lsh-framework 3.1.8 → 3.1.14

package/dist/commands/sync.js

@@ -0,0 +1,365 @@
+/**
+ * Sync Commands
+ * Native IPFS sync for secrets management (mirrors mcli pattern)
+ *
+ * Usage: lsh sync <command>
+ */
+import chalk from 'chalk';
+import ora from 'ora';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as crypto from 'crypto';
+import { getIPFSSync } from '../lib/ipfs-sync.js';
+import { getGitRepoInfo } from '../lib/git-utils.js';
+import { ENV_VARS } from '../constants/index.js';
+/**
+ * Register sync commands
+ */
+export function registerSyncCommands(program) {
+    const syncCommand = program
+        .command('sync')
+        .description('Sync secrets via native IPFS')
+        .action(() => {
+        // Show help when running `lsh sync` without subcommand
+        console.log(chalk.bold.cyan('\n🔄 LSH Sync - IPFS Secrets Sync\n'));
+        console.log(chalk.gray('Sync encrypted secrets via native IPFS (no auth required)\n'));
+        console.log(chalk.bold('Commands:'));
+        console.log(`  ${chalk.cyan('init')}      🚀 Initialize and start the IPFS daemon`);
+        console.log(`  ${chalk.cyan('push')}      ⬆️  Push encrypted secrets to IPFS`);
+        console.log(`  ${chalk.cyan('pull')}      ⬇️  Pull secrets from IPFS by CID`);
+        console.log(`  ${chalk.cyan('status')}    📊 Show IPFS daemon and sync status`);
+        console.log(`  ${chalk.cyan('history')}   📜 Show IPFS sync history`);
+        console.log(`  ${chalk.cyan('verify')}    ✅ Verify that a CID is accessible on IPFS`);
+        console.log(`  ${chalk.cyan('clear')}     🗑️  Clear sync history`);
+        console.log('');
+        console.log(chalk.bold('Examples:'));
+        console.log(chalk.gray('  lsh sync init          # Set up IPFS for first time'));
+        console.log(chalk.gray('  lsh sync push          # Push secrets, get CID'));
+        console.log(chalk.gray('  lsh sync pull <cid>    # Pull secrets by CID'));
+        console.log('');
+        console.log(chalk.gray('Run "lsh sync <command> --help" for more info.'));
+        console.log('');
+    });
+    // lsh sync init
+    syncCommand
+        .command('init')
+        .description('🚀 Initialize and start the IPFS daemon')
+        .action(async () => {
+        console.log(chalk.bold.cyan('\n🚀 Initializing IPFS for sync...\n'));
+        const ipfsSync = getIPFSSync();
+        // Check if daemon is already running
+        if (await ipfsSync.checkDaemon()) {
+            const info = await ipfsSync.getDaemonInfo();
+            console.log(chalk.green('✅ IPFS daemon is already running!'));
+            if (info) {
+                console.log(chalk.gray(`   Peer ID: ${info.peerId.substring(0, 16)}...`));
+                console.log(chalk.gray(`   Version: ${info.version}`));
+            }
+            console.log('');
+            console.log(chalk.gray('You can now sync secrets:'));
+            console.log(chalk.cyan('  lsh sync push'));
+            console.log('');
+            return;
+        }
+        // Daemon not running, show instructions
+        console.log(chalk.yellow('⚠️  IPFS daemon not running'));
+        console.log('');
+        console.log(chalk.gray('To start IPFS:'));
+        console.log('');
+        console.log(chalk.bold('1. Install IPFS (if not installed):'));
+        console.log(chalk.cyan('   lsh ipfs install'));
+        console.log('');
+        console.log(chalk.bold('2. Initialize IPFS repository:'));
+        console.log(chalk.cyan('   lsh ipfs init'));
+        console.log('');
+        console.log(chalk.bold('3. Start the daemon:'));
+        console.log(chalk.cyan('   lsh ipfs start'));
+        console.log('');
+        console.log(chalk.gray('Or run all at once:'));
+        console.log(chalk.cyan('   lsh ipfs install && lsh ipfs init && lsh ipfs start'));
+        console.log('');
+    });
+    // lsh sync push
+    syncCommand
+        .command('push')
+        .description('⬆️  Push encrypted secrets to IPFS, returns CID')
+        .option('-f, --file <path>', 'Path to .env file', '.env')
+        .option('-e, --env <name>', 'Environment name', '')
+        .action(async (options) => {
+        const spinner = ora('Uploading to IPFS...').start();
+        try {
+            const ipfsSync = getIPFSSync();
+            const gitInfo = getGitRepoInfo();
+            // Check daemon
