lsh-framework 3.2.2 → 3.2.4

package/dist/commands/sync-history.js

@@ -45,8 +45,14 @@ export function registerSyncHistoryCommands(program) {
             if (options.url) {
                 // Show URLs only
                 for (const record of records) {
-                    const cid = `bafkrei${record.key_fingerprint.substring(0, 52)}`;
-                    console.log(`ipfs://${cid}`);
+                    if (record.cid) {
+                        console.log(`ipfs://${record.cid}`);
+                    }
+                    else {
+                        // Old records without real CID
+                        const recordId = record.key_fingerprint.substring(0, 16);
+                        console.log(`lsh-record://${recordId} (local)`);
+                    }
                 }
             }
             else {

package/dist/commands/sync.js

@@ -143,57 +143,15 @@ export function registerSyncCommands(program) {
         const ipfsSync = getIPFSSync();
         const gitInfo = getGitRepoInfo();
         // Step 1: Ensure IPFS is set up and daemon is running
-        let daemonReady = await ipfsSync.checkDaemon();
-        if (!daemonReady) {
-            // Check if IPFS is installed
-            const clientInfo = await manager.detect();
-            if (!clientInfo.installed) {
-                const installSpinner = ora('Installing IPFS client...').start();
-                try {
-                    await manager.install();
-                    installSpinner.succeed(chalk.green('IPFS client installed'));
-                }
-                catch (error) {
-                    const err = error;
-                    installSpinner.fail(chalk.red('Failed to install IPFS'));
-                    console.error(chalk.red(err.message));
-                    process.exit(1);
-                }
-            }
-            // Initialize repo if needed
-            const initSpinner = ora('Initializing IPFS...').start();
-            try {
-                await manager.init();
-                initSpinner.succeed(chalk.green('IPFS initialized'));
-            }
-            catch (error) {
-                const err = error;
-                if (!err.message.includes('already') && !err.message.includes('exists')) {
-                    initSpinner.fail(chalk.red('Failed to initialize IPFS'));
-                    console.error(chalk.red(err.message));
-                    process.exit(1);
-                }
-                initSpinner.succeed(chalk.green('IPFS already initialized'));
-            }
-            // Start daemon
-            const startSpinner = ora('Starting IPFS daemon...').start();
-            try {
-                await manager.start();
-                // Give daemon a moment to start accepting connections
-                await new Promise(resolve => { setTimeout(resolve, 2000); });
-                startSpinner.succeed(chalk.green('IPFS daemon started'));
-                daemonReady = true;
-            }
-            catch (error) {
-                const err = error;
-                startSpinner.fail(chalk.red('Failed to start daemon'));
-                console.error(chalk.red(err.message));
-                process.exit(1);
-            }
-        }
-        else {
+        try {
+            await manager.ensureDaemonRunning();
             console.log(chalk.green('✓ IPFS daemon running'));
         }
+        catch (error) {
+            const err = error;
+            console.error(chalk.red(err.message));
+            process.exit(1);
+        }
         // Step 2: Read and validate .env file
         const envPath = path.resolve(options.file);
         if (!fs.existsSync(envPath)) {
@@ -287,12 +245,14 @@ export function registerSyncCommands(program) {
         try {
             const ipfsSync = getIPFSSync();
             const gitInfo = getGitRepoInfo();
-            // Check daemon
-            if (!await ipfsSync.checkDaemon()) {
-                spinner.fail(chalk.red('IPFS daemon not running'));
-                console.log('');
-                console.log(chalk.gray('Initialize IPFS first:'));
-                console.log(chalk.cyan('  lsh sync init'));
+            // Ensure daemon is running (auto-setup if needed)
+            try {
+                const ipfsManager = new IPFSClientManager();
+                await ipfsManager.ensureDaemonRunning();
+            }
+            catch (error) {
+                const err = error;
+                spinner.fail(chalk.red(err.message));
                 process.exit(1);
             }
             // Read .env file
@@ -391,9 +351,13 @@ export function registerSyncCommands(program) {
         if (!cid) {
             try {
                 const ipfsSync = getIPFSSync();
-                if (!await ipfsSync.checkDaemon()) {
-                    spinner.fail(chalk.red('IPFS daemon not running'));
-                    console.log(chalk.gray('  Start with: lsh sync start'));
+                try {
+                    const ipfsManager = new IPFSClientManager();
+                    await ipfsManager.ensureDaemonRunning();
+                }
+                catch (error) {
+                    const err = error;
+                    spinner.fail(chalk.red(err.message));
                     process.exit(1);
                 }
                 // Get encryption key

