lsh-framework 3.1.26 → 3.2.0

package/dist/commands/ipfs.js

@@ -6,6 +6,9 @@ import chalk from 'chalk';
 import ora from 'ora';
 import { IPFSClientManager } from '../lib/ipfs-client-manager.js';
 import { getIPFSSync } from '../lib/ipfs-sync.js';
+import { deriveKeyInfo, ensureKeyImported } from '../lib/ipns-key-manager.js';
+import { getGitRepoInfo } from '../lib/git-utils.js';
+import { ENV_VARS, DEFAULTS } from '../constants/index.js';
 /**
  * Register IPFS commands
  */
@@ -64,6 +67,31 @@ export function registerIPFSCommands(program) {
                 console.log(chalk.gray('     Start with: lsh ipfs start'));
             }
             console.log('');
+            // IPNS info
+            const encryptionKey = process.env[ENV_VARS.LSH_SECRETS_KEY];
+            if (encryptionKey && daemonInfo) {
+                console.log(chalk.bold('IPNS:'));
+                try {
+                    const gitInfo = getGitRepoInfo();
+                    const repoName = gitInfo?.repoName || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const keyInfo = deriveKeyInfo(encryptionKey, repoName, DEFAULTS.DEFAULT_ENVIRONMENT);
+                    const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
+                    if (ipnsName) {
+                        console.log(chalk.green(`  ✅ IPNS name: ${ipnsName}`));
+                        const resolvedCid = await ipfsSync.resolveIPNS(ipnsName);
+                        if (resolvedCid) {
+                            console.log(`     Latest CID: ${resolvedCid.substring(0, 20)}...`);
+                        }
+                        else {
+                            console.log(chalk.gray('     No published record yet'));
+                        }
+                    }
+                }
+                catch {
+                    console.log(chalk.gray('  Could not derive IPNS info'));
+                }
+                console.log('');
+            }
             // Quick actions
             console.log(chalk.bold('Quick Actions:'));
             if (!info.installed) {
@@ -73,8 +101,8 @@ export function registerIPFSCommands(program) {
                 console.log(chalk.cyan('  lsh ipfs start       # Start daemon'));
             }
             else {
-                console.log(chalk.cyan('  lsh ipfs sync push   # Upload encrypted secrets'));
-                console.log(chalk.cyan('  lsh ipfs sync pull <cid>  # Download by CID'));
+                console.log(chalk.cyan('  lsh sync push        # Push secrets'));
+                console.log(chalk.cyan('  lsh sync pull        # Pull latest via IPNS'));
             }
             console.log('');
         }

