archondev 2.19.1 → 2.19.2

package/README.md

@@ -133,6 +133,13 @@ pnpm exec tsx scripts/init-governance-db.ts
 
 No subscriptions. No commitments. Start free, upgrade anytime with `archon upgrade`.
 
+### BYOK Key Security
+
+- Your API keys are stored locally in `~/.archon/keys.json` (never uploaded to ArchonDev servers).
+- Keys are encrypted at rest with AES-256-GCM and the file is set to owner-only permissions (`0600`).
+- BYOK runs locally; cloud execution is Credits-only.
+- If your device is compromised, an attacker could access local files. Treat keys as sensitive secrets.
+
 ### Claude Pro/Max Subscription Support (Coming Soon)
 
 If you have an existing Claude subscription, you'll soon be able to use it with ArchonDev instead of API keys:

package/dist/{auth-HQBAG4CR.js → auth-7DNVC6UX.js}

@@ -2,9 +2,9 @@ import {
   login,
   logout,
   status
-} from "./chunk-CZCY63EY.js";
+} from "./chunk-F4OUCZPN.js";
 import "./chunk-M4LGRTLC.js";
-import "./chunk-LBBHM4I5.js";
+import "./chunk-GBYW3YAY.js";
 import "./chunk-SVU7MLG6.js";
 import "./chunk-4VNS5WPM.js";
 export {

package/dist/{chunk-ZJXIOETW.js → chunk-CTWVQ6F3.js}

@@ -14,7 +14,7 @@ import {
 } from "./chunk-RDG5BUED.js";
 import {
   login
-} from "./chunk-CZCY63EY.js";
+} from "./chunk-F4OUCZPN.js";
 import {
   getApiUrl,
   getAuthToken,
@@ -1071,7 +1071,7 @@ async function manageApiKeys() {
     if (removeIndex >= 0 && removeIndex < providers.length) {
       const providerToRemove = providers[removeIndex];
       if (providerToRemove) {
-        const { removeKey } = await import("./keys-U4QZE5YB.js");
+        const { removeKey } = await import("./keys-T2VPHE7Z.js");
         await removeKey(providerToRemove);
       }
     }
@@ -1079,7 +1079,7 @@ async function manageApiKeys() {
   }
   const provider = providerMap[choice];
   if (provider) {
-    const { addKey } = await import("./keys-U4QZE5YB.js");
+    const { addKey } = await import("./keys-T2VPHE7Z.js");
     await addKey(provider);
   }
 }

package/dist/{chunk-CZCY63EY.js → chunk-F4OUCZPN.js}

@@ -6,7 +6,7 @@ import {
   handleTierSetup,
   promptTierSelection,
   updateUserTier
-} from "./chunk-LBBHM4I5.js";
+} from "./chunk-GBYW3YAY.js";
 import {
   clearConfig,
   loadConfig,

package/dist/{chunk-LBBHM4I5.js → chunk-GBYW3YAY.js}

@@ -43,7 +43,7 @@ async function offerReauthentication(reason) {
     return false;
   }
   console.log();
-  const { login } = await import("./auth-HQBAG4CR.js");
+  const { login } = await import("./auth-7DNVC6UX.js");
   await login({ skipTierSelection: true });
   const { loadConfig: reload } = await import("./config-JBPM2YAB.js");
   const config = await reload();
@@ -207,7 +207,7 @@ async function promptForApiKey() {
       return;
   }
   if (provider) {
-    const { addKey } = await import("./keys-U4QZE5YB.js");
+    const { addKey } = await import("./keys-T2VPHE7Z.js");
     await addKey(provider, {});
     console.log();
     const addAnother = await promptYesNo("Would you like to add another API key?", false);
@@ -455,7 +455,7 @@ function promptYesNo(question, defaultValue) {
 }
 async function showKeyManagementMenu() {
   const { keyManager } = await import("./keys-THCHXIFD.js");
-  const { listKeys, addKey, removeKey } = await import("./keys-U4QZE5YB.js");
+  const { listKeys, addKey, removeKey } = await import("./keys-T2VPHE7Z.js");
   console.log();
   console.log(chalk.bold("API Key Management"));
   console.log(chalk.dim("\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501"));

