crosscheck-cli 0.0.6

package/dist/heartbeat.js

@@ -0,0 +1,88 @@
+/**
+ * Heartbeat scheduler. Runs every 24h from a long-lived `crosscheck serve`
+ * process; tolerates up to 72h of network failure before locking the CLI
+ * out (matches the server's grace window).
+ *
+ * On `status: "revoked"` the CLI must refuse to make further calls and
+ * surface the reason ("your subscription was canceled", "this machine was
+ * deactivated from the dashboard", etc.) — heartbeat is the only way the
+ * server gets to revoke a seat that's already activated.
+ */
+import { request } from "undici";
+import { SERVER_URL, HEARTBEAT_INTERVAL_MS, HEARTBEAT_FAIL_OPEN_MS } from "./config.js";
+import { getSecret, setSecret } from "./keychain.js";
+const state = {
+    lastOkAt: null,
+    status: "ok",
+    message: null,
+};
+export function currentState() {
+    return state;
+}
+export function isAllowedToRun(now = Date.now()) {
+    if (state.status === "revoked")
+        return false;
+    // past_due continues to work within the grace window; revoked never works.
+    if (state.lastOkAt == null)
+        return true; // never heartbeated yet — allow first run
+    return now - state.lastOkAt < HEARTBEAT_FAIL_OPEN_MS;
+}
+export async function runHeartbeat() {
+    const jwt = await getSecret("jwt");
+    if (!jwt)
+        throw new Error("Not activated. Run `crosscheck activate <token>` first.");
+    const res = await request(`${SERVER_URL}/api/crosscheck/heartbeat`, {
+        method: "POST",
+        headers: {
+            authorization: `Bearer ${jwt}`,
+            "content-type": "application/json",
+        },
+        body: JSON.stringify({}),
+    });
+    const body = (await res.body.json());
+    if (res.statusCode === 401) {
+        state.status = "revoked";
+        state.message = "JWT no longer valid. Re-activate.";
+        return body;
+    }
+    state.status = body.status;
+    state.message = body.reason ?? null;
+    if (body.status === "ok") {
+        state.lastOkAt = Date.now();
+        if (body.refreshJwt)
+            await setSecret("jwt", body.refreshJwt);
+    }
+    return body;
+}
+/** Long-running scheduler. Returns a stop fn. */
+export function startScheduler() {
+    let stopped = false;
+    let timer = null;
+    const tick = async () => {
+        if (stopped)
+            return;
+        try {
+            await runHeartbeat();
+        }
+        catch (err) {
+            // Network error — don't change state.status, let isAllowedToRun fall
+            // back to the fail-open window.
+            // eslint-disable-next-line no-console
+            console.error("[heartbeat] network error:", err instanceof Error ? err.message : err);
+        }
+        finally {
+            if (!stopped) {
+                timer = setTimeout(tick, HEARTBEAT_INTERVAL_MS);
+            }
+        }
+    };
+    // Fire once on start so the user sees status quickly, then on the
+    // 24h cadence.
+    void tick();
+    return () => {
+        stopped = true;
+        if (timer)
+            clearTimeout(timer);
+    };
+}
+//# sourceMappingURL=heartbeat.js.map

package/dist/heartbeat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"heartbeat.js","sourceRoot":"","sources":["../src/heartbeat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,QAAQ,CAAC;AAEjC,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACxF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAgBrD,MAAM,KAAK,GAAmB;IAC5B,QAAQ,EAAE,IAAI;IACd,MAAM,EAAE,IAAI;IACZ,OAAO,EAAE,IAAI;CACd,CAAC;AAEF,MAAM,UAAU,YAAY;IAC1B,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAc,IAAI,CAAC,GAAG,EAAE;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7C,2EAA2E;IAC3E,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC,CAAC,0CAA0C;IACnF,OAAO,GAAG,GAAG,KAAK,CAAC,QAAQ,GAAG,sBAAsB,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAErF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,UAAU,2BAA2B,EAAE;QAClE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;KACzB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAsB,CAAC;IAE1D,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,EAAE,CAAC;QAC3B,KAAK,CAAC,MAAM,GAAG,SAAS,CAAC;QACzB,KAAK,CAAC,OAAO,GAAG,mCAAmC,CAAC;QACpD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,UAAU;YAAE,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,iDAAiD;AACjD,MAAM,UAAU,cAAc;IAC5B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,KAAK,GAA0B,IAAI,CAAC;IAExC,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE;QACtB,IAAI,OAAO;YAAE,OAAO;QACpB,IAAI,CAAC;YACH,MAAM,YAAY,EAAE,CAAC;QACvB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qEAAqE;YACrE,gCAAgC;YAChC,sCAAsC;YACtC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACxF,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IAEF,kEAAkE;IAClE,eAAe;IACf,KAAK,IAAI,EAAE,CAAC;IAEZ,OAAO,GAAG,EAAE;QACV,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC"}