package/dist/lib/ipfs-client-manager.js

@@ -7,8 +7,10 @@ import * as path from 'path';
 import * as os from 'os';
 import { exec, spawn } from 'child_process';
 import { promisify } from 'util';
+import * as readline from 'readline';
 import { createLogger } from './logger.js';
 import { getPlatformInfo } from './platform-utils.js';
+import { getLshConfig } from './lsh-config.js';
 const execAsync = promisify(exec);
 const logger = createLogger('IPFSClientManager');
 /**
@@ -364,6 +366,82 @@ export class IPFSClientManager {
         fs.unlinkSync(zipPath);
         fs.rmSync(path.join(this.ipfsDir, 'kubo'), { recursive: true });
     }
+    /**
+     * Ensure IPFS daemon is installed and running.
+     * Prompts once for install consent, then auto-manages daemon lifecycle.
+     */
+    async ensureDaemonRunning() {
+        // Step 1: Check if daemon is already running
+        const isRunning = await this.isDaemonRunning();
+        if (isRunning) {
+            return;
+        }
+        // Step 2: Check if Kubo is installed
+        const clientInfo = await this.detect();
+        const config = getLshConfig();
+        if (!clientInfo.installed) {
+            if (config.getIpfsConsent()) {
+                logger.info('📦 Installing IPFS client (Kubo)...');
+                await this.install();
+                await this.init();
+            }
+            else {
+                if (!process.stdin.isTTY) {
+                    throw new Error('IPFS (Kubo) is required for sync but is not installed.\n' +
+                        'Install manually: lsh ipfs install && lsh ipfs start');
+                }
+                const consent = await this.promptUser('IPFS (Kubo) is required for sync. Install now? [Y/n] ');
+                if (consent.toLowerCase() === 'n') {
+                    throw new Error('IPFS is required for push/pull.\n' +
+                        'Install manually: lsh ipfs install && lsh ipfs start');
+                }
+                logger.info('📦 Installing IPFS client (Kubo)...');
+                await this.install();
+                await this.init();
+                config.setIpfsConsent(true);
+            }
+        }
+        // Step 3: Start daemon
+        logger.info('🚀 Starting IPFS daemon...');
+        await this.start();
+        // Step 4: Wait for API readiness
+        const ready = await this.waitForDaemon(15000);
+        if (!ready) {
+            throw new Error('IPFS daemon started but API is not responding.\n' +
+                'Try manually: lsh ipfs start');
+        }
+        logger.info('✅ IPFS daemon ready');
+    }
+    /**
+     * Check if daemon API is responding
+     */
+    async isDaemonRunning() {
+        try {
+            const response = await fetch('http://127.0.0.1:5001/api/v0/id', {
+                method: 'POST',
+                signal: AbortSignal.timeout(3000),
+            });
+            return response.ok;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * Prompt user for input via readline
+     */
+    promptUser(question) {
+        return new Promise((resolve) => {
+            const rl = readline.createInterface({
+                input: process.stdin,
+                output: process.stdout,
+            });
+            rl.question(question, (answer) => {
+                rl.close();
+                resolve(answer || 'y');
+            });
+        });
+    }
     /**
      * Ensure required directories exist
      */