+            if (!await ipfsSync.checkDaemon()) {
+                spinner.fail(chalk.red('IPFS daemon not running'));
+                console.log('');
+                console.log(chalk.gray('Initialize IPFS first:'));
+                console.log(chalk.cyan('  lsh sync init'));
+                process.exit(1);
+            }
+            // Read .env file
+            const envPath = path.resolve(options.file);
+            if (!fs.existsSync(envPath)) {
+                spinner.fail(chalk.red(`File not found: ${envPath}`));
+                process.exit(1);
+            }
+            const content = fs.readFileSync(envPath, 'utf-8');
+            // Get encryption key
+            const encryptionKey = process.env[ENV_VARS.LSH_SECRETS_KEY];
+            if (!encryptionKey) {
+                spinner.fail(chalk.red('LSH_SECRETS_KEY not set'));
+                console.log('');
+                console.log(chalk.gray('Generate a key with:'));
+                console.log(chalk.cyan('  lsh key'));
+                console.log('');
+                console.log(chalk.gray('Then set it:'));
+                console.log(chalk.cyan('  export LSH_SECRETS_KEY=<your-key>'));
+                process.exit(1);
+            }
+            // Encrypt content
+            const key = crypto.createHash('sha256').update(encryptionKey).digest();
+            const iv = crypto.randomBytes(16);
+            const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+            let encrypted = cipher.update(content, 'utf8', 'hex');
+            encrypted += cipher.final('hex');
+            const encryptedData = iv.toString('hex') + ':' + encrypted;
+            // Upload to IPFS
+            const filename = `lsh-secrets-${options.env || 'default'}.encrypted`;
+            const cid = await ipfsSync.upload(Buffer.from(encryptedData, 'utf-8'), filename, {
+                environment: options.env || undefined,
+                gitRepo: gitInfo?.repoName || undefined,
+            });
+            if (!cid) {
+                spinner.fail(chalk.red('Upload failed'));
+                process.exit(1);
+            }
+            spinner.succeed(chalk.green('Uploaded to IPFS!'));
+            console.log('');
+            console.log(chalk.bold('CID:'), chalk.cyan(cid));
+            console.log('');
+            console.log(chalk.gray('Share this CID with teammates to pull secrets:'));
+            console.log(chalk.cyan(`  lsh sync pull ${cid}`));
+            console.log('');
+            console.log(chalk.gray('Public gateway URLs:'));
+            ipfsSync.getGatewayUrls(cid).slice(0, 2).forEach(url => {
+                console.log(chalk.gray(`  ${url}`));
+            });
+            console.log('');
+        }
+        catch (error) {
+            const err = error;
+            spinner.fail(chalk.red('Push failed'));
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    // lsh sync pull <cid>
+    syncCommand
+        .command('pull <cid>')
+        .description('⬇️  Pull secrets from IPFS by CID')
+        .option('-o, --output <path>', 'Output file path', '.env')
+        .option('--force', 'Overwrite existing file without backup')
+        .action(async (cid, options) => {
+        const spinner = ora('Downloading from IPFS...').start();
+        try {
+            const ipfsSync = getIPFSSync();
+            // Download from IPFS
+            const data = await ipfsSync.download(cid);
+            if (!data) {
+                spinner.fail(chalk.red('Download failed'));
+                console.log('');
+                console.log(chalk.gray('The CID might not be available on public gateways yet.'));
+                console.log(chalk.gray('Make sure the source machine is online with IPFS daemon running.'));
+                process.exit(1);
+            }
+            // Get encryption key
+            const encryptionKey = process.env[ENV_VARS.LSH_SECRETS_KEY];
+            if (!encryptionKey) {
+                spinner.fail(chalk.red('LSH_SECRETS_KEY not set'));
+                console.log('');
+                console.log(chalk.gray('You need the same encryption key used to push.'));
+                console.log(chalk.gray('Set it in your environment:'));
+                console.log(chalk.cyan('  export LSH_SECRETS_KEY=<key-from-teammate>'));
+                process.exit(1);
+            }
