lsh-framework 3.2.1 → 3.2.3

package/dist/commands/init.js

@@ -87,6 +87,7 @@ async function runSetupWizard(options) {
     // Check if secrets already exist locally
     const cloudCheck = await checkCloudSecretsExist();
     let encryptionKey;
+    let importedKey = false;
     if (cloudCheck.exists && cloudCheck.repoName) {
         // Secrets found! This is an existing project
         console.log(chalk.cyan(`\n✨ Found existing secrets for "${cloudCheck.repoName}" in cloud!`));
@@ -120,6 +121,7 @@ async function runSetupWizard(options) {
                 },
             ]);
             encryptionKey = existingKey.trim();
+            importedKey = true;
         }
         else {
             // Generate new key (will overwrite existing)
@@ -128,28 +130,61 @@ async function runSetupWizard(options) {
         }
     }
     else {
-        // No existing secrets - generate new key
-        encryptionKey = generateEncryptionKey();
+        // No existing secrets found locally — ask if joining an existing project
+        const { keyChoice } = await inquirer.prompt([
+            {
+                type: 'list',
+                name: 'keyChoice',
+                message: 'How would you like to set up this project?',
+                choices: [
+                    { name: '🔑 Generate a new encryption key (new project)', value: 'generate' },
+                    { name: '🤝 Import an existing key from a teammate', value: 'import' },
+                ],
+            },
+        ]);
+        if (keyChoice === 'import') {
+            const { existingKey } = await inquirer.prompt([
+                {
+                    type: 'password',
+                    name: 'existingKey',
+                    message: 'Enter the LSH_SECRETS_KEY from your teammate:',
+                    mask: '*',
+                    validate: (input) => {
+                        if (!input.trim())
+                            return 'Encryption key is required';
+                        if (input.length < 16)
+                            return 'Key is too short (minimum 16 characters)';
+                        return true;
+                    },
+                },
+            ]);
+            encryptionKey = existingKey.trim();
+            importedKey = true;
+        }
+        else {
+            encryptionKey = generateEncryptionKey();
+        }
     }
     const config = {
         encryptionKey,
     };
-    // If using existing key and secrets exist, offer to pull them now
-    if (cloudCheck.exists && config.encryptionKey && cloudCheck.repoName) {
+    // Save configuration first so LSH_SECRETS_KEY is available for pull
+    await saveConfiguration(config, baseDir, globalMode);
+    // If user imported a key, offer to pull secrets via IPNS
+    if (importedKey && daemonRunning) {
         const { pullNow } = await inquirer.prompt([
             {
                 type: 'confirm',
                 name: 'pullNow',
-                message: 'Pull secrets now?',
+                message: 'Pull secrets now via IPNS?',
                 default: true,
             },
         ]);
         if (pullNow) {
-            await pullSecretsAfterInit(config.encryptionKey, cloudCheck.repoName);
+            const gitInfo = getGitRepoInfo();
+            await pullSecretsAfterInit(config.encryptionKey, cloudCheck.repoName || gitInfo?.repoName || '');
         }
     }
-    // Save configuration
-    await saveConfiguration(config, baseDir, globalMode);
     // Show success message
     showSuccessMessage(config);
 }
@@ -333,18 +368,12 @@ function showSuccessMessage(config) {
     console.log(chalk.gray('   1. (Optional) Start IPFS daemon for network sync:'));
     console.log(chalk.cyan('      lsh ipfs install && lsh ipfs init && lsh ipfs start'));
     console.log('');
-    console.log(chalk.gray('   2. Push your secrets to IPFS:'));
-    console.log(chalk.cyan('      lsh sync push'));
-    console.log(chalk.gray('      (Returns a CID - share this with teammates)'));
-    console.log('');
-    console.log(chalk.gray('   3. On another machine:'));
-    console.log(chalk.cyan('      lsh init'));
-    console.log(chalk.cyan('      export LSH_SECRETS_KEY=<key-from-teammate>'));
-    console.log(chalk.cyan('      lsh sync pull <cid>'));
+    console.log(chalk.gray('   2. Push your secrets:'));
+    console.log(chalk.cyan('      lsh push'));
     console.log('');
-    console.log(chalk.gray('   Alternatively, use the classic push/pull commands:'));
-    console.log(chalk.cyan('      lsh push --env dev'));
-    console.log(chalk.cyan('      lsh pull --env dev'));
+    console.log(chalk.gray('   3. Teammates (share only the key, nothing else):'));
+    console.log(chalk.cyan('      lsh init        # Choose "Import existing key"'));
+    console.log(chalk.cyan('      lsh pull         # Auto-resolves latest via IPNS'));
     console.log('');
     console.log(chalk.gray('📖 Documentation: https://github.com/gwicho38/lsh'));
     console.log('');