package/dist/lib/ipfs-secrets-storage.js

@@ -63,11 +63,16 @@ export class IPFSSecretsStorage {
         try {
             // Encrypt secrets
             const encryptedData = this.encryptSecrets(secrets, encryptionKey);
-            // Generate CID from encrypted content
-            const cid = this.generateCID(encryptedData);
-            // Store locally (cache)
+            // Upload to IPFS (daemon guaranteed running by ensureDaemonRunning)
+            const ipfsSync = getIPFSSync();
+            const filename = `lsh-secrets-${environment}.encrypted`;
+            const cid = await ipfsSync.upload(Buffer.from(encryptedData, 'utf-8'), filename, { environment, gitRepo });
+            if (!cid) {
+                throw new Error('IPFS upload failed. Is the daemon running? Check: lsh ipfs status');
+            }
+            // Cache locally for fast re-reads
             await this.storeLocally(cid, encryptedData, environment);
-            // Update metadata
+            // Update metadata with real CID
             const metadata = {
                 environment,
                 git_repo: gitRepo,
@@ -84,40 +89,15 @@ export class IPFSSecretsStorage {
             if (gitRepo) {
                 logger.info(`   Repository: ${gitRepo}/${gitBranch || 'main'}`);
             }
-            // Try native IPFS upload
-            const ipfsSync = getIPFSSync();
-            let uploadedToNetwork = false;
-            let realCid = null;
-            if (await ipfsSync.checkDaemon()) {
-                try {
-                    const filename = `lsh-secrets-${environment}.encrypted`;
-                    realCid = await ipfsSync.upload(Buffer.from(encryptedData, 'utf-8'), filename, { environment, gitRepo });
-                    if (realCid) {
-                        // Update CID to the real IPFS CID
-                        logger.info(`   🌐 Synced to IPFS (CID: ${realCid})`);
-                        uploadedToNetwork = true;
-                        // Update metadata with real CID if different
-                        if (realCid !== cid) {
-                            metadata.cid = realCid;
-                            this.metadata[this.getMetadataKey(gitRepo, environment)] = metadata;
-                            await this.saveMetadata();
-                        }
-                    }
-                }
-                catch (error) {
-                    const err = error;
-                    logger.warn(`   ⚠️  IPFS upload failed: ${err.message}`);
-                }
-            }
-            // Publish to IPNS if we uploaded to the network
-            if (uploadedToNetwork && realCid && encryptionKey) {
+            // Publish to IPNS
+            if (encryptionKey) {
                 try {
                     const repoName = gitRepo || DEFAULTS.DEFAULT_ENVIRONMENT;
                     const env = environment || DEFAULTS.DEFAULT_ENVIRONMENT;
                     const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
                     const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
                     if (ipnsName) {
-                        const publishedName = await ipfsSync.publishToIPNS(realCid, keyInfo.keyName);
+                        const publishedName = await ipfsSync.publishToIPNS(cid, keyInfo.keyName);
                         if (publishedName) {
                             metadata.ipns_name = publishedName;
                             this.metadata[this.getMetadataKey(gitRepo, environment)] = metadata;
@@ -128,14 +108,11 @@ export class IPFSSecretsStorage {
                 }
                 catch (error) {
                     const err = error;
-                    logger.warn(`   ⚠️  IPNS publish failed (non-fatal): ${err.message}`);
+                    logger.error(`Content uploaded (CID: ${cid}) but IPNS publish failed: ${err.message}\n` +
+                        `Other machines won't find it via 'lsh pull' until you re-push.`);
                 }
             }
-            if (!uploadedToNetwork) {
-                logger.warn(`   📁 Secrets cached locally only (no network sync)`);
-                logger.warn(`   💡 Start IPFS daemon for network sync: lsh ipfs start`);
-            }
-            return realCid || cid;
+            return cid;
         }
         catch (error) {
             const err = error;
@@ -148,89 +125,61 @@ export class IPFSSecretsStorage {
      */
     async pull(environment, encryptionKey, gitRepo) {
         try {
-            const metadataKey = this.getMetadataKey(gitRepo, environment);
-            let metadata = this.metadata[metadataKey];
-            // Construct display name for error messages
-            const displayEnv = gitRepo
-                ? (environment ? `${gitRepo}_${environment}` : gitRepo)
-                : (environment || 'default');
-            // If no local metadata, try IPNS resolution first
-            if (!metadata && encryptionKey) {
+            const ipfsSync = getIPFSSync();
+            // Step 1: Always resolve via IPNS (source of truth)
+            let resolvedCid = null;
+            if (encryptionKey) {
                 try {
-                    const ipfsSync = getIPFSSync();
-                    if (await ipfsSync.checkDaemon()) {
-                        const repoName = gitRepo || DEFAULTS.DEFAULT_ENVIRONMENT;
-                        const env = environment || DEFAULTS.DEFAULT_ENVIRONMENT;
-                        const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
-                        const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
-                        if (ipnsName) {
-                            logger.info(`   🔍 Resolving via IPNS: ${ipnsName.substring(0, 20)}...`);
-                            const resolvedCid = await ipfsSync.resolveIPNS(ipnsName);
-                            if (resolvedCid) {
-                                logger.info(`   ✅ IPNS resolved to CID: ${resolvedCid}`);
-                                metadata = {
-                                    environment,
-                                    git_repo: gitRepo,
-                                    cid: resolvedCid,
-                                    ipns_name: ipnsName,
-                                    timestamp: new Date().toISOString(),
-                                    keys_count: 0,
-                                    encrypted: true,
-                                };
-                                this.metadata[metadataKey] = metadata;
-                                await this.saveMetadata();
-                            }