package/dist/install.js

@@ -0,0 +1,86 @@
+/**
+ * One-command install orchestrator — the path documented for Claude Code in
+ * VS Code. Run as `npx -y crosscheck-cli@latest install` (Claude Code will
+ * run this for you when you ask it to "Install Crosscheck").
+ *
+ * Steps:
+ *   1. Node version sanity check.
+ *   2. Activate this machine (browser device-auth) — skipped if already
+ *      activated with a valid license.
+ *   3. Set up provider keys (browser / terminal / env import).
+ *   4. Register the MCP server with Claude Code (user scope).
+ *   5. Print next steps.
+ *
+ * Each step is resilient: a failure prints a clear message and the user can
+ * re-run `crosscheck install` (it's idempotent) or the individual subcommand.
+ */
+import { activate } from "./activate.js";
+import { runKeysSetup } from "./keys-setup.js";
+import { registerMcpServer } from "./mcp-register.js";
+import { getSecret } from "./keychain.js";
+import { verifyJwt } from "./jwt.js";
+function log(s = "") {
+    // eslint-disable-next-line no-console
+    console.log(s);
+}
+function step(n, total, title) {
+    log("");
+    log(`[${n}/${total}] ${title}`);
+}
+function checkNode() {
+    const major = Number.parseInt(process.versions.node.split(".")[0] ?? "0", 10);
+    if (major < 20) {
+        log(`✗ Node ${process.versions.node} detected — crosscheck needs Node 20+.\n` +
+            `  Install from https://nodejs.org and re-run \`crosscheck install\`.`);
+        process.exit(1);
+    }
+}
+async function alreadyActivated() {
+    const jwt = await getSecret("jwt");
+    if (!jwt)
+        return false;
+    const v = await verifyJwt(jwt);
+    return v.ok;
+}
+export async function runInstall() {
+    const TOTAL = 4;
+    log("crosscheck — let's get you set up.");
+    checkNode();
+    // 1. Activate.
+    step(1, TOTAL, "Activate this machine");
+    if (await alreadyActivated()) {
+        log("✓ Already activated on this machine.");
+    }
+    else {
+        await activate(); // device-auth: opens the browser, polls for the token
+    }
+    // 2. Keys.
+    step(2, TOTAL, "Set up provider keys");
+    await runKeysSetup();
+    // 3. Register MCP server with Claude Code.
+    step(3, TOTAL, "Register the MCP server with Claude Code");
+    const reg = registerMcpServer();
+    if (reg.method === "cli") {
+        log("✓ Registered with Claude Code (user scope) via the claude CLI.");
+    }
+    else if (reg.method === "file") {
+        log(`✓ Registered in ${reg.configPath} (user scope).`);
+    }
+    else {
+        log("! Couldn't register automatically. Add this to your Claude Code MCP config:");
+        log("");
+        log(reg.snippet);
+        log("");
+        log(`  (reason: ${reg.reason})`);
+    }
+    // 4. Done.
+    step(4, TOTAL, "Done");
+    log("✓ crosscheck is installed.");
+    log("");
+    log("Next:");
+    log("  • Reconnect MCP servers in Claude Code (or restart it) to load crosscheck.");
+    log('  • Try it: ask Claude Code to "use crosscheck to confer on <your question>".');
+    log("  • Manage seats & machines at https://crosscheckagent.com/account");
+    log("");
+}
+//# sourceMappingURL=install.js.map

