crosscheck-cli 0.0.6 → 0.0.7

package/dist/fingerprint.js

@@ -1,24 +1,27 @@
 /**
- * Privacy-preserving machine fingerprint. Argon2id-hashed:
+ * Privacy-preserving machine fingerprint. Hashed with scrypt (Node built-in):
  *
- *   fingerprint = argon2id(machine-id || install-uuid || os-platform)
+ *   fingerprint = scrypt(machine-id || install-uuid || os-platform, fixedSalt)
  *
- * The same fingerprint inputs always produce the same hash (deterministic
- * salt). The hash is not reversible to PII — it's only useful as a stable
- * identifier for re-activation flows. NEVER raw MAC address, serial number,
- * or hardware UUID — those are PII and unstable across OS updates.
+ * The same inputs always produce the same hash (fixed salt). The hash is not
+ * reversible to PII — it's only useful as a stable identifier for
+ * re-activation flows. NEVER raw MAC address, serial number, or hardware UUID
+ * — those are PII and unstable across OS updates.
+ *
+ * Uses Node's built-in crypto (no native dependency) — the fingerprint is a
+ * stable, non-secret identifier the server simply stores, so a slow password
+ * KDF (argon2) was unnecessary and added a node-gyp build step.
  *
  * The `installUuid` is generated once at first run and stored in the OS
  * keychain so subsequent invocations on the same install yield the same
  * fingerprint even if the machine-id rotates.
  */
-import { randomUUID } from "node:crypto";
+import { randomUUID, scryptSync } from "node:crypto";
 import { readFileSync, existsSync } from "node:fs";
 import { execSync } from "node:child_process";
-import * as argon2 from "argon2";
 import { getSecret, setSecret } from "./keychain.js";
 const INSTALL_UUID_KEY = "installUuid";
-const FIXED_SALT = Buffer.from("vardr.crosscheck-fp-v1-salt-2026", "utf8");
+const FIXED_SALT = Buffer.from("crosscheck-fp-v1-salt-2026", "utf8");
 export function detectPlatform() {
     const p = process.platform;
     if (p === "darwin" || p === "linux" || p === "win32")
@@ -68,25 +71,17 @@ export function getMachineId() {
     return `${platform}:${process.env.HOSTNAME ?? "unknown"}`;
 }
 /**
- * Compute the fingerprint hash. Argon2id with the fixed salt so the server
- * doesn't need to know the inputs to verify.
+ * Compute the fingerprint hash. scrypt with the fixed salt so the result is
+ * deterministic for the same machine and the server can just store the string.
  */
 export async function computeFingerprintHash() {
     const machineId = getMachineId();
     const installUuid = await getOrCreateInstallUuid();
     const platform = detectPlatform();
     const input = `${machineId}|${installUuid}|${platform}`;
-    // Argon2id with modest parameters — fingerprinting is one-shot at install
-    // time so the cost only matters once.
-    const hash = await argon2.hash(input, {
-        type: argon2.argon2id,
-        salt: FIXED_SALT,
-        timeCost: 3,
-        memoryCost: 32 * 1024,
-        parallelism: 1,
-        raw: true,
-        hashLength: 32,
-    });
-    return Buffer.from(hash).toString("hex");
+    // 32-byte scrypt output → 64 hex chars (well within the server's
+    // varchar(128) fingerprint column). One-shot at activation time.
+    const hash = scryptSync(input, FIXED_SALT, 32);
+    return hash.toString("hex");
 }
 //# sourceMappingURL=fingerprint.js.map

package/dist/fingerprint.js.map

@@ -1 +1 @@
-{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAEjC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE,MAAM,CAAC,CAAC;AAI3E,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,qCAAqC,EAAE;gBAC1D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,EAAE,CAAC;gBAChE,IAAI,UAAU,CAAC,CAAC,CAAC;oBAAE,OAAO,SAAS,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACtE,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,QAAQ,CAClB,kEAAkE,EAClE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CACxC,CAAC,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,+DAA+D;IAC/D,OAAO,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;IACxD,0EAA0E;IAC1E,sCAAsC;IACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE;QACpC,IAAI,EAAE,MAAM,CAAC,QAAQ;QACrB,IAAI,EAAE,UAAU;QAChB,QAAQ,EAAE,CAAC;QACX,UAAU,EAAE,EAAE,GAAG,IAAI;QACrB,WAAW,EAAE,CAAC;QACd,GAAG,EAAE,IAAI;QACT,UAAU,EAAE,EAAE;KACf,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3C,CAAC"}
+{"version":3,"file":"fingerprint.js","sourceRoot":"","sources":["../src/fingerprint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAErD,MAAM,gBAAgB,GAAG,aAAa,CAAC;AACvC,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,MAAM,CAAC,CAAC;AAIrE,MAAM,UAAU,cAAc;IAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3B,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,CAAC,CAAC;IAC/D,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,gBAAgB,CAAC,CAAC;IACnD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,KAAK,GAAG,UAAU,EAAE,CAAC;IAC3B,MAAM,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY;IAC1B,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,IAAI,CAAC;QACH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,qCAAqC,EAAE;gBAC1D,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC;aACpC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACvD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,KAAK,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,0BAA0B,CAAC,EAAE,CAAC;gBAChE,IAAI,UAAU,CAAC,CAAC,CAAC;oBAAE,OAAO,SAAS,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACtE,CAAC;QACH,CAAC;aAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,QAAQ,CAClB,kEAAkE,EAClE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,CACxC,CAAC,QAAQ,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,+DAA+D;IAC/D,OAAO,GAAG,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB;IAC1C,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,MAAM,sBAAsB,EAAE,CAAC;IACnD,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,GAAG,SAAS,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;IACxD,iEAAiE;IACjE,iEAAiE;IACjE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC"}