+                    const repoName = gitRepo || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const env = environment || DEFAULTS.DEFAULT_ENVIRONMENT;
+                    const keyInfo = deriveKeyInfo(encryptionKey, repoName, env);
+                    const ipnsName = await ensureKeyImported(ipfsSync.getApiUrl(), keyInfo);
+                    if (ipnsName) {
+                        logger.info(`   🔍 Resolving via IPNS: ${ipnsName.substring(0, 20)}...`);
+                        resolvedCid = await ipfsSync.resolveIPNS(ipnsName);
+                        if (resolvedCid) {
+                            logger.info(`   ✅ IPNS resolved to CID: ${resolvedCid}`);
+                            // Update local metadata
+                            const metadataKey = this.getMetadataKey(gitRepo, environment);
+                            this.metadata[metadataKey] = {
+                                environment,
+                                git_repo: gitRepo,
+                                cid: resolvedCid,
+                                ipns_name: ipnsName,
+                                timestamp: new Date().toISOString(),
+                                keys_count: 0,
+                                encrypted: true,
+                            };
+                            await this.saveMetadata();
                         }
                     }
                 }
                 catch (error) {
                     const err = error;
-                    logger.debug(`   IPNS resolution failed: ${err.message}`);
+                    logger.debug(`   IPNS resolution error: ${err.message}`);
                 }
             }
-            // If still no metadata, check IPFS sync history
-            if (!metadata && gitRepo) {
-                try {
-                    const ipfsSync = getIPFSSync();
-                    const latestCid = await ipfsSync.getLatestCid(gitRepo, environment);
-                    if (latestCid) {
-                        logger.info(`   ✅ Found secrets in IPFS history (CID: ${latestCid})`);
-                        // Create metadata from history
-                        metadata = {
-                            environment,
-                            git_repo: gitRepo,
-                            cid: latestCid,
-                            timestamp: new Date().toISOString(),
-                            keys_count: 0, // Unknown until decrypted
-                            encrypted: true,
-                        };
-                        this.metadata[metadataKey] = metadata;
-                        await this.saveMetadata();
-                    }
-                }
-                catch (error) {
-                    // History check failed, continue to error
-                    const err = error;
-                    logger.debug(`   IPFS history check failed: ${err.message}`);
-                }
-            }
-            if (!metadata) {
-                throw new Error(`No secrets found for environment: ${displayEnv}\n\n` +
-                    `💡 Tip: Check available environments with: lsh env\n` +
-                    `   Or push secrets first with: lsh push\n` +
-                    `   Or pull by CID with: lsh sync pull <cid>`);
+            // No fallback to local metadata — IPNS is the source of truth
+            if (!resolvedCid) {
+                throw new Error('Could not resolve secrets from network.\n\n' +
+                    'Possible causes:\n' +
+                    '  - The machine that pushed secrets is offline or IPFS daemon stopped\n' +
+                    '  - IPNS record hasn\'t propagated yet (try again in 30s)\n' +
+                    '  - Network connectivity issue\n' +
+                    '  - IPNS record expired from DHT (records are cached ~24-48h;\n' +
+                    '    the publishing machine must be online periodically)\n\n' +
+                    'Troubleshooting:\n' +
+                    '  lsh ipfs status    # Check local daemon\n' +
+                    '  lsh doctor         # Full health check');
             }
-            // Try to load from local cache
-            let cachedData = await this.loadLocally(metadata.cid);
-            // If not in cache, try downloading from IPFS
+            // Step 2: Load content — try cache first, then IPFS download
+            let cachedData = await this.loadLocally(resolvedCid);
             if (!cachedData) {
-                const ipfsSync = getIPFSSync();
                 try {
                     logger.info(`   🌐 Downloading from IPFS...`);
-                    const downloadedData = await ipfsSync.download(metadata.cid);
+                    const downloadedData = await ipfsSync.download(resolvedCid);
                     if (downloadedData) {
-                        // Store in local cache for future use
-                        await this.storeLocally(metadata.cid, downloadedData.toString('utf-8'), environment);
+                        await this.storeLocally(resolvedCid, downloadedData.toString('utf-8'), environment);
                         cachedData = downloadedData.toString('utf-8');
                         logger.info(`   ✅ Downloaded and cached from IPFS`);
                     }
@@ -241,14 +190,13 @@ export class IPFSSecretsStorage {
                 }
             }
             if (!cachedData) {
-                throw new Error(`Secrets not found in cache or IPFS. CID: ${metadata.cid}\n\n` +
-                    `💡 Tip: Start IPFS daemon: lsh ipfs start\n` +
-                    `   Or pull directly by CID: lsh sync pull <cid>`);
+                throw new Error(`Secrets resolved via IPNS (CID: ${resolvedCid}) but download failed.\n\n` +
+                    `💡 The source machine may be offline. Try again when it's online.`);
             }
-            // Decrypt secrets
+            // Step 3: Decrypt
             const secrets = this.decryptSecrets(cachedData, encryptionKey);
             logger.info(`📥 Retrieved ${secrets.length} secrets from IPFS`);
-            logger.info(`   CID: ${metadata.cid}`);
+            logger.info(`   CID: ${resolvedCid}`);
             logger.info(`   Environment: ${environment}`);
             return secrets;
         }
@@ -344,14 +292,6 @@ export class IPFSSecretsStorage {
             throw error;
         }
     }
-    /**
-     * Generate IPFS-compatible CID from content
-     */
-    generateCID(content) {
-        const hash = crypto.createHash('sha256').update(content).digest('hex');
-        // Format like IPFS CIDv1 (bafkreixxx...)
-        return `bafkrei${hash.substring(0, 52)}`;
-    }
     /**
      * Store encrypted data locally
      */