+            // Decrypt content
+            const encryptedData = data.toString('utf-8');
+            const [ivHex, encrypted] = encryptedData.split(':');
+            if (!ivHex || !encrypted) {
+                spinner.fail(chalk.red('Invalid encrypted data format'));
+                process.exit(1);
+            }
+            const key = crypto.createHash('sha256').update(encryptionKey).digest();
+            const iv = Buffer.from(ivHex, 'hex');
+            let decrypted;
+            try {
+                const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+                decrypted = decipher.update(encrypted, 'hex', 'utf8');
+                decrypted += decipher.final('utf8');
+            }
+            catch {
+                spinner.fail(chalk.red('Decryption failed'));
+                console.log('');
+                console.log(chalk.red('Wrong encryption key!'));
+                console.log(chalk.gray('Make sure LSH_SECRETS_KEY matches the key used to push.'));
+                process.exit(1);
+            }
+            // Write output file
+            const outputPath = path.resolve(options.output);
+            // Backup existing file if it exists (unless --force)
+            if (fs.existsSync(outputPath) && !options.force) {
+                const backupPath = `${outputPath}.backup.${Date.now()}`;
+                fs.copyFileSync(outputPath, backupPath);
+                console.log(chalk.gray(`Backed up existing file to: ${backupPath}`));
+            }
+            fs.writeFileSync(outputPath, decrypted, 'utf-8');
+            spinner.succeed(chalk.green('Downloaded and decrypted!'));
+            console.log('');
+            console.log(chalk.bold('Output:'), chalk.cyan(outputPath));
+            console.log(chalk.bold('CID:'), chalk.gray(cid));
+            console.log('');
+        }
+        catch (error) {
+            const err = error;
+            spinner.fail(chalk.red('Pull failed'));
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    // lsh sync status
+    syncCommand
+        .command('status')
+        .description('📊 Show IPFS daemon and sync status')
+        .action(async () => {
+        try {
+            const ipfsSync = getIPFSSync();
+            const daemonInfo = await ipfsSync.getDaemonInfo();
+            console.log(chalk.bold.cyan('\n📊 Sync Status\n'));
+            console.log(chalk.gray('━'.repeat(50)));
+            console.log('');
+            if (daemonInfo) {
+                console.log(chalk.green('✅ IPFS daemon running'));
+                console.log(`   Peer ID: ${daemonInfo.peerId.substring(0, 16)}...`);
+                console.log(`   Version: ${daemonInfo.version}`);
+                console.log('');
+                console.log(chalk.gray('Ready to sync:'));
+                console.log(chalk.cyan('  lsh sync push      # Push secrets'));
+                console.log(chalk.cyan('  lsh sync pull <cid>  # Pull by CID'));
+            }
+            else {
+                console.log(chalk.yellow('⚠️  IPFS daemon not running'));
+                console.log('');
+                console.log(chalk.gray('Start with:'));
+                console.log(chalk.cyan('  lsh sync init'));
+            }
+            console.log('');
+        }
+        catch (error) {
+            const err = error;
+            console.error(chalk.red('Failed to check status:'), err.message);
+            process.exit(1);
+        }
+    });
+    // lsh sync history
+    syncCommand
+        .command('history')
+        .description('📜 Show IPFS sync history')
+        .option('-n, --limit <number>', 'Number of entries to show', '10')
+        .option('--json', 'Output as JSON')
+        .action(async (options) => {
+        try {
+            const ipfsSync = getIPFSSync();
+            const limit = parseInt(options.limit, 10);
+            const history = await ipfsSync.getHistory(limit);
+            if (options.json) {
+                console.log(JSON.stringify(history, null, 2));
+                return;
+            }
+            console.log(chalk.bold.cyan('\n📜 Sync History\n'));
+            console.log(chalk.gray('━'.repeat(60)));
+            console.log('');
+            if (history.length === 0) {
+                console.log(chalk.gray('No sync history found.'));
+                console.log('');
