@withone/cli 2.9.1 → 2.9.2

package/README.md

@@ -50,10 +50,14 @@ one logout             # Clear credentials (with scope picker and confirmation)
 
 The browser consent page names the key and tags it with where this CLI is installed (scope, project path, machine, OS user, CLI version, chosen harnesses, and the per-install device id unless telemetry is off) so you can find and revoke it from Settings → API keys. The terminal prints exactly what will be sent before the browser opens.
 
-Requires Node.js 18+. `one sync` additionally needs Node 20+, because its
-local SQLite engine (`better-sqlite3`, an optional dependency) ships prebuilt
-binaries only for Node 20 and above. On Node 18 every other command works
-normally; `one sync` reports that the engine isn't installed.
+Requires Node.js 22.23.4+, 24.22.1+ or 26.12.1+. Older Node versions trust the
+compromised eMudhra intermediate CA certificates (October 2026), so a network
+attacker could intercept the CLI's traffic and your API key. On them the CLI
+refuses to run and prints the command that updates Node for how you installed
+it. Node 18, 20, 23 and 25 are end-of-life and never got the fix.
+
+If you can't update Node yet, `ONE_ALLOW_UNPATCHED_NODE=1` runs the CLI anyway,
+with a security warning on every run. You remain exposed while it is set.
 
 ## Quick start
 

package/bin/cli.js

@@ -1,5 +1,11 @@
 #!/usr/bin/env node
 
-import { program } from '../dist/index.js';
+import { requirePatchedNode } from '../dist/node-check.js';
+
+// eMudhra CA compromise: refuse to run before any connection opens on a Node
+// that still trusts the leaked intermediates (see src/node-check.ts).
+requirePatchedNode();
+
+const { program } = await import('../dist/index.js');
 
 program.parse();

package/dist/chunk-FYTWXGPJ.js

@@ -0,0 +1,79 @@
+// src/node-check.ts
+var FIXED_IN = {
+  22: [23, 4],
+  24: [22, 1],
+  26: [12, 1]
+};
+var FIRST_LINE_WITH_FIX = 27;
+var RECOMMENDED_LINE = 24;
+var REQUIRED_NODE = "22.23.4+, 24.22.1+ or 26.12.1+";
+var REQUIRED_NODE_RANGE = "^22.23.4 || ^24.22.1 || >=26.12.1";
+var ALLOW_UNPATCHED_ENV = "ONE_ALLOW_UNPATCHED_NODE";
+function parseVersion(version) {
+  const [major, minor, patch] = version.split(".").map((part) => Number.parseInt(part, 10));
+  return [major, minor, patch ?? 0];
+}
+function nodeHasTlsFix(version = process.versions.node) {
+  const [major, minor, patch] = parseVersion(version);
+  if (!Number.isFinite(major)) return false;
+  if (major >= FIRST_LINE_WITH_FIX) return true;
+  const fixed = FIXED_IN[major];
+  if (!fixed) return false;
+  const [fixedMinor, fixedPatch] = fixed;
+  return minor > fixedMinor || minor === fixedMinor && patch >= fixedPatch;
+}
+function upgradeCommand(version = process.versions.node, execPath = process.execPath) {
+  const [major] = parseVersion(version);
+  const line = FIXED_IN[major] ? major : RECOMMENDED_LINE;
+  const path = execPath.replace(/\\/g, "/");
+  if (/\/\.nvm\/versions\/node\//.test(path)) return `nvm install ${line} && nvm alias default ${line}`;
+  if (/\/AppData\/(Roaming|Local)\/nvm\//i.test(path)) return `nvm install ${line} && nvm use ${line}`;
+  if (/\/\.?volta\//i.test(path)) return `volta install node@${line}`;
+  if (/fnm/i.test(path)) return `fnm install ${line} && fnm default ${line}`;
+  const brew = path.match(/\/Cellar\/(node(?:@\d+)?)\//);
+  if (brew) {
+    const formula = brew[1] === "node" || FIXED_IN[major] ? brew[1] : `node@${line}`;
+    return formula === brew[1] ? `brew upgrade ${formula}` : `brew install ${formula}`;
+  }
+  return `download Node.js ${line} from https://nodejs.org`;
+}
+function unpatchedNodeMessage(version = process.versions.node) {
+  return `Node.js v${version} trusts the compromised eMudhra certificates, so a network attacker could intercept One's traffic and your API key. The One CLI requires Node.js ${REQUIRED_NODE} (Node 18, 20, 23 and 25 never got the fix).`;
+}
+function requirePatchedNode() {
+  if (nodeHasTlsFix()) return;
+  const message = unpatchedNodeMessage();
+  const upgrade = upgradeCommand();
+  const agent = process.argv.includes("--agent") || process.env.ONE_AGENT === "1";
+  if (process.env[ALLOW_UNPATCHED_ENV] === "1") {
+    if (!agent) process.stderr.write(`Warning: ${message} Running anyway because ${ALLOW_UNPATCHED_ENV}=1.
+`);
+    return;
+  }
+  if (agent) {
+    const error = {
+      error: `${message} Ask the user to update Node.js: ${upgrade}`,
+      code: "NODE_UPGRADE_REQUIRED",
+      currentNode: process.versions.node,
+      requiredNode: REQUIRED_NODE_RANGE,
+      upgrade
+    };
+    process.stdout.write(`${JSON.stringify(error)}
+`);
+  } else {
+    process.stderr.write(`Error: ${message}
+To update: ${upgrade}
+`);
+  }
+  process.exit(1);
+}
+
+export {
+  REQUIRED_NODE,
+  REQUIRED_NODE_RANGE,
+  ALLOW_UNPATCHED_ENV,
+  nodeHasTlsFix,
+  upgradeCommand,
+  unpatchedNodeMessage,
+  requirePatchedNode
+};