package/dist/commands/sync-history.js

@@ -45,8 +45,14 @@ export function registerSyncHistoryCommands(program) {
             if (options.url) {
                 // Show URLs only
                 for (const record of records) {
-                    const cid = `bafkrei${record.key_fingerprint.substring(0, 52)}`;
-                    console.log(`ipfs://${cid}`);
+                    if (record.cid) {
+                        console.log(`ipfs://${record.cid}`);
+                    }
+                    else {
+                        // Old records without real CID
+                        const recordId = record.key_fingerprint.substring(0, 16);
+                        console.log(`lsh-record://${recordId} (local)`);
+                    }
                 }
             }
             else {

package/dist/commands/sync.js

@@ -143,57 +143,15 @@ export function registerSyncCommands(program) {
         const ipfsSync = getIPFSSync();
         const gitInfo = getGitRepoInfo();
         // Step 1: Ensure IPFS is set up and daemon is running
-        let daemonReady = await ipfsSync.checkDaemon();
-        if (!daemonReady) {
-            // Check if IPFS is installed
-            const clientInfo = await manager.detect();
-            if (!clientInfo.installed) {
-                const installSpinner = ora('Installing IPFS client...').start();
-                try {
-                    await manager.install();
-                    installSpinner.succeed(chalk.green('IPFS client installed'));
-                }
-                catch (error) {
-                    const err = error;
-                    installSpinner.fail(chalk.red('Failed to install IPFS'));
-                    console.error(chalk.red(err.message));
-                    process.exit(1);
-                }
-            }
-            // Initialize repo if needed
-            const initSpinner = ora('Initializing IPFS...').start();
-            try {
-                await manager.init();
-                initSpinner.succeed(chalk.green('IPFS initialized'));
-            }
-            catch (error) {
-                const err = error;
-                if (!err.message.includes('already') && !err.message.includes('exists')) {
-                    initSpinner.fail(chalk.red('Failed to initialize IPFS'));
-                    console.error(chalk.red(err.message));
-                    process.exit(1);
-                }
-                initSpinner.succeed(chalk.green('IPFS already initialized'));
-            }
-            // Start daemon
-            const startSpinner = ora('Starting IPFS daemon...').start();
-            try {
-                await manager.start();
-                // Give daemon a moment to start accepting connections
-                await new Promise(resolve => { setTimeout(resolve, 2000); });
-                startSpinner.succeed(chalk.green('IPFS daemon started'));
-                daemonReady = true;
-            }
-            catch (error) {
-                const err = error;
-                startSpinner.fail(chalk.red('Failed to start daemon'));
-                console.error(chalk.red(err.message));
-                process.exit(1);
-            }
-        }
-        else {
+        try {
+            await manager.ensureDaemonRunning();
             console.log(chalk.green('✓ IPFS daemon running'));
         }
+        catch (error) {
+            const err = error;
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
         // Step 2: Read and validate .env file
         const envPath = path.resolve(options.file);
         if (!fs.existsSync(envPath)) {
@@ -287,12 +245,14 @@ export function registerSyncCommands(program) {
         try {
             const ipfsSync = getIPFSSync();
             const gitInfo = getGitRepoInfo();
-            // Check daemon
-            if (!await ipfsSync.checkDaemon()) {
-                spinner.fail(chalk.red('IPFS daemon not running'));
-                console.log('');
-                console.log(chalk.gray('Initialize IPFS first:'));
-                console.log(chalk.cyan('  lsh sync init'));
+            // Ensure daemon is running (auto-setup if needed)
+            try {
+                const ipfsManager = new IPFSClientManager();
+                await ipfsManager.ensureDaemonRunning();
+            }
+            catch (error) {
+                const err = error;
+                spinner.fail(chalk.red(err.message));
                 process.exit(1);
             }
             // Read .env file
@@ -391,9 +351,13 @@ export function registerSyncCommands(program) {
         if (!cid) {
             try {
                 const ipfsSync = getIPFSSync();
-                if (!await ipfsSync.checkDaemon()) {
-                    spinner.fail(chalk.red('IPFS daemon not running'));
-                    console.log(chalk.gray('  Start with: lsh sync start'));
+                try {
+                    const ipfsManager = new IPFSClientManager();
+                    await ipfsManager.ensureDaemonRunning();
+                }
+                catch (error) {
+                    const err = error;
+                    spinner.fail(chalk.red(err.message));
                     process.exit(1);
                 }
                 // Get encryption key

