crosscheck-cli 0.0.44 → 0.0.46

package/dist/onepassword/op.js

@@ -0,0 +1,254 @@
+/**
+ * The `op` CLI runner — the only place this backend ever executes anything.
+ * Security checkpoint (see docs/onepassword-security.md): argv construction,
+ * environment policy, timeouts/cleanup, output caps, and the error taxonomy
+ * all live here.
+ *
+ * Hard rules:
+ *   - spawn() only, never a shell. Fixed argv shape, no user-controlled flags.
+ *   - The reference is re-validated here even though config.ts already
+ *     validated it on load — defense in depth, not redundancy for its own
+ *     sake, since this is the last checkpoint before anything reaches argv.
+ *   - Resolved secret values, tokens, and full op:// references never reach
+ *     a log, an error message, or telemetry. Errors carry category +
+ *     remediation + provider-agnostic detail only.
+ *   - Fail closed: any ambiguity (unparseable version, unmatched stderr,
+ *     unexpected exit) becomes a generic "unknown" error, never a pass.
+ */
+import { spawn } from "node:child_process";
+import { parseOpReference } from "./reference.js";
+const DEFAULT_OP_BIN = "op";
+// Best-effort minimum — 1Password CLI v2 added desktop-app integration and
+// service-account support well before this version. NEEDS EMPIRICAL
+// VERIFICATION against a real `op` install before relying on it as a hard
+// gate in production (see docs/onepassword-security.md's open items).
+export const MIN_OP_VERSION = "2.18.0";
+const DESKTOP_TIMEOUT_MS = 120_000; // interactive: biometric/hardware-key prompts can't be rushed
+const SERVICE_ACCOUNT_TIMEOUT_MS = 10_000; // non-interactive: a hang means misconfiguration
+const VERSION_CHECK_TIMEOUT_MS = 10_000;
+const GRACE_MS = 2_000; // SIGTERM -> grace -> SIGKILL
+const MAX_OUTPUT_BYTES = 64 * 1024; // generous for a single secret value or short error text
+// Env vars `op` itself recognizes for service-account/Connect auth. Stripped
+// from a desktop-mode child regardless of what the parent process happens to
+// have set — a stray token in someone's shell must never silently switch
+// which identity the child authenticates as.
+const OP_AUTH_ENV_VARS = ["OP_SERVICE_ACCOUNT_TOKEN", "OP_CONNECT_HOST", "OP_CONNECT_TOKEN"];
+function runOpProcess(opBin, args, opts) {
+    return new Promise((resolve, reject) => {
+        let stdout = "";
+        let stderr = "";
+        let stdoutBytes = 0;
+        let stderrBytes = 0;
+        let outputTooLarge = false;
+        let timedOut = false;
+        let killedForOverflow = false;
+        let graceTimer;
+        let settled = false;
+        const child = spawn(opBin, args, {
+            env: opts.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            shell: false,
+        });
+        const timeoutTimer = setTimeout(() => {
+            timedOut = true;
+            child.kill("SIGTERM");
+            graceTimer = setTimeout(() => {
+                try {
+                    child.kill("SIGKILL");
+                }
+                catch {
+                    /* already gone */
+                }
+            }, GRACE_MS);
+        }, opts.timeoutMs);
+        function checkOverflow() {
+            if (outputTooLarge || killedForOverflow)
+                return;
+            if (stdoutBytes + stderrBytes > MAX_OUTPUT_BYTES) {
+                outputTooLarge = true;
+                killedForOverflow = true;
+                child.kill("SIGTERM");
+            }
+        }
+        child.stdout.on("data", (chunk) => {
+            stdoutBytes += chunk.length;
+            if (stdoutBytes <= MAX_OUTPUT_BYTES)
+                stdout += chunk.toString("utf8");
+            checkOverflow();
+        });
+        child.stderr.on("data", (chunk) => {
+            stderrBytes += chunk.length;
+            if (stderrBytes <= MAX_OUTPUT_BYTES)
+                stderr += chunk.toString("utf8");
+            checkOverflow();
+        });
+        child.on("error", (err) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutTimer);
+            if (graceTimer)
+                clearTimeout(graceTimer);
+            reject(err);
+        });
+        child.on("close", (code, signal) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timeoutTimer);
+            if (graceTimer)
