfig();
+            return this.config.keys[repoName].key;
+        }
+        // Fall back to environment variables
+        const envKey = process.env.LSH_SECRETS_KEY || process.env.LSH_MASTER_KEY;
+        if (envKey) {
+            logger.debug(`Using encryption key from environment for ${repoName}`);
+            return envKey;
+        }
+        return null;
+    }
+    /**
+     * Set encryption key for a specific repository
+     */
+    setKey(repoName, key) {
+        this.config.keys[repoName] = {
+            key,
+            createdAt: this.config.keys[repoName]?.createdAt || new Date().toISOString(),
+            lastUsed: new Date().toISOString(),
+        };
+        this.saveConfig();
+        logger.debug(`Saved encryption key for ${repoName}`);
+    }
+    /**
+     * Check if a key exists for a repository
+     */
+    hasKey(repoName) {
+        return !!this.config.keys[repoName];
+    }
+    /**
+     * Remove encryption key for a repository
+     */
+    removeKey(repoName) {
+        delete this.config.keys[repoName];
+        this.saveConfig();
+        logger.debug(`Removed encryption key for ${repoName}`);
+    }
+    /**
+     * List all repositories with stored keys
+     */
+    listKeys() {
+        return Object.entries(this.config.keys).map(([repoName, data]) => ({
+            repoName,
+            createdAt: data.createdAt,
+            lastUsed: data.lastUsed,
+        }));
+    }
+    /**
+     * Export key for sharing with other hosts
+     */
+    exportKey(repoName) {
+        const key = this.getKey(repoName);
+        if (!key) {
+            return null;
+        }
+        return `export LSH_SECRETS_KEY='${key}'`;
+    }
+    /**
+     * Get config file path (for debugging/migration)
+     */
+    getConfigPath() {
+        return this.configPath;
+    }
+}
+// Singleton instance
+let _configManager = null;
+/**
+ * Get the global LSH config manager instance
+ */
+export function getLshConfig() {
+    if (!_configManager) {
+        _configManager = new LshConfigManager();
+    }
+    return _configManager;
+}

package/dist/lib/secrets-manager.js

@@ -112,6 +112,32 @@ export class SecretsManager {
         }
         return env;
     }
+    /**
+     * Filter out LSH-internal keys that should not be synced
+     * These keys are host-specific and syncing them would cause conflicts
+     */
+    filterLshInternalKeys(env) {
+        const filtered = {};
+        const excludedKeys = new Set([
+            'LSH_SECRETS_KEY', // Encryption key - host-specific, managed separately
+            'LSH_MASTER_KEY', // Alternative encryption key name
+            'LSH_INTERNAL_', // Any other LSH internal keys
+        ]);
+        for (const [key, value] of Object.entries(env)) {
+            // Skip exact matches
+            if (excludedKeys.has(key)) {
+                logger.debug(`Filtering out LSH-internal key: ${key}`);
+                continue;
+            }
+            // Skip keys starting with LSH_INTERNAL_
+            if (key.startsWith('LSH_INTERNAL_')) {
+                logger.debug(`Filtering out LSH-internal key: ${key}`);
+                continue;
+            }
+            filtered[key] = value;
+        }
+        return filtered;
+    }
     /**
      * Format env vars as .env file content
      */
@@ -186,13 +212,20 @@ export class SecretsManager {
         }
         logger.info(`Pushing ${envFilePath} to IPFS (${effectiveEnv})...`);
         const content = fs.readFileSync(envFilePath, 'utf8');
-        const env = this.parseEnvFile(content);
+        const envParsed = this.parseEnvFile(content);
+        // Filter out LSH-internal keys (encryption keys, etc.) that should not be synced
+        const env = this.filterLshInternalKeys(envParsed);
+        const filteredCount = Object.keys(envParsed).length - Object.keys(env).length;
+        if (filteredCount > 0) {
+            logger.debug(`Filtered out ${filteredCount} LSH-internal key(s) from sync`);
+        }
         // Check for destructive changes unless force is true
         if (!force) {
             try {
                 // Check if secrets already exist for this environment
-                if (this.storage.exists(effectiveEnv, this.gitInfo?.repoName)) {
-                    const existingSecrets = await this.storage.pull(effectiveEnv, this.encryptionKey, this.gitInfo?.repoName);
+                // Use raw environment to match storage.push() behavior
+                if (this.storage.exists(environment, this.gitInfo?.repoName)) {
+                    const existingSecrets = await this.storage.pull(environment, this.encryptionKey, this.gitInfo?.repoName);
                     const cloudEnv = {};
                     existingSecrets.forEach(s => {
                         cloudEnv[s.key] = s.value;
@@ -240,22 +273,50 @@ export class SecretsManager {
         const effectiveEnv = this.getRepoAwareEnvironment(environment);
         logger.info(`Pulling ${filename} (${effectiveEnv}) from IPFS...`);
         // Get secrets from IPFS storage
-        const secrets = await this.storage.pull(effectiveEnv, this.encryptionKey, this.gitInfo?.repoName);
+        // Use raw environment parameter to match how push() stores them