package/dist/lib/ipfs-client-manager.js

@@ -7,8 +7,10 @@ import * as path from 'path';
 import * as os from 'os';
 import { exec, spawn } from 'child_process';
 import { promisify } from 'util';
+import * as readline from 'readline';
 import { createLogger } from './logger.js';
 import { getPlatformInfo } from './platform-utils.js';
+import { getLshConfig } from './lsh-config.js';
 const execAsync = promisify(exec);
 const logger = createLogger('IPFSClientManager');
 /**
@@ -364,6 +366,82 @@ export class IPFSClientManager {
         fs.unlinkSync(zipPath);
         fs.rmSync(path.join(this.ipfsDir, 'kubo'), { recursive: true });
     }
+    /**
+     * Ensure IPFS daemon is installed and running.
+     * Prompts once for install consent, then auto-manages daemon lifecycle.
+     */
+    async ensureDaemonRunning() {
+        // Step 1: Check if daemon is already running
+        const isRunning = await this.isDaemonRunning();
+        if (isRunning) {
+            return;
+        }
+        // Step 2: Check if Kubo is installed
+        const clientInfo = await this.detect();
+        const config = getLshConfig();
+        if (!clientInfo.installed) {
+            if (config.getIpfsConsent()) {
+                logger.info('📦 Installing IPFS client (Kubo)...');
+                await this.install();
+                await this.init();
+            }
+            else {
+                if (!process.stdin.isTTY) {
+                    throw new Error('IPFS (Kubo) is required for sync but is not installed.\n' +
+                        'Install manually: lsh ipfs install && lsh ipfs start');
+                }
+                const consent = await this.promptUser('IPFS (Kubo) is required for sync. Install now? [Y/n] ');
+                if (consent.toLowerCase() === 'n') {
+                    throw new Error('IPFS is required for push/pull.\n' +
+                        'Install manually: lsh ipfs install && lsh ipfs start');
+                }
+                logger.info('📦 Installing IPFS client (Kubo)...');
+                await this.install();
+                await this.init();
+                config.setIpfsConsent(true);
+            }
+        }
+        // Step 3: Start daemon
+        logger.info('🚀 Starting IPFS daemon...');
+        await this.start();
+        // Step 4: Wait for API readiness
+        const ready = await this.waitForDaemon(15000);
+        if (!ready) {
+            throw new Error('IPFS daemon started but API is not responding.\n' +
+                'Try manually: lsh ipfs start');
+        }
+        logger.info('✅ IPFS daemon ready');
+    }
+    /**
+     * Check if daemon API is responding
+     */
+    async isDaemonRunning() {
+        try {
+            const response = await fetch('http://127.0.0.1:5001/api/v0/id', {
+                method: 'POST',
+                signal: AbortSignal.timeout(3000),
+            });
+            return response.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Prompt user for input via readline
+     */
+    promptUser(question) {
+        return new Promise((resolve) => {
+            const rl = readline.createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            });
+            rl.question(question, (answer) => {
+                rl.close();
+                resolve(answer || 'y');
+            });
+        });
+    }
     /**
      * Ensure required directories exist
      */