package/dist/lib/ipfs-sync-logger.js

@@ -64,7 +64,7 @@ export class IPFSSyncLogger {
         };
         // Use file-based storage with IPFS-like CIDs
         // Records are stored locally and can optionally be uploaded to IPFS
-        const cid = this.generateContentId(record);
+        const cid = this.generateRecordId(record);
         const repoEnv = this.getRepoEnvKey(record.git_repo, record.environment);
         // Store the record locally
         await this.storeRecordLocally(cid, record);
@@ -73,9 +73,9 @@ export class IPFSSyncLogger {
             this.syncLog[repoEnv] = [];
         }
         this.syncLog[repoEnv].push({
-            cid,
+            cid, // This is the record ID (file key), NOT the IPFS CID
             timestamp: record.timestamp,
-            url: `ipfs://${cid}`,
+            url: record.cid ? `ipfs://${record.cid}` : `lsh-record://${cid}`,
             action: record.action,
         });
         // Save sync log
@@ -138,7 +138,7 @@ export class IPFSSyncLogger {
     /**
      * Generate a content-addressed ID (like IPFS CID)
      */
-    generateContentId(record) {
+    generateRecordId(record) {
         const content = JSON.stringify(record);
         const hash = crypto.createHash('sha256').update(content).digest('hex');
         // Format like IPFS CIDv1 (bafkreixxx...)