package/dist/commands/sync.js

@@ -12,7 +12,8 @@ import * as crypto from 'crypto';
 import { getIPFSSync } from '../lib/ipfs-sync.js';
 import { IPFSClientManager } from '../lib/ipfs-client-manager.js';
 import { getGitRepoInfo } from '../lib/git-utils.js';
-import { ENV_VARS } from '../constants/index.js';
+import { deriveKeyInfo, ensureKeyImported } from '../lib/ipns-key-manager.js';
+import { ENV_VARS, DEFAULTS } from '../constants/index.js';
 /**
  * Register sync commands
  */
@@ -243,8 +244,28 @@ export function registerSyncCommands(program) {
             if (options.description) {
                 console.log(chalk.bold('Description:'), chalk.gray(options.description));
             }
+            // Publish to IPNS
+            if (encryptionKey) {
+                try {
+                    const repoName = gitInfo?.repoName || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const env = options.env || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
+                    const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
+                    if (ipnsName) {
+                        const publishedName = await ipfsSync.publishToIPNS(cid, keyInfo.keyName);
+                        if (publishedName) {
+                            console.log(chalk.bold('IPNS:'), chalk.cyan(publishedName));
+                        }
+                    }
+                }
+                catch {
+                    // Non-fatal: IPNS is a convenience
+                }
+            }
             console.log('');
             console.log(chalk.gray('Pull on another machine:'));
+            console.log(chalk.cyan('  lsh sync pull'));
+            console.log(chalk.gray('Or by specific CID:'));
             console.log(chalk.cyan(`  lsh sync pull ${cid}`));
             console.log('');
         }
@@ -325,15 +346,30 @@ export function registerSyncCommands(program) {
             spinner.succeed(chalk.green('Uploaded to IPFS!'));
             console.log('');
             console.log(chalk.bold('CID:'), chalk.cyan(cid));
+            // Publish to IPNS
+            if (encryptionKey) {
+                try {
+                    const repoName = gitInfo?.repoName || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const env = options.env || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
+                    const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
+                    if (ipnsName) {
+                        const publishedName = await ipfsSync.publishToIPNS(cid, keyInfo.keyName);
+                        if (publishedName) {
+                            console.log(chalk.bold('IPNS:'), chalk.cyan(publishedName));
+                        }
+                    }
+                }
+                catch {
+                    // Non-fatal
+                }
+            }
             console.log('');
-            console.log(chalk.gray('Share this CID with teammates to pull secrets:'));
+            console.log(chalk.gray('Teammates can pull with just:'));
+            console.log(chalk.cyan('  lsh sync pull'));
+            console.log(chalk.gray('Or by specific CID:'));
             console.log(chalk.cyan(`  lsh sync pull ${cid}`));
             console.log('');
-            console.log(chalk.gray('Public gateway URLs:'));
-            ipfsSync.getGatewayUrls(cid).slice(0, 2).forEach(url => {
-                console.log(chalk.gray(`  ${url}`));
-            });
-            console.log('');
         }
         catch (error) {
             const err = error;
@@ -342,14 +378,68 @@ export function registerSyncCommands(program) {
             process.exit(1);
         }
     });
-    // lsh sync pull <cid>
+    // lsh sync pull [cid]
     syncCommand
-        .command('pull <cid>')
-        .description('⬇️  Pull secrets from IPFS by CID')
+        .command('pull [cid]')
+        .description('⬇️  Pull secrets from IPFS (auto-resolves via IPNS if no CID given)')
         .option('-o, --output <path>', 'Output file path', '.env')
+        .option('-e, --env <name>', 'Environment name', '')
         .option('--force', 'Overwrite existing file without backup')
         .action(async (cid, options) => {
-        const spinner = ora('Downloading from IPFS...').start();
+        const spinner = ora(cid ? 'Downloading from IPFS...' : 'Resolving latest secrets via IPNS...').start();
+        // If no CID provided, resolve via IPNS
+        if (!cid) {
+            try {
+                const ipfsSync = getIPFSSync();
+                if (!await ipfsSync.checkDaemon()) {
+                    spinner.fail(chalk.red('IPFS daemon not running'));
+                    console.log(chalk.gray('  Start with: lsh sync start'));
+                    process.exit(1);
+                }
+                // Get encryption key
+                let ipnsKey = process.env[ENV_VARS.LSH_SECRETS_KEY];
+                if (!ipnsKey) {
+                    const outputPath = path.resolve(options.output);
+                    if (fs.existsSync(outputPath)) {
+                        const content = fs.readFileSync(outputPath, 'utf-8');
+                        const keyMatch = content.match(/^LSH_SECRETS_KEY=(.+)$/m);
+                        if (keyMatch) {
+                            ipnsKey = keyMatch[1].trim().replace(/^["']|["']$/g, '');
+                        }
+                    }
+                }
+                if (!ipnsKey) {
+                    spinner.fail(chalk.red('LSH_SECRETS_KEY required for IPNS resolution'));
+                    console.log(chalk.gray('  Set it: export LSH_SECRETS_KEY=<key>'));
+                    process.exit(1);
+                }
+                const gitInfo = getGitRepoInfo();
+                const repoName = gitInfo?.repoName || DEFAULTS.DEFAULT_ENVIRONMENT;
+                const environment = options.env || DEFAULTS.DEFAULT_ENVIRONMENT;
+                const keyInfo = deriveKeyInfo(ipnsKey, repoName, environment);
+                const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
+                if (!ipnsName) {
+                    spinner.fail(chalk.red('Failed to derive IPNS key'));
+                    process.exit(1);
+                }
+                spinner.text = `Resolving IPNS: ${ipnsName.substring(0, 20)}...`;
+                const resolvedCid = await ipfsSync.resolveIPNS(ipnsName);
+                if (!resolvedCid) {
+                    spinner.fail(chalk.red('No secrets found via IPNS'));
+                    console.log(chalk.gray('  No one has pushed secrets for this repo/environment yet.'));
+                    console.log(chalk.gray('  Push first: lsh sync push'));
+                    process.exit(1);
+                }
+                cid = resolvedCid;
+                spinner.succeed(chalk.green(`Resolved IPNS → CID: ${cid.substring(0, 16)}...`));
+                spinner.start('Downloading from IPFS...');
+            }
+            catch (error) {
+                const err = error;
+                spinner.fail(chalk.red(`IPNS resolution failed: ${err.message}`));
+                process.exit(1);
+            }
+        }
         try {
             const ipfsSync = getIPFSSync();
             // Download from IPFS