+                clearTimeout(graceTimer);
+            resolve({ code, signal, stdout, stderr, timedOut, outputTooLarge });
+        });
+    });
+}
+function parseVersion(v) {
+    const m = /^(\d+)\.(\d+)\.(\d+)/.exec(v.trim());
+    if (!m)
+        return null;
+    return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+function isVersionAtLeast(actual, minimum) {
+    const a = parseVersion(actual);
+    const b = parseVersion(minimum);
+    if (!a || !b)
+        return false; // fail closed on an unparseable version string
+    for (let i = 0; i < 3; i += 1) {
+        if (a[i] > b[i])
+            return true;
+        if (a[i] < b[i])
+            return false;
+    }
+    return true; // equal
+}
+export async function checkOpVersion(opts = {}) {
+    const opBin = opts.opBin ?? DEFAULT_OP_BIN;
+    let result;
+    try {
+        result = await runOpProcess(opBin, ["--version"], {
+            env: process.env,
+            timeoutMs: VERSION_CHECK_TIMEOUT_MS,
+        });
+    }
+    catch (e) {
+        const err = e;
+        if (err.code === "ENOENT") {
+            return { ok: false, error: "not-installed", detail: `\`${opBin}\` was not found on PATH` };
+        }
+        return { ok: false, error: "unknown", detail: "could not determine the installed op version" };
+    }
+    if (result.code !== 0 || result.timedOut) {
+        return { ok: false, error: "unknown", detail: "`op --version` did not exit cleanly" };
+    }
+    const version = result.stdout.trim();
+    if (!isVersionAtLeast(version, MIN_OP_VERSION)) {
+        return {
+            ok: false,
+            error: "wrong-version",
+            detail: `op ${version || "(unknown)"} is older than the minimum supported ${MIN_OP_VERSION} — upgrade the 1Password CLI`,
+        };
+    }
+    return { ok: true, version };
+}
+/** Env vars 1Password's desktop-IPC auth needs vary by platform and haven't
+ *  been empirically verified across all of them (see docs/onepassword-
+ *  security.md). Until that verification lands, desktop mode uses
+ *  inherited-env-minus-auth-vars rather than a tighter allowlist — safe
+ *  (auth vars are still stripped) but not yet as narrow as the target. */
+function buildChildEnv(opts) {
+    const env = { ...process.env };
+    for (const key of OP_AUTH_ENV_VARS)
+        delete env[key];
+    if (opts.authMode === "service-account") {
+        env["OP_SERVICE_ACCOUNT_TOKEN"] = opts.serviceAccountToken;
+    }
+    return env;
+}
+function classifyOpFailure(stderr, authMode) {
+    const s = stderr.toLowerCase();
+    if (s.includes("not currently signed in") || s.includes("not signed in") || s.includes("sign in")) {
+        return {
+            ok: false,
+            error: "not-signed-in",
+            detail: authMode === "desktop"
+                ? "unlock prompt unanswered or desktop app unreachable — if running headless, configure service-account mode"
+                : "check that the service-account token is valid and not expired",
+        };
+    }
+    if (s.includes("access denied") || s.includes("forbidden") || s.includes("permission")) {
+        return {
+            ok: false,
+            error: "access-denied",
+            detail: "the authenticated identity does not have access to this item",
+        };
+    }
+    if (s.includes("could not find") ||
+        s.includes("not found") ||
+        s.includes("no such") ||
+        s.includes("isn't a vault") ||
+        s.includes("isn't an item")) {
+        return {
+            ok: false,
+            error: "item-or-field-missing",
+            detail: "the referenced vault, item, or field was not found",
+        };
+    }
+    // Conservative catch-all: never surface raw stderr — it could echo back
+    // parts of the reference, item names, or unrelated system paths.
+    return {
+        ok: false,
+        error: "unknown",
+        detail: "op exited with an error — run `op read <ref>` manually to see the full message",
+    };
+}
+/**
+ * Read one secret value from 1Password. Re-validates `refInput` itself
+ * (never trusts a caller's prior validation), never falls back to any other
+ * source on failure, and never lets a resolved value, token, or reference
+ * reach the returned error on the failure path.
