crosscheck-cli 0.0.44 → 0.0.45

package/dist/onepassword/setup.js

@@ -0,0 +1,108 @@
+/**
+ * `crosscheck keys setup --backend 1password` — validates the config end to
+ * end BEFORE ever persisting the backend preference. Never writes anything
+ * to 1Password (the backend is read-only); a "test read" only ever proves
+ * connectivity — the value is discarded immediately, never printed, never
+ * stored.
+ */
+import { loadOnePasswordConfig, configFilePath } from "./config.js";
+import { checkOpVersion, readOpSecret, MIN_OP_VERSION } from "./op.js";
+import { enableOnePasswordBackend } from "../keychain.js";
+/**
+ * Validate config → `op` version → test-read every mapped provider.
+ * Discloses provider NAMES only, never a full op:// reference — matching
+ * the same disclosure discipline as op.ts's error taxonomy. Never touches
+ * the persisted backend preference; the caller only does that after seeing
+ * `{ ok: true }`.
+ *
+ * "Success" here means at least one mapped provider resolved — not that
+ * every one did. A single bad item/field name is a per-provider config
+ * typo the user can fix later; it shouldn't block enabling the backend for
+ * every OTHER provider that already works. A systemic problem (op missing,
+ * wrong version, or every single provider failing — usually a signed-out
+ * or invalid-token case) DOES block, since persisting a backend where
+ * nothing works at all isn't useful and would just defer the failure to
+ * the next `crosscheck serve`.
+ */
+export async function validateOnePasswordSetup() {
+    const cfg = loadOnePasswordConfig();
+    if (!cfg.ok) {
+        return {
+            ok: false,
+            stage: "config",
+            detail: `${cfg.error}: ${cfg.detail} (expected at ${configFilePath()})`,
+        };
+    }
+    const versionCheck = await checkOpVersion();
+    if (!versionCheck.ok) {
+        return { ok: false, stage: "op-version", detail: versionCheck.detail };
+    }
+    const providerNames = Object.keys(cfg.config.mappings).sort();
+    const results = [];
+    for (const provider of providerNames) {
+        const ref = cfg.config.mappings[provider];
+        const result = await readOpSecret(ref, {
+            authMode: cfg.config.authMode,
+            serviceAccountToken: cfg.config.authMode === "service-account"
+                ? process.env.OP_SERVICE_ACCOUNT_TOKEN
+                : undefined,
+        });
+        results.push(result.ok
+            ? { provider, ok: true }
+            : { provider, ok: false, error: `${result.error}: ${result.detail}` });
+    }
+    if (providerNames.length === 0) {
+        return {
+            ok: false,
+            stage: "no-providers-resolved",
+            detail: "no providers are mapped in the config — add at least one before enabling",
+            providers: results,
+        };
+    }
+    if (!results.some((r) => r.ok)) {
+        return {
+            ok: false,
+            stage: "no-providers-resolved",
+            detail: "no configured provider resolved successfully",
+            providers: results,
+        };
+    }
+    return { ok: true, authMode: cfg.config.authMode, providers: results };
+}
+function printProviderResults(results) {
+    for (const p of results) {
+        process.stdout.write(p.ok ? `  ✓ ${p.provider}\n` : `  ✗ ${p.provider}: ${p.error}\n`);
+    }
+}
+/** Orchestrates `crosscheck keys setup --backend 1password`: validate, then
+ *  (only on success) persist the preference and report what's usable. */
+export async function runOnePasswordKeysSetup() {
+    process.stdout.write("\nValidating your 1Password configuration...\n");
+    const result = await validateOnePasswordSetup();
+    if (!result.ok) {
+        process.stderr.write(`\n✗ ${result.detail}\n`);
+        if (result.stage === "config") {
+            process.stderr.write(`\nExpected a config at ${configFilePath()} shaped like:\n` +
+                '  {\n    "authMode": "desktop",\n    "mappings": { "anthropic": "op://Vault/Item/field" }\n  }\n' +
+                '\n(authMode is "desktop" or "service-account"; for service-account mode, set\n' +
+                "OP_SERVICE_ACCOUNT_TOKEN in the environment — never store it in this file.)\n");
+        }
+        if (result.stage === "op-version") {
+            process.stderr.write(`\nRequires the 1Password CLI (\`op\`), version >= ${MIN_OP_VERSION}.\n`);
+        }
+        if (result.providers)
+            printProviderResults(result.providers);
+        process.stderr.write("\nFix the above, then re-run `crosscheck keys setup --backend 1password`.\n\n");
+        process.exitCode = 1;
+        return;
+    }
+    enableOnePasswordBackend();
+    process.stdout.write(`\n✓ 1Password backend enabled (authMode: ${result.authMode}).\n\n`);
+    printProviderResults(result.providers);
+    process.stdout.write("\nMachine-local secrets (activation, HMAC signing key) still use the local\n" +
+        "encrypted file, unchanged — only providers marked ✓ above are read from\n" +
+        "1Password. Anything else (including a ✗ above) falls back to whatever's\n" +
+        "already stored locally, if anything.\n\n" +
+        "Run `crosscheck doctor` any time to recheck this.\n\n");
+}
+//# sourceMappingURL=setup.js.map

package/dist/onepassword/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/onepassword/setup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AACnF,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAa1D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,iBAAiB,cAAc,EAAE,GAAG;SACxE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACrC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ;YAC7B,mBAAmB,EACjB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,iBAAiB;gBACvC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBACtC,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,EAAE;YACP,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE;YACxB,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,0EAA0E;YAClF,SAAS,EAAE,OAAO;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,8CAA8C;YACtD,SAAS,EAAE,OAAO;SACnB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA8B;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED;yEACyE;AACzE,MAAM,CAAC,KAAK,UAAU,uBAAuB;IAC3C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAEhD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,cAAc,EAAE,iBAAiB;gBACzD,kGAAkG;gBAClG,gFAAgF;gBAChF,+EAA+E,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,cAAc,KAAK,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS;YAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+EAA+E,CAChF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,wBAAwB,EAAE,CAAC;IAE3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,QAAQ,CAAC,CAAC;IAC1F,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8EAA8E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,0CAA0C;QAC1C,uDAAuD,CAC1D,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crosscheck-cli",
-  "version": "0.0.44",
+  "version": "0.0.45",
   "description": "Crosscheck — multi-LLM orchestration MCP for the terminal. Single-machine activation, BYO upstream LLM keys, content-free telemetry. Installs into Claude Code in one command.",
   "license": "SEE LICENSE.md",
   "type": "module",