package/dist/constants/config.js

@@ -134,4 +134,10 @@ export const DEFAULTS = {
     DEFAULT_SHELL_UNIX: '/bin/sh',
     DEFAULT_SHELL_WIN: 'cmd.exe',
     DEFAULT_EDITOR: 'vi',
+    // IPNS configuration
+    DEFAULT_ENVIRONMENT: 'default',
+    IPNS_PUBLISH_LIFETIME: '87600h', // ~10 years, re-published on each push
+    IPNS_RESOLVE_TIMEOUT_MS: 30000, // 30s for DHT lookup
+    IPNS_KEY_PREFIX: 'lsh-',
+    IPNS_KEY_DERIVATION_CONTEXT: 'lsh-ipns-v1',
 };

package/dist/lib/ipfs-client-manager.js

@@ -256,7 +256,7 @@ export class IPFSClientManager {
             catch {
                 // Daemon not ready yet, keep polling
             }
-            await new Promise(resolve => setTimeout(resolve, 500));
+            await new Promise(resolve => { setTimeout(resolve, 500); });
         }
         return false;
     }

package/dist/lib/ipfs-secrets-storage.js

@@ -13,7 +13,8 @@ import * as os from 'os';
 import * as crypto from 'crypto';
 import { createLogger } from './logger.js';
 import { getIPFSSync } from './ipfs-sync.js';
-import { ENV_VARS } from '../constants/index.js';
+import { deriveKeyInfo, ensureKeyImported } from './ipns-key-manager.js';
+import { ENV_VARS, DEFAULTS } from '../constants/index.js';
 const logger = createLogger('IPFSSecretsStorage');
 /**
  * IPFS Secrets Storage
@@ -108,6 +109,28 @@ export class IPFSSecretsStorage {
                     logger.warn(`   ⚠️  IPFS upload failed: ${err.message}`);
                 }
             }
+            // Publish to IPNS if we uploaded to the network
+            if (uploadedToNetwork && realCid && encryptionKey) {
+                try {
+                    const repoName = gitRepo || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const env = environment || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
+                    const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
+                    if (ipnsName) {
+                        const publishedName = await ipfsSync.publishToIPNS(realCid, keyInfo.keyName);
+                        if (publishedName) {
+                            metadata.ipns_name = publishedName;
+                            this.metadata[this.getMetadataKey(gitRepo, environment)] = metadata;
+                            await this.saveMetadata();
+                            logger.info(`   🔗 Published to IPNS: ${publishedName}`);
+                        }
+                    }
+                }
+                catch (error) {
+                    const err = error;
+                    logger.warn(`   ⚠️  IPNS publish failed (non-fatal): ${err.message}`);
+                }
+            }
             if (!uploadedToNetwork) {
                 logger.warn(`   📁 Secrets cached locally only (no network sync)`);
                 logger.warn(`   💡 Start IPFS daemon for network sync: lsh ipfs start`);
@@ -131,7 +154,41 @@ export class IPFSSecretsStorage {
             const displayEnv = gitRepo
                 ? (environment ? `${gitRepo}_${environment}` : gitRepo)
                 : (environment || 'default');
-            // If no local metadata, check IPFS sync history
+            // If no local metadata, try IPNS resolution first
+            if (!metadata && encryptionKey) {
+                try {
+                    const ipfsSync = getIPFSSync();
+                    if (await ipfsSync.checkDaemon()) {
+                        const repoName = gitRepo || DEFAULTS.DEFAULT_ENVIRONMENT;
+                        const env = environment || DEFAULTS.DEFAULT_ENVIRONMENT;
+                        const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
+                        const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
+                        if (ipnsName) {
+                            logger.info(`   🔍 Resolving via IPNS: ${ipnsName.substring(0, 20)}...`);
+                            const resolvedCid = await ipfsSync.resolveIPNS(ipnsName);
+                            if (resolvedCid) {
+                                logger.info(`   ✅ IPNS resolved to CID: ${resolvedCid}`);
+                                metadata = {
+                                    environment,
+                                    git_repo: gitRepo,
+                                    cid: resolvedCid,
+                                    ipns_name: ipnsName,
+                                    timestamp: new Date().toISOString(),
+                                    keys_count: 0,
+                                    encrypted: true,
+                                };
+                                this.metadata[metadataKey] = metadata;
+                                await this.saveMetadata();
+                            }
+                        }
+                    }
+                }
+                catch (error) {
+                    const err = error;
+                    logger.debug(`   IPNS resolution failed: ${err.message}`);
+                }
+            }
+            // If still no metadata, check IPFS sync history
             if (!metadata && gitRepo) {
                 try {
                     const ipfsSync = getIPFSSync();