+                console.log(chalk.gray('Push your first secrets with:'));
+                console.log(chalk.cyan('  lsh sync push'));
+                console.log('');
+                return;
+            }
+            for (const entry of history) {
+                const date = new Date(entry.timestamp);
+                const dateStr = date.toLocaleString();
+                console.log(chalk.bold(`${entry.cid.substring(0, 16)}...`));
+                console.log(`  File: ${entry.filename}`);
+                console.log(`  Size: ${entry.size} bytes`);
+                console.log(`  Time: ${dateStr}`);
+                if (entry.gitRepo) {
+                    console.log(`  Repo: ${entry.gitRepo}`);
+                }
+                if (entry.environment) {
+                    console.log(`  Env:  ${entry.environment}`);
+                }
+                console.log('');
+            }
+            console.log(chalk.gray(`Showing ${history.length} entries. Use -n to show more.`));
+            console.log('');
+        }
+        catch (error) {
+            const err = error;
+            console.error(chalk.red('Failed to get history:'), err.message);
+            process.exit(1);
+        }
+    });
+    // lsh sync verify <cid>
+    syncCommand
+        .command('verify <cid>')
+        .description('✅ Verify that a CID is accessible on IPFS')
+        .action(async (cid) => {
+        const spinner = ora('Verifying CID accessibility...').start();
+        try {
+            const ipfsSync = getIPFSSync();
+            const result = await ipfsSync.verifyCid(cid);
+            if (result.available) {
+                spinner.succeed(chalk.green('CID is accessible!'));
+                console.log('');
+                console.log(chalk.bold('CID:'), chalk.cyan(cid));
+                console.log(chalk.bold('Source:'), chalk.gray(result.source));
+                console.log('');
+            }
+            else {
+                spinner.fail(chalk.red('CID not accessible'));
+                console.log('');
+                console.log(chalk.gray('The CID could not be found on the network.'));
+                console.log(chalk.gray('Possible reasons:'));
+                console.log(chalk.gray('  - Source machine is offline'));
+                console.log(chalk.gray('  - Content not yet propagated to gateways'));
+                console.log(chalk.gray('  - Invalid CID'));
+                console.log('');
+            }
+        }
+        catch (error) {
+            const err = error;
+            spinner.fail(chalk.red('Verification failed'));
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
+    });
+    // lsh sync clear
+    syncCommand
+        .command('clear')
+        .description('🗑️  Clear sync history')
+        .action(async () => {
+        try {
+            const ipfsSync = getIPFSSync();
+            await ipfsSync.clearHistory();
+            console.log(chalk.green('✅ Sync history cleared'));
+        }
+        catch (error) {
+            const err = error;
+            console.error(chalk.red('Failed to clear history:'), err.message);
+            process.exit(1);
+        }
+    });
+}
+export default registerSyncCommands;

package/dist/constants/config.js

@@ -33,7 +33,6 @@ export const ENV_VARS = {
     // Feature flags
     LSH_LOCAL_STORAGE_QUIET: 'LSH_LOCAL_STORAGE_QUIET',
     LSH_V1_COMPAT: 'LSH_V1_COMPAT',
-    LSH_STORACHA_ENABLED: 'LSH_STORACHA_ENABLED',
     DISABLE_IPFS_SYNC: 'DISABLE_IPFS_SYNC',
     // Logging
     LSH_LOG_LEVEL: 'LSH_LOG_LEVEL',

package/dist/lib/ipfs-secrets-storage.js

@@ -1,6 +1,10 @@
 /**
  * IPFS Secrets Storage Adapter
- * Stores encrypted secrets on IPFS using Storacha (formerly web3.storage)
+ * Stores encrypted secrets on IPFS via native Kubo daemon
+ *
+ * Priority order:
+ * 1. Native IPFS (Kubo daemon on port 5001) - zero-config, no auth
+ * 2. Local cache - always available for offline access
  */
 import * as fs from 'fs';
 import * as fsPromises from 'fs/promises';
@@ -8,7 +12,7 @@ import * as path from 'path';
 import * as os from 'os';
 import * as crypto from 'crypto';
 import { createLogger } from './logger.js';
-import { getStorachaClient } from './storacha-client.js';
+import { getIPFSSync } from './ipfs-sync.js';
 import { ENV_VARS } from '../constants/index.js';
 const logger = createLogger('IPFSSecretsStorage');
 /**
