crosscheck-cli 0.0.6

package/LICENSE.md

@@ -0,0 +1,18 @@
+# Crosscheck (XC) CLI License
+
+**Copyright © 2026 Vardr Partners, LLC.** All rights reserved.
+
+This package, the **Crosscheck (XC) CLI** (the "Software"), is proprietary software of Vardr Partners, LLC. Use is governed by the Crosscheck (XC) End User License Agreement available at https://vardrpartners.com/products/crosscheck/legal/eula (the "EULA"), which you accepted during the install flow. The EULA, and not this file, defines the actual scope of your rights.
+
+Notable terms (summary only — the EULA controls):
+
+- The Software runs locally on your machine and communicates with vardrpartners.com solely for activation, heartbeat, and signed content-free telemetry.
+- Upstream LLM provider API keys you configure live only in your OS keychain. The Software does not transmit them to Vardr.
+- The Software embeds and distributes portions of `crosscheck-agent`, licensed to Vardr Partners, LLC by Frank Speiser under a separately-executed revocable reseller license.
+- Vardr Partners, LLC provides the Software AS-IS, without warranty of any kind. Vardr expressly disclaims any warranty that the Software will reduce token consumption, improve model output quality, or accelerate any task.
+- You may not copy, modify, reverse engineer, decompile, or redistribute the Software except as expressly permitted by the EULA.
+- This license may be terminated at Vardr's discretion on thirty (30) days' notice, or immediately if the underlying `crosscheck-agent` license is revoked.
+
+For the complete and authoritative terms, see the EULA.
+
+For questions: crosscheck@vardrpartners.com.

package/README.md

@@ -0,0 +1,77 @@
+# crosscheck-cli
+
+The Crosscheck multi-LLM orchestration **Model Context Protocol (MCP) server**, packaged as a single-machine-activatable CLI. Runs on your laptop, fans structured patterns (`confer`, `debate`, `audit`, `plan`, `panel_pick`, …) across multiple LLM providers using **your own API keys**, and emits signed, content-free telemetry so your dashboard at https://crosscheckagent.com/account can show usage. No Python required — the engine ([`crosscheck-mcp`](https://www.npmjs.com/package/crosscheck-mcp)) is pure TypeScript.
+
+## Install (Claude Code in VS Code — recommended)
+
+In the Claude Code chat, just say:
+
+> **Install Crosscheck**
+
+Claude Code will run the one-liner below for you. Or run it yourself in any terminal:
+
+```bash
+npx -y crosscheck-cli@latest install
+```
+
+That single command:
+
+1. **Activates this machine** — opens your browser to sign in, accept the agreement, and subscribe (device-authorization flow, like `gh auth login`). No tokens to copy and paste.
+2. **Sets up your provider keys** — Anthropic, OpenAI, Google (Gemini), xAI (Grok). Browser, terminal, or import from your environment. Keys are stored in your **OS keychain** and never sent to Crosscheck.
+3. **Registers the MCP server with Claude Code** at user scope (`claude mcp add`, with a `~/.claude.json` fallback) — available in every workspace.
+
+Then reconnect MCP servers in Claude Code (or restart it) and ask it to *"use crosscheck to confer on …"*.
+
+Requires Node 20+.
+
+## Commands
+
+```bash
+crosscheck install                     # set everything up (run this first)
+crosscheck activate                    # (re)authorize this machine via the browser
+crosscheck keys setup                  # interactive wizard for all provider keys
+crosscheck keys add <provider> [--paste]   # add one key (browser by default; --paste for CI)
+crosscheck keys list                   # list stored provider key names (not values)
+crosscheck keys remove <provider>      # remove a key
+crosscheck heartbeat                   # check license status against the server
+crosscheck serve                       # start the MCP server (stdio) — Claude Code runs this
+crosscheck deactivate                  # wipe local credentials
+```
+
+Providers: `anthropic`, `openai`, `gemini`, `grok` (also `groq`, `deepseek`, `mistral`).
+
+## What we never see
+
+The Crosscheck server **never** receives the content of your prompts/responses or your upstream LLM API keys.
+
+What the server does see (and shows on your dashboard):
+- Token counts per call
+- Estimated cost (re-computed server-side from a public price table)
+- Provider, model id, pattern name
+- Latency, success/error status
+
+Telemetry events are HMAC-signed with a per-seat key derived at activation time. Any event carrying a `prompt`, `messages`, `content`, `input`, `text`, `completion`, `response`, or `output` field is rejected at the server boundary.
