fujin-cli 0.22.0__tar.gz → 0.22.2__tar.gz

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 
 This project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.22.2] - 2026-03-21
+
+### 🐛 Bug Fixes
+
+- Handle pre-existing group when creating app user
+
+## [0.22.1] - 2026-03-21
+
+### 🐛 Bug Fixes
+
+- Use native ssh auth first when needed
+
 ## [0.22.0] - 2026-03-20
 
 ### 🚀 Features

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: fujin-cli
-Version: 0.22.0
+Version: 0.22.2
 Summary: Get your project up and running in a few minutes on your own vps.
 Project-URL: Documentation, https://github.com/Tobi-De/fujin#readme
 Project-URL: Issues, https://github.com/Tobi-De/fujin/issues

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/plugins/fujin-secrets-1password/pyproject.toml

@@ -4,7 +4,7 @@ requires = [ "uv-build>=0.9.18,<0.10" ]
 
 [project]
 name = "fujin-secrets-1password"
-version = "0.22.0"
+version = "0.22.2"
 description = "1Password secret adapter for Fujin"
 readme = "README.md"
 authors = [
@@ -20,7 +20,7 @@ classifiers = [
   "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
-  "fujin-cli>=0.22",
+  "fujin-cli>=0.22.2",
   "python-dotenv>=1.0.1",
 ]
 

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/plugins/fujin-secrets-bitwarden/pyproject.toml

@@ -4,7 +4,7 @@ requires = [ "uv-build>=0.9.18,<0.10" ]
 
 [project]
 name = "fujin-secrets-bitwarden"
-version = "0.22.0"
+version = "0.22.2"
 description = "Bitwarden secret adapter for Fujin"
 readme = "README.md"
 authors = [
@@ -20,7 +20,7 @@ classifiers = [
   "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
-  "fujin-cli>=0.22",
+  "fujin-cli>=0.22.2",
   "python-dotenv>=1.0.1",
 ]
 

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/plugins/fujin-secrets-doppler/pyproject.toml

@@ -4,7 +4,7 @@ requires = [ "uv-build>=0.9.18,<0.10" ]
 
 [project]
 name = "fujin-secrets-doppler"
-version = "0.22.0"
+version = "0.22.2"
 description = "Doppler secret adapter for Fujin"
 readme = "README.md"
 authors = [
@@ -20,7 +20,7 @@ classifiers = [
   "Programming Language :: Python :: 3.14",
 ]
 dependencies = [
-  "fujin-cli>=0.22",
+  "fujin-cli>=0.22.2",
   "python-dotenv>=1.0.1",
 ]
 

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/pyproject.toml

@@ -5,7 +5,7 @@ requires = [ "hatchling" ]
 
 [project]
 name = "fujin-cli"
-version = "0.22.0"
+version = "0.22.2"
 description = "Get your project up and running in a few minutes on your own vps."
 readme = "README.md"
 keywords = [
@@ -149,7 +149,7 @@ markers = [
 ]
 
 [tool.bumpversion]
-current_version = "0.22.0"
+current_version = "0.22.2"
 parse = "(?P<major>\\d+)\\.(?P<minor>\\d+)\\.(?P<patch>\\d+)"
 serialize = [ "{major}.{minor}.{patch}" ]
 search = "{current_version}"

fujin_cli-0.22.2/src/fujin/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.22.2"

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/src/fujin/_installer.py

@@ -118,9 +118,15 @@ def install(
         logger.debug("User %s already exists", config.app_user)
     except KeyError:
         logger.debug("Creating system user: %s", config.app_user)
-        run(
-            f"useradd --system --no-create-home --shell /usr/sbin/nologin {config.app_user}",
-        )
+        # Check if group already exists (e.g., from a previous partial install)
+        try:
+            grp.getgrnam(config.app_user)
+            # Group exists, use it instead of creating a new one
+            useradd_cmd = f"useradd --system --no-create-home --shell /usr/sbin/nologin --no-user-group -g {config.app_user} {config.app_user}"
+        except KeyError:
+            # No existing group, let useradd create one
+            useradd_cmd = f"useradd --system --no-create-home --shell /usr/sbin/nologin {config.app_user}"
+        run(useradd_cmd, check=True)
 
     app_dir = Path(config.app_dir)
     app_dir.mkdir(parents=True, exist_ok=True)

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/src/fujin/config.py

@@ -212,6 +212,7 @@ class HostConfig(msgspec.Struct, kw_only=True):
     port: int = 22
     _key_filename: str | None = msgspec.field(name="key_filename", default=None)
     key_passphrase_env: str | None = None
+    native_ssh_auth: bool = False  # Use native ssh for auth (for Tailscale, etc.)
 
     def __post_init__(self):
         if self._env_file and self.env_content:

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/src/fujin/connection.py

@@ -344,8 +344,34 @@ def connection(host: HostConfig) -> Generator[SSH2Connection, None, None]:
     auth_methods_tried = []
     authenticated = False
 