package/dist/lib/ipfs-secrets-storage.js

@@ -63,11 +63,16 @@ export class IPFSSecretsStorage {
         try {
             // Encrypt secrets
             const encryptedData = this.encryptSecrets(secrets, encryptionKey);
-            // Generate CID from encrypted content
-            const cid = this.generateCID(encryptedData);
-            // Store locally (cache)
+            // Upload to IPFS (daemon guaranteed running by ensureDaemonRunning)
+            const ipfsSync = getIPFSSync();
+            const filename = `lsh-secrets-${environment}.encrypted`;
+            const cid = await ipfsSync.upload(Buffer.from(encryptedData, 'utf-8'), filename, { environment, gitRepo });
+            if (!cid) {
+                throw new Error('IPFS upload failed. Is the daemon running? Check: lsh ipfs status');
+            }
+            // Cache locally for fast re-reads
             await this.storeLocally(cid, encryptedData, environment);
-            // Update metadata
+            // Update metadata with real CID
             const metadata = {
                 environment,
                 git_repo: gitRepo,
@@ -84,40 +89,15 @@ export class IPFSSecretsStorage {
             if (gitRepo) {
                 logger.info(`   Repository: ${gitRepo}/${gitBranch || 'main'}`);
             }
-            // Try native IPFS upload
-            const ipfsSync = getIPFSSync();
-            let uploadedToNetwork = false;
-            let realCid = null;
-            if (await ipfsSync.checkDaemon()) {
-                try {
-                    const filename = `lsh-secrets-${environment}.encrypted`;
-                    realCid = await ipfsSync.upload(Buffer.from(encryptedData, 'utf-8'), filename, { environment, gitRepo });
-                    if (realCid) {
-                        // Update CID to the real IPFS CID
-                        logger.info(`   🌐 Synced to IPFS (CID: ${realCid})`);
-                        uploadedToNetwork = true;
-                        // Update metadata with real CID if different
-                        if (realCid !== cid) {
-                            metadata.cid = realCid;
-                            this.metadata[this.getMetadataKey(gitRepo, environment)] = metadata;
-                            await this.saveMetadata();
-                        }
-                    }
-                }
-                catch (error) {
-                    const err = error;
-                    logger.warn(`   ⚠️  IPFS upload failed: ${err.message}`);
-                }
-            }
-            // Publish to IPNS if we uploaded to the network
-            if (uploadedToNetwork && realCid && encryptionKey) {
+            // Publish to IPNS
+            if (encryptionKey) {
                 try {
                     const repoName = gitRepo || DEFAULTS.DEFAULT_ENVIRONMENT;
                     const env = environment || DEFAULTS.DEFAULT_ENVIRONMENT;
                     const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
                     const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
                     if (ipnsName) {
-                        const publishedName = await ipfsSync.publishToIPNS(realCid, keyInfo.keyName);
+                        const publishedName = await ipfsSync.publishToIPNS(cid, keyInfo.keyName);
                         if (publishedName) {
                             metadata.ipns_name = publishedName;
                             this.metadata[this.getMetadataKey(gitRepo, environment)] = metadata;
@@ -128,14 +108,11 @@ export class IPFSSecretsStorage {
                 }
                 catch (error) {
                     const err = error;
-                    logger.warn(`   ⚠️  IPNS publish failed (non-fatal): ${err.message}`);
+                    logger.error(`Content uploaded (CID: ${cid}) but IPNS publish failed: ${err.message}\n` +
+                        `Other machines won't find it via 'lsh pull' until you re-push.`);
                 }
             }
-            if (!uploadedToNetwork) {
-                logger.warn(`   📁 Secrets cached locally only (no network sync)`);
-                logger.warn(`   💡 Start IPFS daemon for network sync: lsh ipfs start`);
-            }
-            return realCid || cid;
+            return cid;
         }
         catch (error) {
             const err = error;
@@ -148,89 +125,61 @@ export class IPFSSecretsStorage {