package/dist/install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install.js","sourceRoot":"","sources":["../src/install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAErC,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE;IACjB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,SAAS,IAAI,CAAC,CAAS,EAAE,KAAa,EAAE,KAAa;IACnD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,KAAK,KAAK,EAAE,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC;IAC9E,IAAI,KAAK,GAAG,EAAE,EAAE,CAAC;QACf,GAAG,CACD,UAAU,OAAO,CAAC,QAAQ,CAAC,IAAI,0CAA0C;YACvE,sEAAsE,CACzE,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,CAAC,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IAC/B,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU;IAC9B,MAAM,KAAK,GAAG,CAAC,CAAC;IAChB,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC1C,SAAS,EAAE,CAAC;IAEZ,eAAe;IACf,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,uBAAuB,CAAC,CAAC;IACxC,IAAI,MAAM,gBAAgB,EAAE,EAAE,CAAC;QAC7B,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,MAAM,QAAQ,EAAE,CAAC,CAAC,sDAAsD;IAC1E,CAAC;IAED,WAAW;IACX,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,sBAAsB,CAAC,CAAC;IACvC,MAAM,YAAY,EAAE,CAAC;IAErB,2CAA2C;IAC3C,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,0CAA0C,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;QACzB,GAAG,CAAC,gEAAgE,CAAC,CAAC;IACxE,CAAC;SAAM,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACjC,GAAG,CAAC,mBAAmB,GAAG,CAAC,UAAU,gBAAgB,CAAC,CAAC;IACzD,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,6EAA6E,CAAC,CAAC;QACnF,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACjB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,cAAc,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,WAAW;IACX,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACvB,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAClC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,OAAO,CAAC,CAAC;IACb,GAAG,CAAC,8EAA8E,CAAC,CAAC;IACpF,GAAG,CAAC,+EAA+E,CAAC,CAAC;IACrF,GAAG,CAAC,oEAAoE,CAAC,CAAC;IAC1E,GAAG,CAAC,EAAE,CAAC,CAAC;AACV,CAAC"}

package/dist/jwt.js

@@ -0,0 +1,68 @@
+/**
+ * Local Ed25519 JWT verification. The activation flow stores the JWT in the
+ * keychain along with the public key that signed it; every subsequent CLI
+ * invocation parses + verifies it locally with the keychain-stored public
+ * key before making any privileged decision (e.g., whether to keep running,
+ * whether to refresh on heartbeat).
+ *
+ * No network round-trip on the hot path — heartbeats are scheduled, not
+ * per-call. This is the offline-tolerance the design depends on.
+ *
+ * Public-key source precedence:
+ *   1. Keychain entry "jwtPublicKey" (set by activate.ts on first activation)
+ *   2. CROSSCHECK_JWT_PUBLIC_KEY env var (dev override)
+ *   3. Fall back to bundled config.ts constant (empty by default; deprecated)
+ *
+ * verifyJwt is async because it reads from the OS keychain. Callers must
+ * await it. The first call caches the resolved KeyObject in memory.
+ */
+import crypto from "node:crypto";
+import { getSecret } from "./keychain.js";
+import { EMBEDDED_PUBLIC_KEY_PEM } from "./config.js";
+function fromB64url(s) {
+    const pad = s.length % 4 === 0 ? "" : "=".repeat(4 - (s.length % 4));
+    return Buffer.from(s.replace(/-/g, "+").replace(/_/g, "/") + pad, "base64");
+}
+let _cached = null;
+async function resolvePublicKey() {
+    if (_cached)
+        return _cached;
+    let pem = (await getSecret("jwtPublicKey")) ||
+        process.env.CROSSCHECK_JWT_PUBLIC_KEY ||
+        EMBEDDED_PUBLIC_KEY_PEM ||
+        "";
+    if (!pem) {
+        throw new Error("No JWT public key available. Re-run `crosscheck activate <token>` to fetch one.");
+    }
+    // Tolerate "\n" escaped form (common when keys are stored in env files).
+    if (pem.includes("\\n"))
+        pem = pem.replace(/\\n/g, "\n");
+    _cached = crypto.createPublicKey(pem);
+    return _cached;
+}
+export async function verifyJwt(jwt) {
+    const [body, sig] = jwt.split(".");
+    if (!body || !sig)
+        return { ok: false, reason: "malformed_jwt" };
+    let valid = false;
+    try {
+        const pub = await resolvePublicKey();
+        valid = crypto.verify(null, Buffer.from(body), pub, fromB64url(sig));
+    }
+    catch {
+        valid = false;
+    }
+    if (!valid)
+        return { ok: false, reason: "bad_signature" };
+    try {
+        const parsed = JSON.parse(fromB64url(body).toString("utf8"));
+        if (typeof parsed.exp !== "number" || Date.now() > parsed.exp) {
+            return { ok: false, reason: "expired" };
+        }
+        return { ok: true, payload: parsed };
+    }
+    catch {
+        return { ok: false, reason: "bad_json" };
+    }
+}
+//# sourceMappingURL=jwt.js.map