@@ -31,8 +35,14 @@ export class IPFSSecretsStorage {
         const lshDir = path.join(homeDir, '.lsh');
         this.cacheDir = path.join(lshDir, 'secrets-cache');
         this.metadataPath = path.join(lshDir, 'secrets-metadata.json');
-        // Initialize metadata - will be loaded on first use
-        this.metadata = {};
+        // Load metadata synchronously to ensure we have all existing entries
+        // This fixes the bug where sequential pushes from different repos
+        // would overwrite each other's metadata
+        this.metadata = this.loadMetadata();
+        // Ensure cache directory exists
+        if (!fs.existsSync(this.cacheDir)) {
+            fs.mkdirSync(this.cacheDir, { recursive: true });
+        }
     }
     /**
      * Initialize async parts
@@ -73,36 +83,36 @@ export class IPFSSecretsStorage {
             if (gitRepo) {
                 logger.info(`   Repository: ${gitRepo}/${gitBranch || 'main'}`);
             }
-            // Upload to Storacha network if enabled
-            const storacha = getStorachaClient();
-            if (storacha.isEnabled()) {
+            // Try native IPFS upload
+            const ipfsSync = getIPFSSync();
+            let uploadedToNetwork = false;
+            let realCid = null;
+            if (await ipfsSync.checkDaemon()) {
                 try {
-                    const filename = `lsh-secrets-${environment}-${cid}.encrypted`;
-                    // encryptedData is already a Buffer, pass it directly
-                    await storacha.upload(Buffer.from(encryptedData), filename);
-                    logger.info(`   ☁️  Synced to Storacha network`);
-                    // Upload registry file if this is a git repo
-                    // This allows detection on new machines without local metadata
-                    // Include the secrets CID so other hosts can fetch the latest version
-                    if (gitRepo) {
-                        try {
-                            await storacha.uploadRegistry(gitRepo, environment, cid);
-                            logger.debug(`   📝 Registry uploaded for ${gitRepo} (CID: ${cid})`);
-                        }
-                        catch (regError) {
-                            // Registry upload failed, but secrets are still uploaded
-                            const _regErr = regError;
-                            logger.debug(`   Registry upload failed: ${_regErr.message}`);
+                    const filename = `lsh-secrets-${environment}.encrypted`;
+                    realCid = await ipfsSync.upload(Buffer.from(encryptedData, 'utf-8'), filename, { environment, gitRepo });
+                    if (realCid) {
+                        // Update CID to the real IPFS CID
+                        logger.info(`   🌐 Synced to IPFS (CID: ${realCid})`);
+                        uploadedToNetwork = true;
+                        // Update metadata with real CID if different
+                        if (realCid !== cid) {
+                            metadata.cid = realCid;
+                            this.metadata[this.getMetadataKey(gitRepo, environment)] = metadata;
+                            await this.saveMetadata();
                         }
                     }
                 }
                 catch (error) {
                     const err = error;
-                    logger.warn(`   ⚠️  Storacha upload failed: ${err.message}`);
-                    logger.warn(`   Secrets are still cached locally`);
+                    logger.warn(`   ⚠️  IPFS upload failed: ${err.message}`);
                 }
             }
-            return cid;
+            if (!uploadedToNetwork) {
+                logger.warn(`   📁 Secrets cached locally only (no network sync)`);
+                logger.warn(`   💡 Start IPFS daemon for network sync: lsh ipfs start`);
+            }
+            return realCid || cid;
         }
         catch (error) {
             const err = error;
@@ -121,94 +131,62 @@ export class IPFSSecretsStorage {
             const displayEnv = gitRepo
                 ? (environment ? `${gitRepo}_${environment}` : gitRepo)
                 : (environment || 'default');
-            // If no local metadata, try to fetch from Storacha registry first (for git repos)
+            // If no local metadata, check IPFS sync history
             if (!metadata && gitRepo) {