      */
     async pull(environment, encryptionKey, gitRepo) {
         try {
-            const metadataKey = this.getMetadataKey(gitRepo, environment);
-            let metadata = this.metadata[metadataKey];
-            // Construct display name for error messages
-            const displayEnv = gitRepo
-                ? (environment ? `${gitRepo}_${environment}` : gitRepo)
-                : (environment || 'default');
-            // If no local metadata, try IPNS resolution first
-            if (!metadata && encryptionKey) {
+            const ipfsSync = getIPFSSync();
+            // Step 1: Always resolve via IPNS (source of truth)
+            let resolvedCid = null;
+            if (encryptionKey) {
                 try {
-                    const ipfsSync = getIPFSSync();
-                    if (await ipfsSync.checkDaemon()) {
-                        const repoName = gitRepo || DEFAULTS.DEFAULT_ENVIRONMENT;
-                        const env = environment || DEFAULTS.DEFAULT_ENVIRONMENT;
-                        const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
-                        const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
-                        if (ipnsName) {
-                            logger.info(`   🔍 Resolving via IPNS: ${ipnsName.substring(0, 20)}...`);
-                            const resolvedCid = await ipfsSync.resolveIPNS(ipnsName);
-                            if (resolvedCid) {
-                                logger.info(`   ✅ IPNS resolved to CID: ${resolvedCid}`);
-                                metadata = {
-                                    environment,
-                                    git_repo: gitRepo,
-                                    cid: resolvedCid,
-                                    ipns_name: ipnsName,
-                                    timestamp: new Date().toISOString(),
-                                    keys_count: 0,
-                                    encrypted: true,
-                                };
-                                this.metadata[metadataKey] = metadata;
-                                await this.saveMetadata();
-                            }
+                    const repoName = gitRepo || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const env = environment || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
+                    const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
+                    if (ipnsName) {
+                        logger.info(`   🔍 Resolving via IPNS: ${ipnsName.substring(0, 20)}...`);
+                        resolvedCid = await ipfsSync.resolveIPNS(ipnsName);
+                        if (resolvedCid) {
+                            logger.info(`   ✅ IPNS resolved to CID: ${resolvedCid}`);
+                            // Update local metadata
+                            const metadataKey = this.getMetadataKey(gitRepo, environment);
+                            this.metadata[metadataKey] = {
+                                environment,
+                                git_repo: gitRepo,
+                                cid: resolvedCid,
+                                ipns_name: ipnsName,
+                                timestamp: new Date().toISOString(),
+                                keys_count: 0,
+                                encrypted: true,
+                            };
+                            await this.saveMetadata();
                         }
                     }
                 }
                 catch (error) {
                     const err = error;
-                    logger.debug(`   IPNS resolution failed: ${err.message}`);
+                    logger.debug(`   IPNS resolution error: ${err.message}`);
                 }
             }
-            // If still no metadata, check IPFS sync history
-            if (!metadata && gitRepo) {
-                try {
-                    const ipfsSync = getIPFSSync();
-                    const latestCid = await ipfsSync.getLatestCid(gitRepo, environment);
-                    if (latestCid) {
-                        logger.info(`   ✅ Found secrets in IPFS history (CID: ${latestCid})`);
-                        // Create metadata from history
-                        metadata = {
-                            environment,
-                            git_repo: gitRepo,
