passclaude 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 passClaude contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,195 @@
-# Temporary Holding Version
+<p align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="https://raw.githubusercontent.com/daniardel/passclaude/main/brand/logo/lockup-on-violet.svg">
+    <img src="https://raw.githubusercontent.com/daniardel/passclaude/main/brand/logo/lockup.svg" alt="passClaude" width="420">
+  </picture>
+</p>
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<h3 align="center">Claude logs you in. Its eyes stay shut.</h3>
+
+<p align="center">Let Claude Code log into websites and use your API keys without ever seeing them.</p>
+
+<p align="center">
+  <a href="https://www.npmjs.com/package/passclaude"><img src="https://img.shields.io/npm/v/passclaude?color=5B2EFF" alt="npm"></a>
+  <a href="https://github.com/daniardel/passclaude/actions/workflows/test.yml"><img src="https://github.com/daniardel/passclaude/actions/workflows/test.yml/badge.svg" alt="tests"></a>
+  <img src="https://img.shields.io/badge/platform-Windows-17132E" alt="platform: Windows">
+  <a href="https://github.com/daniardel/passclaude/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/passclaude?color=FFC92E" alt="license"></a>
+</p>
+
+You never paste a password into the chat. You type it once, into a popup on your PC or a one-time encrypted link on your phone. After that Claude can *use* it, but passClaude's tools never return the value, so it stays out of the conversation, the transcript and the model. There are a few ways it can still get out: read "Not protected" below.
+
+- **Website logins:** Claude clicks the password box and passClaude types the password, but only on the site it belongs to.
+- **API keys in commands:** Claude runs the command, the key goes in as an environment variable or is typed into a login prompt, and it is masked in the output.
+- **Works from your phone** with Claude Code Remote Control, including saving new secrets.
+- **Free and open source.** No password manager, no account. Windows.
+
+passClaude is an independent project. It is not made by or affiliated with Anthropic.
+
+## Install
+
+You need Windows 10 or 11, [Node.js](https://nodejs.org) 20 or newer and [Claude Code](https://docs.claude.com/en/docs/claude-code/setup). For website logins you also need Chrome with Claude in Chrome.
+
+**One click:** download [install-passclaude.cmd](https://github.com/daniardel/passclaude/releases/latest/download/install-passclaude.cmd) and double-click it. A small window checks that Node.js and Claude Code are there and adds passClaude. Windows may warn that the file comes from the internet: choose "More info", then "Run anyway". It's a plain text file (a few batch lines that start Windows PowerShell on the rest), so you can open it in Notepad to read it first.
+
+**One command:**
+
+```
+claude mcp add --scope user passclaude -- npx -y passclaude
+```
+
+**Or ask Claude:** paste this into Claude Code: *Install passClaude for me by running `claude mcp add --scope user passclaude -- npx -y passclaude`.*
+
+Then restart Claude Code.
+
+## What to say to Claude
+
+| You say | What happens |
+|---|---|
+| "Save my Netflix password" | A password popup opens on your PC. You type it there. |
+| "Save my GitHub token. I'm on my phone." | Claude shows a one-time link. You open it on your phone and type the token. |
+| "Save my GitHub token, I'll type it on my phone" (while at the PC) | Same link, and a window on your PC shows it as a QR code to scan. It closes once the token arrives. |
+| "Log into Netflix" | Claude opens the login page and clicks the password box. passClaude types the password, and a note in the corner of the screen says so. Claude clicks Sign in. |
+| "List my GitHub repos with my GitHub token" | Claude runs the command with your token in `$env:GITHUB_TOKEN`. The output shows `••••(github)` where the token would be. |
+| "Log the GitHub CLI in with my GitHub token" | Claude runs `gh auth login --with-token` and passClaude types the token into it, the way you would at the prompt. Works for any command that reads a token or password from its input, like `docker login --password-stdin`. |
+| "What passwords do you have?" | Names and sites only. Never values. |
+
+Commands run in Windows PowerShell (`powershell.exe`, version 5.1), so Claude writes PowerShell syntax such as `$env:GITHUB_TOKEN`, not `$GITHUB_TOKEN` or `%GITHUB_TOKEN%`.