+        const secrets = await this.storage.pull(environment, // Use raw environment, not effectiveEnv
+        this.encryptionKey, this.gitInfo?.repoName);
         if (secrets.length === 0) {
             throw new Error(`No secrets found for environment: ${effectiveEnv}\n\n` +
                 `💡 Tip: Check available environments with: lsh env\n` +
                 `   Or push secrets first with: lsh push --env ${environment}`);
         }
-        // Backup existing .env if it exists (unless force is true)
-        if (fs.existsSync(envFilePath) && !force) {
-            const backup = `${envFilePath}.backup.${Date.now()}`;
-            fs.copyFileSync(envFilePath, backup);
-            logger.info(`Backed up existing .env to ${backup}`);
-        }
-        // Convert secrets back to .env format
-        const envContent = secrets
-            .map(s => `${s.key}=${s.value}`)
-            .join('\n') + '\n';
+        // Preserve local LSH-internal keys before overwriting
+        const localLshKeys = {};
+        if (fs.existsSync(envFilePath)) {
+            const existingContent = fs.readFileSync(envFilePath, 'utf8');
+            const existingEnv = this.parseEnvFile(existingContent);
+            // Extract LSH-internal keys to preserve
+            const lshKeyNames = ['LSH_SECRETS_KEY', 'LSH_MASTER_KEY'];
+            for (const keyName of lshKeyNames) {
+                if (existingEnv[keyName]) {
+                    localLshKeys[keyName] = existingEnv[keyName];
+                    logger.debug(`Preserving local ${keyName}`);
+                }
+            }
+            // Also preserve any LSH_INTERNAL_* keys
+            for (const [key, value] of Object.entries(existingEnv)) {
+                if (key.startsWith('LSH_INTERNAL_')) {
+                    localLshKeys[key] = value;
+                    logger.debug(`Preserving local ${key}`);
+                }
+            }
+            // Backup existing .env (unless force is true)
+            if (!force) {
+                const backup = `${envFilePath}.backup.${Date.now()}`;
+                fs.copyFileSync(envFilePath, backup);
+                logger.info(`Backed up existing ${filename} to ${backup}`);
+            }
+        }
+        // Convert secrets back to env object
+        const pulledEnv = {};
+        secrets.forEach(s => {
+            pulledEnv[s.key] = s.value;
+        });
+        // Merge pulled secrets with preserved local LSH keys
+        const finalEnv = { ...pulledEnv, ...localLshKeys };
+        // Convert to .env format
+        const envContent = this.formatEnvFile(finalEnv);
         // Write new .env
         fs.writeFileSync(envFilePath, envContent, 'utf8');
         logger.info(`✅ Pulled ${secrets.length} secrets from IPFS`);

package/dist/lib/storacha-client.js

@@ -244,12 +244,24 @@ export class StorachaClient {
         if (!await this.isAuthenticated()) {
             throw new Error('Not authenticated');
         }
+        // Get the latest registry version and increment it
+        let registryVersion = 1;
+        try {
+            const latestRegistry = await this.getLatestRegistry(repoName);
+            if (latestRegistry && latestRegistry.registryVersion) {
+                registryVersion = latestRegistry.registryVersion + 1;
+            }
+        }
+        catch (err) {
+            logger.debug(`Could not fetch latest registry version, using version 1: ${err.message}`);
+        }
         const registry = {
             repoName,
             environment,
             cid: secretsCid, // Include the secrets CID
             timestamp: new Date().toISOString(),
-            version: '2.2.2',
+            version: '2.3.0', // LSH version
+            registryVersion, // Incremental version counter
         };
         const content = JSON.stringify(registry, null, 2);
         const buffer = Buffer.from(content, 'utf-8');
@@ -259,7 +271,7 @@ export class StorachaClient {
         // eslint-disable-next-line @typescript-eslint/no-explicit-any
         const file = new File([uint8Array], filename, { type: 'application/json' });
         const cid = await client.uploadFile(file);
-        logger.debug(`📝 Uploaded registry for ${repoName} (secrets CID: ${secretsCid}): ${cid}`);
+        logger.debug(`📝 Uploaded registry v${registryVersion} for ${repoName} (secrets CID: ${secretsCid}): ${cid}`);
         return cid.toString();
     }
     /**
@@ -303,6 +315,7 @@ export class StorachaClient {
                             cid: cid,
                             timestamp: json.timestamp,
                             secretsCid: json.cid,
+                            registryVersion: json.registryVersion || 0, // Default to 0 for old registries without version
                         });
                     }
                 }
@@ -311,11 +324,18 @@ export class StorachaClient {
                     continue;
                 }
             }
-            // Sort by timestamp (newest first) and return the most recent secrets CID
+            // Sort by registryVersion (highest first), then timestamp as tie-breaker
             if (registries.length > 0) {
-                registries.sort((a, b) => new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime());