package/dist/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.js","sourceRoot":"","sources":["../src/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAatD,SAAS,UAAU,CAAC,CAAS;IAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,IAAI,OAAO,GAA4B,IAAI,CAAC;AAE5C,KAAK,UAAU,gBAAgB;IAC7B,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,IAAI,GAAG,GACL,CAAC,MAAM,SAAS,CAAC,cAAc,CAAC,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACrC,uBAAuB;QACvB,EAAE,CAAC;IACL,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,iFAAiF,CAClF,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACzD,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,GAAW;IAKX,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACnC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IACjE,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,gBAAgB,EAAE,CAAC;QACrC,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAwB,CAAC;QACpF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;YAC9D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;AACH,CAAC"}

package/dist/keychain.js

@@ -0,0 +1,34 @@
+/**
+ * OS keychain abstraction. Uses `keytar` on every platform:
+ *   - macOS: Keychain
+ *   - Windows: Credential Manager
+ *   - Linux: libsecret (GNOME Keyring / KWallet)
+ *
+ * On unsupported environments (CI, headless Linux without a keyring), falls
+ * back to an Argon2id-encrypted file under ~/.config/crosscheck/.
+ *
+ * The fallback path is documented in the EULA: keys never leave the local
+ * machine, only their storage form differs.
+ */
+import keytar from "keytar";
+import { KEYCHAIN_SERVICE } from "./config.js";
+export async function setSecret(name, value) {
+    // TODO(phase-3.5): implement Argon2id-encrypted file fallback for
+    // environments where keytar can't talk to a system keyring (CI, some
+    // headless Linux containers). For v1 we assume a working keychain.
+    await keytar.setPassword(KEYCHAIN_SERVICE, name, value);
+}
+export async function getSecret(name) {
+    return await keytar.getPassword(KEYCHAIN_SERVICE, name);
+}
+export async function deleteSecret(name) {
+    return await keytar.deletePassword(KEYCHAIN_SERVICE, name);
+}
+/**
+ * Convenience: list every Crosscheck (XC)-owned credential. Used by `crosscheck
+ * keys list` and by deactivation to wipe everything in one pass.
+ */
+export async function listSecrets() {
+    return await keytar.findCredentials(KEYCHAIN_SERVICE);
+}
+//# sourceMappingURL=keychain.js.map

package/dist/keychain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../src/keychain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACzD,kEAAkE;IAClE,qEAAqE;IACrE,mEAAmE;IACnE,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IAC1C,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAY;IAC7C,OAAO,MAAM,MAAM,CAAC,cAAc,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW;IAG/B,OAAO,MAAM,MAAM,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;AACxD,CAAC"}