+ */
+export async function readOpSecret(refInput, opts) {
+    const parsed = parseOpReference(refInput);
+    if (!parsed.ok) {
+        return { ok: false, error: "malformed-reference", detail: parsed.detail };
+    }
+    if (opts.authMode === "service-account" && !opts.serviceAccountToken) {
+        return { ok: false, error: "token-missing", detail: "service-account mode requires a token" };
+    }
+    const opBin = opts.opBin ?? DEFAULT_OP_BIN;
+    const versionCheck = await checkOpVersion({ opBin });
+    if (!versionCheck.ok)
+        return versionCheck;
+    const env = buildChildEnv(opts);
+    const timeoutMs = opts.authMode === "desktop" ? DESKTOP_TIMEOUT_MS : SERVICE_ACCOUNT_TIMEOUT_MS;
+    let result;
+    try {
+        result = await runOpProcess(opBin, ["read", parsed.ref], { env, timeoutMs });
+    }
+    catch (e) {
+        const err = e;
+        if (err.code === "ENOENT") {
+            return { ok: false, error: "not-installed", detail: `\`${opBin}\` was not found on PATH` };
+        }
+        return { ok: false, error: "unknown", detail: "failed to launch the op process" };
+    }
+    if (result.outputTooLarge) {
+        return {
+            ok: false,
+            error: "output-too-large",
+            detail: `op output exceeded ${MAX_OUTPUT_BYTES} bytes`,
+        };
+    }
+    if (result.timedOut) {
+        return { ok: false, error: "timeout", detail: `op did not respond within ${timeoutMs}ms` };
+    }
+    if (result.code !== 0) {
+        return classifyOpFailure(result.stderr, opts.authMode);
+    }
+    const value = result.stdout.replace(/\r?\n$/, "");
+    if (value.length === 0) {
+        return { ok: false, error: "empty-value", detail: "op returned an empty value" };
+    }
+    return { ok: true, value };
+}
+//# sourceMappingURL=op.js.map

package/dist/onepassword/op.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"op.js","sourceRoot":"","sources":["../../src/onepassword/op.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,MAAM,cAAc,GAAG,IAAI,CAAC;AAE5B,2EAA2E;AAC3E,oEAAoE;AACpE,0EAA0E;AAC1E,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAG,QAAQ,CAAC;AAEvC,MAAM,kBAAkB,GAAG,OAAO,CAAC,CAAC,8DAA8D;AAClG,MAAM,0BAA0B,GAAG,MAAM,CAAC,CAAC,iDAAiD;AAC5F,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,8BAA8B;AACtD,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,yDAAyD;AAE7F,6EAA6E;AAC7E,6EAA6E;AAC7E,yEAAyE;AACzE,6CAA6C;AAC7C,MAAM,gBAAgB,GAAG,CAAC,0BAA0B,EAAE,iBAAiB,EAAE,kBAAkB,CAAC,CAAC;AAyC7F,SAAS,YAAY,CACnB,KAAa,EACb,IAAc,EACd,IAAmD;IAEnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,IAAI,cAAc,GAAG,KAAK,CAAC;QAC3B,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,iBAAiB,GAAG,KAAK,CAAC;QAC9B,IAAI,UAAsC,CAAC;QAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/B,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;YACjC,KAAK,EAAE,KAAK;SACb,CAAC,CAAC;QAEH,MAAM,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE;YACnC,QAAQ,GAAG,IAAI,CAAC;YAChB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACtB,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;gBAC3B,IAAI,CAAC;oBACH,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;gBAAC,MAAM,CAAC;oBACP,kBAAkB;gBACpB,CAAC;YACH,CAAC,EAAE,QAAQ,CAAC,CAAC;QACf,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAEnB,SAAS,aAAa;YACpB,IAAI,cAAc,IAAI,iBAAiB;gBAAE,OAAO;YAChD,IAAI,WAAW,GAAG,WAAW,GAAG,gBAAgB,EAAE,CAAC;gBACjD,cAAc,GAAG,IAAI,CAAC;gBACtB,iBAAiB,GAAG,IAAI,CAAC;gBACzB,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,IAAI,WAAW,IAAI,gBAAgB;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtE,aAAa,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACxC,WAAW,IAAI,KAAK,CAAC,MAAM,CAAC;YAC5B,IAAI,WAAW,IAAI,gBAAgB;gBAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACtE,aAAa,EAAE,CAAC;QAClB,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3B,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACzC,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YACjC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3B,IAAI,UAAU;gBAAE,YAAY,CAAC,UAAU,CAAC,CAAC;YACzC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,OAAe;IACvD,MAAM,CAAC,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