+
+## How it works
+
+```
+ You ─ type once ─▶ PC popup, or phone link (encrypted on the phone)
+                        │
+                        ▼
+          Windows Credential Manager  (entries named passclaude:<name>)
+                        │
+ Claude ─ type_secret ──┼──▶ checks Chrome is on the right site and a password box is focused ──▶ types it
+ Claude ─ run_with_secret ─▶ command gets the key as an env var ──▶ output is masked ──▶ Claude
+```
+
+passClaude is an MCP server that runs on your PC. Its tools never return a secret, so passClaude never puts one in the chat. It can't stop every other way a secret can leak: see "Not protected" below.
+
+| Tool | What it does |
+|---|---|
+| `list_secrets` | Names, kinds and sites of saved secrets |
+| `add_secret` | Opens a password popup on the PC |
+| `add_secret_from_phone` | Gives a one-time link to type the secret on your phone, optionally shown as a QR code on the PC |
+| `check_phone_secret` | Waits up to 50 seconds for the phone to send it |
+| `type_secret` | Types a website password into Chrome, only on its site |
+| `run_with_secret` | Runs a Windows PowerShell command with secrets as environment variables or typed into its input, output masked |
+| `delete_secret` | Deletes a secret |
+
+Commands stop after 2 minutes unless Claude asks for longer (10 minutes at most). Output is cut off at 1 MB per stream.
+
+Website passwords and command secrets are kept apart: a website password can only be typed, and only on its own site; a command secret can only be used in commands.
+
+## Security: what it protects and what it doesn't
+
+**Protected**
+- No passClaude tool returns a secret. Secrets don't appear in tool results, so passClaude itself never sends them to the model, your transcripts or Anthropic's servers. The ways a secret can still get out are listed under "Not protected".
+- Website passwords are typed only when Chrome's address bar shows the site they were saved for (subdomains included, lookalikes like `netflix.com.evil.ru` refused) and only into a password box.
+- A saved secret is never replaced without a delete first.
+- Phone links are end-to-end encrypted (ECDH P-256 + AES-256-GCM, done in your phone's browser). The relay ([ntfy.sh](https://ntfy.sh)) only sees scrambled data. Each link saves one secret and expires after 5 minutes (but see the link note below).
+
+**Not protected (please read)**
+- Claude Code can run shell commands as you. A Claude that is deliberately trying, or that has been tricked by a malicious web page or file, could read Windows Credential Manager directly. The optional guard (below) blocks the obvious ways. It's a speed bump, not a wall.
+- A tricked Claude could send a command secret somewhere inside the command it runs. Masking protects the output, not network calls. Keep Claude Code's approval prompt on for `run_with_secret` and read the command before you approve it.
+- Masking hides the whole secret in the output, its common encodings (base64, URL-encoded, hex, JSON-escaped), and any piece of 8 or more characters of them, also when Windows PowerShell wraps a long value onto the next line or shortens it with `...`. It can't catch pieces shorter than 8 characters, other encodings, or a value that the command deliberately reshapes, for example by reversing it, splitting it up or re-encoding it. Because it masks pieces, masking can occasionally also hide ordinary text that happens to match part of a secret. Read the command before you approve it.
+- Once typed, a password sits in the page's password box. Scripts on that page can read it, just like when you type it yourself. So can Claude's own browser tools: Claude in Chrome can run JavaScript on the page, or click "show password" and take a screenshot, and that puts the password in the chat. passClaude can't stop this. The site lock only limits where the password is typed. Watch what Claude does on the page after it types.
+- The phone page is served from GitHub Pages ([daniardel/passclaude-phone](https://github.com/daniardel/passclaude-phone)). Whoever controls that repo controls the page's code. You can host your own copy (see Configuration).
+- The site lock reads Chrome's address bar. It is tested with English Chrome. Other languages use a fallback that finds the address bar as the first text box outside the web page, which has not been tested in a non-English Chrome yet.