package/dist/lib/ipfs-sync.js

@@ -337,6 +337,63 @@ export class IPFSSync {
     getGatewayUrls(cid) {
         return this.GATEWAYS.map(template => template.replace('{cid}', cid));
     }
+    /**
+     * Get the Kubo API URL
+     */
+    getApiUrl() {
+        return this.LOCAL_IPFS_API;
+    }
+    /**
+     * Publish a CID to IPNS under the given key name.
+     * The key must already be imported into Kubo.
+     * Returns the IPNS name on success, null on failure.
+     */
+    async publishToIPNS(cid, keyName) {
+        try {
+            const response = await fetch(`${this.LOCAL_IPFS_API}/name/publish?arg=${cid}&key=${encodeURIComponent(keyName)}&lifetime=87600h&resolve=false`, {
+                method: 'POST',
+                signal: AbortSignal.timeout(30000),
+            });
+            if (!response.ok) {
+                const errorText = await response.text();
+                logger.warn(`IPNS publish failed: ${errorText}`);
+                return null;
+            }
+            const data = await response.json();
+            logger.info(`📡 IPNS published: ${data.Name} → ${data.Value}`);
+            return data.Name;
+        }
+        catch (error) {
+            const err = error;
+            logger.debug(`IPNS publish error: ${err.message}`);
+            return null;
+        }
+    }
+    /**
+     * Resolve an IPNS name to its current CID.
+     * Returns the CID (without /ipfs/ prefix) on success, null on failure/timeout.
+     */
+    async resolveIPNS(ipnsName) {
+        try {
+            const response = await fetch(`${this.LOCAL_IPFS_API}/name/resolve?arg=${encodeURIComponent(ipnsName)}&nocache=true`, {
+                method: 'POST',
+                signal: AbortSignal.timeout(30000),
+            });
+            if (!response.ok) {
+                return null;
+            }
+            const data = await response.json();
+            // Strip /ipfs/ prefix to get the raw CID
+            const resolvedCid = data.Path.replace(/^\/ipfs\//, '');
+            logger.info(`📡 IPNS resolved: ${ipnsName} → ${resolvedCid}`);
+            return resolvedCid;
+        }
+        catch (error) {
+            const err = error;
+            logger.debug(`IPNS resolve error: ${err.message}`);
+            return null;
+        }
+    }
 }
 // Singleton instance
 let ipfsSyncInstance = null;