-                            cid: latestCid,
-                            timestamp: new Date().toISOString(),
-                            keys_count: 0, // Unknown until decrypted
-                            encrypted: true,
-                        };
-                        this.metadata[metadataKey] = metadata;
-                        await this.saveMetadata();
-                    }
-                }
-                catch (error) {
-                    // History check failed, continue to error
-                    const err = error;
-                    logger.debug(`   IPFS history check failed: ${err.message}`);
-                }
-            }
-            if (!metadata) {
-                throw new Error(`No secrets found for environment: ${displayEnv}\n\n` +
-                    `💡 Tip: Check available environments with: lsh env\n` +
-                    `   Or push secrets first with: lsh push\n` +
-                    `   Or pull by CID with: lsh sync pull <cid>`);
+            // No fallback to local metadata — IPNS is the source of truth
+            if (!resolvedCid) {
+                throw new Error('Could not resolve secrets from network.\n\n' +
+                    'Possible causes:\n' +
+                    '  - The machine that pushed secrets is offline or IPFS daemon stopped\n' +
+                    '  - IPNS record hasn\'t propagated yet (try again in 30s)\n' +
+                    '  - Network connectivity issue\n' +
+                    '  - IPNS record expired from DHT (records are cached ~24-48h;\n' +
+                    '    the publishing machine must be online periodically)\n\n' +
+                    'Troubleshooting:\n' +
+                    '  lsh ipfs status    # Check local daemon\n' +
+                    '  lsh doctor         # Full health check');
             }
-            // Try to load from local cache
-            let cachedData = await this.loadLocally(metadata.cid);
-            // If not in cache, try downloading from IPFS
+            // Step 2: Load content — try cache first, then IPFS download
+            let cachedData = await this.loadLocally(resolvedCid);
             if (!cachedData) {
-                const ipfsSync = getIPFSSync();
                 try {
                     logger.info(`   🌐 Downloading from IPFS...`);
-                    const downloadedData = await ipfsSync.download(metadata.cid);
+                    const downloadedData = await ipfsSync.download(resolvedCid);
                     if (downloadedData) {
-                        // Store in local cache for future use
-                        await this.storeLocally(metadata.cid, downloadedData.toString('utf-8'), environment);
+                        await this.storeLocally(resolvedCid, downloadedData.toString('utf-8'), environment);
                         cachedData = downloadedData.toString('utf-8');
                         logger.info(`   ✅ Downloaded and cached from IPFS`);
                     }
@@ -241,14 +190,13 @@ export class IPFSSecretsStorage {
                 }
             }
             if (!cachedData) {
-                throw new Error(`Secrets not found in cache or IPFS. CID: ${metadata.cid}\n\n` +
-                    `💡 Tip: Start IPFS daemon: lsh ipfs start\n` +
-                    `   Or pull directly by CID: lsh sync pull <cid>`);
+                throw new Error(`Secrets resolved via IPNS (CID: ${resolvedCid}) but download failed.\n\n` +
+                    `💡 The source machine may be offline. Try again when it's online.`);
             }
-            // Decrypt secrets
+            // Step 3: Decrypt
             const secrets = this.decryptSecrets(cachedData, encryptionKey);
             logger.info(`📥 Retrieved ${secrets.length} secrets from IPFS`);
-            logger.info(`   CID: ${metadata.cid}`);
+            logger.info(`   CID: ${resolvedCid}`);
             logger.info(`   Environment: ${environment}`);
             return secrets;
         }
@@ -344,14 +292,6 @@ export class IPFSSecretsStorage {
             throw error;
         }
     }
-    /**
-     * Generate IPFS-compatible CID from content
-     */
-    generateCID(content) {
-        const hash = crypto.createHash('sha256').update(content).digest('hex');
-        // Format like IPFS CIDv1 (bafkreixxx...)
-        return `bafkrei${hash.substring(0, 52)}`;
-    }
     /**
      * Store encrypted data locally
      */