+    # For hosts that require native SSH auth (Tailscale, etc.), authenticate via ssh first
+    if host.native_ssh_auth:
+        logger.info("Using native SSH for authentication...")
+        ssh_cmd = [
+            "ssh",
+            "-p",
+            str(host.port),
+            "-o",
+            "StrictHostKeyChecking=accept-new",
+            f"{host.user}@{host.address}",
+            "exit",
+        ]
+        result = subprocess.run(ssh_cmd)
+        if result.returncode == 0:
+            # Reconnect after successful auth - session is now authorized
+            sock.close()
+            sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
+            sock.settimeout(30)
+            sock.connect((host.address, host.port))
+            sock.settimeout(None)
+            sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
+            session = Session()
+            session.handshake(sock)
+            auth_methods_tried.append("native ssh")
+            # Continue to normal auth methods below (they should work now)
+
     # Method 1: Explicit key file (if specified)
-    if host.key_filename:
+    if not authenticated and host.key_filename:
         try:
             key_path = Path(host.key_filename).expanduser()
             logger.debug(f"Trying explicit key: {key_path}")
@@ -416,46 +442,6 @@ def connection(host: HostConfig) -> Generator[SSH2Connection, None, None]:
             logger.debug(f"Password auth failed: {e}")
             auth_methods_tried.append("password (failed)")
 
-    # Method 5: Keyboard-interactive via native SSH (for Tailscale, etc.)
-    if not authenticated:
-        try:
-            available_methods = session.userauth_list(host.user)
-            if available_methods and "keyboard-interactive" in available_methods:
-                logger.info(
-                    "Trying keyboard-interactive auth via native SSH (Tailscale, etc.)..."
-                )
-                # Spawn native ssh to handle interactive auth (shows URL, waits for browser)
-                ssh_cmd = [
-                    "ssh",
-                    "-p",
-                    str(host.port),
-                    "-o",
-                    "StrictHostKeyChecking=accept-new",
-                    f"{host.user}@{host.address}",
-                    "exit",
-                ]
-                result = subprocess.run(ssh_cmd)
-                if result.returncode == 0:
-                    # Auth succeeded via native SSH, retry with ssh2-python
-                    # Need to create a new session since the old one may be in a bad state
-                    sock.close()
-                    sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
-                    sock.settimeout(30)
-                    sock.connect((host.address, host.port))
-                    sock.settimeout(None)
-                    sock.setsockopt(socket.IPPROTO_TCP, socket.TCP_NODELAY, 1)
-                    session = Session()
-                    session.handshake(sock)
-                    # Retry agent auth (Tailscale adds credentials to agent after browser auth)
-                    session.agent_auth(host.user)
-                    authenticated = session.userauth_authenticated()
-                    if authenticated:
-                        logger.info("✓ Authenticated after keyboard-interactive flow")
-                    auth_methods_tried.append("keyboard-interactive (native ssh)")
-        except Exception as e:
-            logger.debug(f"Keyboard-interactive auth failed: {e}")
-            auth_methods_tried.append("keyboard-interactive (failed)")
-
     if not authenticated:
         sock.close()
         methods_str = ", ".join(auth_methods_tried) if auth_methods_tried else "none"

{fujin_cli-0.22.0 → fujin_cli-0.22.2}/uv.lock

@@ -336,7 +336,7 @@ name = "exceptiongroup"
 version = "1.3.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
-    { name = "typing-extensions", marker = "python_full_version < '3.12'" },
+    { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
 sdist = { url = "https://files.pythonhosted.org/packages/50/79/66800aadf48771f6b62f7eb014e352e5d06856655206165d775e675a02c9/exceptiongroup-1.3.1.tar.gz", hash = "sha256:8b412432c6055b0b7d14c310000ae93352ed6754f70fa8f7c34141f91c4e3219", size = 30371, upload-time = "2025-11-21T23:01:54.787Z" }
 wheels = [
@@ -345,7 +345,7 @@ wheels = [
 
 [[package]]
 name = "fujin-cli"
-version = "0.21.4"
+version = "0.22.0"
 source = { editable = "." }
 dependencies = [
     { name = "cappa" },
@@ -401,7 +401,7 @@ docs = [
 
 [[package]]
 name = "fujin-secrets-1password"
-version = "0.21.4"
+version = "0.22.0"
 source = { editable = "plugins/fujin-secrets-1password" }
 dependencies = [
     { name = "fujin-cli" },
@@ -416,7 +416,7 @@ requires-dist = [
 
 [[package]]
 name = "fujin-secrets-bitwarden"
-version = "0.21.4"
+version = "0.22.0"
 source = { editable = "plugins/fujin-secrets-bitwarden" }
 dependencies = [
     { name = "fujin-cli" },
@@ -431,7 +431,7 @@ requires-dist = [
 
 [[package]]
 name = "fujin-secrets-doppler"
-version = "0.21.4"
+version = "0.22.0"
 source = { editable = "plugins/fujin-secrets-doppler" }
 dependencies = [
     { name = "fujin-cli" },

fujin_cli-0.22.0/src/fujin/__init__.py

@@ -1 +0,0 @@
-__version__ = "0.22.0"