package/dist/keychain.js

@@ -1,34 +1,41 @@
 /**
- * OS keychain abstraction. Uses `keytar` on every platform:
+ * OS keychain abstraction. Backed by `@napi-rs/keyring` (Rust / N-API) which
+ * ships prebuilt binaries for every platform — no node-gyp, no Python, no
+ * compile step at install time:
  *   - macOS: Keychain
  *   - Windows: Credential Manager
- *   - Linux: libsecret (GNOME Keyring / KWallet)
+ *   - Linux: Secret Service (GNOME Keyring / KWallet via libsecret)
  *
- * On unsupported environments (CI, headless Linux without a keyring), falls
- * back to an Argon2id-encrypted file under ~/.config/crosscheck/.
+ * The functions stay async so call sites don't change, even though the
+ * underlying API is synchronous.
  *
- * The fallback path is documented in the EULA: keys never leave the local
- * machine, only their storage form differs.
+ * On headless environments without a system keyring (some CI / containers),
+ * the keyring calls throw; a future encrypted-file fallback under
+ * ~/.config/crosscheck/ is tracked as a TODO. Keys never leave the local
+ * machine either way — only the storage form would differ.
  */
-import keytar from "keytar";
+import { Entry, findCredentials } from "@napi-rs/keyring";
 import { KEYCHAIN_SERVICE } from "./config.js";
 export async function setSecret(name, value) {
-    // TODO(phase-3.5): implement Argon2id-encrypted file fallback for
-    // environments where keytar can't talk to a system keyring (CI, some
-    // headless Linux containers). For v1 we assume a working keychain.
-    await keytar.setPassword(KEYCHAIN_SERVICE, name, value);
+    new Entry(KEYCHAIN_SERVICE, name).setPassword(value);
 }
 export async function getSecret(name) {
-    return await keytar.getPassword(KEYCHAIN_SERVICE, name);
+    return new Entry(KEYCHAIN_SERVICE, name).getPassword();
 }
 export async function deleteSecret(name) {
-    return await keytar.deletePassword(KEYCHAIN_SERVICE, name);
+    try {
+        return new Entry(KEYCHAIN_SERVICE, name).deletePassword();
+    }
+    catch {
+        // No such entry — treat as a no-op delete.
+        return false;
+    }
 }
 /**
- * Convenience: list every Crosscheck (XC)-owned credential. Used by `crosscheck
- * keys list` and by deactivation to wipe everything in one pass.
+ * List every Crosscheck-owned credential. Used by `crosscheck keys list` and
+ * by deactivation to wipe everything in one pass.
  */
 export async function listSecrets() {
-    return await keytar.findCredentials(KEYCHAIN_SERVICE);
+    return findCredentials(KEYCHAIN_SERVICE);
 }
 //# sourceMappingURL=keychain.js.map

package/dist/keychain.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACzD,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAG/B,OAAO,MAAM,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AACxD,CAAC"}
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACzD,IAAI,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,OAAO,IAAI,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,KAAK,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;QAC3C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAG/B,OAAO,eAAe,CAAC,gBAAgB,CAAC,CAAC;AAC3C,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "crosscheck-cli",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "Crosscheck — multi-LLM orchestration MCP for the terminal. Single-machine activation, BYO upstream LLM keys, content-free telemetry. Installs into Claude Code in one command.",
   "license": "SEE LICENSE.md",
   "type": "module",
@@ -23,13 +23,13 @@
     "dev": "tsx src/cli.ts",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run",
-    "lint": "tsc -p tsconfig.json --noEmit"
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "prepublishOnly": "npm run build"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",
-    "argon2": "^0.41.0",
+    "@napi-rs/keyring": "^1.3.0",
     "crosscheck-mcp": "^0.1.0",
-    "keytar": "^7.9.0",
     "undici": "^7.0.0"
   },
   "devDependencies": {