                 try {
-                    const storacha = getStorachaClient();
-                    if (storacha.isEnabled() && await storacha.isAuthenticated()) {
-                        logger.info(`   🔍 No local metadata found, checking Storacha registry...`);
-                        const latestCid = await storacha.getLatestCID(gitRepo);
-                        if (latestCid) {
-                            logger.info(`   ✅ Found secrets in registry (CID: ${latestCid})`);
-                            // Create metadata from registry
-                            metadata = {
-                                environment,
-                                git_repo: gitRepo,
-                                cid: latestCid,
-                                timestamp: new Date().toISOString(),
-                                keys_count: 0, // Unknown until decrypted
-                                encrypted: true,
-                            };
-                            this.metadata[metadataKey] = metadata;
-                            await this.saveMetadata();
-                        }
+                    const ipfsSync = getIPFSSync();
+                    const latestCid = await ipfsSync.getLatestCid(gitRepo, environment);
+                    if (latestCid) {
+                        logger.info(`   ✅ Found secrets in IPFS history (CID: ${latestCid})`);
+                        // Create metadata from history
+                        metadata = {
+                            environment,
+                            git_repo: gitRepo,
+                            cid: latestCid,
+                            timestamp: new Date().toISOString(),
+                            keys_count: 0, // Unknown until decrypted
+                            encrypted: true,
+                        };
+                        this.metadata[metadataKey] = metadata;
+                        await this.saveMetadata();
                     }
                 }
                 catch (error) {
-                    // Registry check failed, continue to error
+                    // History check failed, continue to error
                     const err = error;
-                    logger.debug(`   Registry check failed: ${err.message}`);
+                    logger.debug(`   IPFS history check failed: ${err.message}`);
                 }
             }
             if (!metadata) {
                 throw new Error(`No secrets found for environment: ${displayEnv}\n\n` +
                     `💡 Tip: Check available environments with: lsh env\n` +
-                    `   Or push secrets first with: lsh push`);
-            }
-            // Check if there's a newer version in the registry (for git repos)
-            if (gitRepo) {
-                try {
-                    const storacha = getStorachaClient();
-                    if (storacha.isEnabled() && await storacha.isAuthenticated()) {
-                        const latestCid = await storacha.getLatestCID(gitRepo);
-                        if (latestCid && latestCid !== metadata.cid) {
-                            logger.info(`   🔄 Found newer version in registry (CID: ${latestCid})`);
-                            // Update metadata with latest CID
-                            metadata = {
-                                ...metadata,
-                                cid: latestCid,
-                                timestamp: new Date().toISOString(),
-                            };
-                            this.metadata[metadataKey] = metadata;
-                            await this.saveMetadata();
-                        }
-                    }
-                }
-                catch (error) {
-                    // Registry check failed, continue with local metadata
-                    const err = error;
-                    logger.debug(`   Registry check failed: ${err.message}`);
-                }
+                    `   Or push secrets first with: lsh push\n` +
+                    `   Or pull by CID with: lsh sync pull <cid>`);
             }
             // Try to load from local cache
             let cachedData = await this.loadLocally(metadata.cid);
-            // If not in cache, try downloading from Storacha
+            // If not in cache, try downloading from IPFS
             if (!cachedData) {