+
+## Architecture
+
+```
+Customer machine                         crosscheckagent.com
+─────────────────                        ─────────────────────────────
+crosscheck CLI          <-- HTTPS -->    /api/crosscheck/cli/device-code
+  OS keychain                            /api/crosscheck/cli/token
+    upstream LLM keys                    /api/crosscheck/heartbeat
+    Ed25519 JWT                          /api/crosscheck/telemetry
+    seat HMAC key
+  └─ spawns crosscheck-mcp (stdio)  ← the TypeScript engine (npm dependency)
+```
+
+The CLI:
+1. Activates against the server (browser device-auth → Ed25519 JWT + per-seat HMAC key, stored in the OS keychain).
+2. Stores upstream LLM keys in the OS keychain (Keychain / Credential Manager / libsecret).
+3. Heartbeats every 24h; refreshes the JWT and honors revocation.
+4. Signs and POSTs content-free telemetry on each LLM call.
+5. Spawns `crosscheck-mcp` locally, injecting your keys as env vars, and lets the MCP client talk to it over stdio.
+
+## License
+
+See [LICENSE.md](LICENSE.md) and the canonical EULA at https://crosscheckagent.com/legal/eula.

package/dist/activate.js

@@ -0,0 +1,196 @@
+/**
+ * Activation. Two paths:
+ *
+ *   1. Device-authorization grant (RFC 8628) — new default. Run with no
+ *      argument:  `crosscheck activate`
+ *      Prints a URL + short user-code; polls /api/crosscheck/cli/token
+ *      until the user authorizes in their browser; stores the resulting
+ *      JWT + signing keys in the OS keychain. This is what `gh auth
+ *      login` / `vercel login` do; eliminates the "paste a 256-char
+ *      base64 token into your terminal" friction wall.
+ *
+ *   2. Legacy single-use token paste — kept alive for backwards
+ *      compatibility with the old install flow:
+ *      `crosscheck activate <TOKEN>`
+ *      Will be removed in a future release.
+ *
+ * Both paths end with the same artifacts in the keychain:
+ *   - jwt              (Ed25519-signed activation JWT)
+ *   - jwtJti           (revocation handle)
+ *   - jwtPublicKey     (key used to verify the JWT — comes from server)
+ *   - hmacSigningKey   (per-seat key for signing telemetry events)
+ */
+import { request } from "undici";
+import { SERVER_URL } from "./config.js";
+import { setSecret } from "./keychain.js";
+import { openBrowser } from "./open-browser.js";
+import { computeFingerprintHash, detectPlatform, getOrCreateInstallUuid, } from "./fingerprint.js";
+/** Persist the activation artifacts to the OS keychain. */
+async function persistActivation(s) {
+    await setSecret("jwt", s.jwt);
+    await setSecret("hmacSigningKey", s.hmacSigningKey);
+    await setSecret("jwtJti", s.jwtJti);
+    if (s.jwtPublicKey) {
+        await setSecret("jwtPublicKey", s.jwtPublicKey);
+    }
+}
+/** Public entry point. With no token, runs the device flow. */
+export async function activate(token) {
+    if (token && token.length >= 16) {
+        return activateLegacy(token);
+    }
+    return activateDeviceFlow();
+}
+/** Legacy: paste-a-token activation. Kept for old install scripts. */
+async function activateLegacy(token) {
+    const fingerprintHash = await computeFingerprintHash();
+    const installUuid = await getOrCreateInstallUuid();
+    const osPlatform = detectPlatform();
+    const res = await request(`${SERVER_URL}/api/crosscheck/activate`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({
+            activationToken: token,
+            fingerprintHash,
+            installUuid,
+            osPlatform,
+        }),
+    });
+    const body = (await res.body.json());
+    if (res.statusCode !== 200 || !("ok" in body) || !body.ok) {
+        const error = "ok" in body && !body.ok
+            ? `${body.error}${body.reason ? ` (${body.reason})` : ""}`
+            : `HTTP ${res.statusCode}`;
+        throw new Error(`Activation failed: ${error}`);
+    }
+    await persistActivation(body);
+    // eslint-disable-next-line no-console
+    console.log(`✓ Activated. JWT expires ${new Date(body.expiresAt).toLocaleString()}.`);
+}
+/**
+ * Device-flow activation. Prints a URL + user-code, polls until the user
+ * authorizes in their browser, then stores artifacts in the keychain.
