spinuptui 0.22.0 → 0.22.2

package/CHANGELOG.md

@@ -11,6 +11,25 @@ versions; such changes are called out here.
 
 ## [Unreleased]
 
+## [0.22.2] - 2026-07-13
+
+### Fixed
+- **A failed "Remember in macOS Keychain" save no longer fails silently.** If the
+  Keychain write fails (e.g. a locked login keychain — the underlying `security`
+  command needs it unlocked first), the sudo connection itself still succeeds,
+  but the "Sudo connected" panel now shows the real reason as a warning instead
+  of silently reverting to "kept in memory only, never saved."
+
+## [0.22.1] - 2026-07-13
+
+### Fixed
+- **`K` (grant/revoke SSH key) is discoverable again.** The v0.22.0 Control-strip
+  rebuild dropped it from both Site Control and Server Control's action lists —
+  the keybinding itself kept working, but you had to already know it existed.
+  It's back in Site Control's Remote group and Server Control's Access group,
+  and now also works from the Servers pane (falling back to the server's first
+  key-eligible site), matching how `S`/`h` already work from either pane.
+
 ## [0.22.0] - 2026-07-13
 
 ### Added
@@ -1166,7 +1185,9 @@ Initial tagged release.
 ### Notes
 - Read-only release: works with a SpinupWP **Read Only** API token.
 
-[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.22.0...HEAD
+[Unreleased]: https://github.com/mwender/spinupwp-tui/compare/v0.22.2...HEAD
+[0.22.2]: https://github.com/mwender/spinupwp-tui/compare/v0.22.1...v0.22.2
+[0.22.1]: https://github.com/mwender/spinupwp-tui/compare/v0.22.0...v0.22.1
 [0.22.0]: https://github.com/mwender/spinupwp-tui/compare/v0.21.2...v0.22.0
 [0.21.2]: https://github.com/mwender/spinupwp-tui/compare/v0.21.1...v0.21.2
 [0.21.1]: https://github.com/mwender/spinupwp-tui/compare/v0.21.0...v0.21.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spinuptui",
-  "version": "0.22.0",
+  "version": "0.22.2",
   "description": "SpinupTUI — a terminal dashboard for browsing, monitoring, and managing your SpinupWP servers and sites.",
   "type": "module",
   "bin": {

package/src/lib/keychain.ts

@@ -27,11 +27,20 @@ async function security(args: string[]): Promise<{ ok: boolean; stdout: string;
   }
 }
 
-// Store (or update) a server's sudo password. Returns false off macOS / on failure.
-export async function setSudoPassword(serverId: number, password: string): Promise<boolean> {
-  if (!keychainAvailable()) return false
+export interface KeychainWriteResult {
+  ok: boolean
+  // `security`'s own error line (e.g. "User interaction is not allowed." when the
+  // login keychain is locked) — set whenever ok is false and on macOS, so the
+  // caller can show the real reason instead of a silent no-op.
+  error?: string
+}
+
+// Store (or update) a server's sudo password. ok:false off macOS / on failure.
+export async function setSudoPassword(serverId: number, password: string): Promise<KeychainWriteResult> {
+  if (!keychainAvailable()) return { ok: false }
   const r = await security(["add-generic-password", "-U", "-s", SERVICE, "-a", account(serverId), "-w", password])
-  return r.ok
+  if (r.ok) return { ok: true }
+  return { ok: false, error: r.stderr.trim().replace(/^security:\s*/, "") || "the Keychain write failed" }
 }
 
 // Retrieve a server's sudo password, or null if absent / denied / off macOS. The first

package/src/ui/Details.tsx

@@ -106,7 +106,7 @@ function serverControlGroups(
 // Labels stay terse and avoid repeating their group's title — see siteGroups().
 export const SERVER_CONTROL: ActionGroup[] = [
   { title: "Clone", items: [["C", "Clone →"]] },
-  { title: "Access", items: [["S", "Sudo"]] },
+  { title: "Access", items: [["S", "Sudo"], ["K", "Grant SSH key"]] },
   {
     title: "Manage",
     items: [

package/src/ui/components.tsx

@@ -436,6 +436,7 @@ export function ControlPanel({ heading, groups, layout = "list" }: { heading: st
 export function siteGroups(isWordpress: boolean, localSync: boolean, isVanity: boolean): ActionGroup[] {
   const remote: [string, string][] = [
     ["s", "SSH"],
+    ["K", "Grant SSH key"],
     ["n", "DNS"],
   ]
   if (isWordpress) {