package/dist/lib/ipfs-sync.js

@@ -346,31 +346,41 @@ export class IPFSSync {
     /**
      * Publish a CID to IPNS under the given key name.
      * The key must already be imported into Kubo.
+     * Publishes to DHT and blocks until confirmed.
+     * Retries once on failure.
      * Returns the IPNS name on success, null on failure.
      */
     async publishToIPNS(cid, keyName) {
-        try {
-            // allow-offline=true stores the record locally and returns immediately;
-            // the daemon propagates it to the DHT in the background.
-            // Without this, first publishes can take 60-90s for DHT propagation.
-            const response = await fetch(`${this.LOCAL_IPFS_API}/name/publish?arg=${cid}&key=${encodeURIComponent(keyName)}&lifetime=87600h&resolve=false&offline=true`, {
-                method: 'POST',
-                signal: AbortSignal.timeout(15000),
-            });
-            if (!response.ok) {
-                const errorText = await response.text();
-                logger.warn(`IPNS publish failed: ${errorText}`);
-                return null;
+        const url = `${this.LOCAL_IPFS_API}/name/publish?arg=${cid}&key=${encodeURIComponent(keyName)}&lifetime=87600h&resolve=false&offline=false&allow-offline=false`;
+        for (let attempt = 1; attempt <= 2; attempt++) {
+            try {
+                logger.info('📡 Publishing to IPNS (waiting for network confirmation)...');
+                const response = await fetch(url, {
+                    method: 'POST',
+                    signal: AbortSignal.timeout(120000),
+                });
+                if (!response.ok) {
+                    const errorText = await response.text();
+                    logger.warn(`IPNS publish failed (attempt ${attempt}): ${errorText}`);
+                    if (attempt === 2)
+                        return null;
+                    continue;
+                }
+                const data = await response.json();
+                logger.info(`📡 IPNS published: ${data.Name} → ${data.Value}`);
+                return data.Name;
+            }
+            catch (error) {
+                const err = error;
+                logger.warn(`IPNS publish error (attempt ${attempt}): ${err.message}`);
+                if (attempt === 2) {
+                    logger.error(`IPNS publish failed after retry. Content is uploaded (CID: ${cid}) ` +
+                        `but other machines won't find it via 'lsh pull' until you re-push.`);
+                    return null;
+                }
             }
-            const data = await response.json();
-            logger.info(`📡 IPNS published: ${data.Name} → ${data.Value}`);
-            return data.Name;
-        }
-        catch (error) {
-            const err = error;
-            logger.debug(`IPNS publish error: ${err.message}`);
-            return null;
         }
+        return null;
     }
     /**
      * Resolve an IPNS name to its current CID.

package/dist/lib/lsh-config.js

@@ -126,6 +126,13 @@ export class LshConfigManager {
     getConfigPath() {
         return this.configPath;
     }
+    getIpfsConsent() {
+        return this.config.ipfs_consent === true;
+    }
+    setIpfsConsent(value) {
+        this.config.ipfs_consent = value;
+        this.saveConfig();
+    }
 }
 // Singleton instance
 let _configManager = null;

package/dist/lib/secrets-manager.js

@@ -299,7 +299,7 @@ export class SecretsManager {
         logger.info(`✅ Pushed ${secrets.length} secrets from ${filename} to IPFS`);
         console.log(`📦 IPFS CID: ${cid}`);
         // Log to IPFS for immutable audit record
-        await this.logToIPFS('push', effectiveEnv, secrets.length);
+        await this.logToIPFS('push', effectiveEnv, secrets.length, cid);
     }
     /**
      * Pull .env from IPFS
@@ -961,7 +961,7 @@ LSH_SECRETS_KEY=${this.encryptionKey}
     /**
      * Log sync operation to IPFS for immutable record
      */
-    async logToIPFS(action, environment, keysCount) {
+    async logToIPFS(action, environment, keysCount, realCid) {
         try {
             const ipfsLogger = new IPFSSyncLogger();
             if (!ipfsLogger.isEnabled()) {
@@ -971,10 +971,13 @@ LSH_SECRETS_KEY=${this.encryptionKey}
                 action,
                 environment: this.getRepoAwareEnvironment(environment),
                 keys_count: keysCount,
+                cid: realCid,
             });
             if (cid) {
-                console.log(`📝 Recorded on IPFS: ipfs://${cid}`);
-                console.log(`   View: https://ipfs.io/ipfs/${cid}`);
+                if (realCid) {
+                    console.log(`📝 Recorded on IPFS: ipfs://${realCid}`);
+                    console.log(`   View: https://ipfs.io/ipfs/${realCid}`);
+                }
             }
         }
         catch (error) {