+                registries.sort((a, b) => {
+                    // First compare by registryVersion (higher is newer)
+                    if (b.registryVersion !== a.registryVersion) {
+                        return b.registryVersion - a.registryVersion;
+                    }
+                    // If versions match, use timestamp as tie-breaker
+                    return new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime();
+                });
                 const latest = registries[0];
-                logger.debug(`✅ Found latest CID for ${repoName}: ${latest.secretsCid} (timestamp: ${latest.timestamp})`);
+                logger.debug(`✅ Found latest CID for ${repoName}: ${latest.secretsCid} (v${latest.registryVersion}, timestamp: ${latest.timestamp})`);
                 return latest.secretsCid;
             }
             // No registry found
@@ -327,6 +347,76 @@ export class StorachaClient {
             return null;
         }
     }
+    /**
+     * Get the latest registry object for a repo
+     * Returns the full registry object including registryVersion
+     */
+    async getLatestRegistry(repoName) {
+        if (!this.isEnabled()) {
+            return null;
+        }
+        if (!await this.isAuthenticated()) {
+            return null;
+        }
+        try {
+            const client = await this.getClient();
+            // Only check recent uploads (limit to 20 for performance)
+            const pageSize = 20;
+            // Get first page of uploads
+            const results = await client.capability.upload.list({
+                cursor: '',
+                size: pageSize,
+            });
+            // Collect all registry files for this repo
+            const registries = [];
+            for (const upload of results.results) {
+                try {
+                    const cid = upload.root.toString();
+                    // Download with timeout
+                    const downloadPromise = this.download(cid);
+                    const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 5000));
+                    const content = await Promise.race([downloadPromise, timeoutPromise]);
+                    // Skip large files (registry should be < 1KB)
+                    if (content.length > 1024) {
+                        continue;
+                    }
+                    // Try to parse as JSON
+                    const json = JSON.parse(content.toString('utf-8'));
+                    // Check if it's an LSH registry file for our repo
+                    if (json.repoName === repoName && json.version && json.cid && json.timestamp) {
+                        registries.push({
+                            repoName: json.repoName,
+                            environment: json.environment,
+                            cid: json.cid,
+                            timestamp: json.timestamp,
+                            version: json.version,
+                            registryVersion: json.registryVersion || 0,
+                        });
+                    }
+                }
+                catch {
+                    // Not an LSH registry file or failed to download
+                    continue;
+                }
+            }
+            // Sort by registryVersion (highest first), then timestamp as tie-breaker
+            if (registries.length > 0) {
+                registries.sort((a, b) => {
+                    if (b.registryVersion !== a.registryVersion) {
+                        return b.registryVersion - a.registryVersion;
+                    }
+                    return new Date(b.timestamp).getTime() - new Date(a.timestamp).getTime();
+                });
+                return registries[0];
+            }
+            return null;
+        }
+        catch (error) {
+            const err = error;
+            logger.debug(`Failed to get latest registry: ${err.message}`);
+            return null;
+        }
+    }
     /**
      * Check if registry exists for a repo by listing uploads
      * Returns true if a registry file for this repo exists in Storacha

package/dist/services/secrets/secrets.js

@@ -842,5 +842,208 @@ API_KEY=
             process.exit(1);
         }
     });
+    // Clear stuck registries and local metadata
+    program
+        .command('clear')
+        .description('Clear local metadata and cache to resolve stuck registries')
+        .option('--repo <name>', 'Clear metadata for specific repo only')
+        .option('--cache', 'Also clear local encrypted secrets cache')
+        .option('--storacha', 'Also delete old Storacha uploads (registries and secrets)')
+        .option('--all', 'Clear all metadata and cache (requires confirmation)')
+        .option('-y, --yes', 'Skip confirmation prompts')
+        .action(async (options) => {
+        try {
+            const lshDir = path.join(process.env.HOME || process.env.USERPROFILE || '', '.lsh');
+            const metadataPath = path.join(lshDir, 'secrets-metadata.json');
+            const cacheDir = path.join(lshDir, 'secrets-cache');
+            // Determine what we're clearing
+            if (!options.repo && !options.all) {