+- The one-time link appears in the chat. It contains no secret: only a public key, a random relay topic, the secret's name, kind and site, when it expires, and the relay address. But the link works like a key: anyone who sees it before you use it could send their own value to it within its 5 minutes. Open it right away. After you send, your phone page must say "Saved". If Claude says it saved but your phone page didn't, delete the secret and try again.
+- A tricked Claude could show you a fake phone link that sends what you type to someone else. The phone page can't tell a real link from a fake one. Only open a phone link right after you asked Claude to save a secret, and check the name and site it shows.
+- Claude chooses a secret's name and site. Check the site shown in the popup or on the phone page before you type. A password saved for the wrong site is typed on that wrong site.
+- Your phone's browser might offer to save what you typed in its own password manager. Tap Never if you don't want a copy there.
+- Typing needs the PC unlocked, with the login page as the visible tab of a Chrome window that isn't minimized or completely covered (for example by a full-screen game). Claude in Chrome sometimes opens pages in a background tab: if passClaude says Chrome is showing another site, switch to the login tab. Remote Control drives your PC; passClaude types on the PC, not on your phone.
+
+### Optional guard
+
+```
+npx -y passclaude install-guard
+```
+
+Shows the exact change, asks first, backs up `~/.claude/settings.json`, then adds a hook that blocks shell commands which try to read saved secrets directly (`cmdkey`, the Windows credential APIs, hidden base64 PowerShell commands and similar).
+
+The hook covers Claude Code's Bash and PowerShell tools and also passClaude's own `run_with_secret` tool. `run_with_secret` makes the same check itself, so it refuses these kinds of commands even if you never install the guard. The guard adds the same block for Claude Code's own shell tools.
+
+## Configuration
+
+| Environment variable | Default | What it's for |
+|---|---|---|
+| `PASSCLAUDE_NTFY_URL` | `https://ntfy.sh` | Relay for phone links. Point it at your own [ntfy](https://docs.ntfy.sh/install/) server if you like. |
+| `PASSCLAUDE_PAGE_URL` | `https://daniardel.github.io/passclaude-phone/` | Where phone links open. Host the page yourself and point this at it. |
+| `PASSCLAUDE_NOTIFY` | `on` | Set to `off` (or `0`, `false`, `no`) to stop the note in the corner of the screen each time passClaude types a password. |
+
+A custom relay must use https and be reachable from your phone. The page URL must be https too, because the page needs a secure connection to encrypt. To host the page yourself, copy `index.html`, `style.css`, `app.js`, `link.js`, `e2e.js` and the `brand` folder from the `docs/` folder of the GitHub repo. The page loads nothing from other sites, fonts included. The npm package only ships `docs/e2e.js`.
+
+Example:
+
+```
+claude mcp add --env PASSCLAUDE_NTFY_URL=https://ntfy.example.com --scope user passclaude -- npx -y passclaude
+```
+
+## FAQ
+
+**Does Claude really never see my password?**
+No passClaude tool returns it, and command output is masked. The project's tests check that no tool output contains a saved value, including base64 and URL-encoded copies. That is not the same as a promise that it can't leak: see "Not protected" above, for example for Claude's own browser tools and for what masking can't catch.
+
+**Where are my secrets stored?**
+In Windows Credential Manager, encrypted by Windows for your user account. You can see them in Control Panel → Credential Manager → Windows Credentials, named `passclaude:<name>`.
+
+**How do I change a password?**
+Ask Claude to delete it and save it again.
+
+**Does it press Enter after typing?**
+No. Claude clicks the sign-in button itself. That makes the login a separate step that shows up in the chat, so you can see it. With Remote Control you may not be watching the PC while it types.
+
+**Does it work on a work PC?**
+Maybe not. passClaude runs bundled PowerShell scripts. It asks PowerShell to skip the execution policy for them, but if your organization's Group Policy forces the execution policy to AllSigned or Restricted, that setting wins, the scripts can't run and passClaude won't work. AppLocker or Windows Defender Application Control (WDAC) rules can also put PowerShell in Constrained Language Mode, which blocks the C# code the scripts compile. And if your organization turns on PowerShell logging or transcription by policy, commands run with `run_with_secret` may be recorded in Windows logs, including what they print, before passClaude masks it.