package/src/ui/store.tsx

@@ -649,8 +649,8 @@ interface StoreValue extends DataState {
   sudoConnectServer: Server | null
   setSudoConnectServer: (s: Server | null) => void
   isSudoConnected: (serverId: number) => boolean
-  connectSudo: (server: Server, user: string, password: string, remember?: boolean) => Promise<{ ok: true } | { ok: false; error: string }>
-  connectSudoFromKeychain: (server: Server) => Promise<{ ok: true } | { ok: false; error: string }>
+  connectSudo: (server: Server, user: string, password: string, remember?: boolean) => Promise<{ ok: true; keychainError?: string } | { ok: false; error: string }>
+  connectSudoFromKeychain: (server: Server) => Promise<{ ok: true; keychainError?: string } | { ok: false; error: string }>
   disconnectSudo: (serverId: number) => void
   sudoSavedFor: (serverId: number) => boolean // a sudo password is saved in the Keychain
   forgetSudoKeychain: (serverId: number) => Promise<void>
@@ -1783,17 +1783,21 @@ export function StoreProvider({ children }: { children: ReactNode }) {
   // (opt-in, macOS) the password into the Keychain. `remember` toggles Keychain
   // storage — unchecking it on a server that had one saved removes it.
   const finishConnect = useCallback(
-    async (server: Server, sudoUser: string, password: string, remember: boolean) => {
+    async (server: Server, sudoUser: string, password: string, remember: boolean): Promise<{ keychainError?: string }> => {
       sudoPwRef.current.set(server.id, password)
       setSudoConnected((prev) => new Set(prev).add(server.id))
       const users = new Map(sudoUsers).set(server.id, sudoUser)
       setSudoUsers(users)
       let saved = sudoSaved
+      let keychainError: string | undefined
       if (keychainAvailable()) {
         if (remember && !sudoSaved.has(server.id)) {
-          if (await setSudoPassword(server.id, password)) saved = new Set(sudoSaved).add(server.id)
+          const r = await setSudoPassword(server.id, password)
+          if (r.ok) saved = new Set(sudoSaved).add(server.id)
+          else keychainError = r.error
         } else if (remember && sudoSaved.has(server.id)) {
-          await setSudoPassword(server.id, password) // refresh in case the password changed
+          const r = await setSudoPassword(server.id, password) // refresh in case the password changed
+          if (!r.ok) keychainError = r.error
         } else if (!remember && sudoSaved.has(server.id)) {
           await deleteSudoPassword(server.id)
           saved = new Set(sudoSaved)
@@ -1802,6 +1806,7 @@ export function StoreProvider({ children }: { children: ReactNode }) {
         if (saved !== sudoSaved) setSudoSaved(saved)
       }
       persistSudoMeta(users, saved)
+      return { keychainError }
     },
     [sudoUsers, sudoSaved, persistSudoMeta],
   )
@@ -1810,13 +1815,13 @@ export function StoreProvider({ children }: { children: ReactNode }) {
   // connected, hold the password in memory, persist the username, and optionally save
   // the password to the Keychain. Returns the verify result so the overlay shows pass/fail.
   const connectSudo = useCallback(
-    async (server: Server, user: string, password: string, remember = false): Promise<{ ok: true } | { ok: false; error: string }> => {
+    async (server: Server, user: string, password: string, remember = false): Promise<{ ok: true; keychainError?: string } | { ok: false; error: string }> => {
       const sudoUser = user.trim()
       if (!sudoUser) return { ok: false, error: "Enter a sudo username." }
       const res = await verifySudo(server, { sudoUser, sudoPassword: password })
       if (!res.ok) return res
-      await finishConnect(server, sudoUser, password, remember)
-      return { ok: true }
+      const { keychainError } = await finishConnect(server, sudoUser, password, remember)
+      return { ok: true, keychainError }
     },
     [finishConnect],
   )
@@ -1824,15 +1829,15 @@ export function StoreProvider({ children }: { children: ReactNode }) {
   // Auto-connect from the Keychain (the `S` overlay calls this on open when a password
   // is saved). Retrieve → verify → connect, all without prompting for the password.
   const connectSudoFromKeychain = useCallback(
-    async (server: Server): Promise<{ ok: true } | { ok: false; error: string }> => {
+    async (server: Server): Promise<{ ok: true; keychainError?: string } | { ok: false; error: string }> => {
       const sudoUser = sudoUsers.get(server.id)
       if (!sudoUser) return { ok: false, error: "No saved sudo user for this server." }
       const password = await getSudoPassword(server.id)
       if (password == null) return { ok: false, error: "Couldn't read the saved password from the Keychain." }
       const res = await verifySudo(server, { sudoUser, sudoPassword: password })
       if (!res.ok) return res
-      await finishConnect(server, sudoUser, password, true)
-      return { ok: true }
+      const { keychainError } = await finishConnect(server, sudoUser, password, true)
+      return { ok: true, keychainError }
     },
     [sudoUsers, finishConnect],
   )