+ *
+ * Polling resilience (per Matt's panel review): network errors retry with
+ * backoff and don't terminate the flow. Only `expired`, `denied`, and
+ * `already_consumed` are terminal.
+ */
+async function activateDeviceFlow() {
+    // 1. Request a device code pair from the server.
+    const startRes = await request(`${SERVER_URL}/api/crosscheck/cli/device-code`, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({}),
+    });
+    const start = (await startRes.body.json());
+    if (startRes.statusCode !== 200 || !("ok" in start) || !start.ok) {
+        const err = "error" in start ? start.error : `HTTP ${startRes.statusCode}`;
+        throw new Error(`Could not start activation: ${err}`);
+    }
+    // 2. Print instructions and auto-open the browser (like `gh auth login`).
+    const verifyUrl = `${start.verificationUrl}?code=${start.userCode}`;
+    printActivationPrompt(start.userCode, start.verificationUrl, start.expiresIn);
+    openBrowser(verifyUrl);
+    // Compute the machine fingerprint once and send it on every poll so the
+    // device-flow activation carries the same identity as the legacy flow
+    // (enables revocation + the server's seat-in-use guard).
+    const fingerprintHash = await computeFingerprintHash();
+    const installUuid = await getOrCreateInstallUuid();
+    const osPlatform = detectPlatform();
+    // 3. Poll for the token.
+    const intervalMs = Math.max(2_000, start.interval * 1000);
+    const deadlineMs = Date.now() + start.expiresIn * 1000;
+    let lastStatus = "pending";
+    // Backoff for transient network errors only — capped so polling stays
+    // responsive once the network recovers.
+    let backoffMs = intervalMs;
+    while (Date.now() < deadlineMs) {
+        await sleep(backoffMs);
+        backoffMs = intervalMs; // reset; only widened by network failures below
+        let res;
+        try {
+            res = await request(`${SERVER_URL}/api/crosscheck/cli/token`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({
+                    deviceCode: start.deviceCode,
+                    fingerprintHash,
+                    installUuid,
+                    osPlatform,
+                }),
+            });
+        }
+        catch (err) {
+            // Transient — back off and retry.
+            backoffMs = Math.min(intervalMs * 4, 30_000);
+            process.stderr.write(`  (network glitch: ${err instanceof Error ? err.message : "unknown"}; retrying)\n`);
+            continue;
+        }
+        const body = (await res.body.json());
+        if (body.ok && body.status === "ok") {
+            await persistActivation(body);
+            // eslint-disable-next-line no-console
+            console.log(`\n✓ Activated. JWT expires ${new Date(body.expiresAt).toLocaleString()}.`);
+            return;
+        }
+        if (!body.ok) {
+            const s = "status" in body ? body.status : "unknown";
+            if (s === "pending") {
+                // Show a heartbeat so the user knows we're alive. One dot per poll.
+                if (s !== lastStatus) {
+                    process.stderr.write("Waiting for authorization");
+                }
+                process.stderr.write(".");
+                lastStatus = s;
+                continue;
+            }
+            if (s === "seat_in_use") {
+                process.stderr.write("\n");
+                throw new Error("This seat is already active on another machine. Deactivate it at " +
+                    `${SERVER_URL}/account, or add a seat, then re-run \`crosscheck activate\`.`);
+            }
+            if (s === "eula_required") {
+                process.stderr.write("\n");
+                throw new Error("You need to accept the agreement first. Re-run `crosscheck activate` and complete the browser step.");
+            }
+            if (s === "expired" || s === "denied" || s === "already_consumed") {
+                process.stderr.write("\n");
+                throw new Error(`Activation aborted: ${s}. Re-run \`crosscheck activate\` to try again.`);
+            }
+            if (s === "rate_limited") {
+                // Server told us to back off — respect it.
+                backoffMs = Math.min(intervalMs * 4, 30_000);
+                continue;
+            }
+            // Unknown status — log and keep polling rather than crash.