+
+**Can I save a very long secret from my phone?**
+Almost always. A secret can be up to 1,280 characters, and the phone relay limits message size. Ordinary secrets of any allowed length fit. A very long secret made of Chinese, Japanese or Korean characters (over about 950) or emoji (over about 350) can be too big. If it is, the phone page says so. Use the PC popup (`add_secret`) instead.
+
+**What if my PC can't reach the phone relay?**
+Before it gives you a link, passClaude checks that your PC can connect to the relay (ntfy.sh, or your own). If it can't within 8 seconds, it says so right away instead of giving you a link whose secret could never reach your PC. Use the PC popup (`add_secret`) instead.
+
+**What should I do while it types?**
+Leave the mouse and keyboard alone for a moment. If another window comes to the front, typing stops and the password box may be partly filled: clear it and try again. A click into another box of the same window is not caught.
+
+**Mac or Linux?**
+Not yet. Windows first.
+
+**Edge or Firefox?**
+Chrome only for now.
+
+**Why not a password manager's Claude integration?**
+If you already use one with Claude, that may suit you better. passClaude is for people who want something free, with no account, that works over Remote Control.
+
+## Uninstall
+
+1. Ask Claude to delete your passClaude secrets, or remove the `passclaude:` entries in Credential Manager.
+2. Run `claude mcp remove passclaude --scope user`.
+3. If you installed the guard: remove the passClaude entry under `hooks.PreToolUse` in `~/.claude/settings.json` (a backup was saved next to it) and delete the `~/.claude/passclaude` folder.
+
+## Development
+
+```
+git clone https://github.com/daniardel/passclaude.git
+cd passclaude
+npm install
+npm test
+```
+
+To try your copy in Claude Code: `claude mcp add --scope user passclaude -- node "<this folder>\src\cli.js"`.
+
+The phone page is `docs/index.html`, `docs/style.css`, `docs/app.js`, `docs/link.js`, `docs/e2e.js` and `docs/brand/`. The live copy is in the public [passclaude-phone](https://github.com/daniardel/passclaude-phone) repo. After changing any of these files, copy them there and push, or phone links keep opening the old page. To try it locally: `node scripts/serve.js docs`.
+
+The look (colours, fonts, the padlock) lives in [`brand/`](https://github.com/daniardel/passclaude/blob/main/brand/README.md). After changing it, run `npm run brand` and commit what it writes; it also refreshes `docs/brand/`.
+
+## Reporting a security problem
+
+Please don't open a public issue. See [SECURITY.md](https://github.com/daniardel/passclaude/blob/main/SECURITY.md).
+
+## License
+
+MIT

package/assets/fonts/OFL-BricolageGrotesque.txt

@@ -0,0 +1,93 @@
+Copyright 2022 The Bricolage Grotesque Project Authors (https://github.com/ateliertriay/bricolage)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/assets/fonts/OFL-DMSans.txt

@@ -0,0 +1,93 @@
+Copyright 2014 The DM Sans Project Authors (https://github.com/googlefonts/dm-fonts)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded, 
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/assets/fonts/OFL-JetBrainsMono.txt

@@ -0,0 +1,93 @@
+Copyright 2020 The JetBrains Mono Project Authors (https://github.com/JetBrains/JetBrainsMono)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+
+This license is copied below, and is also available with a FAQ at: https://scripts.sil.org/OFL
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

package/docs/e2e.js

@@ -0,0 +1,56 @@
+// End-to-end encryption shared by the phone page (browser) and the passClaude server (Node 20+).
+// ECDH P-256 -> HKDF-SHA256 -> AES-256-GCM, using only the standard WebCrypto API.