package/dist/services/secrets/secrets.js

@@ -8,12 +8,47 @@ import * as path from 'path';
 import * as readline from 'readline';
 import { getGitRepoInfo } from '../../lib/git-utils.js';
 import { ENV_VARS } from '../../constants/index.js';
+import { IPFSClientManager } from '../../lib/ipfs-client-manager.js';
 /**
  * Type guard to check if a string is a valid OutputFormat.
  */
 function isOutputFormat(value) {
     return ['env', 'json', 'yaml', 'toml', 'export'].includes(value);
 }
+/**
+ * Find existing LSH_SECRETS_KEY from environment, local .env, or global ~/.env
+ */
+function findExistingKey() {
+    // 1. Check environment variable
+    const envKey = process.env[ENV_VARS.LSH_SECRETS_KEY];
+    if (envKey)
+        return envKey;
+    // 2. Check local .env
+    const localEnvPath = path.join(process.cwd(), '.env');
+    const localKey = readKeyFromEnvFile(localEnvPath);
+    if (localKey)
+        return localKey;
+    // 3. Check global ~/.env
+    const globalEnvPath = path.join(process.env.HOME || '~', '.env');
+    const globalKey = readKeyFromEnvFile(globalEnvPath);
+    if (globalKey)
+        return globalKey;
+    return null;
+}
+function readKeyFromEnvFile(envPath) {
+    try {
+        if (fs.existsSync(envPath)) {
+            const content = fs.readFileSync(envPath, 'utf-8');
+            const match = content.match(/^LSH_SECRETS_KEY=['"]?([^'"\n]+)['"]?/m);
+            if (match)
+                return match[1];
+        }
+    }
+    catch {
+        // Ignore read errors
+    }
+    return null;
+}
 export async function init_secrets(program) {
     // Push secrets to cloud
     program
@@ -26,6 +61,8 @@ export async function init_secrets(program) {
         .action(async (options) => {
         const manager = new SecretsManager({ globalMode: options.global });
         try {
+            const ipfsManager = new IPFSClientManager();
+            await ipfsManager.ensureDaemonRunning();
             // Resolve file path (handles global mode)
             const filePath = manager.resolveFilePath(options.file);
             // v2.0: Use context-aware default environment
@@ -53,6 +90,8 @@ export async function init_secrets(program) {
         .action(async (options) => {
         const manager = new SecretsManager({ globalMode: options.global });
         try {
+            const ipfsManager = new IPFSClientManager();
+            await ipfsManager.ensureDaemonRunning();
             // Resolve file path (handles global mode)
             const filePath = manager.resolveFilePath(options.file);
             // v2.0: Use context-aware default environment
@@ -259,25 +298,153 @@ export async function init_secrets(program) {
             process.exit(1);
         }
     });
-    // Generate encryption key
-    program
+    // Key management command group
+    const keyCmd = program
         .command('key')
+        .description('Manage your LSH encryption key');
+    // Default action: show existing key or prompt to generate
+    keyCmd
+        .action(async () => {
+        const existingKey = findExistingKey();
+        if (existingKey) {
+            const masked = existingKey.slice(0, 8) + '...' + existingKey.slice(-4);
+            console.log(`\n🔑 LSH_SECRETS_KEY=${masked}\n`);
+            console.log('  lsh key show --no-mask    Reveal full key');
+            console.log('  lsh key generate          Generate a new key');
+            console.log('  lsh key import            Import a key from a teammate\n');
+        }
+        else {
+            console.log('\n⚠️  No encryption key found.\n');
+            console.log('  lsh key generate    Create a new key');
+            console.log('  lsh key import      Import a key from a teammate\n');
+        }
+    });
+    // lsh key show
+    keyCmd
+        .command('show')
+        .description('Display the current encryption key')
+        .option('--no-mask', 'Show the full key (default: masked)')
+        .option('--export', 'Output in export format for shell evaluation')
+        .action(async (options) => {
+        const existingKey = findExistingKey();
+        if (!existingKey) {
+            console.error('❌ No encryption key found. Run: lsh key generate');
+            process.exit(1);
+        }
+        if (options.export) {
+            console.log(`export LSH_SECRETS_KEY='${existingKey}'`);
+            return;
+        }
+        const displayKey = options.mask === false ? existingKey : existingKey.slice(0, 8) + '...' + existingKey.slice(-4);
+        console.log(`\n🔑 LSH_SECRETS_KEY=${displayKey}\n`);
+        if (options.mask !== false) {
+            console.log('💡 Use --no-mask to reveal the full key');
+        }
+        console.log('💡 Share this key securely with your team to sync secrets.');
+        console.log('    Never commit it to git!\n');
+    });
+    // lsh key generate
+    keyCmd
+        .command('generate')
         .description('Generate a new encryption key')
+        .option('--force', 'Overwrite existing key')
         .option('--export', 'Output in export format for shell evaluation')
         .action(async (options) => {