+            process.stderr.write(`\n  (unexpected status: ${s}; continuing)\n`);
+        }
+    }
+    process.stderr.write("\n");
+    throw new Error("Activation timed out. Re-run `crosscheck activate` to get a fresh code.");
+}
+function printActivationPrompt(userCode, verificationUrl, expiresIn) {
+    const minutes = Math.round(expiresIn / 60);
+    // eslint-disable-next-line no-console
+    console.log("");
+    // eslint-disable-next-line no-console
+    console.log("  Open this URL in your browser:");
+    // eslint-disable-next-line no-console
+    console.log(`    ${verificationUrl}?code=${userCode}`);
+    // eslint-disable-next-line no-console
+    console.log("");
+    // eslint-disable-next-line no-console
+    console.log("  Or type this code:");
+    // eslint-disable-next-line no-console
+    console.log(`    ${userCode}`);
+    // eslint-disable-next-line no-console
+    console.log("");
+    // eslint-disable-next-line no-console
+    console.log(`  Code expires in ${minutes} minutes. Press Ctrl-C to cancel.`);
+    // eslint-disable-next-line no-console
+    console.log("");
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=activate.js.map

package/dist/activate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activate.js","sourceRoot":"","sources":["../src/activate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,sBAAsB,GACvB,MAAM,kBAAkB,CAAC;AAgC1B,2DAA2D;AAC3D,KAAK,UAAU,iBAAiB,CAAC,CAAkB;IACjD,MAAM,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,SAAS,CAAC,gBAAgB,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO,cAAc,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,cAAc,CAAC,KAAa;IACzC,MAAM,eAAe,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,0BAA0B,EAAE;QACjE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,eAAe,EAAE,KAAK;YACtB,eAAe;YACf,WAAW;YACX,UAAU;SACX,CAAC;KACH,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAmB,CAAC;IACvD,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QAC1D,MAAM,KAAK,GACT,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE;YACtB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YAC1D,CAAC,CAAC,QAAQ,GAAG,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sBAAsB,KAAK,EAAE,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,kBAAkB;IAC/B,iDAAiD;IACjD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,iCAAiC,EAAE;QAC7E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAwB,CAAC;IAClE,IAAI,QAAQ,CAAC,UAAU,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACjE,MAAM,GAAG,GAAG,OAAO,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,QAAQ,CAAC,UAAU,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,+BAA+B,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,0EAA0E;IAC1E,MAAM,SAAS,GAAG,GAAG,KAAK,CAAC,eAAe,SAAS,KAAK,CAAC,QAAQ,EAAE,CAAC;IACpE,qBAAqB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,eAAe,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9E,WAAW,CAAC,SAAS,CAAC,CAAC;IAEvB,wEAAwE;IACxE,sEAAsE;IACtE,yDAAyD;IACzD,MAAM,eAAe,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACvD,MAAM,WAAW,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACnD,MAAM,UAAU,GAAG,cAAc,EAAE,CAAC;IAEpC,yBAAyB;IACzB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;IACvD,IAAI,UAAU,GAAG,SAAS,CAAC;IAC3B,sEAAsE;IACtE,wCAAwC;IACxC,IAAI,SAAS,GAAG,UAAU,CAAC;IAE3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;QAC/B,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACvB,SAAS,GAAG,UAAU,CAAC,CAAC,gDAAgD;QAExE,IAAI,GAAG,CAAC;QACR,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,2BAA2B,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;oBACnB,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,eAAe;oBACf,WAAW;oBACX,UAAU;iBACX,CAAC;aACH,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,kCAAkC;YAClC,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,sBAAsB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,eAAe,CACpF,CAAC;YACF,SAAS;QACX,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAkB,CAAC;QACtD,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACpC,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;YAC9B,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YACrD,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;gBACpB,oEAAoE;gBACpE,IAAI,CAAC,KAAK,UAAU,EAAE,CAAC;oBACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;gBACpD,CAAC;gBACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC1B,UAAU,GAAG,CAAC,CAAC;gBACf,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,aAAa,EAAE,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,mEAAmE;oBACjE,GAAG,UAAU,+DAA+D,CAC/E,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,eAAe,EAAE,CAAC;gBAC1B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CACb,qGAAqG,CACtG,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,kBAAkB,EAAE,CAAC;gBAClE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,gDAAgD,CAAC,CAAC;YAC5F,CAAC;YACD,IAAI,CAAC,KAAK,cAAc,EAAE,CAAC;gBACzB,2CAA2C;gBAC3C,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,2DAA2D;YAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,iBAAiB,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,IAAI,KAAK,CACb,yEAAyE,CAC1E,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,QAAgB,EAChB,eAAuB,EACvB,SAAiB;IAEjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,EAAE,CAAC,CAAC;IAC3C,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC;IAChD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,OAAO,eAAe,SAAS,QAAQ,EAAE,CAAC,CAAC;IACvD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;IACpC,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;IAC/B,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,mCAAmC,CAAC,CAAC;IAC7E,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/cli.js

@@ -0,0 +1,186 @@
+#!/usr/bin/env node
+/**
+ * Crosscheck (XC) CLI entry point. Minimal argument parser — subcommand and
+ * positional/named args. We don't pull in a heavyweight CLI library in the
+ * skeleton; if richer help text or interactive flows are needed later,
+ * commander or yargs slots in here.