+
+const subtle = globalThis.crypto.subtle;
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+
+export function toB64u(bytes) {
+  let s = '';
+  for (const b of new Uint8Array(bytes)) s += String.fromCharCode(b);
+  return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+export function fromB64u(str) {
+  const s = atob(String(str).replace(/-/g, '+').replace(/_/g, '/'));
+  return Uint8Array.from(s, (c) => c.charCodeAt(0));
+}
+
+export function randomTopic() {
+  return `pc-${toB64u(globalThis.crypto.getRandomValues(new Uint8Array(24)))}`;
+}
+
+export async function generateKeyPair() {
+  const pair = await subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, false, ['deriveBits']);
+  const publicKeyRaw = new Uint8Array(await subtle.exportKey('raw', pair.publicKey));
+  return { privateKey: pair.privateKey, publicKeyRaw };
+}
+
+export async function deriveKey(privateKey, peerPublicRaw, topic) {
+  const peer = await subtle.importKey('raw', peerPublicRaw, { name: 'ECDH', namedCurve: 'P-256' }, false, []);
+  const shared = await subtle.deriveBits({ name: 'ECDH', public: peer }, privateKey, 256);
+  const hkdf = await subtle.importKey('raw', shared, 'HKDF', false, ['deriveKey']);
+  return subtle.deriveKey(
+    { name: 'HKDF', hash: 'SHA-256', salt: enc.encode(topic), info: enc.encode('passclaude v1') },
+    hkdf,
+    { name: 'AES-GCM', length: 256 },
+    false,
+    ['encrypt', 'decrypt'],
+  );
+}
+
+/** Binds a message to one link and one direction, so it can't be replayed elsewhere. */
+export function aadFor({ topic, name, kind, site }, purpose) {
+  return enc.encode(`passclaude v1|${purpose}|${topic}|${name}|${kind}|${site ?? ''}`);
+}
+
+export async function seal(key, obj, aad) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const ct = await subtle.encrypt({ name: 'AES-GCM', iv, additionalData: aad }, key, enc.encode(JSON.stringify(obj)));
+  return { iv: toB64u(iv), ct: toB64u(ct) };
+}
+
+export async function unseal(key, { iv, ct }, aad) {
+  const plain = await subtle.decrypt({ name: 'AES-GCM', iv: fromB64u(iv), additionalData: aad }, key, fromB64u(ct));
+  return JSON.parse(dec.decode(plain));
+}

package/hook/guard.cjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+// passClaude guard: a Claude Code PreToolUse hook for the Bash and PowerShell tools.
+// Blocks shell commands that try to read saved secrets directly instead of using the passClaude tools.
+// A speed bump, not a wall: a determined attacker can find other ways. See the README security section.
+'use strict';
+
+const BLOCKED = [
+  /passclaude:/i, // Credential Manager target names
+  /cred\.ps1/i, // passClaude's own vault script
+  /\bCred(Read|Enumerate)/i, // the Windows credential APIs
+  /advapi32/i, // the DLL that holds them
+  /\bcmdkey\b/i,
+  /Get-StoredCredential/i,
+  /CredentialManager/i,
+  /PasswordVault/i,
+  /\bvaultcmd\b/i,
+  /\s-(ec|enc|encodedcommand)\b/i, // PowerShell commands hidden in base64
+];
+
+function verdict(input) {
+  const command = String(input?.tool_input?.command ?? '');
+  if (!BLOCKED.some((re) => re.test(command))) return null;
+  return 'Blocked by passClaude guard: this command looks like it reads saved secrets directly or hides what it does. '
+    + 'Use the passClaude tools instead (type_secret, run_with_secret). If this is a mistake, the user can run it themselves.';
+}
+
+module.exports = { BLOCKED, verdict };
+
+if (require.main === module) {
+  let data = '';
+  process.stdin.setEncoding('utf8');
+  process.stdin.on('data', (chunk) => { data += chunk; });
+  process.stdin.on('end', () => {
+    let input;
+    try {
+      input = JSON.parse(data);
+    } catch {
+      process.exit(0);
+    }
+    const reason = verdict(input);
+    if (reason) {
+      process.stderr.write(`${reason}\n`);
+      process.exit(2);
+    }
+    process.exit(0);
+  });
+}