package/dist/keys-browser-flow.js

@@ -0,0 +1,218 @@
+/**
+ * Browser-paste flow for upstream LLM keys. Same trust pattern as
+ * `gh auth login`: the CLI spins up a localhost HTTP server, opens a
+ * Crosscheck (XC)-served form in the user's browser, and the form POSTs the
+ * pasted key directly back to localhost. Crosscheck's servers never
+ * see the value.
+ *
+ * Why this exists: pasting a 200-character API key into a terminal is
+ * (a) easy to screw up (newlines, shell history), (b) reveals the value
+ * on-screen, and (c) culturally foreign to non-CLI-native users. The
+ * browser form is masked-input, has Cmd-V "Paste from Clipboard"
+ * affordances built in, and is what every developer is used to from
+ * console.anthropic.com etc.
+ *
+ * Security properties:
+ *   - State token (32 bytes urlsafe) bound at server-start. Mismatched
+ *     state → CLI rejects the POST.
+ *   - Loopback only — server binds to 127.0.0.1 (NOT 0.0.0.0). Other
+ *     machines on the LAN can't hit it.
+ *   - Browser → CLI path is HTTP, but it's loopback, so it never crosses
+ *     the network. Modern browsers special-case localhost CORS.
+ *   - 5-minute timeout. Server self-terminates after the value lands or
+ *     the deadline elapses.
+ *   - Server accepts exactly one valid POST. Subsequent calls 410.
+ *   - Provider list pinned at compile time on both sides (server + CLI)
+ *     so an attacker-controlled query string can't store a key under a
+ *     made-up provider name.
+ */
+import crypto from "node:crypto";
+import http from "node:http";
+import { spawn } from "node:child_process";
+import { SERVER_URL } from "./config.js";
+const SUPPORTED_PROVIDERS = new Set([
+    "anthropic",
+    "openai",
+    "gemini",
+    "grok",
+    "groq",
+    "deepseek",
+    "mistral",
+]);
+const FLOW_TIMEOUT_MS = 5 * 60 * 1000;
+const MAX_KEY_BYTES = 4096; // generous; real keys are << this
+/**
+ * Run the browser flow. Returns the captured key on success; throws on
+ * timeout, invalid state, or server error.
+ */
+export async function captureKeyViaBrowser(args) {
+    if (!SUPPORTED_PROVIDERS.has(args.provider)) {
+        throw new Error(`Unsupported provider: ${args.provider}`);
+    }
+    const state = crypto.randomBytes(24).toString("base64url");
+    const pageBase = args.pageBaseUrl ?? `${SERVER_URL}/cli/keys`;
+    return new Promise((resolve, reject) => {
+        let captured = null;
+        let consumed = false;
+        const server = http.createServer((req, res) => {
+            // CORS preflight from the browser. The page lives on
+            // crosscheckagent.com; the fetch to localhost triggers a preflight.
+            if (req.method === "OPTIONS") {
+                res.writeHead(204, corsHeaders(pageBase));
+                res.end();
+                return;
+            }
+            if (req.method !== "POST") {
+                res.writeHead(405, { "content-type": "text/plain", ...corsHeaders(pageBase) });
+                res.end("method not allowed");
+                return;
+            }
+            if (consumed) {
+                res.writeHead(410, { "content-type": "text/plain", ...corsHeaders(pageBase) });
+                res.end("already used");
+                return;
+            }
+            const url = new URL(req.url ?? "/", `http://localhost`);
+            if (url.pathname !== "/key") {
+                res.writeHead(404, { "content-type": "text/plain", ...corsHeaders(pageBase) });
+                res.end("not found");
+                return;
+            }
+            // Body cap so a malicious page can't OOM us.
+            let received = 0;
+            const chunks = [];
+            req.on("data", (chunk) => {
+                received += chunk.length;
+                if (received > MAX_KEY_BYTES) {
+                    res.writeHead(413, { "content-type": "text/plain", ...corsHeaders(pageBase) });
+                    res.end("payload too large");
+                    req.destroy();
+                    return;
+                }
+                chunks.push(chunk);
+            });
+            req.on("end", () => {
+                if (req.destroyed)
+                    return;
+                let body;
+                try {
+                    body = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                }
+                catch {
+                    res.writeHead(400, { "content-type": "text/plain", ...corsHeaders(pageBase) });
+                    res.end("invalid json");
+                    return;
+                }
+                if (body.state !== state) {
+                    res.writeHead(403, { "content-type": "text/plain", ...corsHeaders(pageBase) });
+                    res.end("state mismatch");
+                    return;
+                }
+                if (body.provider !== args.provider) {
+                    res.writeHead(400, { "content-type": "text/plain", ...corsHeaders(pageBase) });
+                    res.end("provider mismatch");
+                    return;
+                }
+                const value = typeof body.value === "string" ? body.value.trim() : "";
+                if (!value) {
+                    res.writeHead(400, { "content-type": "text/plain", ...corsHeaders(pageBase) });
+                    res.end("empty key");
+                    return;
+                }
+                consumed = true;
+                captured = { provider: args.provider, value };
+                res.writeHead(200, { "content-type": "application/json", ...corsHeaders(pageBase) });
+                res.end(JSON.stringify({ ok: true }));
+                // Close the server shortly after responding so the test can finish.
+                setTimeout(() => {
+                    server.close();
+                }, 100);
+            });
+        });
+        server.on("error", (err) => reject(err));
+        // Bind to a random port on loopback only (127.0.0.1, not 0.0.0.0).
+        server.listen(0, "127.0.0.1", () => {
+            const addr = server.address();
+            if (!addr || typeof addr === "string") {
+                server.close();
+                reject(new Error("Could not determine local port."));
+                return;
+            }
+            const port = addr.port;
+            const callback = `http://127.0.0.1:${port}/key`;
+            const pageUrl = `${pageBase}?provider=${encodeURIComponent(args.provider)}&state=${encodeURIComponent(state)}&callback=${encodeURIComponent(callback)}`;
+            printAndOpen(args.provider, pageUrl);
+            // Timeout.
+            const timeoutId = setTimeout(() => {
+                if (!captured) {
+                    server.close();
+                    reject(new Error(`Timed out waiting for the browser. Re-run \`crosscheck keys add ${args.provider}\` to try again.`));
+                }
+            }, FLOW_TIMEOUT_MS);
+            server.on("close", () => {
+                clearTimeout(timeoutId);
+                if (captured)
+                    resolve(captured);
+                // If captured is null at this point and no error was thrown,
+                // the timeout above already rejected.
+            });
+        });
+    });
+}
+function corsHeaders(origin) {
+    // Lock the allowed origin to the served page's origin so a malicious
+    // page on another origin can't POST to the loopback server. We use the
+    // origin form (scheme + host) not the full URL with path.
+    let allow = "*";
+    try {
+        const u = new URL(origin);
+        allow = `${u.protocol}//${u.host}`;
+    }
+    catch {
+        // Fall through with *.
+    }
+    return {
+        "access-control-allow-origin": allow,
+        "access-control-allow-methods": "POST, OPTIONS",
+        "access-control-allow-headers": "content-type",
+        "access-control-max-age": "600",
+        "vary": "origin",
+    };
+}
+function printAndOpen(provider, pageUrl) {
+    // eslint-disable-next-line no-console
+    console.log("");
+    // eslint-disable-next-line no-console
+    console.log(`  Open this URL in your browser to paste your ${provider} key:`);
+    // eslint-disable-next-line no-console
+    console.log(`    ${pageUrl}`);
+    // eslint-disable-next-line no-console
+    console.log("");
+    // eslint-disable-next-line no-console
+    console.log("  Waiting for the browser… (5 min timeout; Ctrl-C to cancel)");
+    // eslint-disable-next-line no-console
+    console.log("");
+    // Best-effort browser auto-open. Failure is silent — the user can copy
+    // the URL above. We don't shell out to fancy `open` packages so the CLI
+    // stays dep-light.
+    const opener = process.platform === "darwin"
+        ? "open"
+        : process.platform === "win32"
+            ? "cmd"
+            : "xdg-open";
+    const args = process.platform === "win32" ? ["/c", "start", "", pageUrl] : [pageUrl];
+    try {
+        const child = spawn(opener, args, {
+            stdio: "ignore",
+            detached: true,
+        });
+        child.unref();
+        child.on("error", () => {
+            // Swallow — the URL is printed above, user can click it.
+        });
+    }
+    catch {
+        /* ignore */
+    }
+}
+//# sourceMappingURL=keys-browser-flow.js.map