+ */
+import { activate } from "./activate.js";
+import { runHeartbeat } from "./heartbeat.js";
+import { deleteSecret, getSecret, listSecrets, setSecret, } from "./keychain.js";
+import { captureKeyViaBrowser } from "./keys-browser-flow.js";
+import { runKeysSetup } from "./keys-setup.js";
+import { runInstall } from "./install.js";
+import { startMcpServer } from "./mcp.js";
+const HELP = `crosscheck — multi-LLM orchestration MCP for the terminal
+
+Usage:
+  crosscheck install                          Set it all up: activate, keys, and register with
+                                              Claude Code. Run this first (or just ask Claude
+                                              Code to "Install Crosscheck").
+  crosscheck activate                         Authorize this machine via your browser.
+  crosscheck activate <TOKEN>                 Legacy: paste-a-token activation (deprecated).
+  crosscheck login                            Alias for \`crosscheck activate\`.
+  crosscheck deactivate                       Wipe local credentials.
+  crosscheck heartbeat                        Check status against the server.
+  crosscheck keys setup                       Interactive wizard for all provider keys.
+  crosscheck keys add <provider> [--paste]    Store one upstream LLM key in your OS keychain
+                                              (default: opens a browser form; --paste falls
+                                              back to stdin for CI / headless environments).
+  crosscheck keys list                        List stored upstream-provider key names (not values).
+  crosscheck keys remove <provider>           Remove an upstream LLM key.
+  crosscheck serve                            Start the MCP server (stdio).
+  crosscheck help                             Show this help.
+
+Providers: anthropic, openai, gemini, grok
+
+Documentation: https://crosscheckagent.com/install
+`;
+async function readStdin() {
+    return new Promise((resolve, reject) => {
+        let buf = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (c) => (buf += c));
+        process.stdin.on("end", () => resolve(buf.trim()));
+        process.stdin.on("error", reject);
+    });
+}
+async function main() {
+    const [, , cmd, ...rest] = process.argv;
+    switch (cmd) {
+        case undefined:
+        case "help":
+        case "--help":
+        case "-h":
+            // eslint-disable-next-line no-console
+            console.log(HELP);
+            return;
+        case "install": {
+            await runInstall();
+            return;
+        }
+        case "activate":
+        case "login": {
+            // No token argument = device-authorization grant (default).
+            //   $ crosscheck activate
+            //   $ crosscheck login          (alias)
+            // With a token = legacy paste-the-token activation (deprecated).
+            //   $ crosscheck activate <TOKEN>
+            const token = rest[0];
+            await activate(token);
+            return;
+        }
+        case "deactivate": {
+            const items = await listSecrets();
+            for (const item of items) {
+                await deleteSecret(item.account);
+            }
+            // eslint-disable-next-line no-console
+            console.log(`✓ Removed ${items.length} keychain entries. To set up again, run \`crosscheck install\`.`);
+            return;
+        }
+        case "heartbeat": {
+            const r = await runHeartbeat();
+            // eslint-disable-next-line no-console
+            console.log(`status=${r.status}${r.reason ? ` reason=${r.reason}` : ""}`);
+            if (r.status === "revoked")
+                process.exit(2);
+            return;
+        }
+        case "keys": {
+            const sub = rest[0];
+            const provider = rest[1];
+            // --paste falls back to the legacy stdin paste flow (useful in
+            // CI/headless/SSH environments where the browser flow can't work).