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 import { Command } from 'commander';
+export { nodeHasTlsFix } from './node-check.js';
 
 declare const program: Command;
 

package/dist/index.js

@@ -1,3 +1,6 @@
+import {
+  nodeHasTlsFix
+} from "./chunk-FYTWXGPJ.js";
 import {
   ApiError,
   FLOW_SCHEMA,
@@ -10917,6 +10920,7 @@ Request specific sections:
 - **Always use \`--agent\` flag** for structured JSON output
 - Platform names are **lowercase**; multi-word names use dashes (e.g., \`hubspot\`, \`google-calendar\`)
 - Always use the **exact action ID** from a find answer \u2014 don't guess
+- Requires Node.js 22.23.4+, 24.22.1+ or 26.12.1+. Older Node trusts the compromised eMudhra CA certificates, so every command exits 1 there with \`"code": "NODE_UPGRADE_REQUIRED"\` and an \`upgrade\` field holding the command for the user's setup. Don't retry: show the user that command and ask them to update Node.js
 - Always read **knowledge** before executing any action
 - Connection keys come from \`one connection list\` \u2014 don't hardcode them
 - \`connection list\` also reports an \`access\` field per connection (\`full\` / \`methods\` / \`actions\`, plus a \`level\`: full, read-write, read-only, custom, none) \u2014 what One enforces for this key, narrowed by \`one config\`. Read it before planning so you don't propose an action that will be refused. \`accessSource: "local"\` means One did not report it, so it is unverified
@@ -13441,5 +13445,6 @@ program.command("list").alias("ls").description("Shortcut for: connection list")
   await connectionListCommand(options);
 });
 export {
+  nodeHasTlsFix,
   program
 };

package/dist/node-check.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Refuses to run on a Node.js that still trusts the compromised eMudhra
+ * intermediate CAs (October 2026, RUSTSEC-2026-0381).
+ *
+ * Eight eMudhra/emSign intermediates were created with 8-bit private keys, so
+ * anyone can compute them and sign a certificate for any domain, including
+ * api.withone.ai. Node.js blocks them inside the TLS handshake from 22.23.4,
+ * 24.22.1 and 26.12.1 (nodejs/node#66871). On any older Node, a network
+ * attacker can intercept the CLI's traffic and the user's API key, and nothing
+ * in userland can block the intermediates the way Node's fix does.
+ *
+ * Built as its own entry so bin/cli.js can run it before loading the rest of
+ * the CLI, and before any connection opens.
+ */
+declare const REQUIRED_NODE = "22.23.4+, 24.22.1+ or 26.12.1+";
+declare const REQUIRED_NODE_RANGE = "^22.23.4 || ^24.22.1 || >=26.12.1";
+/** Set to 1 to run on an unpatched Node anyway, with a warning on every run. */
+declare const ALLOW_UNPATCHED_ENV = "ONE_ALLOW_UNPATCHED_NODE";
+/** True when this Node version rejects chains through the compromised eMudhra intermediates. */
+declare function nodeHasTlsFix(version?: string): boolean;
+/**
+ * The command that updates Node for however it was installed, judged from the
+ * path of the running binary. A line that got the fix stays on its line; any
+ * other moves to the recommended one.
+ */
+declare function upgradeCommand(version?: string, execPath?: string): string;
+declare function unpatchedNodeMessage(version?: string): string;
+/**
+ * Exits with an error on an unpatched Node; returns on a patched one. In agent
+ * mode the error is JSON on stdout with a code agents can act on. With
+ * ONE_ALLOW_UNPATCHED_NODE=1 it warns and returns instead (silently in agent
+ * mode, where stderr would corrupt the JSON for harnesses that merge streams).
+ */
+declare function requirePatchedNode(): void;
+
+export { ALLOW_UNPATCHED_ENV, REQUIRED_NODE, REQUIRED_NODE_RANGE, nodeHasTlsFix, requirePatchedNode, unpatchedNodeMessage, upgradeCommand };

package/dist/node-check.js

@@ -0,0 +1,18 @@
+import {
+  ALLOW_UNPATCHED_ENV,
+  REQUIRED_NODE,
+  REQUIRED_NODE_RANGE,
+  nodeHasTlsFix,
+  requirePatchedNode,
+  unpatchedNodeMessage,
+  upgradeCommand
+} from "./chunk-FYTWXGPJ.js";
+export {
+  ALLOW_UNPATCHED_ENV,
+  REQUIRED_NODE,
+  REQUIRED_NODE_RANGE,
+  nodeHasTlsFix,
+  requirePatchedNode,
+  unpatchedNodeMessage,
+  upgradeCommand
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withone/cli",
-  "version": "2.9.1",
+  "version": "2.9.2",
   "description": "CLI for managing One",
   "type": "module",
   "files": [
@@ -52,6 +52,6 @@
     "url": "https://github.com/withoneai/cli"
   },
   "engines": {
-    "node": ">=18"
+    "node": "^22.23.4 || ^24.22.1 || >=26.12.1"
   }
 }

package/skills/one/SKILL.md

@@ -171,6 +171,8 @@ All segments are validated before any execution. Failed actions don't block othe
 
 All errors return JSON: `{"error": "message"}`. Parse output as JSON and check for the `error` key.
 
+The CLI requires Node.js 22.23.4+, 24.22.1+ or 26.12.1+ (older Node trusts the compromised eMudhra CA certificates). On an older Node every command exits 1 with `"code": "NODE_UPGRADE_REQUIRED"` and an `upgrade` field holding the command for the user's setup. Don't retry: show the user that command and ask them to update Node.js.
+
 ## Important Rules
 
 - Always use `--agent` flag for structured JSON output