,+CAA+C;IAC3E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE;YAAE,OAAO,IAAI,CAAC;QAC/B,IAAI,CAAC,CAAC,CAAC,CAAE,GAAG,CAAC,CAAC,CAAC,CAAE;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,QAAQ;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA2B,EAAE;IAChE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC,WAAW,CAAC,EAAE;YAChD,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAA0B,CAAC;QACvC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,KAAK,0BAA0B,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,8CAA8C,EAAE,CAAC;IACjG,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,cAAc,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,MAAM,OAAO,IAAI,WAAW,wCAAwC,cAAc,8BAA8B;SACzH,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED;;;;0EAI0E;AAC1E,SAAS,aAAa,CAAC,IAAqB;IAC1C,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,gBAAgB;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,IAAI,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;QACxC,GAAG,CAAC,0BAA0B,CAAC,GAAG,IAAI,CAAC,mBAAoB,CAAC;IAC9D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc,EAAE,QAAkB;IAC3D,MAAM,CAAC,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IAC/B,IAAI,CAAC,CAAC,QAAQ,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClG,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe;YACtB,MAAM,EACJ,QAAQ,KAAK,SAAS;gBACpB,CAAC,CAAC,2GAA2G;gBAC7G,CAAC,CAAC,+DAA+D;SACtE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QACvF,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,eAAe;YACtB,MAAM,EAAE,8DAA8D;SACvE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,CAAC,QAAQ,CAAC,gBAAgB,CAAC;QAC5B,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;QACvB,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC;QAC3B,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,EAC3B,CAAC;QACD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,oDAAoD;SAC7D,CAAC;IACJ,CAAC;IACD,wEAAwE;IACxE,iEAAiE;IACjE,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,gFAAgF;KACzF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB,EAAE,IAAqB;IACxE,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,IAAI,CAAC,QAAQ,KAAK,iBAAiB,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,uCAAuC,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,cAAc,CAAC;IAC3C,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,YAAY,CAAC,EAAE;QAAE,OAAO,YAAY,CAAC;IAE1C,MAAM,GAAG,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,0BAA0B,CAAC;IAEhG,IAAI,MAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,CAA0B,CAAC;QACvC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,KAAK,KAAK,0BAA0B,EAAE,CAAC;QAC7F,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;IACpF,CAAC;IAED,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,kBAAkB;YACzB,MAAM,EAAE,sBAAsB,gBAAgB,QAAQ;SACvD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,6BAA6B,SAAS,IAAI,EAAE,CAAC;IAC7F,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,iBAAiB,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC"}

package/dist/onepassword/reference.js

@@ -0,0 +1,82 @@
+/**
+ * Strict parser/validator for 1Password secret references (`op://vault/item/field`).
+ *
+ * v1 supports only the plain 3-segment form — no optional `section` segment.
+ * Keeping the grammar minimal keeps this file (and its test surface) small,
+ * which matters because it's the first of two defense-in-depth checkpoints
+ * against CWE-78: op.ts (PR 2) re-validates immediately before spawning `op`,
+ * but rejecting anything that isn't a clean `op://...` string here means a
+ * malformed/hostile config value never gets far enough to be a runner
+ * concern. Anything not starting with the literal "op://" prefix also can't
+ * be mistaken for a flag by `op`'s own argument parser, since it's always
+ * passed as a single argv element via execFile — never a shell.
+ */
+const OP_URI_PREFIX = "op://";
+const MAX_REF_LENGTH = 512;
+// Conservative allowlist per segment. Real op:// references are plain
+// vault/item/field names — never shell metacharacters or control
+// characters. Tighten or loosen only against a verified real `op` binary
+// (see PR 2's empirical env/argv matrix), not by inspection alone.