package/dist/lib/ipfs-sync-logger.js

@@ -64,7 +64,7 @@ export class IPFSSyncLogger {
         };
         // Use file-based storage with IPFS-like CIDs
         // Records are stored locally and can optionally be uploaded to IPFS
-        const cid = this.generateContentId(record);
+        const cid = this.generateRecordId(record);
         const repoEnv = this.getRepoEnvKey(record.git_repo, record.environment);
         // Store the record locally
         await this.storeRecordLocally(cid, record);
@@ -73,9 +73,9 @@ export class IPFSSyncLogger {
             this.syncLog[repoEnv] = [];
         }
         this.syncLog[repoEnv].push({
-            cid,
+            cid, // This is the record ID (file key), NOT the IPFS CID
             timestamp: record.timestamp,
-            url: `ipfs://${cid}`,
+            url: record.cid ? `ipfs://${record.cid}` : `lsh-record://${cid}`,
             action: record.action,
         });
         // Save sync log
@@ -138,7 +138,7 @@ export class IPFSSyncLogger {
     /**
      * Generate a content-addressed ID (like IPFS CID)
      */
-    generateContentId(record) {
+    generateRecordId(record) {
         const content = JSON.stringify(record);
         const hash = crypto.createHash('sha256').update(content).digest('hex');
         // Format like IPFS CIDv1 (bafkreixxx...)

package/dist/lib/ipfs-sync.js

@@ -346,31 +346,41 @@ export class IPFSSync {
     /**
      * Publish a CID to IPNS under the given key name.
      * The key must already be imported into Kubo.
+     * Publishes to DHT and blocks until confirmed.
+     * Retries once on failure.
      * Returns the IPNS name on success, null on failure.
      */
     async publishToIPNS(cid, keyName) {
-        try {
-            // allow-offline=true stores the record locally and returns immediately;
-            // the daemon propagates it to the DHT in the background.
-            // Without this, first publishes can take 60-90s for DHT propagation.
-            const response = await fetch(`${this.LOCAL_IPFS_API}/name/publish?arg=${cid}&key=${encodeURIComponent(keyName)}&lifetime=87600h&resolve=false&offline=true`, {
-                method: 'POST',
-                signal: AbortSignal.timeout(15000),
-            });
-            if (!response.ok) {
-                const errorText = await response.text();
-                logger.warn(`IPNS publish failed: ${errorText}`);
-                return null;
+        const url = `${this.LOCAL_IPFS_API}/name/publish?arg=${cid}&key=${encodeURIComponent(keyName)}&lifetime=87600h&resolve=false&offline=false&allow-offline=false`;
+        for (let attempt = 1; attempt <= 2; attempt++) {
+            try {
+                logger.info('📡 Publishing to IPNS (waiting for network confirmation)...');
+                const response = await fetch(url, {
+                    method: 'POST',
+                    signal: AbortSignal.timeout(120000),
+                });
+                if (!response.ok) {
+                    const errorText = await response.text();
+                    logger.warn(`IPNS publish failed (attempt ${attempt}): ${errorText}`);
+                    if (attempt === 2)
+                        return null;
+                    continue;
+                }
+                const data = await response.json();
+                logger.info(`📡 IPNS published: ${data.Name} → ${data.Value}`);
+                return data.Name;
+            }
+            catch (error) {
+                const err = error;
+                logger.warn(`IPNS publish error (attempt ${attempt}): ${err.message}`);
+                if (attempt === 2) {
+                    logger.error(`IPNS publish failed after retry. Content is uploaded (CID: ${cid}) ` +
+                        `but other machines won't find it via 'lsh pull' until you re-push.`);
+                    return null;
+                }
             }
-            const data = await response.json();
-            logger.info(`📡 IPNS published: ${data.Name} → ${data.Value}`);
-            return data.Name;
-        }
-        catch (error) {
-            const err = error;
-            logger.debug(`IPNS publish error: ${err.message}`);
-            return null;
         }
+        return null;
     }
     /**
      * Resolve an IPNS name to its current CID.