+            const paste = rest.includes("--paste");
+            if (sub === "setup") {
+                await runKeysSetup();
+                return;
+            }
+            if (sub === "list") {
+                const items = (await listSecrets()).filter((i) => i.account.startsWith("key:"));
+                for (const i of items) {
+                    // eslint-disable-next-line no-console
+                    console.log(i.account.slice(4));
+                }
+                return;
+            }
+            const validProviders = [
+                "anthropic",
+                "openai",
+                "gemini",
+                "grok",
+                "groq",
+                "deepseek",
+                "mistral",
+            ];
+            if (!provider || !validProviders.includes(provider)) {
+                // eslint-disable-next-line no-console
+                console.error(`usage: crosscheck keys (add|remove) (${validProviders.join("|")}) [--paste]`);
+                process.exit(1);
+            }
+            if (sub === "add") {
+                let value = "";
+                if (paste) {
+                    process.stderr.write(`Paste your ${provider} API key, then press Enter+Ctrl-D:\n`);
+                    value = await readStdin();
+                }
+                else {
+                    // Default: browser flow. The CLI opens a Crosscheck (XC)-served form
+                    // that POSTs the pasted key directly to a loopback HTTP server
+                    // we spin up here. Value never transits Crosscheck's servers.
+                    try {
+                        const captured = await captureKeyViaBrowser({ provider });
+                        value = captured.value;
+                    }
+                    catch (err) {
+                        // eslint-disable-next-line no-console
+                        console.error(`✗ ${err instanceof Error ? err.message : err}\n  To use the legacy paste-into-stdin flow, run \`crosscheck keys add ${provider} --paste\`.`);
+                        process.exit(1);
+                    }
+                }
+                if (!value) {
+                    // eslint-disable-next-line no-console
+                    console.error("✗ no key entered");
+                    process.exit(1);
+                }
+                await setSecret(`key:${provider}`, value);
+                // eslint-disable-next-line no-console
+                console.log(`✓ Stored ${provider} key in OS keychain (never sent to Crosscheck).`);
+                return;
+            }
+            if (sub === "remove") {
+                const ok = await deleteSecret(`key:${provider}`);
+                // eslint-disable-next-line no-console
+                console.log(ok ? `✓ Removed ${provider} key.` : `(no ${provider} key was stored)`);
+                return;
+            }
+            // eslint-disable-next-line no-console
+            console.error("usage: crosscheck keys (add|remove|list) [provider]");
+            process.exit(1);
+            return;
+        }
+        case "serve": {
+            const jwt = await getSecret("jwt");
+            if (!jwt) {
+                // eslint-disable-next-line no-console
+                console.error("Not activated. Run `crosscheck install` first.");
+                process.exit(1);
+            }
+            await startMcpServer();
+            return;
+        }
+        default:
+            // eslint-disable-next-line no-console
+            console.error(`Unknown command: ${cmd}\n`);
+            // eslint-disable-next-line no-console
+            console.log(HELP);
+            process.exit(1);
+    }
+}
+main().catch((err) => {
+    // eslint-disable-next-line no-console
+    console.error(err instanceof Error ? err.message : err);
+    process.exit(1);
+});
+//# sourceMappingURL=cli.js.map

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA;;;;;GAKG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EACL,YAAY,EACZ,SAAS,EACT,WAAW,EACX,SAAS,GACV,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;CAuBZ,CAAC;AAEF,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QACnD,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,EAAE,AAAD,EAAG,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;IAExC,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,SAAS,CAAC;QACf,KAAK,MAAM,CAAC;QACZ,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO;QAET,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,UAAU,EAAE,CAAC;YACnB,OAAO;QACT,CAAC;QAED,KAAK,UAAU,CAAC;QAChB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,4DAA4D;YAC5D,0BAA0B;YAC1B,wCAAwC;YACxC,iEAAiE;YACjE,kCAAkC;YAClC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QAED,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,KAAK,GAAG,MAAM,WAAW,EAAE,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACnC,CAAC;YACD,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,aAAa,KAAK,CAAC,MAAM,iEAAiE,CAAC,CAAC;YACxG,OAAO;QACT,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,YAAY,EAAE,CAAC;YAC/B,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5C,OAAO;QACT,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACzB,+DAA+D;YAC/D,mEAAmE;YACnE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YAEvC,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBACpB,MAAM,YAAY,EAAE,CAAC;gBACrB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,MAAM,KAAK,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;gBAChF,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