+const SEGMENT_CHARS = /^[A-Za-z0-9 _.'-]+$/;
+export function parseOpReference(input) {
+    if (typeof input !== "string" || input.length === 0) {
+        return { ok: false, error: "empty", detail: "reference is empty" };
+    }
+    if (input.length > MAX_REF_LENGTH) {
+        return {
+            ok: false,
+            error: "too-long",
+            detail: `reference exceeds ${MAX_REF_LENGTH} characters`,
+        };
+    }
+    // eslint-disable-next-line no-control-regex
+    if (/[\x00-\x1f\x7f]/.test(input)) {
+        return {
+            ok: false,
+            error: "control-characters",
+            detail: "reference contains control characters",
+        };
+    }
+    if (input.includes("?") || input.includes("#")) {
+        return {
+            ok: false,
+            error: "query-or-fragment",
+            detail: "reference must not contain '?' or '#'",
+        };
+    }
+    if (!input.startsWith(OP_URI_PREFIX)) {
+        return {
+            ok: false,
+            error: "missing-prefix",
+            detail: `reference must start with "${OP_URI_PREFIX}"`,
+        };
+    }
+    const rest = input.slice(OP_URI_PREFIX.length);
+    const segments = rest.split("/");
+    if (segments.length !== 3) {
+        return {
+            ok: false,
+            error: "wrong-segment-count",
+            detail: `expected exactly 3 segments (vault/item/field), got ${segments.length}`,
+        };
+    }
+    const [vault, item, field] = segments;
+    for (const seg of [vault, item, field]) {
+        if (seg.length === 0) {
+            return {
+                ok: false,
+                error: "empty-segment",
+                detail: "vault/item/field segments must not be empty",
+            };
+        }
+        if (!SEGMENT_CHARS.test(seg)) {
+            return {
+                ok: false,
+                error: "invalid-characters",
+                detail: "segments may only contain letters, digits, spaces, and . _ - '",
+            };
+        }
+    }
+    return { ok: true, ref: input, vault, item, field };
+}
+//# sourceMappingURL=reference.js.map

package/dist/onepassword/reference.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reference.js","sourceRoot":"","sources":["../../src/onepassword/reference.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,MAAM,aAAa,GAAG,OAAO,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,sEAAsE;AACtE,iEAAiE;AACjE,yEAAyE;AACzE,mEAAmE;AACnE,MAAM,aAAa,GAAG,qBAAqB,CAAC;AAgB5C,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,UAAU;YACjB,MAAM,EAAE,qBAAqB,cAAc,aAAa;SACzD,CAAC;IACJ,CAAC;IACD,4CAA4C;IAC5C,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,oBAAoB;YAC3B,MAAM,EAAE,uCAAuC;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,mBAAmB;YAC1B,MAAM,EAAE,uCAAuC;SAChD,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACrC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,gBAAgB;YACvB,MAAM,EAAE,8BAA8B,aAAa,GAAG;SACvD,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,qBAAqB;YAC5B,MAAM,EAAE,uDAAuD,QAAQ,CAAC,MAAM,EAAE;SACjF,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,GAAG,QAAoC,CAAC;IAClE,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,eAAe;gBACtB,MAAM,EAAE,6CAA6C;aACtD,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,oBAAoB;gBAC3B,MAAM,EAAE,gEAAgE;aACzE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,KAAoB,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACrE,CAAC"}

package/dist/onepassword/setup.js

@@ -0,0 +1,150 @@
+/**
+ * `crosscheck keys setup --backend 1password` — validates the config end to
+ * end BEFORE ever persisting the backend preference. Never writes anything
+ * to 1Password (the backend is read-only); a "test read" only ever proves
+ * connectivity — the value is discarded immediately, never printed, never
+ * stored.
+ */
+import { loadOnePasswordConfig, writeOnePasswordConfig, configFilePath } from "./config.js";
+import { checkOpVersion, readOpSecret, MIN_OP_VERSION } from "./op.js";
+import { captureOnePasswordConfigViaBrowser } from "./browser-flow.js";
+import { enableOnePasswordBackend } from "../keychain.js";
+import { SUPPORTED_PROVIDERS } from "../keys-browser-flow.js";
+/**
+ * Validate config → `op` version → test-read every mapped provider.
+ * Discloses provider NAMES only, never a full op:// reference — matching
+ * the same disclosure discipline as op.ts's error taxonomy. Never touches
+ * the persisted backend preference; the caller only does that after seeing
+ * `{ ok: true }`.
+ *
+ * "Success" here means at least one mapped provider resolved — not that
+ * every one did. A single bad item/field name is a per-provider config
+ * typo the user can fix later; it shouldn't block enabling the backend for
+ * every OTHER provider that already works. A systemic problem (op missing,
+ * wrong version, or every single provider failing — usually a signed-out
+ * or invalid-token case) DOES block, since persisting a backend where
+ * nothing works at all isn't useful and would just defer the failure to
+ * the next `crosscheck serve`.