package/dist/keys-browser-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-browser-flow.js","sourceRoot":"","sources":["../src/keys-browser-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,WAAW;IACX,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,MAAM;IACN,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACtC,MAAM,aAAa,GAAG,IAAI,CAAC,CAAC,kCAAkC;AAI9D;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAO1C;IACC,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC5D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,IAAI,GAAG,UAAU,WAAW,CAAC;IAE9D,OAAO,IAAI,OAAO,CAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAClD,IAAI,QAAQ,GAAuB,IAAI,CAAC;QACxC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YAC5C,qDAAqD;YACrD,oEAAoE;YACpE,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;gBAC1C,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACT,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC1B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC/E,GAAG,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBAC9B,OAAO;YACT,CAAC;YACD,IAAI,QAAQ,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC/E,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;gBACxB,OAAO;YACT,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;YACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;gBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC/E,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACT,CAAC;YAED,6CAA6C;YAC7C,IAAI,QAAQ,GAAG,CAAC,CAAC;YACjB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;gBAC/B,QAAQ,IAAI,KAAK,CAAC,MAAM,CAAC;gBACzB,IAAI,QAAQ,GAAG,aAAa,EAAE,CAAC;oBAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC/E,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBAC7B,GAAG,CAAC,OAAO,EAAE,CAAC;oBACd,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;YACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,IAAI,GAAG,CAAC,SAAS;oBAAE,OAAO;gBAC1B,IAAI,IAA2D,CAAC;gBAChE,IAAI,CAAC;oBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC;oBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC/E,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC/E,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBAC1B,OAAO;gBACT,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC/E,GAAG,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;oBAC7B,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;oBAC/E,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBACD,QAAQ,GAAG,IAAI,CAAC;gBAChB,QAAQ,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;gBAC9C,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACrF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtC,oEAAoE;gBACpE,UAAU,CAAC,GAAG,EAAE;oBACd,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC,EAAE,GAAG,CAAC,CAAC;YACV,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAEzC,mEAAmE;QACnE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,MAAM,CAAC,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC,CAAC;gBACrD,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;YACvB,MAAM,QAAQ,GAAG,oBAAoB,IAAI,MAAM,CAAC;YAChD,MAAM,OAAO,GAAG,GAAG,QAAQ,aAAa,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,kBAAkB,CAAC,KAAK,CAAC,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAExJ,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAErC,WAAW;YACX,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE;gBAChC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CACJ,IAAI,KAAK,CACP,mEAAmE,IAAI,CAAC,QAAQ,kBAAkB,CACnG,CACF,CAAC;gBACJ,CAAC;YACH,CAAC,EAAE,eAAe,CAAC,CAAC;YAEpB,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACtB,YAAY,CAAC,SAAS,CAAC,CAAC;gBACxB,IAAI,QAAQ;oBAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBAChC,6DAA6D;gBAC7D,sCAAsC;YACxC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IACjC,qEAAqE;IACrE,uEAAuE;IACvE,0DAA0D;IAC1D,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,KAAK,GAAG,GAAG,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IACD,OAAO;QACL,6BAA6B,EAAE,KAAK;QACpC,8BAA8B,EAAE,eAAe;QAC/C,8BAA8B,EAAE,cAAc;QAC9C,wBAAwB,EAAE,KAAK;QAC/B,MAAM,EAAE,QAAQ;KACjB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAe;IACrD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,iDAAiD,QAAQ,OAAO,CAAC,CAAC;IAC9E,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IAC9B,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,uEAAuE;IACvE,wEAAwE;IACxE,mBAAmB;IACnB,MAAM,MAAM,GACV,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,UAAU,CAAC;IACnB,MAAM,IAAI,GACR,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1E,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE;YAChC,KAAK,EAAE,QAAQ;YACf,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACrB,yDAAyD;QAC3D,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC"}