;oBACtB,sCAAsC;oBACtC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClC,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,cAAc,GAAG;gBACrB,WAAW;gBACX,QAAQ;gBACR,QAAQ;gBACR,MAAM;gBACN,MAAM;gBACN,UAAU;gBACV,SAAS;aACV,CAAC;YACF,IAAI,CAAC,QAAQ,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACpD,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CACX,wCAAwC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAC9E,CAAC;gBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,IAAI,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,KAAK,EAAE,CAAC;oBACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,QAAQ,sCAAsC,CAAC,CAAC;oBACnF,KAAK,GAAG,MAAM,SAAS,EAAE,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN,qEAAqE;oBACrE,+DAA+D;oBAC/D,8DAA8D;oBAC9D,IAAI,CAAC;wBACH,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;wBAC1D,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC;oBACzB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,sCAAsC;wBACtC,OAAO,CAAC,KAAK,CACX,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,0EAA0E,QAAQ,aAAa,CAC7I,CAAC;wBACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAClB,CAAC;gBACH,CAAC;gBACD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,sCAAsC;oBACtC,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC;oBAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;gBACD,MAAM,SAAS,CAAC,OAAO,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;gBAC1C,sCAAsC;gBACtC,OAAO,CAAC,GAAG,CAAC,YAAY,QAAQ,iDAAiD,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;YACD,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,OAAO,QAAQ,EAAE,CAAC,CAAC;gBACjD,sCAAsC;gBACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,QAAQ,OAAO,CAAC,CAAC,CAAC,OAAO,QAAQ,kBAAkB,CAAC,CAAC;gBACnF,OAAO;YACT,CAAC;YACD,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,qDAAqD,CAAC,CAAC;YACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,OAAO;QACT,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,sCAAsC;gBACtC,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,cAAc,EAAE,CAAC;YACvB,OAAO;QACT,CAAC;QAED;YACE,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAAC;YAC3C,sCAAsC;YACtC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,sCAAsC;IACtC,OAAO,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/config.js

@@ -0,0 +1,45 @@
+/**
+ * Compile-time constants. Override the server base URL via the
+ * CROSSCHECK_SERVER environment variable for local development against a
+ * preview deployment. The Ed25519 public key is embedded at build time so
+ * the CLI can verify JWTs offline.
+ */
+export const SERVER_URL = process.env.CROSSCHECK_SERVER || "https://crosscheckagent.com";
+/** npm package name of this CLI — used when self-registering the MCP server. */
+export const CLI_PACKAGE = "crosscheck-cli";
+/**
+ * npm package name of the TypeScript MCP engine the CLI runs. The CLI is the
+ * license/onboarding wrapper; crosscheck-mcp is the engine (formerly a bundled
+ * Python server — now pure TypeScript, shipped as a normal npm dependency).
+ */
+export const ENGINE_PACKAGE = "crosscheck-mcp";
+/**
+ * Ed25519 public key (PEM, SPKI) used to verify activation JWTs. This is
+ * replaced at build time by the publish pipeline with the public half of
+ * the keypair produced by scripts/generate-cb-secrets.ts on the server.
+ *
+ * For local dev: set CROSSCHECK_JWT_PUBLIC_KEY in the environment.
+ */
+export const EMBEDDED_PUBLIC_KEY_PEM = process.env.CROSSCHECK_JWT_PUBLIC_KEY ?? "";
+/**
+ * OS keychain service identifier. Stored entries:
+ *   - "jwt"                            → the activation JWT (rotates ~weekly)
+ *   - "hmacSigningKey"                 → per-seat HMAC key from /activate
+ *   - "key:anthropic" / "key:openai" / "key:gemini" / "key:grok"
+ *                                      → user-supplied upstream LLM keys
+ *   - "installUuid"                    → stable UUID generated at first run
+ */
+export const KEYCHAIN_SERVICE = "crosscheck";
+/**
+ * Heartbeat cadence. Matches the server's 24h refreshAt / 7d exp / 72h
+ * fail-open grace. Configurable for tests.
+ */
+export const HEARTBEAT_INTERVAL_MS = 24 * 60 * 60 * 1000;
+export const HEARTBEAT_FAIL_OPEN_MS = 72 * 60 * 60 * 1000;
+/**
+ * Telemetry batch flush. Events accumulate in memory and POST in batches
+ * up to 100 events or 30 seconds, whichever comes first.
+ */
+export const TELEMETRY_BATCH_SIZE = 50;
+export const TELEMETRY_FLUSH_MS = 30_000;
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,UAAU,GACrB,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,6BAA6B,CAAC;AAEjE,gFAAgF;AAChF,MAAM,CAAC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AAE5C;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAE/C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,IAAI,EAAE,CAAC;AAEnF;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC;AAE7C;;;GAGG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAE1D;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAC;AACvC,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC"}

package/dist/fingerprint.js

@@ -0,0 +1,92 @@
+/**
+ * Privacy-preserving machine fingerprint. Argon2id-hashed:
+ *
+ *   fingerprint = argon2id(machine-id || install-uuid || os-platform)
+ *
+ * The same fingerprint inputs always produce the same hash (deterministic
+ * salt). The hash is not reversible to PII — it's only useful as a stable
+ * identifier for re-activation flows. NEVER raw MAC address, serial number,
+ * or hardware UUID — those are PII and unstable across OS updates.