+ */
+export async function validateOnePasswordSetup() {
+    const cfg = loadOnePasswordConfig();
+    if (!cfg.ok) {
+        return {
+            ok: false,
+            stage: "config",
+            detail: `${cfg.error}: ${cfg.detail} (expected at ${configFilePath()})`,
+        };
+    }
+    const versionCheck = await checkOpVersion();
+    if (!versionCheck.ok) {
+        return { ok: false, stage: "op-version", detail: versionCheck.detail };
+    }
+    const providerNames = Object.keys(cfg.config.mappings).sort();
+    const results = [];
+    for (const provider of providerNames) {
+        const ref = cfg.config.mappings[provider];
+        const result = await readOpSecret(ref, {
+            authMode: cfg.config.authMode,
+            serviceAccountToken: cfg.config.authMode === "service-account"
+                ? process.env.OP_SERVICE_ACCOUNT_TOKEN
+                : undefined,
+        });
+        results.push(result.ok
+            ? { provider, ok: true }
+            : { provider, ok: false, error: `${result.error}: ${result.detail}` });
+    }
+    if (providerNames.length === 0) {
+        return {
+            ok: false,
+            stage: "no-providers-resolved",
+            detail: "no providers are mapped in the config — add at least one before enabling",
+            providers: results,
+        };
+    }
+    if (!results.some((r) => r.ok)) {
+        return {
+            ok: false,
+            stage: "no-providers-resolved",
+            detail: "no configured provider resolved successfully",
+            providers: results,
+        };
+    }
+    return { ok: true, authMode: cfg.config.authMode, providers: results };
+}
+function printProviderResults(results) {
+    for (const p of results) {
+        process.stdout.write(p.ok ? `  ✓ ${p.provider}\n` : `  ✗ ${p.provider}: ${p.error}\n`);
+    }
+}
+/**
+ * Orchestrates `crosscheck keys setup --backend 1password`: by default,
+ * opens a browser wizard to collect authMode + per-provider Vault/Item/Field
+ * (pre-filled with whatever's already configured, so re-running to add one
+ * more provider doesn't lose the rest) and writes the config — no one has
+ * to hand-edit ~/.crosscheck/1password.json. Pass `{ useFile: true }` (the
+ * CLI's `--file` flag) to skip the browser and just validate a config
+ * that's already been placed there some other way (dotfiles, CI
+ * provisioning, etc.). Either way, ends the same: validate, then (only on
+ * success) persist the preference and report what's usable.
+ */
+export async function runOnePasswordKeysSetup(opts = {}) {
+    if (!opts.useFile) {
+        const existingLoad = loadOnePasswordConfig();
+        const existing = existingLoad.ok ? existingLoad.config.mappings : undefined;
+        const existingAuthMode = existingLoad.ok ? existingLoad.config.authMode : undefined;
+        process.stdout.write("\nLet's set up 1Password in your browser — no file to hand-edit.\n");
+        let captured;
+        try {
+            captured = await captureOnePasswordConfigViaBrowser({
+                providers: [...SUPPORTED_PROVIDERS],
+                existing,
+                existingAuthMode,
+            });
+        }
+        catch (err) {
+            process.stderr.write(`\n✗ ${err instanceof Error ? err.message : String(err)}\n\n`);
+            process.exitCode = 1;
+            return;
+        }
+        if (Object.keys(captured.mappings).length === 0) {
+            process.stderr.write("\n✗ No providers were mapped — nothing to enable.\n\n");
+            process.exitCode = 1;
+            return;
+        }
+        const written = writeOnePasswordConfig(captured);
+        if (!written.ok) {
+            process.stderr.write(`\n✗ ${written.error}: ${written.detail}\n\n`);
+            process.exitCode = 1;
+            return;
+        }
+        process.stdout.write(`✓ Saved ${configFilePath()}\n`);
+    }
+    process.stdout.write("\nValidating your 1Password configuration...\n");
+    const result = await validateOnePasswordSetup();
+    if (!result.ok) {
+        process.stderr.write(`\n✗ ${result.detail}\n`);
+        if (result.stage === "config") {
+            process.stderr.write(`\nExpected a config at ${configFilePath()} shaped like:\n` +
+                '  {\n    "authMode": "desktop",\n    "mappings": { "anthropic": "op://Vault/Item/field" }\n  }\n' +
+                '\n(authMode is "desktop" or "service-account"; for service-account mode, set\n' +
+                "OP_SERVICE_ACCOUNT_TOKEN in the environment — never store it in this file.)\n");