+                console.error('❌ Please specify either --repo <name> or --all');
+                console.log('');
+                console.log('Examples:');
+                console.log('  lsh clear --repo lsh_test_repo    # Clear metadata for specific repo');
+                console.log('  lsh clear --all                    # Clear all metadata');
+                console.log('  lsh clear --all --cache            # Clear metadata and cache');
+                process.exit(1);
+            }
+            // Load metadata
+            if (!fs.existsSync(metadataPath)) {
+                console.log('ℹ️  No metadata file found - nothing to clear');
+                return;
+            }
+            const metadata = JSON.parse(fs.readFileSync(metadataPath, 'utf-8'));
+            const keys = Object.keys(metadata);
+            if (keys.length === 0) {
+                console.log('ℹ️  Metadata is already empty');
+                return;
+            }
+            // Show what will be cleared
+            console.log('📋 Current metadata entries:');
+            console.log('');
+            if (options.repo) {
+                const repoKeys = keys.filter(k => metadata[k].git_repo === options.repo);
+                if (repoKeys.length === 0) {
+                    console.log(`ℹ️  No metadata found for repo: ${options.repo}`);
+                    return;
+                }
+                console.log(`Repo: ${options.repo}`);
+                repoKeys.forEach(key => {
+                    console.log(`  - ${key} (CID: ${metadata[key].cid.substring(0, 12)}...)`);
+                });
+                console.log('');
+                console.log(`Will clear ${repoKeys.length} ${repoKeys.length === 1 ? 'entry' : 'entries'}`);
+            }
+            else {
+                const repoCount = new Set(keys.map(k => metadata[k].git_repo)).size;
+                console.log(`Total entries: ${keys.length} across ${repoCount} ${repoCount === 1 ? 'repo' : 'repos'}`);
+            }
+            if (options.cache) {
+                if (fs.existsSync(cacheDir)) {
+                    const cacheFiles = fs.readdirSync(cacheDir);
+                    console.log(`Cache files: ${cacheFiles.length}`);
+                }
+            }
+            console.log('');
+            // Confirmation
+            if (!options.yes) {
+                console.log('⚠️  WARNING: This will clear local metadata!');
+                console.log('');
+                console.log('This is useful when:');
+                console.log('  • Registry is returning stale/old CIDs');
+                console.log('  • Pull fails with "bad decrypt" errors');
+                console.log('  • You need to force a fresh sync');
+                console.log('');
+                console.log('After clearing, you will need to push secrets again.');
+                console.log('');
+                const rl = readline.createInterface({
+                    input: process.stdin,
+                    output: process.stdout,
+                });
+                const answer = await new Promise((resolve) => {
+                    rl.question('Continue? (yes/no): ', (ans) => {
+                        rl.close();
+                        resolve(ans.trim().toLowerCase());
+                    });
+                });
+                if (answer !== 'yes' && answer !== 'y') {
+                    console.log('');
+                    console.log('❌ Cancelled');
+                    return;
+                }
+            }
+            console.log('');
+            // Clear metadata
+            if (options.repo) {
+                const repoKeys = keys.filter(k => metadata[k].git_repo === options.repo);
+                repoKeys.forEach(key => delete metadata[key]);
+                fs.writeFileSync(metadataPath, JSON.stringify(metadata, null, 2));
+                console.log(`✅ Cleared ${repoKeys.length} metadata ${repoKeys.length === 1 ? 'entry' : 'entries'} for ${options.repo}`);
+            }
+            else {
+                fs.writeFileSync(metadataPath, '{}');
+                console.log(`✅ Cleared all ${keys.length} metadata ${keys.length === 1 ? 'entry' : 'entries'}`);
+            }
+            // Clear cache if requested
+            if (options.cache && fs.existsSync(cacheDir)) {
+                const cacheFiles = fs.readdirSync(cacheDir);
+                let cleared = 0;
+                for (const file of cacheFiles) {
+                    const filePath = path.join(cacheDir, file);
+                    if (fs.statSync(filePath).isFile()) {
+                        fs.unlinkSync(filePath);
+                        cleared++;
+                    }
+                }
+                console.log(`✅ Cleared ${cleared} cache ${cleared === 1 ? 'file' : 'files'}`);
+            }
+            // Clear Storacha uploads if requested
+            if (options.storacha && options.repo) {
+                console.log('');
+                console.log('🌐 Clearing Storacha uploads...');
+                try {
+                    const { StorachaClient } = await import('../../lib/storacha-client.js');
+                    const storacha = new StorachaClient();