+ *
+ * The `installUuid` is generated once at first run and stored in the OS
+ * keychain so subsequent invocations on the same install yield the same
+ * fingerprint even if the machine-id rotates.
+ */
+import { randomUUID } from "node:crypto";
+import { readFileSync, existsSync } from "node:fs";
+import { execSync } from "node:child_process";
+import * as argon2 from "argon2";
+import { getSecret, setSecret } from "./keychain.js";
+const INSTALL_UUID_KEY = "installUuid";
+const FIXED_SALT = Buffer.from("vardr.crosscheck-fp-v1-salt-2026", "utf8");
+export function detectPlatform() {
+    const p = process.platform;
+    if (p === "darwin" || p === "linux" || p === "win32")
+        return p;
+    return "other";
+}
+export async function getOrCreateInstallUuid() {
+    const existing = await getSecret(INSTALL_UUID_KEY);
+    if (existing)
+        return existing;
+    const fresh = randomUUID();
+    await setSecret(INSTALL_UUID_KEY, fresh);
+    return fresh;
+}
+/**
+ * Best-effort machine identifier. Falls back to a stable hash of OS +
+ * hostname if a true machine-id is unavailable.
+ */
+export function getMachineId() {
+    const platform = detectPlatform();
+    try {
+        if (platform === "darwin") {
+            const out = execSync("ioreg -d2 -c IOPlatformExpertDevice", {
+                stdio: ["ignore", "pipe", "ignore"],
+            }).toString();
+            const m = out.match(/IOPlatformUUID"\s*=\s*"([^"]+)"/);
+            if (m && m[1])
+                return `darwin:${m[1]}`;
+        }
+        else if (platform === "linux") {
+            for (const p of ["/etc/machine-id", "/var/lib/dbus/machine-id"]) {
+                if (existsSync(p))
+                    return `linux:${readFileSync(p, "utf8").trim()}`;
+            }
+        }
+        else if (platform === "win32") {
+            const out = execSync("reg query HKLM\\SOFTWARE\\Microsoft\\Cryptography /v MachineGuid", { stdio: ["ignore", "pipe", "ignore"] }).toString();
+            const m = out.match(/MachineGuid\s+REG_SZ\s+([0-9a-fA-F-]+)/);
+            if (m && m[1])
+                return `win32:${m[1]}`;
+        }
+    }
+    catch {
+        // Fall through to a stable-enough fallback.
+    }
+    // Last-resort: not unique across machines but stable per-host.
+    return `${platform}:${process.env.HOSTNAME ?? "unknown"}`;
+}
+/**
+ * Compute the fingerprint hash. Argon2id with the fixed salt so the server
+ * doesn't need to know the inputs to verify.
+ */
+export async function computeFingerprintHash() {
+    const machineId = getMachineId();
+    const installUuid = await getOrCreateInstallUuid();
+    const platform = detectPlatform();
+    const input = `${machineId}|${installUuid}|${platform}`;
+    // Argon2id with modest parameters — fingerprinting is one-shot at install
+    // time so the cost only matters once.
+    const hash = await argon2.hash(input, {
+        type: argon2.argon2id,
+        salt: FIXED_SALT,
+        timeCost: 3,
+        memoryCost: 32 * 1024,
+        parallelism: 1,
+        raw: true,
+        hashLength: 32,
+    });
+    return Buffer.from(hash).toString("hex");
+}
+//# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;AAI3E,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,qCAAqC,EAAE;gBAC1D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,EAAE,CAAC;gBAChE,IAAI,UAAU,CAAC,CAAC,CAAC;oBAAE,OAAO,SAAS,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACtE,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,QAAQ,CAClB,kEAAkE,EAClE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CACxC,CAAC,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,+DAA+D;IAC/D,OAAO,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;IACxD,0EAA0E;IAC1E,sCAAsC;IACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;QACpC,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,EAAE,GAAG,IAAI;QACrB,WAAW,EAAE,CAAC;QACd,GAAG,EAAE,IAAI;QACT,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC"}