+        }
+        if (result.stage === "op-version") {
+            process.stderr.write(`\nRequires the 1Password CLI (\`op\`), version >= ${MIN_OP_VERSION}.\n`);
+        }
+        if (result.providers)
+            printProviderResults(result.providers);
+        process.stderr.write("\nFix the above, then re-run `crosscheck keys setup --backend 1password`.\n\n");
+        process.exitCode = 1;
+        return;
+    }
+    enableOnePasswordBackend();
+    process.stdout.write(`\n✓ 1Password backend enabled (authMode: ${result.authMode}).\n\n`);
+    printProviderResults(result.providers);
+    process.stdout.write("\nMachine-local secrets (activation, HMAC signing key) still use the local\n" +
+        "encrypted file, unchanged — only providers marked ✓ above are read from\n" +
+        "1Password. Anything else (including a ✗ above) falls back to whatever's\n" +
+        "already stored locally, if anything.\n\n" +
+        "Run `crosscheck doctor` any time to recheck this.\n\n");
+}
+//# sourceMappingURL=setup.js.map

package/dist/onepassword/setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../src/onepassword/setup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,cAAc,EAAiB,MAAM,aAAa,CAAC;AAC3G,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,kCAAkC,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAa9D;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB;IAC5C,MAAM,GAAG,GAAG,qBAAqB,EAAE,CAAC;IACpC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,KAAK,GAAG,CAAC,MAAM,iBAAiB,cAAc,EAAE,GAAG;SACxE,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,cAAc,EAAE,CAAC;IAC5C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,EAAE,CAAC;IACzE,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;IAC9D,MAAM,OAAO,GAA0B,EAAE,CAAC;IAC1C,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAE,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE;YACrC,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ;YAC7B,mBAAmB,EACjB,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,iBAAiB;gBACvC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB;gBACtC,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC;QACH,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,EAAE;YACP,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE;YACxB,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,EAAE,CACxE,CAAC;IACJ,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,0EAA0E;YAClF,SAAS,EAAE,OAAO;SACnB,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,uBAAuB;YAC9B,MAAM,EAAE,8CAA8C;YACtD,SAAS,EAAE,OAAO;SACnB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAA8B;IAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAA8B,EAAE;IAC5E,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,MAAM,YAAY,GAAG,qBAAqB,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,gBAAgB,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QAEpF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC3F,IAAI,QAAQ,CAAC;QACb,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,kCAAkC,CAAC;gBAClD,SAAS,EAAE,CAAC,GAAG,mBAAmB,CAAC;gBACnC,QAAQ;gBACR,gBAAgB;aACjB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACpF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;YAC9E,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,KAAK,KAAK,OAAO,CAAC,MAAM,MAAM,CAAC,CAAC;YACpE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,cAAc,EAAE,IAAI,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC;IAEhD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAC/C,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,0BAA0B,cAAc,EAAE,iBAAiB;gBACzD,kGAAkG;gBAClG,gFAAgF;gBAChF,+EAA+E,CAClF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,KAAK,KAAK,YAAY,EAAE,CAAC;YAClC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,cAAc,KAAK,CAAC,CAAC;QACjG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS;YAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,+EAA+E,CAChF,CAAC;QACF,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACT,CAAC;IAED,wBAAwB,EAAE,CAAC;IAE3B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,MAAM,CAAC,QAAQ,QAAQ,CAAC,CAAC;IAC1F,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,8EAA8E;QAC5E,2EAA2E;QAC3E,2EAA2E;QAC3E,0CAA0C;QAC1C,uDAAuD,CAC1D,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crosscheck-cli",
-  "version": "0.0.44",
+  "version": "0.0.46",
   "description": "Crosscheck — multi-LLM orchestration MCP for the terminal. Single-machine activation, BYO upstream LLM keys, content-free telemetry. Installs into Claude Code in one command.",
   "license": "SEE LICENSE.md",
   "type": "module",