+        const existingKey = findExistingKey();
+        if (existingKey && !options.force) {
+            console.error('❌ An encryption key already exists. Use --force to overwrite.');
+            console.error('⚠️  Warning: existing secrets will NOT be decryptable with a new key.\n');
+            process.exit(1);
+        }
         const { randomBytes } = await import('crypto');
         const key = randomBytes(32).toString('hex');
         if (options.export) {
-            // Just output the export statement for eval
             console.log(`export LSH_SECRETS_KEY='${key}'`);
+            return;
         }
-        else {
-            // Interactive output with tips
-            console.log('\n🔑 New encryption key (add to your .env):\n');
-            console.log(`export LSH_SECRETS_KEY='${key}'\n`);
-            console.log('💡 Tip: Share this key securely with your team to sync secrets.');
-            console.log('    Never commit it to git!\n');
-            console.log('💡 To load immediately: eval "$(lsh key --export)"\n');
+        if (existingKey && options.force) {
+            console.log('\n⚠️  Replacing existing key. Old secrets will NOT be decryptable with this new key!\n');
+        }
+        console.log('\n🔑 New encryption key (add to your .env):\n');
+        console.log(`export LSH_SECRETS_KEY='${key}'\n`);
+        console.log('💡 Tip: Share this key securely with your team to sync secrets.');
+        console.log('    Never commit it to git!\n');
+        console.log('💡 To load immediately: eval "$(lsh key generate --export)"\n');
+    });
+    // lsh key import
+    keyCmd
+        .command('import')
+        .description('Import an encryption key from a teammate')
+        .argument('[key]', 'The encryption key to import')
+        .option('-f, --file <path>', 'Path to .env file to save to', '.env')
+        .option('-g, --global', 'Save to global ~/.env instead of local')
+        .action(async (keyArg, options) => {
+        let keyValue = keyArg;
+        // If no key argument, prompt for it
+        if (!keyValue) {
+            const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+            keyValue = await new Promise((resolve) => {
+                rl.question('🔑 Paste the encryption key: ', (answer) => {
+                    rl.close();
+                    resolve(answer.trim());
+                });
+            });
+        }
+        if (!keyValue || keyValue.length === 0) {
+            console.error('❌ No key provided.');
+            process.exit(1);
+        }
+        // Validate key format (should be 64 hex chars = 32 bytes)
+        if (!/^[0-9a-fA-F]{64}$/.test(keyValue)) {
+            console.error('❌ Invalid key format. Expected 64 hex characters (256-bit key).');
+            process.exit(1);
+        }
+        // Check for existing key
+        const existingKey = findExistingKey();
+        if (existingKey) {
+            if (existingKey === keyValue) {
+                console.log('\n✅ This key is already configured.\n');
+                return;
+            }
+            const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+            const confirm = await new Promise((resolve) => {
+                rl.question('⚠️  An existing key will be replaced. Continue? (y/N) ', (answer) => {
+                    rl.close();
+                    resolve(answer.trim().toLowerCase());
+                });
+            });
+            if (confirm !== 'y' && confirm !== 'yes') {
+                console.log('Aborted.');
+                return;
+            }
+        }
+        // Save to .env file
+        const envPath = options.global
+            ? path.join(process.env.HOME || '~', '.env')
+            : path.resolve(options.file);
+        try {
+            let content = '';
+            if (fs.existsSync(envPath)) {
+                content = fs.readFileSync(envPath, 'utf-8');
+                // Replace existing key if present
+                if (/^LSH_SECRETS_KEY=/m.test(content)) {
+                    content = content.replace(/^LSH_SECRETS_KEY=.*/m, `LSH_SECRETS_KEY=${keyValue}`);
+                }
+                else {
+                    content = content.trimEnd() + `\nLSH_SECRETS_KEY=${keyValue}\n`;
+                }
+            }
+            else {
+                content = `LSH_SECRETS_KEY=${keyValue}\n`;
+            }
+            fs.writeFileSync(envPath, content, { mode: 0o600 });
+            console.log(`\n✅ Key saved to ${envPath}\n`);
+            console.log('💡 Now pull secrets: lsh sync pull\n');
+        }
+        catch (error) {
+            const err = error;
+            console.error(`❌ Failed to save key: ${err.message}`);
+            process.exit(1);
         }
     });
     // Create .env file

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "lsh-framework",
-  "version": "3.2.2",
+  "version": "3.2.4",
   "description": "Simple, cross-platform encrypted secrets manager with automatic sync, IPFS audit logs, and multi-environment support. Just run lsh sync and start managing your secrets.",
   "main": "dist/app.js",
   "bin": {