package/dist/keys-setup.js

@@ -0,0 +1,104 @@
+/**
+ * Interactive upstream-key setup wizard. For each provider in the panel it
+ * offers three ways to add a key, none of which send the key to our servers:
+ *
+ *   [b] browser — opens a crosscheck-served form that POSTs the key directly
+ *       to a localhost loopback server we run; key lands in the OS keychain.
+ *   [t] terminal — paste it here (read from stdin).
+ *   [e] env — import a key already present in the environment
+ *       (ANTHROPIC_API_KEY, OPENAI_API_KEY, …).
+ *   [s] skip.
+ *
+ * Keys are stored ONLY in the OS keychain and never transit crosscheckagent.com.
+ */
+import readline from "node:readline/promises";
+import { stdin, stdout } from "node:process";
+import { getSecret, setSecret } from "./keychain.js";
+import { captureKeyViaBrowser } from "./keys-browser-flow.js";
+/** The default panel. `grok` maps to XAI_API_KEY inside the engine. */
+const PANEL = [
+    { key: "anthropic", label: "Anthropic (Claude)", env: "ANTHROPIC_API_KEY" },
+    { key: "openai", label: "OpenAI (GPT)", env: "OPENAI_API_KEY" },
+    { key: "gemini", label: "Google (Gemini)", env: "GEMINI_API_KEY" },
+    { key: "grok", label: "xAI (Grok)", env: "XAI_API_KEY" },
+];
+function log(s = "") {
+    // eslint-disable-next-line no-console
+    console.log(s);
+}
+export async function runKeysSetup() {
+    log("");
+    log("Set up your provider keys. They're stored in your OS keychain and");
+    log("never sent to Crosscheck — you bring your own keys.");
+    log("");
+    const rl = readline.createInterface({ input: stdin, output: stdout });
+    let configured = 0;
+    try {
+        for (const p of PANEL) {
+            const existing = await getSecret(`key:${p.key}`);
+            if (existing) {
+                const ans = (await rl.question(`• ${p.label}: already set. Replace? [y/N] `))
+                    .trim()
+                    .toLowerCase();
+                if (ans !== "y" && ans !== "yes") {
+                    configured += 1;
+                    continue;
+                }
+            }
+            const fromEnv = process.env[p.env];
+            const options = fromEnv ? "[b]rowser / [t]erminal / [e]nv / [s]kip" : "[b]rowser / [t]erminal / [s]kip";
+            const envNote = fromEnv ? ` (found ${p.env} in your environment)` : "";
+            const choice = (await rl.question(`• ${p.label}${envNote}\n  ${options}: `))
+                .trim()
+                .toLowerCase();
+            if (choice === "s" || choice === "skip" || choice === "") {
+                continue;
+            }
+            if (choice === "e" || choice === "env") {
+                if (fromEnv) {
+                    await setSecret(`key:${p.key}`, fromEnv.trim());
+                    log(`  ✓ Imported ${p.label} key from ${p.env}.`);
+                    configured += 1;
+                }
+                else {
+                    log(`  (no ${p.env} in environment — skipped)`);
+                }
+                continue;
+            }
+            if (choice === "t" || choice === "terminal" || choice === "paste") {
+                const value = (await rl.question(`  Paste your ${p.label} key: `)).trim();
+                if (value) {
+                    await setSecret(`key:${p.key}`, value);
+                    log(`  ✓ Stored ${p.label} key in your OS keychain.`);
+                    configured += 1;
+                }
+                else {
+                    log("  (empty — skipped)");
+                }
+                continue;
+            }
+            // Default: browser flow.
+            try {
+                const captured = await captureKeyViaBrowser({ provider: p.key });
+                await setSecret(`key:${p.key}`, captured.value);
+                log(`  ✓ Stored ${p.label} key in your OS keychain.`);
+                configured += 1;
+            }
+            catch (err) {
+                log(`  ✗ ${err instanceof Error ? err.message : String(err)} — skipped.`);
+            }
+        }
+    }
+    finally {
+        rl.close();
+    }
+    log("");
+    if (configured === 0) {
+        log("No keys configured yet. Run `crosscheck keys setup` any time to add them.");
+    }
+    else {
+        log(`Configured ${configured} provider${configured === 1 ? "" : "s"}.`);
+    }
+    return { configured };
+}
+//# sourceMappingURL=keys-setup.js.map