package/dist/lib/ipns-key-manager.js

@@ -0,0 +1,82 @@
+/**
+ * IPNS Key Manager
+ *
+ * Deterministic IPNS key derivation from LSH_SECRETS_KEY.
+ * Same key + repo + env always produces the same IPNS name,
+ * so teammates only need to share the encryption key.
+ */
+import * as crypto from 'crypto';
+import { DEFAULTS } from '../constants/config.js';
+import { createLogger } from './logger.js';
+const logger = createLogger('IPNSKeyManager');
+// PKCS8 DER prefix for ed25519 private keys (RFC 8410)
+// This wraps a raw 32-byte seed into a valid PKCS8 structure.
+const ED25519_PKCS8_PREFIX = Buffer.from('302e020100300506032b657004220420', 'hex');
+/**
+ * Derive deterministic IPNS key info from secrets key + repo + env.
+ * Same inputs always produce the same key.
+ */
+export function deriveKeyInfo(secretsKey, repoName, environment) {
+    const context = `${DEFAULTS.IPNS_KEY_DERIVATION_CONTEXT}:${repoName}:${environment}`;
+    const seed = crypto.createHmac('sha256', secretsKey)
+        .update(context)
+        .digest();
+    const keyName = DEFAULTS.IPNS_KEY_PREFIX +
+        crypto.createHash('sha256').update(seed).digest('hex').substring(0, 16);
+    return { keyName, seed };
+}
+/**
+ * Build a PEM-encoded PKCS8 ed25519 private key from a 32-byte seed.
+ * This is the format Kubo's /key/import accepts with format=pem-pkcs8-cleartext.
+ */
+export function buildPemFromSeed(seed) {
+    const pkcs8Der = Buffer.concat([ED25519_PKCS8_PREFIX, seed]);
+    const b64 = pkcs8Der.toString('base64');
+    const lines = b64.match(/.{1,64}/g) || [b64];
+    return `-----BEGIN PRIVATE KEY-----\n${lines.join('\n')}\n-----END PRIVATE KEY-----\n`;
+}
+/**
+ * Ensure the derived key is imported into the local Kubo node.
+ * Idempotent: checks /key/list first, only imports if missing.
+ * Returns the IPNS name (peer ID) on success, null on failure.
+ */
+export async function ensureKeyImported(kuboApiUrl, keyInfo) {
+    try {
+        // Check if key already exists
+        const listResponse = await fetch(`${kuboApiUrl}/key/list`, {
+            method: 'POST',
+            signal: AbortSignal.timeout(5000),
+        });
+        if (listResponse.ok) {
+            const listData = await listResponse.json();
+            const existing = listData.Keys?.find(k => k.Name === keyInfo.keyName);
+            if (existing) {
+                logger.debug(`IPNS key "${keyInfo.keyName}" already imported: ${existing.Id}`);
+                return existing.Id;
+            }
+        }
+        // Import the key
+        const pem = buildPemFromSeed(keyInfo.seed);
+        const formData = new FormData();
+        const blob = new Blob([pem], { type: 'application/x-pem-file' });
+        formData.append('file', blob, 'key.pem');
+        const importResponse = await fetch(`${kuboApiUrl}/key/import?arg=${encodeURIComponent(keyInfo.keyName)}&format=pem-pkcs8-cleartext`, {
+            method: 'POST',
+            body: formData,
+            signal: AbortSignal.timeout(5000),
+        });
+        if (!importResponse.ok) {
+            const errorText = await importResponse.text();
+            logger.warn(`Failed to import IPNS key: ${errorText}`);
+            return null;
+        }
+        const importData = await importResponse.json();
+        logger.info(`Imported IPNS key "${importData.Name}": ${importData.Id}`);
+        return importData.Id;
+    }
+    catch (error) {
+        const err = error;
+        logger.debug(`IPNS key import failed: ${err.message}`);
+        return null;
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lsh-framework",
-  "version": "3.1.26",
+  "version": "3.2.0",
   "description": "Simple, cross-platform encrypted secrets manager with automatic sync, IPFS audit logs, and multi-environment support. Just run lsh sync and start managing your secrets.",
   "main": "dist/app.js",
   "bin": {