-                const storacha = getStorachaClient();
-                if (storacha.isEnabled()) {
-                    try {
-                        logger.info(`   ☁️  Downloading from Storacha network...`);
-                        const downloadedData = await storacha.download(metadata.cid);
+                const ipfsSync = getIPFSSync();
+                try {
+                    logger.info(`   🌐 Downloading from IPFS...`);
+                    const downloadedData = await ipfsSync.download(metadata.cid);
+                    if (downloadedData) {
                         // Store in local cache for future use
                         await this.storeLocally(metadata.cid, downloadedData.toString('utf-8'), environment);
                         cachedData = downloadedData.toString('utf-8');
-                        logger.info(`   ✅ Downloaded and cached from Storacha`);
-                    }
-                    catch (error) {
-                        const err = error;
-                        throw new Error(`Secrets not in cache and Storacha download failed: ${err.message}`);
+                        logger.info(`   ✅ Downloaded and cached from IPFS`);
                     }
                 }
-                else {
-                    throw new Error(`Secrets not found in cache. CID: ${metadata.cid}\n\n` +
-                        `💡 Tip: Enable Storacha network sync:\n` +
-                        `   export LSH_STORACHA_ENABLED=true\n` +
-                        `   Or set up Supabase: lsh supabase init`);
+                catch (error) {
+                    const err = error;
+                    logger.debug(`   IPFS download failed: ${err.message}`);
                 }
             }
-            // At this point cachedData is guaranteed to be a string
             if (!cachedData) {
-                throw new Error(`Failed to retrieve secrets for environment: ${environment}`);
+                throw new Error(`Secrets not found in cache or IPFS. CID: ${metadata.cid}\n\n` +
+                    `💡 Tip: Start IPFS daemon: lsh ipfs start\n` +
+                    `   Or pull directly by CID: lsh sync pull <cid>`);
             }
             // Decrypt secrets
             const secrets = this.decryptSecrets(cachedData, encryptionKey);
@@ -302,7 +280,7 @@ export class IPFSSecretsStorage {
                 throw new Error('Decryption failed. This usually means:\n' +
                     '  1. You need to set LSH_SECRETS_KEY environment variable\n' +
                     '  2. The key must match the one used during encryption\n' +
-                    '  3. Generate a shared key with: lsh secrets key\n' +
+                    '  3. Generate a shared key with: lsh key\n' +
                     '  4. Add it to your .env: LSH_SECRETS_KEY=<key>\n' +
                     '\nOriginal error: ' + err.message);
             }

package/dist/lib/ipfs-sync-logger.js

@@ -1,6 +1,6 @@
 /**
  * IPFS Sync Logger
- * Records immutable sync operations to IPFS using Storacha (formerly web3.storage)
+ * Records immutable sync operations to IPFS via native Kubo daemon
  */
 import * as fs from 'fs';
 import * as path from 'path';
@@ -11,12 +11,11 @@ import { ENV_VARS } from '../constants/index.js';
 /**
  * IPFS Sync Logger
  *
- * Stores immutable sync records on IPFS using Storacha (storacha.network)
+ * Stores immutable sync records on IPFS via native daemon
  *
  * Features:
- * - Zero-config: Works automatically with embedded token
+ * - Zero-config: Works with local IPFS daemon
  * - Immutable: Content-addressed storage on IPFS
- * - Free: 5GB storage forever via Storacha
  * - Privacy: Only metadata stored, no secrets
  * - Opt-out: Can be disabled via DISABLE_IPFS_SYNC config
  */
@@ -63,9 +62,8 @@ export class IPFSSyncLogger {
             user: os.userInfo().username,
             lsh_version: version,
         };
-        // For now, use simple file-based storage with IPFS-like CIDs
-        // This avoids requiring Storacha authentication
-        // In production, you'd upload to actual IPFS/Storacha
+        // Use file-based storage with IPFS-like CIDs
+        // Records are stored locally and can optionally be uploaded to IPFS
         const cid = this.generateContentId(record);
         const repoEnv = this.getRepoEnvKey(record.git_repo, record.environment);
         // Store the record locally