package/src/ui/views/Browser.tsx

@@ -128,12 +128,17 @@ export function Browser({ rows }: { rows: number }) {
         }
         return
       }
-      case "K":
-        // Grant Spinup's machine key to the selected site over SSH (privileged
-        // write via the server's sudo user — the API can't do this). Capital K
-        // (like L/V/N) since lowercase k is the vim "move up" binding.
-        if (focus === "sites" && sites[siteIndex]) setGrantKeySite(sites[siteIndex])
+      case "K": {
+        // Grant Spinup's machine key to a site over SSH (privileged write via the
+        // server's sudo user — the API can't do this). Capital K (like L/V/N)
+        // since lowercase k is the vim "move up" binding. Site-anchored (the
+        // overlay itself picks the scope: just this site, or every site on the
+        // server) but works from either pane like S/h — the Servers pane falls
+        // back to the server's first key-eligible site as the anchor.
+        const anchor = focus === "sites" ? sites[siteIndex] : server ? sitesForServer(server.id).find((s) => s.site_user) : undefined
+        if (anchor) setGrantKeySite(anchor)
         return
+      }
       case "L":
         // Link / view the selected site's local working copy (Phase 1).
         if (focus === "sites" && sites[siteIndex]) setLocalLinkSite(sites[siteIndex])

package/src/ui/views/SudoConnect.tsx

@@ -46,6 +46,9 @@ export function SudoConnect() {
   const [pwInput, setPwInput] = useState("")
   const [remember, setRemember] = useState(saved) // keep the box checked for already-saved servers
   const [error, setError] = useState<string | null>(null)
+  // Sudo itself connected fine, but "Remember in Keychain" silently failed (e.g. a
+  // locked login keychain) — distinct from `error`, which blocks the connection.
+  const [keychainWarning, setKeychainWarning] = useState<string | null>(null)
 
   // Auto-unlock from the Keychain once, when we open on a saved server.
   const unlockTried = useRef(false)
@@ -53,8 +56,10 @@ export function SudoConnect() {
     if (unlockTried.current || phase !== "unlocking" || !server) return
     unlockTried.current = true
     void connectSudoFromKeychain(server).then((res) => {
-      if (res.ok) setPhase("connected")
-      else {
+      if (res.ok) {
+        setKeychainWarning(res.keychainError ?? null)
+        setPhase("connected")
+      } else {
         setError(`Keychain unlock failed: ${res.error}`)
         setUserInput(savedUser ?? "")
         setField("password")
@@ -84,9 +89,11 @@ export function SudoConnect() {
       setPwInput("") // don't keep the secret in component state past the attempt
       if (res.ok) {
         setError(null)
+        setKeychainWarning(res.keychainError ?? null)
         setPhase("connected")
       } else {
         setError(res.error)
+        setKeychainWarning(null)
         setPhase("error")
       }
     })
@@ -99,6 +106,7 @@ export function SudoConnect() {
     if (phase === "connected") {
       if ((name === "x" || name === "d") && server) {
         disconnectSudo(server.id)
+        setKeychainWarning(null)
         // Saved in the Keychain → drop the session but offer a no-password
         // reconnect instead of making them re-type a password we already hold.
         if (saved && keychainAvailable) return setPhase("reconnect")
@@ -211,7 +219,13 @@ export function SudoConnect() {
             <text content="Privileged actions on this server run for the rest of this" fg={theme.textDim} wrapMode="none" />
             <text content="session — press K on a site to grant SpinupTUI's SSH key." fg={theme.textDim} wrapMode="none" />
             <box style={{ height: 1 }} />
-            {saved ? (
+            {keychainWarning ? (
+              <>
+                <text content={`⚠ Couldn't save to the Keychain: ${keychainWarning}`} fg={theme.warn} wrapMode="none" />
+                <text content="Connected for this session only — check whether your login" fg={theme.textFaint} wrapMode="none" />
+                <text content="keychain is locked, then reconnect." fg={theme.textFaint} wrapMode="none" />
+              </>
+            ) : saved ? (
               <>
                 <text content="Saved in the macOS Keychain — sudo unlocks automatically" fg={theme.textFaint} wrapMode="none" />
                 <text content="next time you open this server. Press f to forget it." fg={theme.textFaint} wrapMode="none" />