+                    if (!storacha.isEnabled()) {
+                        console.log('ℹ️  Storacha is not enabled - skipping cloud cleanup');
+                    }
+                    else if (!(await storacha.isAuthenticated())) {
+                        console.log('ℹ️  Not authenticated with Storacha - skipping cloud cleanup');
+                    }
+                    else {
+                        // Get all uploads
+                        const client = await storacha.getClient();
+                        const pageSize = 50;
+                        const results = await client.capability.upload.list({
+                            cursor: '',
+                            size: pageSize,
+                        });
+                        // Find LSH-related uploads for this repo
+                        const toDelete = [];
+                        for (const upload of results.results) {
+                            try {
+                                const cid = upload.root.toString();
+                                // Download with timeout
+                                const downloadPromise = storacha.download(cid);
+                                const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error('timeout')), 5000));
+                                const content = await Promise.race([downloadPromise, timeoutPromise]);
+                                // Check if it's a registry file for this repo
+                                if (content.length < 2048) {
+                                    try {
+                                        const json = JSON.parse(content.toString('utf-8'));
+                                        if (json.repoName === options.repo) {
+                                            toDelete.push({ cid, type: 'registry', size: content.length });
+                                        }
+                                    }
+                                    catch {
+                                        // Not JSON, might be encrypted secrets
+                                        // Check filename pattern
+                                        const _filename = `lsh-secrets-${options.repo}`;
+                                        if (cid.includes(options.repo) || content.toString().includes(options.repo)) {
+                                            toDelete.push({ cid, type: 'secrets', size: content.length });
+                                        }
+                                    }
+                                }
+                            }
+                            catch {
+                                // Failed to download or parse, skip
+                                continue;
+                            }
+                        }
+                        if (toDelete.length > 0) {
+                            console.log(`Found ${toDelete.length} Storacha ${toDelete.length === 1 ? 'upload' : 'uploads'} for ${options.repo}:`);
+                            toDelete.forEach((item) => {
+                                console.log(`  - ${item.type}: ${item.cid.substring(0, 16)}... (${item.size} bytes)`);
+                            });
+                            // Note: Storacha doesn't currently support deletion via SDK
+                            // The uploads will remain but won't be used after metadata is cleared
+                            console.log('');
+                            console.log('⚠️  Note: Storacha uploads cannot be deleted programmatically.');
+                            console.log('   These files will remain in Storacha but won\'t be used after metadata is cleared.');
+                            console.log('   To fully remove them, use the Storacha web console:');
+                            console.log('   https://console.storacha.network/');
+                        }
+                        else {
+                            console.log(`ℹ️  No Storacha uploads found for ${options.repo}`);
+                        }
+                    }
+                }
+                catch (storageError) {
+                    const storErr = storageError;
+                    console.error(`⚠️  Failed to check Storacha uploads: ${storErr.message}`);
+                    console.log('   Local metadata has been cleared, but cloud uploads may remain.');
+                }
+            }
+            console.log('');
+            console.log('💡 Next steps:');
+            console.log('   1. lsh push .env     # Push secrets with current key');
+            console.log('   2. lsh pull .env     # Verify pull works');
+            console.log('');
+        }
+        catch (error) {
+            const err = error;
+            console.error('❌ Failed to clear metadata:', err.message);
+            process.exit(1);
+        }
+    });
 }
 export default init_secrets;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lsh-framework",
-  "version": "2.2.5",
+  "version": "2.3.1",
   "description": "Simple, cross-platform encrypted secrets manager with automatic sync, IPFS audit logs, and multi-environment support. Just run lsh sync and start managing your secrets.",
   "main": "dist/app.js",
   "bin": {