package/dist/keys-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys-setup.js","sourceRoot":"","sources":["../src/keys-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,QAAQ,MAAM,wBAAwB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAU9D,uEAAuE;AACvE,MAAM,KAAK,GAAe;IACxB,EAAE,GAAG,EAAE,WAAW,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,mBAAmB,EAAE;IAC3E,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,gBAAgB,EAAE;IAC/D,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,gBAAgB,EAAE;IAClE,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,GAAG,EAAE,aAAa,EAAE;CACzD,CAAC;AAEF,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE;IACjB,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY;IAChC,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,mEAAmE,CAAC,CAAC;IACzE,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAC3D,GAAG,CAAC,EAAE,CAAC,CAAC;IAER,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACtE,IAAI,UAAU,GAAG,CAAC,CAAC;IAEnB,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YACjD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,gCAAgC,CAAC,CAAC;qBAC1E,IAAI,EAAE;qBACN,WAAW,EAAE,CAAC;gBACjB,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;oBACjC,UAAU,IAAI,CAAC,CAAC;oBAChB,SAAS;gBACX,CAAC;YACH,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,yCAAyC,CAAC,CAAC,CAAC,iCAAiC,CAAC;YACxG,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,GAAG,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,MAAM,MAAM,GAAG,CACb,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,OAAO,OAAO,OAAO,IAAI,CAAC,CAC5D;iBACE,IAAI,EAAE;iBACN,WAAW,EAAE,CAAC;YAEjB,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,EAAE,EAAE,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;gBACvC,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;oBAChD,GAAG,CAAC,gBAAgB,CAAC,CAAC,KAAK,aAAa,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;oBAClD,UAAU,IAAI,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,SAAS,CAAC,CAAC,GAAG,4BAA4B,CAAC,CAAC;gBAClD,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;gBAClE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC1E,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;oBACvC,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,2BAA2B,CAAC,CAAC;oBACtD,UAAU,IAAI,CAAC,CAAC;gBAClB,CAAC;qBAAM,CAAC;oBACN,GAAG,CAAC,qBAAqB,CAAC,CAAC;gBAC7B,CAAC;gBACD,SAAS;YACX,CAAC;YAED,yBAAyB;YACzB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;gBACjE,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAChD,GAAG,CAAC,cAAc,CAAC,CAAC,KAAK,2BAA2B,CAAC,CAAC;gBACtD,UAAU,IAAI,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;YAC5E,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,UAAU,KAAK,CAAC,EAAE,CAAC;QACrB,GAAG,CAAC,2EAA2E,CAAC,CAAC;IACnF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,cAAc,UAAU,YAAY,UAAU,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACxB,CAAC"}