package/dist/lib/lsh-config.js

@@ -126,6 +126,13 @@ export class LshConfigManager {
     getConfigPath() {
         return this.configPath;
     }
+    getIpfsConsent() {
+        return this.config.ipfs_consent === true;
+    }
+    setIpfsConsent(value) {
+        this.config.ipfs_consent = value;
+        this.saveConfig();
+    }
 }
 // Singleton instance
 let _configManager = null;

package/dist/lib/secrets-manager.js

@@ -299,7 +299,7 @@ export class SecretsManager {
         logger.info(`✅ Pushed ${secrets.length} secrets from ${filename} to IPFS`);
         console.log(`📦 IPFS CID: ${cid}`);
         // Log to IPFS for immutable audit record
-        await this.logToIPFS('push', effectiveEnv, secrets.length);
+        await this.logToIPFS('push', effectiveEnv, secrets.length, cid);
     }
     /**
      * Pull .env from IPFS
@@ -961,7 +961,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
     /**
      * Log sync operation to IPFS for immutable record
      */
-    async logToIPFS(action, environment, keysCount) {
+    async logToIPFS(action, environment, keysCount, realCid) {
         try {
             const ipfsLogger = new IPFSSyncLogger();
             if (!ipfsLogger.isEnabled()) {
@@ -971,10 +971,13 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 action,
                 environment: this.getRepoAwareEnvironment(environment),
                 keys_count: keysCount,
+                cid: realCid,
             });
             if (cid) {
-                console.log(`📝 Recorded on IPFS: ipfs://${cid}`);
-                console.log(`   View: https://ipfs.io/ipfs/${cid}`);
+                if (realCid) {
+                    console.log(`📝 Recorded on IPFS: ipfs://${realCid}`);
+                    console.log(`   View: https://ipfs.io/ipfs/${realCid}`);
+                }
             }
         }
         catch (error) {

package/dist/services/secrets/secrets.js

@@ -8,6 +8,7 @@ import * as path from 'path';
 import * as readline from 'readline';
 import { getGitRepoInfo } from '../../lib/git-utils.js';
 import { ENV_VARS } from '../../constants/index.js';
+import { IPFSClientManager } from '../../lib/ipfs-client-manager.js';
 /**
  * Type guard to check if a string is a valid OutputFormat.
  */
@@ -26,6 +27,8 @@ export async function init_secrets(program) {
         .action(async (options) => {
         const manager = new SecretsManager({ globalMode: options.global });
         try {
+            const ipfsManager = new IPFSClientManager();
+            await ipfsManager.ensureDaemonRunning();
             // Resolve file path (handles global mode)
             const filePath = manager.resolveFilePath(options.file);
             // v2.0: Use context-aware default environment
@@ -53,6 +56,8 @@ export async function init_secrets(program) {
         .action(async (options) => {
         const manager = new SecretsManager({ globalMode: options.global });
         try {
+            const ipfsManager = new IPFSClientManager();
+            await ipfsManager.ensureDaemonRunning();
             // Resolve file path (handles global mode)
             const filePath = manager.resolveFilePath(options.file);
             // v2.0: Use context-aware default environment

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lsh-framework",
-  "version": "3.2.1",
+  "version": "3.2.3",
   "description": "Simple, cross-platform encrypted secrets manager with automatic sync, IPFS audit logs, and multi-environment support. Just run lsh sync and start managing your secrets.",
   "main": "dist/app.js",
   "bin": {