package/dist/{chunk-75J2JMU3.js → chunk-JNFXMWBR.js}

@@ -47,6 +47,10 @@ async function addKey(provider, options = {}) {
     process.exit(1);
   }
   const label = options.label ?? "default";
+  console.log(chalk.dim("Security: Your API key stays on this machine (never uploaded)."));
+  console.log(chalk.dim("  \u2022 Encrypted at rest (AES-256-GCM)"));
+  console.log(chalk.dim("  \u2022 Stored in ~/.archon/keys.json with owner-only permissions (0600)"));
+  console.log(chalk.dim("  \u2022 Used only for local BYOK calls"));
   const apiKey = await promptForKey(provider);
   if (!apiKey) {
     console.error(chalk.red("API key cannot be empty"));

package/dist/index.js

@@ -27,7 +27,7 @@ import {
   setPreference,
   showExecutionPreferences,
   showPreferences
-} from "./chunk-ZJXIOETW.js";
+} from "./chunk-CTWVQ6F3.js";
 import {
   a11yBadge,
   a11yCheck,
@@ -85,14 +85,14 @@ import {
   listKeys,
   removeKey,
   setPrimaryKey
-} from "./chunk-75J2JMU3.js";
+} from "./chunk-JNFXMWBR.js";
 import "./chunk-TFSHS7EN.js";
 import "./chunk-RDG5BUED.js";
 import {
   login,
   logout,
   status
-} from "./chunk-CZCY63EY.js";
+} from "./chunk-F4OUCZPN.js";
 import {
   API_URL,
   SUPABASE_ANON_KEY,
@@ -102,7 +102,7 @@ import {
   handleTierSetup,
   promptTierSelection,
   updateUserTier
-} from "./chunk-LBBHM4I5.js";
+} from "./chunk-GBYW3YAY.js";
 import {
   getAuthToken,
   loadConfig,
@@ -2850,22 +2850,22 @@ async function start(options = {}) {
       const choice = await promptWithCommands("What would you like to do?", { allowMultiline: true });
       switch (choice) {
         case "1":
-          const { handleTierSetup: handleTierSetup2 } = await import("./tier-selection-426HA765.js");
+          const { handleTierSetup: handleTierSetup2 } = await import("./tier-selection-XFBM4SZ4.js");
           await handleTierSetup2("BYOK");
           break;
         case "2":
-          const { updateUserTier: updateUserTier2 } = await import("./tier-selection-426HA765.js");
+          const { updateUserTier: updateUserTier2 } = await import("./tier-selection-XFBM4SZ4.js");
           const result = await updateUserTier2("CREDITS");
           if (result.success) {
             config.tier = "CREDITS";
             await saveConfig(config);
             console.log(chalk6.green("\u2713 Switched to Managed Plan"));
-            const { handleTierSetup: setupCredits } = await import("./tier-selection-426HA765.js");
+            const { handleTierSetup: setupCredits } = await import("./tier-selection-XFBM4SZ4.js");
             await setupCredits("CREDITS");
           }
           break;
         case "3":
-          const { updateUserTier: downgrade } = await import("./tier-selection-426HA765.js");
+          const { updateUserTier: downgrade } = await import("./tier-selection-XFBM4SZ4.js");
           const downgradeResult = await downgrade("FREE");
           if (downgradeResult.success) {
             config.tier = "FREE";
@@ -3788,7 +3788,7 @@ async function showMainMenu() {
     } }] : [],
     { key: "7", label: "Settings & Preferences", action: () => settingsMenu() },
     { key: "8", label: "Upgrade tier", action: async () => {
-      const { showUpgradeMenu } = await import("./tier-selection-426HA765.js");
+      const { showUpgradeMenu } = await import("./tier-selection-XFBM4SZ4.js");
       await showUpgradeMenu();
       await showMainMenu();
     } },
@@ -3840,7 +3840,7 @@ async function listAtoms() {
 async function executeNext() {
   const { listLocalAtoms: listLocalAtoms2 } = await import("./plan-HCYXLSSD.js");
   const { analyzeProject, getComplexityDescription, getModeDescription } = await import("./orchestration-HIF3KP25.js");
-  const { loadExecutionPreferences } = await import("./preferences-I6WETXOI.js");
+  const { loadExecutionPreferences } = await import("./preferences-OAOZCZGR.js");
   const cwd = process.cwd();
   const atoms = await listLocalAtoms2();
   const pendingAtoms = atoms.filter((a) => a.status === "READY" || a.status === "IN_PROGRESS");
@@ -3935,11 +3935,11 @@ async function reportBug() {
   }
 }
 async function viewStatus() {
-  const { status: status2 } = await import("./auth-HQBAG4CR.js");
+  const { status: status2 } = await import("./auth-7DNVC6UX.js");
   await status2();
 }
 async function settingsMenu() {
-  const { interactiveSettings } = await import("./preferences-I6WETXOI.js");
+  const { interactiveSettings } = await import("./preferences-OAOZCZGR.js");
   await interactiveSettings();
   await showMainMenu();
 }
@@ -3998,12 +3998,12 @@ async function reviewCode() {
 async function handleInSessionCommand(input) {
   const normalized = input.toLowerCase().trim();
   if (normalized === "upgrade" || normalized === "archon upgrade" || normalized === "pricing" || normalized === "archon pricing") {
-    const { showUpgradeMenu } = await import("./tier-selection-426HA765.js");
+    const { showUpgradeMenu } = await import("./tier-selection-XFBM4SZ4.js");
     await showUpgradeMenu();
     return true;
   }
   if (normalized === "status" || normalized === "archon status") {
-    const { status: status2 } = await import("./auth-HQBAG4CR.js");
+    const { status: status2 } = await import("./auth-7DNVC6UX.js");
     await status2();
     return true;
   }
@@ -4019,7 +4019,7 @@ async function handleInSessionCommand(input) {
     return true;
   }
   if (normalized === "keys" || normalized === "archon keys") {
-    const { listKeys: listKeys2 } = await import("./keys-U4QZE5YB.js");
+    const { listKeys: listKeys2 } = await import("./keys-T2VPHE7Z.js");
     await listKeys2();
     return true;
   }
@@ -8175,11 +8175,11 @@ program.command("status").description("Show current user and project status").ac
   await status();
 });
 program.command("upgrade").description("Upgrade your tier (BYOK for free unlimited, or Managed plan)").action(async () => {
-  const { showUpgradeMenu } = await import("./tier-selection-426HA765.js");
+  const { showUpgradeMenu } = await import("./tier-selection-XFBM4SZ4.js");
   await showUpgradeMenu();
 });
 program.command("pricing", { hidden: true }).action(async () => {
-  const { showUpgradeMenu } = await import("./tier-selection-426HA765.js");
+  const { showUpgradeMenu } = await import("./tier-selection-XFBM4SZ4.js");
   await showUpgradeMenu();
 });
 program.command("init").description("Initialize ArchonDev in current project").option("--analyze", "Run enhanced analysis of codebase").option("--no-git", "Skip git initialization").action(async (options) => {

package/dist/{keys-U4QZE5YB.js → keys-T2VPHE7Z.js}

@@ -3,7 +3,7 @@ import {
   listKeys,
   removeKey,
   setPrimaryKey
-} from "./chunk-75J2JMU3.js";
+} from "./chunk-JNFXMWBR.js";
 import "./chunk-TFSHS7EN.js";
 import "./chunk-RDG5BUED.js";
 import "./chunk-SVU7MLG6.js";

package/dist/{preferences-I6WETXOI.js → preferences-OAOZCZGR.js}

@@ -7,13 +7,13 @@ import {
   setPreference,
   showExecutionPreferences,
   showPreferences
-} from "./chunk-ZJXIOETW.js";
+} from "./chunk-CTWVQ6F3.js";
 import "./chunk-UFR2LX6G.js";
 import "./chunk-TFSHS7EN.js";
 import "./chunk-RDG5BUED.js";
-import "./chunk-CZCY63EY.js";
+import "./chunk-F4OUCZPN.js";
 import "./chunk-M4LGRTLC.js";
-import "./chunk-LBBHM4I5.js";
+import "./chunk-GBYW3YAY.js";
 import "./chunk-SVU7MLG6.js";
 import "./chunk-4VNS5WPM.js";
 export {

package/dist/{tier-selection-426HA765.js → tier-selection-XFBM4SZ4.js}

@@ -4,7 +4,7 @@ import {
   showTierSwitchMenu,
   showUpgradeMenu,
   updateUserTier
-} from "./chunk-LBBHM4I5.js";
+} from "./chunk-GBYW3YAY.js";
 import "./chunk-SVU7MLG6.js";
 import "./chunk-4VNS5WPM.js";
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "archondev",
-  "version": "2.19.1",
+  "version": "2.19.2",
   "description": "Local-first AI-powered development governance system",
   "main": "dist/index.js",
   "bin": {